certificate scheme 2

On the fly create certificates via openssl (Maybe change this to
libressl in the future?). This is probably the best scheme to get
something that simply works. Self signed certificates only pose a
problem when connecting to retrieve the email via imap or pop3.

mail-config.nix

@@ -82,15 +82,18 @@ let
   #    implies that the FQDN must be set as an `A` record to point to the IP of
   #    the server. TODO: Explain more details
   #
-  # TODO: Only certificate scheme 1) works as of yet.
+  # TODO: Only certificate scheme 1) and 2) work as of yet.
-  certificate_scheme = 1;
+  certificate_scheme = 2;
 
   # Sceme 1)
   cert_file = "/root/mail-server.crt";
   key_file = "/root/mail-server.key";
 
   # Sceme 2)
-  cert_folder = "/root/certs";
+  # This is the folder where the certificate will be created. The name is
+  # hardcoded to "cert-${domain}.pem" and "key-${domain}.pem" and the
+  # certificate is valid for 10 years.
+  cert_dir = "/root/certs";
 
   #
   # Whether to enable imap / pop3. Both variants are only supported in the
@@ -123,11 +126,11 @@ in
   services = import ./mail-server/services.nix {
     inherit mail_dir vmail_user_name vmail_group_name valiases domain
             enable_imap enable_pop3 virus_scanning dkim_signing
-            certificate_scheme cert_file key_file;
+            certificate_scheme cert_file key_file cert_dir;
-  };
+ };
 
   environment = import ./mail-server/environment.nix {
-    inherit pkgs;
+    inherit pkgs certificate_scheme;
   };
 
   networking = import ./mail-server/networking.nix {
@@ -135,7 +138,8 @@ in
   };
 
   systemd = import ./mail-server/systemd.nix {
-    inherit mail_dir vmail_group_name;
+    inherit mail_dir vmail_group_name certificate_scheme cert_dir host_prefix
+            domain pkgs;
   };
 
   users = import ./mail-server/users.nix {

mail-server/dovecot.nix

@@ -14,23 +14,13 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ vmail_group_name, vmail_user_name, mail_dir, enable_imap, enable_pop3,
+{ vmail_group_name, vmail_user_name, mail_dir, enable_imap, enable_pop3, cert,
-certificate_scheme, cert_file, key_file }:
+key }:
+
 let
   # maildir in format "/${domain}/${user}/"
   dovecot_maildir = "maildir:${mail_dir}/%d/%n/";
 
-  # cert :: PATH
-  cert = if certificate_scheme == 1
-         then cert_file
-         else "";
-
-  # key :: PATH
-  key = if certificate_scheme == 1
-        then key_file
-        else "";
-
-
 in
 {
   enable = true;

mail-server/environment.nix

@@ -14,10 +14,10 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ pkgs, ... }:
+{ pkgs, certificate_scheme }:
 
 {
   systemPackages = with pkgs; [
     dovecot opendkim openssh postfix clamav rspamd rmilter
-  ];
+  ] ++ (if certificate_scheme == 2 then [ openssl ] else []);
 }

mail-server/postfix.nix

@@ -14,7 +14,7 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ mail_dir, domain, valiases, certificate_scheme, cert_file, key_file }:
+{ mail_dir, domain, valiases, cert, key }:
 
 let
   # valiasToString :: { from = "..."; to = "..." } -> String
@@ -34,16 +34,6 @@ let
   # vhosts_file :: Path
   vhosts_file = builtins.toFile "vhosts" domain;
 
-  # cert :: PATH
-  cert = if certificate_scheme == 1
-         then cert_file
-         else "";
-
-  # key :: PATH
-  key = if certificate_scheme == 1
-        then key_file
-        else "";
-
 in
 {
   enable = true;

mail-server/services.nix

@@ -16,8 +16,23 @@
 
 { mail_dir, vmail_user_name, vmail_group_name, valiases, domain, enable_imap,
 enable_pop3, virus_scanning, dkim_signing, certificate_scheme, cert_file,
-key_file }:
+key_file, cert_dir }:
 
+let
+  # cert :: PATH
+  cert = if certificate_scheme == 1
+         then cert_file
+         else if certificate_scheme == 2
+              then "${cert_dir}/cert-${domain}.pem"
+              else "";
+
+  # key :: PATH
+  key = if certificate_scheme == 1
+        then key_file
+        else if certificate_scheme == 2
+             then "${cert_dir}/key-${domain}.pem"
+             else "";
+in
 {
   # rspamd
   rspamd = {
@@ -29,11 +44,11 @@ key_file }:
   };
 
   postfix = import ./postfix.nix {
-    inherit mail_dir domain valiases certificate_scheme cert_file key_file;
+    inherit mail_dir domain valiases cert key;
   };
 
   dovecot2 = import ./dovecot.nix {
     inherit vmail_group_name vmail_user_name mail_dir enable_imap
-            enable_pop3 certificate_scheme cert_file key_file;
+            enable_pop3 cert key;
   };
 }

mail-server/systemd.nix

@@ -14,8 +14,29 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ mail_dir, vmail_group_name }:
+{ pkgs, mail_dir, vmail_group_name, certificate_scheme, cert_dir, host_prefix,
+domain }:
 
+let
+  create_certificate = if certificate_scheme == 2 then
+        ''
+          # Create certificates if they do not exist yet
+          dir="${cert_dir}"
+          fqdn="${host_prefix}.${domain}"
+          case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
+          key="''${dir}/key-${domain}.pem";
+          cert="''${dir}/cert-${domain}.pem";
+
+          if [ ! -f "''${key}" ] || [ ! -f "''${cert}" ]
+          then
+              mkdir -p "${cert_dir}"
+              (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "''${key}" 2048) &&
+                  "${pkgs.openssl}/bin/openssl" req -new -key "''${key}" -x509 -subj "/CN=''${fqdn}" \
+                          -days 3650 -out "''${cert}"
+          fi
+        ''
+        else "";
+in
 {
   # Set the correct permissions for dovecot vmail folder. See
   # <http://wiki2.dovecot.org/SharedMailboxes/Permissions>. We choose
@@ -23,8 +44,18 @@
   # dovecot gets started.
   services.dovecot2.preStart =
   ''
-    mkdir -p ${mail_dir}
+    # Create mail directory and set permissions
-    chgrp ${vmail_group_name} ${mail_dir}
+    mkdir -p "${mail_dir}"
-    chmod 02770 ${mail_dir}
+    chgrp "${vmail_group_name}" "${mail_dir}"
+    chmod 02770 "${mail_dir}"
+
+    ${create_certificate}
+  '';
+
+  # Check for certificate before both postfix and dovecot to make sure it
+  # exists.
+  services.postfix.preStart = 
+  ''
+    ${create_certificate}
   '';
 }