Skynet/misc_nixos-mailserver
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

certificate scheme 2

Browse source 
On the fly create certificates via openssl (Maybe change this to
libressl in the future?). This is probably the best scheme to get
something that simply works. Self signed certificates only pose a
problem when connecting to retrieve the email via imap or pop3.
This commit is contained in:
Robin Raymond 2017-08-13 11:51:07 +02:00
parent be5d8c09d8
commit b68e64ec72
6 changed files with 70 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
mail-config.nix
View file

@ -82,15 +82,18 @@ let
# implies that the FQDN must be set as an `A` record to point to the IP of
# the server. TODO: Explain more details
#
# TODO: Only certificate scheme 1) works as of yet.
certificate_scheme = 1;
# TODO: Only certificate scheme 1) and 2) work as of yet.
certificate_scheme = 2;
# Sceme 1)
cert_file = "/root/mail-server.crt";
key_file = "/root/mail-server.key";
# Sceme 2)
cert_folder = "/root/certs";
# This is the folder where the certificate will be created. The name is
# hardcoded to "cert-${domain}.pem" and "key-${domain}.pem" and the
# certificate is valid for 10 years.
cert_dir = "/root/certs";
#
# Whether to enable imap / pop3. Both variants are only supported in the
@ -123,11 +126,11 @@ in
services = import ./mail-server/services.nix {
inherit mail_dir vmail_user_name vmail_group_name valiases domain
enable_imap enable_pop3 virus_scanning dkim_signing
certificate_scheme cert_file key_file;
certificate_scheme cert_file key_file cert_dir;
};
environment = import ./mail-server/environment.nix {
inherit pkgs;
inherit pkgs certificate_scheme;
};
networking = import ./mail-server/networking.nix {
@ -135,7 +138,8 @@ in
};
systemd = import ./mail-server/systemd.nix {
inherit mail_dir vmail_group_name;
inherit mail_dir vmail_group_name certificate_scheme cert_dir host_prefix
domain pkgs;
};
users = import ./mail-server/users.nix {

16
mail-server/dovecot.nix
View file

@ -14,23 +14,13 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{ vmail_group_name, vmail_user_name, mail_dir, enable_imap, enable_pop3,
certificate_scheme, cert_file, key_file }:
{ vmail_group_name, vmail_user_name, mail_dir, enable_imap, enable_pop3, cert,
key }:
let
# maildir in format "/${domain}/${user}/"
dovecot_maildir = "maildir:${mail_dir}/%d/%n/";
# cert :: PATH
cert = if certificate_scheme == 1
then cert_file
else "";
# key :: PATH
key = if certificate_scheme == 1
then key_file
else "";
in
{
enable = true;

4
mail-server/environment.nix
View file

@ -14,10 +14,10 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{ pkgs, ... }:
{ pkgs, certificate_scheme }:
{
systemPackages = with pkgs; [
dovecot opendkim openssh postfix clamav rspamd rmilter
];
] ++ (if certificate_scheme == 2 then [ openssl ] else []);
}

12
mail-server/postfix.nix
View file

@ -14,7 +14,7 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{ mail_dir, domain, valiases, certificate_scheme, cert_file, key_file }:
{ mail_dir, domain, valiases, cert, key }:
let
# valiasToString :: { from = "..."; to = "..." } -> String
@ -34,16 +34,6 @@ let
# vhosts_file :: Path
vhosts_file = builtins.toFile "vhosts" domain;
# cert :: PATH
cert = if certificate_scheme == 1
then cert_file
else "";
# key :: PATH
key = if certificate_scheme == 1
then key_file
else "";
in
{
enable = true;

21
mail-server/services.nix
View file

@ -16,8 +16,23 @@
{ mail_dir, vmail_user_name, vmail_group_name, valiases, domain, enable_imap,
enable_pop3, virus_scanning, dkim_signing, certificate_scheme, cert_file,
key_file }:
key_file, cert_dir }:
let
# cert :: PATH
cert = if certificate_scheme == 1
then cert_file
else if certificate_scheme == 2
then "${cert_dir}/cert-${domain}.pem"
else "";
# key :: PATH
key = if certificate_scheme == 1
then key_file
else if certificate_scheme == 2
then "${cert_dir}/key-${domain}.pem"
else "";
in
{
# rspamd
rspamd = {
@ -29,11 +44,11 @@ key_file }:
};
postfix = import ./postfix.nix {
inherit mail_dir domain valiases certificate_scheme cert_file key_file;
inherit mail_dir domain valiases cert key;
};
dovecot2 = import ./dovecot.nix {
inherit vmail_group_name vmail_user_name mail_dir enable_imap
enable_pop3 certificate_scheme cert_file key_file;
enable_pop3 cert key;
};
}

39
mail-server/systemd.nix
View file

@ -14,8 +14,29 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{ mail_dir, vmail_group_name }:
{ pkgs, mail_dir, vmail_group_name, certificate_scheme, cert_dir, host_prefix,
domain }:
let
create_certificate = if certificate_scheme == 2 then
''
# Create certificates if they do not exist yet
dir="${cert_dir}"
fqdn="${host_prefix}.${domain}"
case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
key="''${dir}/key-${domain}.pem";
cert="''${dir}/cert-${domain}.pem";
if [ ! -f "''${key}" ] || [ ! -f "''${cert}" ]
then
mkdir -p "${cert_dir}"
(umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "''${key}" 2048) &&
"${pkgs.openssl}/bin/openssl" req -new -key "''${key}" -x509 -subj "/CN=''${fqdn}" \
-days 3650 -out "''${cert}"
fi
''
else "";
in
{
# Set the correct permissions for dovecot vmail folder. See
# <http://wiki2.dovecot.org/SharedMailboxes/Permissions>. We choose
@ -23,8 +44,18 @@
# dovecot gets started.
services.dovecot2.preStart =
''
mkdir -p ${mail_dir}
chgrp ${vmail_group_name} ${mail_dir}
chmod 02770 ${mail_dir}
# Create mail directory and set permissions
mkdir -p "${mail_dir}"
chgrp "${vmail_group_name}" "${mail_dir}"
chmod 02770 "${mail_dir}"
${create_certificate}
'';
# Check for certificate before both postfix and dovecot to make sure it
# exists.
services.postfix.preStart =
''
${create_certificate}
'';
}