ci: deploy upstream on changes

Relates to https://gitlab.skynet.ie/compsoc1/skynet/nixos/-/issues/22

test: Remove the account type limiatation

.forgejo/workflows/build.yaml

@@ -0,0 +1,17 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  # deploy it upstream
+  deploy:
+    runs-on: docker
+    steps:
+      - name: "Deploy to Skynet"
+        uses: https://forgejo.skynet.ie/Skynet/actions-deploy-to-skynet@v2
+        with:
+          input: 'simple-nixos-mailserver'
+          token: ${{ secrets.API_TOKEN_FORGEJO }}

.gitlab-ci.yml

@@ -3,11 +3,11 @@ hydra-pr:
     - merge_requests
   image: nixos/nix
   script:
-    - nix run -f channel:nixos-unstable hydra-cli -c hydra-cli -H https://hydra.nix-community.org jobset-wait simple-nixos-mailserver ${CI_MERGE_REQUEST_IID}
+    - nix-shell -I nixpkgs=channel:nixos-22.05 -p hydra-cli --run 'hydra-cli -H https://hydra.nix-community.org jobset-wait simple-nixos-mailserver ${CI_MERGE_REQUEST_IID}'
 
 hydra-master:
   only:
     - master
   image: nixos/nix
   script:
-    - nix run -f channel:nixos-unstable hydra-cli -c hydra-cli -H https://hydra.nix-community.org jobset-wait simple-nixos-mailserver master
+    - nix-shell -I nixpkgs=channel:nixos-22.05 -p hydra-cli --run 'hydra-cli -H https://hydra.nix-community.org jobset-wait simple-nixos-mailserver master'

.hydra/declarative-jobsets.nix

@@ -1,4 +1,4 @@
-{ nixpkgs, declInput, pulls }:
+{ nixpkgs, pulls, ... }:
 
 let
   pkgs = import nixpkgs {};
@@ -8,85 +8,37 @@ let
     { enabled = 1;
       hidden = false;
       description = "PR ${num}: ${info.title}";
-      nixexprinput = "snm";
-      nixexprpath = ".hydra/default.nix";
       checkinterval = 30;
       schedulingshares = 20;
       enableemail = false;
       emailoverride = "";
       keepnr = 1;
-      type = 0;
+      type = 1;
-      inputs = {
+      flake = "gitlab:simple-nixos-mailserver/nixos-mailserver/merge-requests/${info.iid}/head";
-        snm = {
-          type = "git";
-          value = "${info.target_repo_url} merge-requests/${info.iid}/head";
-          emailresponsible = false;
-        };
-      };
     }
   ) prs;
+  mkFlakeJobset = branch: {
+    description = "Build ${branch} branch of Simple NixOS MailServer";
+    checkinterval = "60";
+    enabled = "1";
+    schedulingshares = 100;
+    enableemail = false;
+    emailoverride = "";
+    keepnr = 3;
+    hidden = false;
+    type = 1;
+    flake = "gitlab:simple-nixos-mailserver/nixos-mailserver/${branch}";
+  };
 
   desc = prJobsets // {
-    master = {
+    "master" = mkFlakeJobset "master";
-      description = "Build master branch of Simple NixOS MailServer";
+    "nixos-23.11" = mkFlakeJobset "nixos-23.11";
-      checkinterval = "60";
+    "nixos-24.05" = mkFlakeJobset "nixos-24.05";
-      enabled = "1";
-      nixexprinput = "snm";
-      nixexprpath = ".hydra/default.nix";
-      schedulingshares = 100;
-      enableemail = false;
-      emailoverride = "";
-      keepnr = 3;
-      hidden = false;
-      type = 0;
-      inputs = {
-        snm = {
-          value = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver master";
-          type = "git";
-          emailresponsible = false;
-        };
-      };
-    };
-    "nixos-20.03" = {
-      description = "Build the nixos-20.03 branch of Simple NixOS MailServer";
-      checkinterval = "60";
-      enabled = "1";
-      nixexprinput = "snm";
-      nixexprpath = ".hydra/default.nix";
-      schedulingshares = 100;
-      enableemail = false;
-      emailoverride = "";
-      keepnr = 3;
-      hidden = false;
-      type = 0;
-      inputs = {
-        snm = {
-          value = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver nixos-20.03";
-          type = "git";
-          emailresponsible = false;
-        };
-      };
-    };
-    "nixos-20.09" = {
-      description = "Build the nixos-20.09 branch of Simple NixOS MailServer";
-      checkinterval = "60";
-      enabled = "1";
-      nixexprinput = "snm";
-      nixexprpath = ".hydra/default.nix";
-      schedulingshares = 100;
-      enableemail = false;
-      emailoverride = "";
-      keepnr = 3;
-      hidden = false;
-      type = 0;
-      inputs = {
-        snm = {
-          value = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver nixos-20.09";
-          type = "git";
-          emailresponsible = false;
-        };
-      };
   };
+
+  log = {
+    pulls = prs;
+    jobsets = desc;
   };
 
 in {
@@ -94,5 +46,10 @@ in {
     cat >$out <<EOF
     ${builtins.toJSON desc}
     EOF
+    # This is to get nice .jobsets build logs on Hydra
+    cat >tmp <<EOF
+    ${builtins.toJSON log}
+    EOF
+    ${pkgs.jq}/bin/jq . tmp
   '';
 }

.readthedocs.yaml

@@ -0,0 +1,29 @@
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+# Required
+version: 2
+
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3"
+  apt_packages:
+    - nix
+    - proot
+  jobs:
+    pre_install:
+      - mkdir -p ~/.nix ~/.config/nix
+      - echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
+      - proot -b ~/.nix:/nix /bin/sh -c "nix build -L .#optionsDoc && cp -v result docs/options.md"
+
+sphinx:
+   configuration: docs/conf.py
+
+formats:
+  - pdf
+  - epub
+
+python:
+   install:
+   - requirements: docs/requirements.txt

README.md

@@ -8,28 +8,21 @@
 For each NixOS release, we publish a branch. You then have to use the
 SNM branch corresponding to your NixOS version.
 
-* For NixOS 20.09
+* For NixOS 24.05
-   - Use the [SNM branch `nixos-20.09`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/nixos-20.09)
+   - Use the [SNM branch `nixos-24.05`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/nixos-24.05)
-   - [Documentation](https://nixos-mailserver.readthedocs.io/en/nixos-20.09/)
+   - [Documentation](https://nixos-mailserver.readthedocs.io/en/nixos-24.05/)
-   - [Release notes](https://nixos-mailserver.readthedocs.io/en/nixos-20.09/release-notes.html#nixos-20-09)
+   - [Release notes](https://nixos-mailserver.readthedocs.io/en/nixos-24.05/release-notes.html#nixos-24-05)
-* For NixOS 20.03
+* For NixOS 23.11
-   - Use the [SNM branch `nixos-20.03`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/nixos-20.03)
+   - Use the [SNM branch `nixos-23.11`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/nixos-23.11)
-   - [Release notes](#nixos-2003)
+   - [Documentation](https://nixos-mailserver.readthedocs.io/en/nixos-23.11/)
+   - [Release notes](https://nixos-mailserver.readthedocs.io/en/nixos-23.11/release-notes.html#nixos-23-11)
 * For NixOS unstable
    - Use the [SNM branch `master`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/master)
    - [Documentation](https://nixos-mailserver.readthedocs.io/en/latest/)
-   - This branch is currently supporting the NixOS release 20.09 but
-     we could remove this support on any NixOS unstable breaking
-     change.
 
 [Subscribe to SNM Announcement List](https://www.freelists.org/list/snm)
 This is a very low volume list where new releases of SNM are announced, so you
-can stay up to date with bug fixes and updates. All announcements are signed by
+can stay up to date with bug fixes and updates.
-the gpg key with fingerprint
-
-```
-D9FE 4119 F082 6F15 93BD  BD36 6162 DBA5 635E A16A
-```
 
 
 ## Features
@@ -76,73 +69,17 @@ D9FE 4119 F082 6F15 93BD  BD36 6162 DBA5 635E A16A
 ### Get in touch
 
 - Subscribe to the [mailing list](https://www.freelists.org/archive/snm/)
-- Join the Freenode IRC channel `#nixos-mailserver`
+- Join the Libera Chat IRC channel `#nixos-mailserver`
-
-### Quick Start
-
-```nix
-   { config, pkgs, ... }:
-   let release = "nixos-20.09";
-   in {
-     imports = [
-       (builtins.fetchTarball {
-         url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz";
-         # This hash needs to be updated
-         sha256 = "0000000000000000000000000000000000000000000000000000";
-       })
-     ];
-
-     mailserver = {
-       enable = true;
-       fqdn = "mail.example.com";
-       domains = [ "example.com" "example2.com" ];
-       loginAccounts = {
-           "user1@example.com" = {
-               # nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2 > /hashed/password/file/location
-               hashedPasswordFile = "/hashed/password/file/location";
-
-               aliases = [
-                   "info@example.com"
-                   "postmaster@example.com"
-                   "postmaster@example2.com"
-               ];
-           };
-       };
-     };
-   }
-```
-
-For a complete list of options, see `default.nix`.
-
-
 
 ## How to Set Up a 10/10 Mail Server Guide
-Check out the [Complete Setup Guide](https://nixos-mailserver.readthedocs.io/en/latest/setup-guide.html) in the project's documentation.
 
-## How to Backup
+Check out the [Setup Guide](https://nixos-mailserver.readthedocs.io/en/latest/setup-guide.html) in the project's documentation.
 
-Checkout the [Complete Backup Guide](https://nixos-mailserver.readthedocs.io/en/latest/backup-guide.html). Backups are easy with `SNM`.
+For a complete list of options, [see in readthedocs](https://nixos-mailserver.readthedocs.io/en/latest/options.html).
 
 ## Development
 
-See the [How to Develop SNM](https://nixos-mailserver.readthedocs.io/en/latest/howto-develop.html) wiki page.
+See the [How to Develop SNM](https://nixos-mailserver.readthedocs.io/en/latest/howto-develop.html) documentation page.
-
-## Release notes
-
-### nixos-20.03
-
-- Rspamd is upgraded to 2.0 which deprecates the SQLite Bayes
-  backend. We then moved to the Redis backend (the default since
-  Rspamd 2.0). If you don't want to relearn the Redis backend from the
-  scratch, we could manually run
-
-      rspamadm statconvert --spam-db /var/lib/rspamd/bayes.spam.sqlite --ham-db /var/lib/rspamd/bayes.ham.sqlite -h 127.0.0.1:6379 --symbol-ham BAYES_HAM --symbol-spam BAYES_SPAM
-
-  See the [Rspamd migration
-  notes](https://rspamd.com/doc/migration.html#migration-to-rspamd-20)
-  and [this SNM Merge
-  Request](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/164)
-  for details.
 
 ## Contributors
 See the [contributor tab](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/graphs/master)
@@ -157,6 +94,4 @@ See the [contributor tab](https://gitlab.com/simple-nixos-mailserver/nixos-mails
  * Logo made with [Logomakr.com](https://logomakr.com)
 
 
-
+[logo]: docs/logo.png
-
-[logo]: logo/logo.png

default.nix

@@ -44,6 +44,17 @@ in
       description = "The domains that this mail server serves.";
     };
 
+    certificateDomains = mkOption {
+      type = types.listOf types.str;
+      example = [ "imap.example.com" "pop3.example.com" ];
+      default = [];
+      description = ''
+        ({option}`mailserver.certificateScheme` == `acme-nginx`)
+
+        Secondary domains and subdomains for which it is necessary to generate a certificate.
+      '';
+    };
+
     messageSizeLimit = mkOption {
       type = types.int;
       example = 52428800;
@@ -65,14 +76,14 @@ in
             default = null;
             example = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";
             description = ''
-              The user's hashed password. Use `htpasswd` as follows
+              The user's hashed password. Use `mkpasswd` as follows
 
               ```
-              nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
+              nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
               ```
 
               Warning: this is stored in plaintext in the Nix store!
-              Use `hashedPasswordFile` instead.
+              Use {option}`mailserver.loginAccounts.<name>.hashedPasswordFile` instead.
             '';
           };
 
@@ -81,10 +92,10 @@ in
             default = null;
             example = "/run/keys/user1-passwordhash";
             description = ''
-              A file containing the user's hashed password. Use `htpasswd` as follows
+              A file containing the user's hashed password. Use `mkpasswd` as follows
 
               ```
-              nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
+              nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
               ```
             '';
           };
@@ -100,6 +111,15 @@ in
             '';
           };
 
+          aliasesRegexp = mkOption {
+            type = with types; listOf types.str;
+            example = [''/^tom\..*@domain\.com$/''];
+            default = [];
+            description = ''
+              Same as {option}`mailserver.aliases` but using PCRE (Perl compatible regex).
+            '';
+          };
+
           catchAll = mkOption {
             type = with types; listOf (enum cfg.domains);
             example = ["example.com" "example2.com"];
@@ -149,7 +169,7 @@ in
             description = ''
               Specifies if the account should be a send-only account.
               Emails sent to send-only accounts will be rejected from
-              unauthorized senders with the sendOnlyRejectMessage
+              unauthorized senders with the `sendOnlyRejectMessage`
               stating the reason.
             '';
           };
@@ -177,27 +197,190 @@ in
       };
       description = ''
         The login account of the domain. Every account is mapped to a unix user,
-        e.g. `user1@example.com`. To generate the passwords use `htpasswd` as
+        e.g. `user1@example.com`. To generate the passwords use `mkpasswd` as
         follows
 
         ```
-        nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
+        nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
         ```
       '';
       default = {};
     };
 
+    ldap = {
+      enable = mkEnableOption "LDAP support";
+
+      uris  = mkOption {
+        type = types.listOf types.str;
+        example = literalExpression ''
+          [
+            "ldaps://ldap1.example.com"
+            "ldaps://ldap2.example.com"
+          ]
+        '';
+        description = ''
+          URIs where your LDAP server can be reached
+        '';
+      };
+
+      startTls = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable StartTLS upon connection to the server.
+        '';
+      };
+
+      tlsCAFile = mkOption {
+        type = types.path;
+        default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+        defaultText = lib.literalMD "see [source](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/blob/master/default.nix)";
+        description = ''
+          Certifificate trust anchors used to verify the LDAP server certificate.
+        '';
+      };
+
+      bind = {
+        dn = mkOption {
+          type = types.str;
+          example = "cn=mail,ou=accounts,dc=example,dc=com";
+          description = ''
+            Distinguished name used by the mail server to do lookups
+            against the LDAP servers.
+          '';
+        };
+
+        passwordFile = mkOption {
+          type = types.str;
+          example = "/run/my-secret";
+          description = ''
+            A file containing the password required to authenticate against the LDAP servers.
+          '';
+        };
+      };
+
+      searchBase = mkOption {
+        type = types.str;
+        example = "ou=people,ou=accounts,dc=example,dc=com";
+        description = ''
+          Base DN at below which to search for users accounts.
+        '';
+      };
+
+      searchScope = mkOption {
+        type = types.enum [ "sub" "base" "one" ];
+        default = "sub";
+        description = ''
+          Search scope below which users accounts are looked for.
+        '';
+      };
+
+      dovecot = {
+        userAttrs = mkOption {
+          type = types.nullOr types.str;
+          default = "";
+          description = ''
+            LDAP attributes to be retrieved during userdb lookups.
+
+            See the users_attrs reference at
+            https://doc.dovecot.org/configuration_manual/authentication/ldap_settings_auth/#user-attrs
+            in the Dovecot manual.
+          '';
+        };
+
+        userFilter = mkOption {
+          type = types.str;
+          default = "mail=%u";
+          example = "(&(objectClass=inetOrgPerson)(mail=%u))";
+          description = ''
+            Filter for user lookups in Dovecot.
+
+            See the user_filter reference at
+            https://doc.dovecot.org/configuration_manual/authentication/ldap_settings_auth/#user-filter
+            in the Dovecot manual.
+          '';
+        };
+
+        passAttrs = mkOption {
+          type = types.str;
+          default = "userPassword=password";
+          description = ''
+            LDAP attributes to be retrieved during passdb lookups.
+
+            See the pass_attrs reference at
+            https://doc.dovecot.org/configuration_manual/authentication/ldap_settings_auth/#pass-attrs
+            in the Dovecot manual.
+          '';
+        };
+
+        passFilter = mkOption {
+          type = types.nullOr types.str;
+          default = "mail=%u";
+          example = "(&(objectClass=inetOrgPerson)(mail=%u))";
+          description = ''
+            Filter for password lookups in Dovecot.
+
+            See the pass_filter reference for
+            https://doc.dovecot.org/configuration_manual/authentication/ldap_settings_auth/#pass-filter
+            in the Dovecot manual.
+          '';
+        };
+      };
+
+      postfix = {
+        filter = mkOption {
+          type = types.str;
+          default = "mail=%s";
+          example = "(&(objectClass=inetOrgPerson)(mail=%s))";
+          description = ''
+            LDAP filter used to search for an account by mail, where
+            `%s` is a substitute for the address in
+            question.
+          '';
+        };
+
+        uidAttribute = mkOption {
+          type = types.str;
+          default = "mail";
+          example = "uid";
+          description = ''
+            The LDAP attribute referencing the account name for a user.
+          '';
+        };
+
+        mailAttribute = mkOption {
+          type = types.str;
+          default = "mail";
+          description = ''
+            The LDAP attribute holding mail addresses for a user.
+          '';
+        };
+      };
+    };
+
+    indexDir = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Folder to store search indices. If null, indices are stored
+        along with email, which could not necessarily be desirable,
+        especially when {option}`mailserver.fullTextSearch.enable` is `true` since
+        indices it creates are voluminous and do not need to be backed
+        up.
+
+        Be careful when changing this option value since all indices
+        would be recreated at the new location (and clients would need
+        to resynchronize).
+
+        Note the some variables can be used in the file path. See
+        https://doc.dovecot.org/configuration_manual/mail_location/#variables
+        for details.
+      '';
+      example = "/var/lib/dovecot/indices";
+    };
 
     fullTextSearch = {
       enable = mkEnableOption "Full text search indexing with xapian. This has significant performance and disk space cost.";
-      indexDir = mkOption {
-        type = types.nullOr types.str;
-        default = "/var/lib/dovecot/fts_xapian";
-        description = ''
-          Folder to store search indices. If null, indices are stored along with email, which
-          is not necessarily desirable as indices are voluminous and do not need to be backed up.
-        '';
-      };
       autoIndex = mkOption {
         type = types.bool;
         default = true;
@@ -223,8 +406,8 @@ in
         default = "no";
         description = ''
           Fail searches when no index is available. If set to
-          <literal>body</literal>, then only body searches (as opposed to
+          `body`, then only body searches (as opposed to
-          header) are affected. If set to <literal>no<literal>, searches may
+          header) are affected. If set to `no`, searches may
           fall back to a very slow brute force search.
         '';
       };
@@ -262,7 +445,7 @@ in
         randomizedDelaySec = mkOption {
           type = types.int;
           default = 1000;
-          description = "Run the maintenance job not exactly at the time specified with <literal>onCalendar</literal>, but plus or minus this many seconds.";
+          description = "Run the maintenance job not exactly at the time specified with `onCalendar`, but plus or minus this many seconds.";
         };
       };
     };
@@ -281,7 +464,6 @@ in
       type = let
         loginAccount = mkOptionType {
           name = "Login Account";
-          check = (account: builtins.elem account (builtins.attrNames cfg.loginAccounts));
         };
       in with types; attrsOf (either loginAccount (nonEmptyListOf loginAccount));
       example = {
@@ -306,7 +488,6 @@ in
 
     forwards = mkOption {
       type = with types; attrsOf (either (listOf str) str);
-      default = {};
       example = {
         "user@example.com" = "user@elsewhere.com";
       };
@@ -315,7 +496,7 @@ in
         the value {`"user@example.com" = "user@elsewhere.com";}`
         means that mails to `user@example.com` are forwarded to
         `user@elsewhere.com`. The difference with the
-        `extraVirtualAliases` option is that `user@elsewhere.com`
+        {option}`mailserver.extraVirtualAliases` option is that `user@elsewhere.com`
         can't send mail as `user@example.com`. Also, this option
         allows to forward mails to external addresses.
       '';
@@ -349,7 +530,7 @@ in
       description = ''
         The unix UID of the virtual mail user.  Be mindful that if this is
         changed, you will need to manually adjust the permissions of
-        mailDirectory.
+        `mailDirectory`.
       '';
     };
 
@@ -392,6 +573,14 @@ in
       '';
     };
 
+    useUTF8FolderNames = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Store mailbox names on disk using UTF-8 instead of modified UTF-7 (mUTF-7).
+      '';
+    };
+
     hierarchySeparator = mkOption {
       type = types.str;
       default = ".";
@@ -410,8 +599,7 @@ in
         The mailboxes for dovecot.
         Depending on the mail client used it might be necessary to change some mailbox's name.
       '';
-      default = let
+      default = {
-        defMailBoxes = {
         Trash = {
           auto = "no";
           specialUse = "Trash";
@@ -429,23 +617,28 @@ in
           specialUse = "Sent";
         };
       };
-      in if (versionAtLeast version "20.09pre") then defMailBoxes
-      else (flip mapAttrsToList defMailBoxes (name: options: { inherit name; } // options));
     };
 
-    certificateScheme = mkOption {
+    certificateScheme = let
-      type = types.enum [ 1 2 3 ];
+      schemes = [ "manual" "selfsigned" "acme-nginx" "acme" ];
-      default = 2;
+      translate = i: warn "Setting mailserver.certificateScheme by number is deprecated, please use names instead: 'mailserver.certificateScheme = ${builtins.toString i}' can be replaced by 'mailserver.certificateScheme = \"${(builtins.elemAt schemes (i - 1))}\"'."
+        (builtins.elemAt schemes (i - 1));
+    in mkOption {
+      type = with types; coercedTo (enum [ 1 2 3 ]) translate (enum schemes);
+      default = "selfsigned";
       description = ''
-        Certificate Files. There are three options for these.
+        The scheme to use for managing TLS certificates:
 
-        1) You specify locations and manually copy certificates there.
+        1. `manual`: you specify locations via {option}`mailserver.certificateFile` and
-        2) You let the server create new (self signed) certificates on the fly.
+           {option}`mailserver.keyFile` and manually copy certificates there.
-        3) You let the server create a certificate via `Let's Encrypt`. Note that
+        2. `selfsigned`: you let the server create new (self-signed) certificates on the fly.
-           this implies that a stripped down webserver has to be started. This also
+        3. `acme-nginx`: you let the server request certificates from [Let's Encrypt](https://letsencrypt.org)
-           implies that the FQDN must be set as an `A` record to point to the IP of
+           via NixOS' ACME module. By default, this will set up a stripped-down Nginx server for
-           the server. In particular port 80 on the server will be opened. For details
+           {option}`mailserver.fqdn` and open port 80. For this to work, the FQDN must be properly
-           on how to set up the domain records, see the guide in the readme.
+           configured to point to your server (see the [setup guide](setup-guide.rst) for more information).
+        4. `acme`: you already have an ACME certificate set up (for example, you're already running a TLS-enabled
+           Nginx server on the FQDN). This is better than `manual` because the appropriate services will be reloaded
+           when the certificate is renewed.
       '';
     };
 
@@ -453,8 +646,9 @@ in
       type = types.path;
       example = "/root/mail-server.crt";
       description = ''
-        Scheme 1)
+        ({option}`mailserver.certificateScheme` == `manual`)
-        Location of the certificate
+
+        Location of the certificate.
       '';
     };
 
@@ -462,8 +656,9 @@ in
       type = types.path;
       example = "/root/mail-server.key";
       description = ''
-        Scheme 1)
+        ({option}`mailserver.certificateScheme` == `manual`)
-        Location of the key file
+
+        Location of the key file.
       '';
     };
 
@@ -471,13 +666,27 @@ in
       type = types.path;
       default = "/var/certs";
       description = ''
-        Scheme 2)
+        ({option}`mailserver.certificateScheme` == `selfsigned`)
-        This is the folder where the certificate will be created. The name is
+
-        hardcoded to "cert-<domain>.pem" and "key-<domain>.pem" and the
+        This is the folder where the self-signed certificate will be created. The name is
+        hardcoded to "cert-DOMAIN.pem" and "key-DOMAIN.pem" and the
         certificate is valid for 10 years.
       '';
     };
 
+    acmeCertificateName = mkOption {
+      type = types.str;
+      default = cfg.fqdn;
+      example = "example.com";
+      description = ''
+          ({option}`mailserver.certificateScheme` == `acme`)
+
+        When the `acme` `certificateScheme` is selected, you can use this option
+        to override the default certificate name. This is useful if you've
+        generated a wildcard certificate, for example.
+      '';
+    };
+
     enableImap = mkOption {
       type = types.bool;
       default = true;
@@ -567,7 +776,7 @@ in
       type = types.str;
       default = "mail";
       description = ''
-
+        The DKIM selector.
       '';
     };
 
@@ -575,7 +784,7 @@ in
       type = types.path;
       default = "/var/dkim";
       description = ''
-
+        The DKIM directory.
       '';
     };
 
@@ -586,12 +795,93 @@ in
             How many bits in generated DKIM keys. RFC6376 advises minimum 1024-bit keys.
 
             If you have already deployed a key with a different number of bits than specified
-            here, then you should use a different selector (dkimSelector). In order to get
+            here, then you should use a different selector ({option}`mailserver.dkimSelector`). In order to get
             this package to generate a key with the new number of bits, you will either have to
             change the selector or delete the old key file.
         '';
     };
 
+    dkimHeaderCanonicalization = mkOption {
+        type = types.enum ["relaxed" "simple"];
+        default = "relaxed";
+        description = ''
+          DKIM canonicalization algorithm for message headers.
+
+          See https://datatracker.ietf.org/doc/html/rfc6376/#section-3.4 for details.
+        '';
+    };
+
+    dkimBodyCanonicalization = mkOption {
+        type = types.enum ["relaxed" "simple"];
+        default = "relaxed";
+        description = ''
+          DKIM canonicalization algorithm for message bodies.
+
+          See https://datatracker.ietf.org/doc/html/rfc6376/#section-3.4 for details.
+        '';
+    };
+
+    dmarcReporting = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to send out aggregated, daily DMARC reports in response to incoming
+          mail, when the sender domain defines a DMARC policy including the RUA tag.
+
+          This is helpful for the mail ecosystem, because it allows third parties to
+          get notified about SPF/DKIM violations originating from their sender domains.
+
+          See https://rspamd.com/doc/modules/dmarc.html#reporting
+        '';
+      };
+
+      localpart = mkOption {
+        type = types.str;
+        default = "dmarc-noreply";
+        example = "dmarc-report";
+        description = ''
+          The local part of the email address used for outgoing DMARC reports.
+        '';
+      };
+
+      domain = mkOption {
+        type = types.enum (cfg.domains);
+        example = "example.com";
+        description = ''
+          The domain from which outgoing DMARC reports are served.
+        '';
+      };
+
+      email = mkOption {
+        type = types.str;
+        default = with cfg.dmarcReporting; "${localpart}@${domain}";
+        defaultText = literalExpression ''"''${localpart}@''${domain}"'';
+        readOnly = true;
+        description = ''
+          The email address used for outgoing DMARC reports. Read-only.
+        '';
+      };
+
+      organizationName = mkOption {
+        type = types.str;
+        example = "ACME Corp.";
+        description = ''
+          The name of your organization used in the `org_name` attribute in
+          DMARC reports.
+        '';
+      };
+
+      fromName = mkOption {
+        type = types.str;
+        default = cfg.dmarcReporting.organizationName;
+        defaultText = literalMD "{option}`mailserver.dmarcReporting.organizationName`";
+        description = ''
+          The sender name for DMARC reports. Defaults to the organization name.
+        '';
+      };
+    };
+
     debug = mkOption {
       type = types.bool;
       default = false;
@@ -620,12 +910,20 @@ in
       '';
     };
 
+    recipientDelimiter = mkOption {
+      type = types.str;
+      default = "+";
+      description = ''
+        Configure the recipient delimiter.
+      '';
+    };
+
     redis = {
       address = mkOption {
         type = types.str;
         # read the default from nixos' redis module
         default = let
-          cf = config.services.redis.bind;
+          cf = config.services.redis.servers.rspamd.bind;
           cfdefault = if cf == null then "127.0.0.1" else cf;
           ips = lib.strings.splitString " " cfdefault;
           ip = lib.lists.head (ips ++ [ "127.0.0.1" ]);
@@ -634,28 +932,27 @@ in
         if (ip == "0.0.0.0" || ip == "::")
         then "127.0.0.1"
         else if isIpv6 ip then "[${ip}]" else ip;
+        defaultText = lib.literalMD "computed from `config.services.redis.servers.rspamd.bind`";
         description = ''
-          Address that rspamd should use to contact redis. The default value
+          Address that rspamd should use to contact redis.
-          is read from <literal>config.services.redis.bind</literal>.
         '';
       };
 
       port = mkOption {
         type = types.port;
-        default = config.services.redis.port;
+        default = config.services.redis.servers.rspamd.port;
+        defaultText = lib.literalExpression "config.services.redis.servers.rspamd.port";
         description = ''
-          Port that rspamd should use to contact redis. The default value is
+          Port that rspamd should use to contact redis.
-          read from <literal>config.services.redis.port<literal>.
         '';
       };
 
       password = mkOption {
         type = types.nullOr types.str;
-        default = config.services.redis.requirePass;
+        default = config.services.redis.servers.rspamd.requirePass;
+        defaultText = lib.literalExpression "config.services.redis.servers.rspamd.requirePass";
         description = ''
-          Password that rspamd should use to contact redis, or null if not
+          Password that rspamd should use to contact redis, or null if not required.
-          required. The default value is read from
-          <literal>config.services.redis.requirePass<literal>.
         '';
       };
     };
@@ -670,10 +967,25 @@ in
       '';
     };
 
+    smtpdForbidBareNewline = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        With "smtpd_forbid_bare_newline = yes", the Postfix SMTP server
+        disconnects a remote SMTP client that sends a line ending in a 'bare
+        newline'.
+
+        This feature was added in Postfix 3.8.4 against SMTP Smuggling and will
+        default to "yes" in Postfix 3.9.
+
+        https://www.postfix.org/smtp-smuggling.html
+      '';
+    };
+
     sendingFqdn = mkOption {
       type = types.str;
       default = cfg.fqdn;
-      defaultText = "config.mailserver.fqdn";
+      defaultText = lib.literalMD "{option}`mailserver.fqdn`";
       example = "myserver.example.com";
       description = ''
         The fully qualified domain name of the mail server used to
@@ -689,7 +1001,7 @@ in
 
         This setting allows the server to identify as
         myserver.example.com when forwarding mail, independently of
-        `fqdn` (which, for SSL reasons, should generally be the name
+        {option}`mailserver.fqdn` (which, for SSL reasons, should generally be the name
         to which the user connects).
 
         Set this to the name to which the sending IP's reverse DNS
@@ -757,10 +1069,11 @@ in
                 stop program = "${pkgs.systemd}/bin/systemctl stop dovecot2"
                 if failed host ${cfg.fqdn} port 993 type tcpssl sslauto protocol imap for 5 cycles then restart
 
-          check process rspamd with pidfile /var/run/rspamd.pid
+          check process rspamd with matching "rspamd: main process"
                 start program = "${pkgs.systemd}/bin/systemctl start rspamd"
                 stop program = "${pkgs.systemd}/bin/systemctl stop rspamd"
         '';
+        defaultText = lib.literalMD "see [source](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/blob/master/default.nix)";
         description = ''
           The configuration used for monitoring via monit.
           Use a mail address that you actively check and set it via 'set alert ...'.
@@ -777,7 +1090,8 @@ in
         description = ''
           The location where borg saves the backups.
           This can be a local path or a remote location such as user@host:/path/to/repo.
-          It is exported and thus available as an environment variable to cmdPreexec and cmdPostexec.
+          It is exported and thus available as an environment variable to
+          {option}`mailserver.borgbackup.cmdPreexec` and {option}`mailserver.borgbackup.cmdPostexec`.
         '';
       };
 
@@ -837,13 +1151,14 @@ in
           default = "none";
           description = ''
             The backup can be encrypted by choosing any other value than 'none'.
-            When using encryption the password / passphrase must be provided in passphraseFile.
+            When using encryption the password/passphrase must be provided in `passphraseFile`.
           '';
         };
 
         passphraseFile = mkOption {
           type = types.nullOr types.path;
           default = null;
+          description = "Path to a file containing the encryption password or passphrase.";
         };
       };
 
@@ -859,6 +1174,7 @@ in
       locations = mkOption {
         type = types.listOf types.path;
         default = [cfg.mailDirectory];
+        defaultText = lib.literalExpression "[ config.mailserver.mailDirectory ]";
         description = "The locations that are to be backed up by borg.";
       };
 
@@ -879,8 +1195,9 @@ in
         default = null;
         description = ''
           The command to be executed before each backup operation.
-          This is called prior to borg init in the same script that runs borg init and create and cmdPostexec.
+          This is called prior to borg init in the same script that runs borg init and create and `cmdPostexec`.
-          Example:
+        '';
+        example = ''
           export BORG_RSH="ssh -i /path/to/private/key"
         '';
       };
@@ -891,7 +1208,7 @@ in
         description = ''
           The command to be executed after each backup operation.
           This is called after borg create completed successfully and in the same script that runs
-          cmdPreexec, borg init and create.
+          `cmdPreexec`, borg init and create.
         '';
       };
 
@@ -904,7 +1221,7 @@ in
         example = true;
         description = ''
           Whether to enable automatic reboot after kernel upgrades.
-          This is to be used in conjunction with system.autoUpgrade.enable = true"
+          This is to be used in conjunction with `system.autoUpgrade.enable = true;`
         '';
       };
       method = mkOption {
@@ -979,6 +1296,7 @@ in
   };
 
   imports = [
+    ./mail-server/assertions.nix
     ./mail-server/borgbackup.nix
     ./mail-server/debug.nix
     ./mail-server/rsnapshot.nix

docs/add-radicale.rst

@@ -4,8 +4,8 @@ Add Radicale
 Configuration by @dotlambda
 
 Starting with Radicale 3 (first introduced in NixOS 20.09) the traditional
-crypt passwords, as generated by `mkpasswd`, are no longer supported.  Instead
+crypt passwords are no longer supported.  Instead bcrypt passwords
-bcrypt passwords have to be used which can be generated using `htpasswd`.
+have to be used. These can still be generated using `mkpasswd -m bcrypt`.
 
 .. code:: nix
 
@@ -24,12 +24,13 @@ bcrypt passwords have to be used which can be generated using `htpasswd`.
    in {
      services.radicale = {
        enable = true;
-       config = ''
+       settings = {
-         [auth]
+         auth = {
-         type = htpasswd
+           type = "htpasswd";
-         htpasswd_filename = ${htpasswd}
+           htpasswd_filename = "${htpasswd}";
-         htpasswd_encryption = bcrypt
+           htpasswd_encryption = "bcrypt";
-       '';
+         };
+       };
      };
 
      services.nginx = {

docs/add-roundcube.rst

@@ -0,0 +1,32 @@
+Add Roundcube, a webmail
+========================
+
+The NixOS module for roundcube nearly works out of the box with SNM. By
+default, it sets up a nginx virtual host to serve the webmail, other web
+servers may require more work.
+
+.. code:: nix
+
+   { config, pkgs, lib, ... }:
+
+   with lib;
+
+   {
+     services.roundcube = {
+        enable = true;
+        # this is the url of the vhost, not necessarily the same as the fqdn of
+        # the mailserver
+        hostName = "webmail.example.com";
+        extraConfig = ''
+          # starttls needed for authentication, so the fqdn required to match
+          # the certificate
+          $config['smtp_host'] = "tls://${config.mailserver.fqdn}";
+          $config['smtp_user'] = "%u";
+          $config['smtp_pass'] = "%p";
+        '';
+     };
+
+     services.nginx.enable = true;
+
+     networking.firewall.allowedTCPPorts = [ 80 443 ];
+   }

docs/autodiscovery.rst

@@ -0,0 +1,18 @@
+Autodiscovery
+=============
+
+`RFC6186 <https://www.rfc-editor.org/rfc/rfc6186>`_ allows supporting email clients to automatically discover SMTP / IMAP addresses
+of the mailserver. For that, the following records are required:
+
+================= ==== ==== ======== ====== ==== =================
+Record            TTL  Type Priority Weight Port Value
+================= ==== ==== ======== ====== ==== =================
+_submission._tcp  3600 SRV  5        0      587  mail.example.com.
+_submissions._tcp 3600 SRV  5        0      465  mail.example.com.
+_imap._tcp        3600 SRV  5        0      143  mail.example.com.
+_imaps._tcp       3600 SRV  5        0      993  mail.example.com.
+================= ==== ==== ======== ====== ==== =================
+
+Please note that only a few MUAs currently implement this. For vendor-specific
+discovery mechanisms `automx <https://github.com/rseichter/automx2>`_ can be used instead.
+

docs/conf.py

@@ -18,7 +18,7 @@
 # -- Project information -----------------------------------------------------
 
 project = 'NixOS Mailserver'
-copyright = '2020, NixOS Mailserver Contributors'
+copyright = '2022, NixOS Mailserver Contributors'
 author = 'NixOS Mailserver Contributors'
 
 
@@ -28,8 +28,16 @@ author = 'NixOS Mailserver Contributors'
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
 extensions = [
+    'myst_parser'
 ]
 
+myst_enable_extensions = [
+    'colon_fence',
+    'linkify',
+]
+
+smartquotes = False
+
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
 
@@ -50,4 +58,4 @@ html_theme = 'sphinx_rtd_theme'
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['_static']
+html_static_path = []

docs/flakes.rst

@@ -0,0 +1,30 @@
+Nix Flakes
+==========
+
+If you're using `flakes <https://nixos.wiki/wiki/Flakes>`__, you can use
+the following minimal ``flake.nix`` as an example:
+
+.. code:: nix
+
+   {
+     description = "NixOS configuration";
+
+     inputs.simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-20.09";
+
+     outputs = { self, nixpkgs, simple-nixos-mailserver }: {
+       nixosConfigurations = {
+         hostname = nixpkgs.lib.nixosSystem {
+           system = "x86_64-linux";
+           modules = [
+             simple-nixos-mailserver.nixosModule
+             {
+               mailserver = {
+                 enable = true;
+                 # ...
+               };
+             }
+           ];
+         };
+       };
+     };
+   }

docs/fts.rst

@@ -38,9 +38,17 @@ issues a search query, so latency will be high.
 Resource requirements
 ~~~~~~~~~~~~~~~~~~~~~~~~
 
-Indices can take more disk space than the emails themselves. By default, they
+Indices created by the full text search feature can take more disk
-are kept in a different location (``/var/lib/dovecot/fts_xapian``) than emails
+space than the emails themselves. By default, they are kept in the
-so that you can backup emails without indices.
+emails location. When enabling the full text search feature, it is
+recommended to move indices in a different location, such as
+(``/var/lib/dovecot/indices``) by using the option
+``mailserver.indexDir``.
+
+.. warning::
+
+   When the value of the ``indexDir`` option is changed, all dovecot
+   indices needs to be recreated: clients would need to resynchronize.
 
 Indexation itself is rather resouces intensive, in CPU, and for emails with
 large headers, in memory as well. Initial indexation of existing emails can take

docs/howto-develop.rst

@@ -4,37 +4,46 @@ Contribute or troubleshoot
 To report an issue, please go to
 `<https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues>`_.
 
-You can also chat with us on the Freenode IRC channel ``#nixos-mailserver``.
+You can also chat with us on the Libera IRC channel ``#nixos-mailserver``.
 
 Run NixOS tests
 ---------------
 
-You can run the testsuite via
+To run the test suite, you need to enable `Nix Flakes
+<https://nixos.wiki/wiki/Flakes#Installing_flakes>`_.
+
+You can then run the testsuite via
 
 ::
 
-   $ nix-build tests -A extern.nixpkgs_20_03
+   $ nix flake check -L
-   $ nix-build tests -A intern.nixpkgs_unstable
+
-   ...
+Since Nix doesn't garantee your machine have enough resources to run
+all test VMs in parallel, some tests can fail. You would then haev to
+run tests manually. For instance:
+
+::
+
+   $ nix build .#hydraJobs.x86_64-linux.external-unstable -L
+
 
 Contributing to the documentation
 ---------------------------------
 
-The documentation is written in RST, build with Sphinx and published
+The documentation is written in RST (except option documentation which is in CommonMark),
-by `Read the Docs <https://readthedocs.org/>`_.
+built with Sphinx and published by `Read the Docs <https://readthedocs.org/>`_.
 
-For the syntax, see `RST/Sphinx Cheatsheet
+For the syntax, see the `RST/Sphinx primer
-<https://sphinx-tutorial.readthedocs.io/cheatsheet/>`_.
+<https://www.sphinx-doc.org/en/master/usage/restructuredtext/basics.html>`_.
+
+To build the documentation, you need to enable `Nix Flakes
+<https://nixos.wiki/wiki/Flakes#Installing_flakes>`_.
 
-The ``shell.nix`` provides all the tooling required to build the
-documentation:
 
 ::
 
-   $ nix-shell
+   $ nix build .#documentation
-   $ cd docs
+   $ xdg-open result/index.html
-   $ make html
-   $ firefox ./_build/html/index.html
 
 Nixops
 ------

docs/index.rst

@@ -6,18 +6,18 @@
 Welcome to NixOS Mailserver's documentation!
 ============================================
 
-.. image:: ../logo/logo.png
+.. image:: logo.png
    :width: 400
    :alt: SNM Logo
 
 .. toctree::
    :maxdepth: 2
 
-   quick-start
    setup-guide
    howto-develop
    faq
    release-notes
+   options
 
 .. toctree::
    :maxdepth: 1
@@ -25,8 +25,12 @@ Welcome to NixOS Mailserver's documentation!
 
    backup-guide
    add-radicale
+   add-roundcube
    rspamd-tuning
    fts
+   flakes
+   autodiscovery
+   ldap
 
 Indices and tables
 ==================

docs/ldap.rst

@@ -0,0 +1,14 @@
+LDAP Support
+============
+
+It is possible to manage mail user accounts with LDAP rather than with
+the option `loginAccounts <options.html#mailserver-loginaccounts>`_.
+
+All related LDAP options are described in the `LDAP options section
+<options.html#mailserver-ldap>`_ and the `LDAP test
+<https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/blob/master/tests/ldap.nix>`_
+provides a getting started example.
+
+.. note::
+   The LDAP support can not be enabled if some accounts are also defined with ``mailserver.loginAccounts``.
+

docs/quick-start.rst

@@ -1,34 +0,0 @@
-Quick Start
-===========
-
-.. code:: nix
-
-   { config, pkgs, ... }:
-   let release = "nixos-20.09";
-   in {
-     imports = [
-       (builtins.fetchTarball {
-         url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz";
-         # This hash needs to be updated
-         sha256 = "0000000000000000000000000000000000000000000000000000";
-       })
-     ];
-
-     mailserver = {
-       enable = true;
-       fqdn = "mail.example.com";
-       domains = [ "example.com" "example2.com" ];
-       loginAccounts = {
-           "user1@example.com" = {
-               # nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2 > /hashed/password/file/location
-               hashedPasswordFile = "/hashed/password/file/location";
-
-               aliases = [
-                   "info@example.com"
-                   "postmaster@example.com"
-                   "postmaster@example2.com"
-               ];
-           };
-       };
-     };
-   }

docs/release-notes.rst

@@ -1,6 +1,61 @@
 Release Notes
 =============
 
+NixOS 24.05
+-----------
+
+- Add new option ``acmeCertificateName`` which can be used to support
+  wildcard certificates
+
+NixOS 23.11
+-----------
+
+- Add basic support for LDAP users
+- Add support for regex (PCRE) aliases
+
+NixOS 23.05
+-----------
+
+- Existing ACME certificates can be reused without configuring NGINX
+- Certificate scheme is no longer a number, but a meaningful string instead
+
+NixOS 22.11
+-----------
+
+- Allow Rspamd to send DMARC reporting
+  (`merge request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/244>`__)
+
+NixOS 22.05
+-----------
+
+- Make NixOS Mailserver options discoverable from search.nixos.org
+- Add a roundcube setup guide in the documentation
+
+NixOS 21.11
+-----------
+
+- Switch default DKIM body policy from simple to relaxed
+  (`merge request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/247>`__)
+- Ensure locally-delivered mails have the X-Original-To header
+  (`merge request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/243>`__)
+- NixOS Mailserver options are detailed in the `documentation
+  <https://nixos-mailserver.readthedocs.io/en/latest/options.html>`__
+- New options ``dkimBodyCanonicalization`` and
+  ``dkimHeaderCanonicalization``
+- New option ``certificateDomains`` to generate certificate for
+  additional domains (such as ``imap.example.com``)
+
+
+NixOS 21.05
+-----------
+
+- New `fullTextSearch` option to search in messages (based on Xapian)
+  (`Merge Request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/212>`__)
+- Flake support
+  (`Merge Request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/200>`__)
+- New `openFirewall` option defaulting to `true`
+- We moved from Freenode to Libera Chat
+
 NixOS 20.09
 -----------
 

docs/requirements.txt

@@ -0,0 +1,4 @@
+sphinx ~= 5.3
+sphinx_rtd_theme ~= 1.1
+myst-parser ~= 0.18
+linkify-it-py ~= 2.0

docs/setup-guide.rst

@@ -3,272 +3,215 @@ Setup Guide
 
 Mail servers can be a tricky thing to set up. This guide is supposed to
 run you through the most important steps to achieve a 10/10 score on
-``mail-tester.com``.
+`<https://mail-tester.com>`_.
 
-What you need:
+What you need is:
 
--  A server with a public IP (referred to as ``server-IP``)
+- a server running NixOS with a public IP
--  A Fully Qualified Domain Name (``FQDN``) where your server is
+- a domain name.
-   reachable, so that other servers can find yours. Common FQDN include
-   ``mx.example.com`` (where ``example.com`` is a domain you own) or
-   ``mail.example.com``. The domain is referred to as ``server-domain``
-   (``example.com`` in the above example) and the ``FQDN`` is referred
-   to by ``server-FQDN`` (``mx.example.com`` above).
--  A list of domains you want to your email server to serve. (Note that
-   this does not have to include ``server-domain``, but may of course).
-   These will be referred to as ``domains``. As an example,
-   ``domains = [ example1.com, example2.com ]``.
 
-Setup server
+.. note::
-~~~~~~~~~~~~
+
+   In the following, we consider a server with the public IP ``1.2.3.4``
+   and the domain ``example.com``.
+
+First, we will set the minimum DNS configuration to be able to deploy
+an up and running mail server. Once the server is deployed, we could
+then set all DNS entries required to send and receive mails on this
+server.
+
+Setup DNS A record for server
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Add a DNS record to the domain ``example.com`` with the following
+entries
+
+==================== ===== ==== =============
+Name (Subdomain)     TTL   Type Value
+==================== ===== ==== =============
+``mail.example.com`` 10800 A    ``1.2.3.4``
+==================== ===== ==== =============
+
+You can check this with
+
+::
+
+   $ ping mail.example.com
+   64 bytes from mail.example.com (1.2.3.4): icmp_seq=1 ttl=46 time=21.3 ms
+   ...
+
+Note that it can take a while until a DNS entry is propagated. This
+DNS entry is required for the Let's Encrypt certificate generation
+(which is used in the below configuration example).
+
+Setup the server
+~~~~~~~~~~~~~~~~
 
 The following describes a server setup that is fairly complete. Even
-though there are more possible options (see ``default.nix``), these
+though there are more possible options (see the `NixOS Mailserver
-should be the most common ones.
+options documentation <options.html>`_), these should be the most
+common ones.
 
 .. code:: nix
 
-   { config, pkgs, ... }:
+   { config, pkgs, ... }: {
-   {
      imports = [
        (builtins.fetchTarball {
-         # Pick a commit from the branch you are interested in
+         # Pick a release version you are interested in and set its hash, e.g.
-         url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/A-COMMIT-ID/nixos-mailserver-A-COMMIT-ID.tar.gz";
+         url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-23.05/nixos-mailserver-nixos-23.05.tar.gz";
-         # And set its hash
+         # To get the sha256 of the nixos-mailserver tarball, we can use the nix-prefetch-url command:
+         # release="nixos-23.05"; nix-prefetch-url "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz" --unpack
          sha256 = "0000000000000000000000000000000000000000000000000000";
        })
      ];
 
-
      mailserver = {
        enable = true;
-       fqdn = <server-FQDN>;
+       fqdn = "mail.example.com";
-       domains = [ <domains> ];
+       domains = [ "example.com" ];
 
        # A list of all login accounts. To create the password hashes, use
-       # nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
+       # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
        loginAccounts = {
          "user1@example.com" = {
-               hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/";
+           hashedPasswordFile = "/a/file/containing/a/hashed/password";
-
+           aliases = ["postmaster@example.com"];
-               aliases = [
-                   "postmaster@example.com"
-                   "postmaster@example2.com"
-               ];
-
-               # Make this user the catchAll address for domains example.com and
-               # example2.com
-               catchAll = [
-                   "example.com"
-                   "example2.com"
-               ];
          };
-
          "user2@example.com" = { ... };
        };
 
-       # Extra virtual aliases. These are email addresses that are forwarded to
-       # loginAccounts addresses.
-       extraVirtualAliases = {
-           # address = forward address;
-           "abuse@example.com" = "user1@example.com";
-       };
-
        # Use Let's Encrypt certificates. Note that this needs to set up a stripped
        # down nginx and opens port 80.
-       certificateScheme = 3;
+       certificateScheme = "acme-nginx";
-
-       # Enable IMAP and POP3
-       enableImap = true;
-       enablePop3 = true;
-       enableImapSsl = true;
-       enablePop3Ssl = true;
-
-       # Enable the ManageSieve protocol
-       enableManageSieve = true;
-
-       # whether to scan inbound emails for viruses (note that this requires at least
-       # 1 Gb RAM for the server. Without virus scanning 256 MB RAM should be plenty)
-       virusScanning = false;
      };
+     security.acme.acceptTerms = true;
+     security.acme.defaults.email = "security@example.com";
    }
 
-After a ``nixos-rebuild switch --upgrade`` your server should be good to
+After a ``nixos-rebuild switch`` your server should be running all
-go. If you want to use ``nixops`` to deploy the server, look in the
+mail components.
-subfolder ``nixops`` for some inspiration.
 
-If you're using `flakes <https://nixos.wiki/wiki/Flakes>`__, you can use
+Setup all other DNS requirements
-the following minimal ``flake.nix`` as an example:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. code:: nix
+Set rDNS (reverse DNS) entry for server
-
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-   {
-     description = "NixOS configuration";
-
-     inputs.simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
-
-     outputs = { self, nixpkgs, simple-nixos-mailserver }: {
-       nixosConfigurations = {
-         hostname = nixpkgs.lib.nixosSystem {
-           system = "x86_64-linux";
-           modules = [
-             simple-nixos-mailserver.nixosModule
-             {
-               mailserver = {
-                 enable = true;
-                 # ...
-               };
-             }
-           ];
-         };
-       };
-     };
-   }
-
-Setup everything else
-~~~~~~~~~~~~~~~~~~~~~
-
-Step 1: Set DNS entry for server
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Add a DNS record to the domain ``server-domain`` with the following
-entries
-
-================ ===== ==== ======== =============
-Name (Subdomain) TTL   Type Priority Value
-================ ===== ==== ======== =============
-``server-FQDN``  10800 A             ``server-IP``
-================ ===== ==== ======== =============
-
-This resolves DNS queries for ``server-FQDN`` to ``server-IP``. You can
-test if your setting is correct by
-
-::
-
-   ping <server-FQDN>
-
-Expected output:
-
-::
-
-   64 bytes from <server-FQDN> (<server-IP>): icmp_seq=1 ttl=46 time=21.3 ms
-   ...
-
-Note that it can take a while until a DNS entry is propagated.
-
-Step 2: Set rDNS (reverse DNS) entry for server
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Wherever you have rented your server, you should be able to set reverse
-DNS entries for the IP’s you own. Add an entry resolving ``server-IP``
+DNS entries for the IP’s you own. Add an entry resolving ``1.2.3.4``
-to ``server-FQDN``
+to ``mail.example.com``.
 
-You can test if your setting is correct by
+.. warning::
+
+   We don't recommend setting up a mail server if you are not able to
+   set a reverse DNS on your public IP because sent emails would be
+   mostly marked as spam. Note that many residential ISP providers
+   don't allow you to set a reverse DNS entry.
+
+You can check this with
 
 ::
 
-   host <server-IP>
+   $ nix-shell -p bind --command "host 1.2.3.4"
-
+   4.3.2.1.in-addr.arpa domain name pointer mail.example.com.
-Expected output:
-
-::
-
-   <server-IP-octets-reversed>.in-addr.arpa domain name pointer <server-FQDN>.
 
 Note that it can take a while until a DNS entry is propagated.
 
-Step 3: Set ``MX`` Records
+Set a ``MX`` record
-^^^^^^^^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^
 
-For every ``domain`` in ``domains`` do: \* Add a ``MX`` record to the
+
-domain ``domain``
+Add a ``MX`` record to the domain ``example.com``.
+
+================ ==== ======== =================
+Name (Subdomain) Type Priority Value
+================ ==== ======== =================
+example.com      MX   10       mail.example.com
+================ ==== ======== =================
+
+You can check this with
 
 ::
 
-   | Name (Subdomain) | TTL   | Type | Priority | Value             |
+   $ nix-shell -p bind --command "host -t mx example.com"
-   | ---------------- | ----- | ---- | -------- | ----------------- |
+   example.com mail is handled by 10 mail.example.com.
-   | `domain`         |       | MX   | 10       | `server-FQDN`     |
-
-You can test this via
-
-::
-
-   dig -t MX <domain>
-
-Expected output:
-
-::
-
-   ...
-   ;; ANSWER SECTION:
-   <domain>    10800   IN  MX  10 <server-FQDN>
-   ...
 
 Note that it can take a while until a DNS entry is propagated.
 
-Step 4: Set ``SPF`` Records
+Set a ``SPF`` record
-^^^^^^^^^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^^
 
-For every ``domain`` in ``domains`` do: \* Add a ``SPF`` record to the
+Add a `SPF <https://en.wikipedia.org/wiki/Sender_Policy_Framework>`_
-domain ``domain``
+record to the domain ``example.com``.
-
-::
-
-   | Name (Subdomain) | TTL   | Type | Priority | Value                         |
-   | ---------------- | ----- | ---- | -------- | -----------------             |
-   | `domain`         | 10800 | TXT  |          | `v=spf1 ip4:<server-IP> -all` |
-
-You can check this with ``dig -t TXT <domain>`` similar to the last
-section. Note that ``SPF`` records are set as ``TXT`` records since
-RFC1035.
-
-Note that it can take a while until a DNS entry is propagated. If you
-want to use multiple servers for your email handling, don’t forget to
-add all server IP’s to this list.
-
-Step 5: Set ``DKIM`` signature
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-In this section we assume that your ``dkimSelector`` is set to ``mail``.
-If you have a different selector, replace all ``mail``\ ’s below
-accordingly.
-
-For every ``domain`` in ``domains`` do: \* Go to your server and
-navigate to the dkim key directory (by default ``/var/dkim``). There you
-will find a public key for any domain in the ``domain.txt`` file. It
-will look like
-``mail._domainkey IN TXT "v=DKIM1; r=postmaster; g=*; k=rsa; p=<really-long-key>" ; ----- DKIM mail for domain.tld``
-\* Add a ``DKIM`` record to the domain ``domain``
-
-::
-
-   | Name (Subdomain)         | TTL   | Type | Priority | Value                          |
-   | ----------------         | ----- | ---- | -------- | -----------------              |
-   | mail._domainkey.`domain` | 10800 | TXT  |          | `v=DKIM1; p=<really-long-key>` |
-
-You can check this with ``dig -t TXT mail._domainkey.<domain>`` similar
-to the last section.
-
-Note that it can take a while until a DNS entry is propagated.
-
-Step 6: Set ``DMARC`` record
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-For every ``domain`` in ``domains`` do:
-
--  Add a ``DMARC`` record to the domain ``domain``
 
 ================ ===== ==== ================================
-   Name (Subdomain)     TTL   Type Priority Value
+Name (Subdomain) TTL   Type Value
 ================ ===== ==== ================================
-   \_dmarc.\ ``domain`` 10800 TXT           ``v=DMARC1; p=none``
+example.com      10800 TXT  `v=spf1 a:mail.example.com -all`
 ================ ===== ==== ================================
 
-You can check this with ``dig -t TXT _dmarc.<domain>`` similar to the
+You can check this with
-last section.
+
+::
+
+   $ nix-shell -p bind --command "host -t TXT example.com"
+   example.com descriptive text "v=spf1 a:mail.example.com -all"
 
 Note that it can take a while until a DNS entry is propagated.
 
+Set ``DKIM`` signature
+^^^^^^^^^^^^^^^^^^^^^^
+
+On your server, the ``opendkim`` systemd service generated a file
+containing your DKIM public key in the file
+``/var/dkim/example.com.mail.txt``. The content of this file looks
+like
+
+::
+
+   mail._domainkey IN TXT "v=DKIM1; k=rsa; s=email; p=<really-long-key>" ; ----- DKIM mail for domain.tld
+
+where ``really-long-key`` is your public key.
+
+Based on the content of this file, we can add a ``DKIM`` record to the
+domain ``example.com``.
+
+=========================== ===== ==== ==============================
+Name (Subdomain)            TTL   Type Value
+=========================== ===== ==== ==============================
+mail._domainkey.example.com 10800 TXT  ``v=DKIM1; p=<really-long-key>``
+=========================== ===== ==== ==============================
+
+You can check this with
+
+::
+
+   $ nix-shell -p bind --command "host -t txt mail._domainkey.example.com"
+   mail._domainkey.example.com descriptive text "v=DKIM1;p=<really-long-key>"
+
+Note that it can take a while until a DNS entry is propagated.
+
+Set a ``DMARC`` record
+^^^^^^^^^^^^^^^^^^^^^^
+
+Add a ``DMARC`` record to the domain ``example.com``.
+
+======================== ===== ==== ====================
+Name (Subdomain)         TTL   Type Value
+======================== ===== ==== ====================
+_dmarc.example.com       10800 TXT  ``v=DMARC1; p=none``
+======================== ===== ==== ====================
+
+You can check this with
+
+::
+
+   $ nix-shell -p bind --command "host -t TXT _dmarc.example.com"
+   _dmarc.example.com descriptive text "v=DMARC1; p=none"
+
+Note that it can take a while until a DNS entry is propagated.
+
+
 Test your Setup
 ~~~~~~~~~~~~~~~
 

flake.lock

@@ -1,12 +1,44 @@
 {
   "nodes": {
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1607522989,
+        "lastModified": 1717602782,
-        "narHash": "sha256-o/jWhOSAlaK7y2M57OIriRt6whuVVocS/T0mG7fd1TI=",
+        "narHash": "sha256-pL9jeus5QpX5R+9rsp3hhZ+uplVHscNJh8n8VpqscM0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e9158eca70ae59e73fae23be5d13d3fa0cfc78b4",
+        "rev": "e8057b67ebf307f01bdcc8fba94d94f75039d1f6",
         "type": "github"
       },
       "original": {
@@ -15,25 +47,27 @@
         "type": "indirect"
       }
     },
-    "root": {
+    "nixpkgs-24_05": {
-      "inputs": {
-        "nixpkgs": "nixpkgs",
-        "utils": "utils"
-      }
-    },
-    "utils": {
       "locked": {
-        "lastModified": 1605370193,
+        "lastModified": 1717144377,
-        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
+        "narHash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=",
-        "owner": "numtide",
+        "owner": "NixOS",
-        "repo": "flake-utils",
+        "repo": "nixpkgs",
-        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
+        "rev": "805a384895c696f802a9bf5bf4720f37385df547",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
+        "id": "nixpkgs",
-        "repo": "flake-utils",
+        "ref": "nixos-24.05",
-        "type": "github"
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-24_05": "nixpkgs-24_05"
       }
     }
   },

flake.nix

@@ -2,25 +2,126 @@
   description = "A complete and Simple Nixos Mailserver";
 
   inputs = {
-    utils.url = "github:numtide/flake-utils";
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
     nixpkgs.url = "flake:nixpkgs/nixos-unstable";
+    nixpkgs-24_05.url = "flake:nixpkgs/nixos-24.05";
+    blobs = {
+      url = "gitlab:simple-nixos-mailserver/blobs";
+      flake = false;
+    };
   };
 
-  outputs = { self, utils, nixpkgs }: {
+  outputs = { self, blobs, nixpkgs, nixpkgs-24_05, ... }: let
-    nixosModules.mailserver = import ./.;
+    lib = nixpkgs.lib;
-    nixosModule = self.nixosModules.mailserver;
+    system = "x86_64-linux";
-  } // utils.lib.eachDefaultSystem (system: let
     pkgs = nixpkgs.legacyPackages.${system};
-  in {
+    releases = [
-    devShell = pkgs.mkShell {
+      {
-      buildInputs = with pkgs; [
+        name = "unstable";
-        (python3.withPackages (p: with p; [
+        pkgs = nixpkgs.legacyPackages.${system};
+      }
+      {
+        name = "24.05";
+        pkgs = nixpkgs-24_05.legacyPackages.${system};
+      }
+    ];
+    testNames = [
+      "internal"
+      "external"
+      "clamav"
+      "multiple"
+      "ldap"
+    ];
+    genTest = testName: release: {
+      "name"= "${testName}-${builtins.replaceStrings ["."] ["_"] release.name}";
+      "value"= import (./tests/. + "/${testName}.nix") {
+        pkgs = release.pkgs;
+        inherit blobs;
+      };
+    };
+    # Generate an attribute set such as
+    # {
+    #   external-unstable = <derivation>;
+    #   external-21_05 = <derivation>;
+    #   ...
+    # }
+    allTests = lib.listToAttrs (
+      lib.flatten (map (t: map (r: genTest t r) releases) testNames));
+
+    mailserverModule = import ./.;
+
+    # Generate a MarkDown file describing the options of the NixOS mailserver module
+    optionsDoc = let
+      eval = lib.evalModules {
+        modules = [
+          mailserverModule
+          {
+            _module.check = false;
+            mailserver = {
+              fqdn = "mx.example.com";
+              domains = [
+                "example.com"
+              ];
+              dmarcReporting = {
+                organizationName = "Example Corp";
+                domain = "example.com";
+              };
+            };
+          }
+        ];
+      };
+      options = builtins.toFile "options.json" (builtins.toJSON
+        (lib.filter (opt: opt.visible && !opt.internal && lib.head opt.loc == "mailserver")
+          (lib.optionAttrSetToDocList eval.options)));
+    in pkgs.runCommand "options.md" { buildInputs = [pkgs.python3Minimal]; } ''
+      echo "Generating options.md from ${options}"
+      python ${./scripts/generate-options.py} ${options} > $out
+    '';
+
+    documentation = pkgs.stdenv.mkDerivation {
+      name = "documentation";
+      src = lib.sourceByRegex ./docs ["logo\\.png" "conf\\.py" "Makefile" ".*\\.rst"];
+      buildInputs = [(
+        pkgs.python3.withPackages (p: with p; [
           sphinx
           sphinx_rtd_theme
-        ]))
+          myst-parser
-        jq
+          linkify-it-py
+        ])
+      )];
+      buildPhase = ''
+        cp ${optionsDoc} options.md
+        # Workaround for https://github.com/sphinx-doc/sphinx/issues/3451
+        unset SOURCE_DATE_EPOCH
+        make html
+      '';
+      installPhase = ''
+        cp -Tr _build/html $out
+      '';
+    };
+
+  in {
+    nixosModules = rec {
+      mailserver = mailserverModule;
+      default = mailserver;
+    };
+    nixosModule = self.nixosModules.default; # compatibility
+    hydraJobs.${system} = allTests // {
+      inherit documentation;
+    };
+    checks.${system} = allTests;
+    packages.${system} = {
+      inherit optionsDoc documentation;
+    };
+    devShells.${system}.default = pkgs.mkShell {
+      inputsFrom = [ documentation ];
+      packages = with pkgs; [
         clamav
       ];
     };
-  });
+    devShell.${system} = self.devShells.${system}.default; # compatibility
+  };
 }

mail-server/assertions.nix

@@ -0,0 +1,18 @@
+{ config, lib, pkgs, ... }:
+{
+  assertions = lib.optionals config.mailserver.ldap.enable [
+    {
+      assertion = config.mailserver.loginAccounts == {};
+      message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.loginAccounts";
+    }
+    {
+      assertion = config.mailserver.forwards == {};
+      message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.forwards";
+    }
+  ] ++ lib.optionals (config.mailserver.enable && config.mailserver.certificateScheme != "acme") [
+    {
+      assertion = config.mailserver.acmeCertificateName == config.mailserver.fqdn;
+      message = "When the certificate scheme is not 'acme' (mailserver.certificateScheme != \"acme\"), it is not possible to define mailserver.acmeCertificateName";
+    }
+  ];
+}

mail-server/clamav.nix

@@ -14,19 +14,17 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, options, ... }:
 
 let
   cfg = config.mailserver;
 in
 {
   config = lib.mkIf (cfg.enable && cfg.virusScanning) {
-    services.clamav.daemon.enable = true;
+    services.clamav.daemon = {
+      enable = true;
+      settings.PhishingScanURLs = "no";
+    };
     services.clamav.updater.enable = true;
-
-    services.clamav.daemon.extraConfig = ''
-      PhishingScanURLs no
-    '';
   };
 }
-

mail-server/common.nix

@@ -21,22 +21,22 @@ let
 in
 {
   # cert :: PATH
-  certificatePath = if cfg.certificateScheme == 1
+  certificatePath = if cfg.certificateScheme == "manual"
              then cfg.certificateFile
-             else if cfg.certificateScheme == 2
+             else if cfg.certificateScheme == "selfsigned"
                   then "${cfg.certificateDirectory}/cert-${cfg.fqdn}.pem"
-                  else if cfg.certificateScheme == 3
+                  else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx"
-                       then "${config.security.acme.certs.${cfg.fqdn}.directory}/fullchain.pem"
+                       then "${config.security.acme.certs.${cfg.acmeCertificateName}.directory}/fullchain.pem"
-                       else throw "Error: Certificate Scheme must be in { 1, 2, 3 }";
+                       else throw "unknown certificate scheme";
 
   # key :: PATH
-  keyPath = if cfg.certificateScheme == 1
+  keyPath = if cfg.certificateScheme == "manual"
         then cfg.keyFile
-        else if cfg.certificateScheme == 2
+        else if cfg.certificateScheme == "selfsigned"
              then "${cfg.certificateDirectory}/key-${cfg.fqdn}.pem"
-              else if cfg.certificateScheme == 3
+              else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx"
-                   then "${config.security.acme.certs.${cfg.fqdn}.directory}/key.pem"
+                   then "${config.security.acme.certs.${cfg.acmeCertificateName}.directory}/key.pem"
-                   else throw "Error: Certificate Scheme must be in { 1, 2, 3 }";
+                   else throw "unknown certificate scheme";
 
   passwordFiles = let
     mkHashFile = name: hash: pkgs.writeText "${builtins.hashString "sha256" name}-password-hash" hash;
@@ -45,4 +45,26 @@ in
     if value.hashedPasswordFile == null then
       builtins.toString (mkHashFile name value.hashedPassword)
     else value.hashedPasswordFile) cfg.loginAccounts;
+
+  # Appends the LDAP bind password to files to avoid writing this
+  # password into the Nix store.
+  appendLdapBindPwd = {
+    name, file, prefix, suffix ? "", passwordFile, destination
+  }: pkgs.writeScript "append-ldap-bind-pwd-in-${name}" ''
+    #!${pkgs.stdenv.shell}
+    set -euo pipefail
+
+    baseDir=$(dirname ${destination})
+    if (! test -d "$baseDir"); then
+      mkdir -p $baseDir
+      chmod 755 $baseDir
+    fi
+
+    cat ${file} > ${destination}
+    echo -n '${prefix}' >> ${destination}
+    cat ${passwordFile} >> ${destination}
+    echo -n '${suffix}' >> ${destination}
+    chmod 600 ${destination}
+  '';
+
 }

mail-server/dovecot.nix

@@ -23,17 +23,19 @@ let
 
   passwdDir = "/run/dovecot2";
   passwdFile = "${passwdDir}/passwd";
-
+  userdbFile = "${passwdDir}/userdb";
+  # This file contains the ldap bind password
+  ldapConfFile = "${passwdDir}/dovecot-ldap.conf.ext";
   bool2int = x: if x then "1" else "0";
 
   maildirLayoutAppendix = lib.optionalString cfg.useFsLayout ":LAYOUT=fs";
+  maildirUTF8FolderNames = lib.optionalString cfg.useUTF8FolderNames ":UTF-8";
 
   # maildir in format "/${domain}/${user}"
   dovecotMaildir =
-    "maildir:${cfg.mailDirectory}/%d/%n${maildirLayoutAppendix}"
+    "maildir:${cfg.mailDirectory}/%d/%n${maildirLayoutAppendix}${maildirUTF8FolderNames}"
-    + (lib.optionalString
+    + (lib.optionalString (cfg.indexDir != null)
-        (cfg.fullTextSearch.enable && (cfg.fullTextSearch.indexDir != null))
+       ":INDEX=${cfg.indexDir}/%d/%n"
-        ":INDEX=${cfg.fullTextSearch.indexDir}/%d/%n"
       );
 
   postfixCfg = config.services.postfix;
@@ -58,6 +60,42 @@ let
     '';
   };
 
+
+  ldapConfig = pkgs.writeTextFile {
+    name = "dovecot-ldap.conf.ext.template";
+    text = ''
+      ldap_version = 3
+      uris = ${lib.concatStringsSep " " cfg.ldap.uris}
+      ${lib.optionalString cfg.ldap.startTls ''
+      tls = yes
+      ''}
+      tls_require_cert = hard
+      tls_ca_cert_file = ${cfg.ldap.tlsCAFile}
+      dn = ${cfg.ldap.bind.dn}
+      sasl_bind = no
+      auth_bind = yes
+      base = ${cfg.ldap.searchBase}
+      scope = ${mkLdapSearchScope cfg.ldap.searchScope}
+      ${lib.optionalString (cfg.ldap.dovecot.userAttrs != null) ''
+      user_attrs = ${cfg.ldap.dovecot.userAttrs}
+      ''}
+      user_filter = ${cfg.ldap.dovecot.userFilter}
+      ${lib.optionalString (cfg.ldap.dovecot.passAttrs != "") ''
+      pass_attrs = ${cfg.ldap.dovecot.passAttrs}
+      ''}
+      pass_filter = ${cfg.ldap.dovecot.passFilter}
+    '';
+  };
+
+  setPwdInLdapConfFile = appendLdapBindPwd {
+    name = "ldap-conf-file";
+    file = ldapConfig;
+    prefix = ''dnpass = "'';
+    suffix = ''"'';
+    passwordFile = cfg.ldap.bind.passwordFile;
+    destination = ldapConfFile;
+  };
+
   genPasswdScript = pkgs.writeScript "generate-password-file" ''
     #!${pkgs.stdenv.shell}
 
@@ -68,6 +106,9 @@ let
       chmod 755 "${passwdDir}"
     fi
 
+    # Prevent world-readable password files, even temporarily.
+    umask 077
+
     for f in ${builtins.toString (lib.mapAttrsToList (name: value: passwordFiles."${name}") cfg.loginAccounts)}; do
       if [ ! -f "$f" ]; then
         echo "Expected password hash file $f does not exist!"
@@ -77,18 +118,48 @@ let
 
     cat <<EOF > ${passwdFile}
     ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:
-      "${name}:${"$(head -n 1 ${passwordFiles."${name}"})"}:${builtins.toString cfg.vmailUID}:${builtins.toString cfg.vmailUID}::${cfg.mailDirectory}:/run/current-system/sw/bin/nologin:"
+      "${name}:${"$(head -n 1 ${passwordFiles."${name}"})"}::::::"
+    ) cfg.loginAccounts)}
+    EOF
+
+    cat <<EOF > ${userdbFile}
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:
+      "${name}:::::::"
         + (if lib.isString value.quota
               then "userdb_quota_rule=*:storage=${value.quota}"
               else "")
     ) cfg.loginAccounts)}
     EOF
-
-    chmod 600 ${passwdFile}
   '';
+
+  junkMailboxes = builtins.attrNames (lib.filterAttrs (n: v: v ? "specialUse" && v.specialUse == "Junk") cfg.mailboxes);
+  junkMailboxNumber = builtins.length junkMailboxes;
+  # The assertion garantees there is exactly one Junk mailbox.
+  junkMailboxName = if junkMailboxNumber == 1 then builtins.elemAt junkMailboxes 0 else "";
+
+  mkLdapSearchScope = scope: (
+    if scope == "sub" then "subtree"
+    else if scope == "one" then "onelevel"
+    else scope
+  );
+
 in
 {
   config = with cfg; lib.mkIf enable {
+    assertions = [
+      {
+        assertion = junkMailboxNumber == 1;
+        message = "nixos-mailserver requires exactly one dovecot mailbox with the 'special use' flag set to 'Junk' (${builtins.toString junkMailboxNumber} have been found)";
+      }
+    ];
+
+    # for sieve-test. Shelling it in on demand usually doesnt' work, as it reads
+    # the global config and tries to open shared libraries configured in there,
+    # which are usually not compatible.
+    environment.systemPackages = [
+      pkgs.dovecot_pigeonhole
+    ];
+
     services.dovecot2 = {
       enable = true;
       enableImap = enableImap || enableImapSsl;
@@ -105,17 +176,48 @@ in
       mailPlugins.globally.enable = lib.optionals cfg.fullTextSearch.enable [ "fts" "fts_xapian" ];
       protocols = lib.optional cfg.enableManageSieve "sieve";
 
-      sieveScripts = {
+      pluginSettings = {
-        after = builtins.toFile "spam.sieve" ''
+        sieve = "file:${cfg.sieveDirectory}/%u/scripts;active=${cfg.sieveDirectory}/%u/active.sieve";
+        sieve_default = "file:${cfg.sieveDirectory}/%u/default.sieve";
+        sieve_default_name = "default";
+      };
+
+      sieve = {
+        extensions = [
+          "fileinto"
+        ];
+
+        scripts.after = builtins.toFile "spam.sieve" ''
           require "fileinto";
 
           if header :is "X-Spam" "Yes" {
-              fileinto "Junk";
+              fileinto "${junkMailboxName}";
               stop;
           }
         '';
+
+        pipeBins = map lib.getExe [
+          (pkgs.writeShellScriptBin "sa-learn-ham.sh"
+            "exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/worker-controller.sock learn_ham")
+          (pkgs.writeShellScriptBin "sa-learn-spam.sh"
+            "exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/worker-controller.sock learn_spam")
+        ];
       };
 
+      imapsieve.mailbox = [
+        {
+          name = junkMailboxName;
+          causes = [ "COPY" "APPEND" ];
+          before = ./dovecot/imap_sieve/report-spam.sieve;
+        }
+        {
+          name = "*";
+          from = junkMailboxName;
+          causes = [ "COPY" ];
+          before = ./dovecot/imap_sieve/report-ham.sieve;
+        }
+      ];
+
       mailboxes = cfg.mailboxes;
 
       extraConfig = ''
@@ -191,7 +293,7 @@ in
           }
         }
 
-        recipient_delimiter = +
+        recipient_delimiter = ${cfg.recipientDelimiter}
         lmtp_save_to_detail_mailbox = ${cfg.lmtpSaveToDetailMailbox}
 
         protocol lmtp {
@@ -205,9 +307,23 @@ in
 
         userdb {
           driver = passwd-file
-          args = ${passwdFile}
+          args = ${userdbFile}
+          default_fields = uid=${builtins.toString cfg.vmailUID} gid=${builtins.toString cfg.vmailUID} home=${cfg.mailDirectory}
         }
 
+        ${lib.optionalString cfg.ldap.enable ''
+        passdb {
+          driver = ldap
+          args = ${ldapConfFile}
+        }
+
+        userdb {
+          driver = ldap
+          args = ${ldapConfFile}
+          default_fields = home=/var/vmail/ldap/%u uid=${toString cfg.vmailUID} gid=${toString cfg.vmailUID}
+        }
+        ''}
+
         service auth {
           unix_listener auth {
             mode = 0660
@@ -223,29 +339,7 @@ in
           inbox = yes
         }
 
-        plugin {
+        ${lib.optionalString cfg.fullTextSearch.enable ''
-          sieve_plugins = sieve_imapsieve sieve_extprograms
-          sieve = file:${cfg.sieveDirectory}/%u/scripts;active=${cfg.sieveDirectory}/%u/active.sieve
-          sieve_default = file:${cfg.sieveDirectory}/%u/default.sieve
-          sieve_default_name = default
-
-          # From elsewhere to Spam folder
-          imapsieve_mailbox1_name = Junk
-          imapsieve_mailbox1_causes = COPY
-          imapsieve_mailbox1_before = file:${stateDir}/imap_sieve/report-spam.sieve
-
-          # From Spam folder to elsewhere
-          imapsieve_mailbox2_name = *
-          imapsieve_mailbox2_from = Junk
-          imapsieve_mailbox2_causes = COPY
-          imapsieve_mailbox2_before = file:${stateDir}/imap_sieve/report-ham.sieve
-
-          sieve_pipe_bin_dir = ${pipeBin}/pipe/bin
-
-          sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
-        }
-
-        ${lib.optionalString (cfg.fullTextSearch.enable != null) ''
         plugin {
           plugin = fts fts_xapian
           fts = xapian
@@ -273,17 +367,10 @@ in
     systemd.services.dovecot2 = {
       preStart = ''
         ${genPasswdScript}
-        rm -rf '${stateDir}/imap_sieve'
+      '' + (lib.optionalString cfg.ldap.enable setPwdInLdapConfFile);
-        mkdir '${stateDir}/imap_sieve'
-        cp -p "${./dovecot/imap_sieve}"/*.sieve '${stateDir}/imap_sieve/'
-        for k in "${stateDir}/imap_sieve"/*.sieve ; do
-          ${pkgs.dovecot_pigeonhole}/bin/sievec "$k"
-        done
-        chown -R '${dovecot2Cfg.mailUser}:${dovecot2Cfg.mailGroup}' '${stateDir}/imap_sieve'
-      '';
     };
 
-    systemd.services.postfix.restartTriggers = [ genPasswdScript ];
+    systemd.services.postfix.restartTriggers = [ genPasswdScript ] ++ (lib.optional cfg.ldap.enable [setPwdInLdapConfFile]);
 
     systemd.services.dovecot-fts-xapian-optimize = lib.mkIf (cfg.fullTextSearch.enable && cfg.fullTextSearch.maintenance.enable) {
       description = "Optimize dovecot indices for fts_xapian";

mail-server/environment.nix

@@ -23,6 +23,6 @@ in
   config = with cfg; lib.mkIf enable {
     environment.systemPackages = with pkgs; [
       dovecot opendkim openssh postfix rspamd
-    ] ++ (if certificateScheme == 2 then [ openssl ] else []);
+    ] ++ (if certificateScheme == "selfsigned" then [ openssl ] else []);
   };
 }

mail-server/kresd.nix

@@ -22,7 +22,6 @@ in
 {
   config = lib.mkIf (cfg.enable && cfg.localDnsResolver) {
     services.kresd.enable = true;
-    networking.nameservers = [ "127.0.0.1" ];
   };
 }
 

mail-server/networking.nix

@@ -14,7 +14,7 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:
 
 let
   cfg = config.mailserver;
@@ -31,7 +31,7 @@ in
         ++ lib.optional enablePop3 110
         ++ lib.optional enablePop3Ssl 995
         ++ lib.optional enableManageSieve 4190
-        ++ lib.optional (certificateScheme == 3) 80;
+        ++ lib.optional (certificateScheme == "acme-nginx") 80;
     };
   };
 }

mail-server/nginx.nix

@@ -17,28 +17,26 @@
 
 { config, pkgs, lib, ... }:
 
-with (import ./common.nix { inherit config; });
+with (import ./common.nix { inherit config lib pkgs; });
 
 let
   cfg = config.mailserver;
-  acmeRoot = "/var/lib/acme/acme-challenge";
 in
 {
-  config = lib.mkIf (cfg.enable && cfg.certificateScheme == 3) {
+  config = lib.mkIf (cfg.enable && (cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx")) {
-    services.nginx = {
+    services.nginx = lib.mkIf (cfg.certificateScheme == "acme-nginx") {
       enable = true;
       virtualHosts."${cfg.fqdn}" = {
         serverName = cfg.fqdn;
+        serverAliases = cfg.certificateDomains;
         forceSSL = true;
         enableACME = true;
-        acmeRoot = acmeRoot;
       };
     };
 
-    security.acme.certs."${cfg.fqdn}".postRun = ''
+    security.acme.certs."${cfg.acmeCertificateName}".reloadServices = [
-      systemctl reload nginx
+      "postfix.service"
-      systemctl reload postfix
+      "dovecot2.service"
-      systemctl reload dovecot2
+    ];
-    '';
   };
 }

mail-server/opendkim.nix

@@ -29,7 +29,7 @@ let
       dkim_txt = "${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.txt";
     in
         ''
-          if [ ! -f "${dkim_key}" ] || [ ! -f "${dkim_txt}" ]
+          if [ ! -f "${dkim_key}" ]
           then
               ${pkgs.opendkim}/bin/opendkim-genkey -s "${cfg.dkimSelector}" \
                                                    -d "${dom}" \
@@ -37,6 +37,7 @@ let
                                                    --directory="${cfg.dkimKeyDirectory}"
               mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.private" "${dkim_key}"
               mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.txt" "${dkim_txt}"
+              chmod 644 "${dkim_txt}"
               echo "Generated key for domain ${dom} selector ${cfg.dkimSelector}"
           fi
         '';
@@ -59,7 +60,7 @@ in
         keyPath = cfg.dkimKeyDirectory;
         domains = "csl:${builtins.concatStringsSep "," cfg.domains}";
         configFile = pkgs.writeText "opendkim.conf" (''
-          Canonicalization relaxed/simple
+          Canonicalization ${cfg.dkimHeaderCanonicalization}/${cfg.dkimBodyCanonicalization}
           UMask 0002
           Socket ${dkim.socket}
           KeyTable file:${keyTable}

mail-server/postfix.nix

@@ -33,6 +33,11 @@ let
       let to = name;
       in map (from: {"${from}" = to;}) (value.aliases ++ lib.singleton name))
     cfg.loginAccounts));
+  regex_valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList
+    (name: value:
+      let to = name;
+      in map (from: {"${from}" = to;}) value.aliasesRegexp)
+    cfg.loginAccounts));
 
   # catchAllPostfix :: Map String [String]
   catchAllPostfix =  mergeLookupTables (lib.flatten (lib.mapAttrsToList
@@ -65,6 +70,10 @@ let
     content = lookupTableToString (mergeLookupTables [all_valiases_postfix catchAllPostfix]);
   in builtins.toFile "valias" content;
 
+  regex_valiases_file = let
+    content = lookupTableToString regex_valiases_postfix;
+  in builtins.toFile "regex_valias" content;
+
   # denied_recipients_postfix :: [ String ]
   denied_recipients_postfix = (map
     (acct: "${acct.name} REJECT ${acct.sendOnlyRejectMessage}")
@@ -94,6 +103,7 @@ let
   # every alias is owned (uniquely) by its user.
   # The user's own address is already in all_valiases_postfix.
   vaccounts_file = builtins.toFile "vaccounts" (lookupTableToString all_valiases_postfix);
+  regex_vaccounts_file = builtins.toFile "regex_vaccounts" (lookupTableToString regex_valiases_postfix);
 
   submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" (''
      # Removes sensitive headers from mails handed in via the submission port.
@@ -123,6 +133,7 @@ let
   policyd-spf = pkgs.writeText "policyd-spf.conf" cfg.policydSPFExtraConfig;
 
   mappedFile = name: "hash:/var/lib/postfix/conf/${name}";
+  mappedRegexFile = name: "pcre:/var/lib/postfix/conf/${name}";
 
   submissionOptions =
     {
@@ -133,21 +144,73 @@ let
       smtpd_sasl_security_options = "noanonymous";
       smtpd_sasl_local_domain = "$myhostname";
       smtpd_client_restrictions = "permit_sasl_authenticated,reject";
-      smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
+      smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts${lib.optionalString cfg.ldap.enable ",ldap:${ldapSenderLoginMapFile}"}${lib.optionalString (regex_valiases_postfix != {}) ",pcre:/etc/postfix/regex_vaccounts"}";
       smtpd_sender_restrictions = "reject_sender_login_mismatch";
       smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
       cleanup_service_name = "submission-header-cleanup";
     };
+
+  commonLdapConfig = ''
+    server_host = ${lib.concatStringsSep " " cfg.ldap.uris}
+    start_tls = ${if cfg.ldap.startTls then "yes" else "no"}
+    version = 3
+    tls_ca_cert_file = ${cfg.ldap.tlsCAFile}
+    tls_require_cert = yes
+
+    search_base = ${cfg.ldap.searchBase}
+    scope = ${cfg.ldap.searchScope}
+
+    bind = yes
+    bind_dn = ${cfg.ldap.bind.dn}
+  '';
+
+  ldapSenderLoginMap = pkgs.writeText "ldap-sender-login-map.cf" ''
+    ${commonLdapConfig}
+    query_filter = ${cfg.ldap.postfix.filter}
+    result_attribute = ${cfg.ldap.postfix.mailAttribute}
+  '';
+  ldapSenderLoginMapFile = "/run/postfix/ldap-sender-login-map.cf";
+  appendPwdInSenderLoginMap = appendLdapBindPwd {
+    name = "ldap-sender-login-map";
+    file = ldapSenderLoginMap;
+    prefix = "bind_pw = ";
+    passwordFile = cfg.ldap.bind.passwordFile;
+    destination = ldapSenderLoginMapFile;
+  };
+
+  ldapVirtualMailboxMap = pkgs.writeText "ldap-virtual-mailbox-map.cf" ''
+    ${commonLdapConfig}
+    query_filter = ${cfg.ldap.postfix.filter}
+    result_attribute = ${cfg.ldap.postfix.uidAttribute}
+  '';
+  ldapVirtualMailboxMapFile = "/run/postfix/ldap-virtual-mailbox-map.cf";
+  appendPwdInVirtualMailboxMap = appendLdapBindPwd {
+    name = "ldap-virtual-mailbox-map";
+    file = ldapVirtualMailboxMap;
+    prefix = "bind_pw = ";
+    passwordFile = cfg.ldap.bind.passwordFile;
+    destination = ldapVirtualMailboxMapFile;
+  };
 in
 {
   config = with cfg; lib.mkIf enable {
 
+    systemd.services.postfix-setup = lib.mkIf cfg.ldap.enable {
+      preStart = ''
+        ${appendPwdInVirtualMailboxMap}
+        ${appendPwdInSenderLoginMap}
+      '';
+      restartTriggers = [ appendPwdInVirtualMailboxMap appendPwdInSenderLoginMap ];
+    };
+
     services.postfix = {
       enable = true;
       hostname = "${sendingFqdn}";
       networksStyle = "host";
       mapFiles."valias" = valiases_file;
+      mapFiles."regex_valias" = regex_valiases_file;
       mapFiles."vaccounts" = vaccounts_file;
+      mapFiles."regex_vaccounts" = regex_vaccounts_file;
       mapFiles."denied_recipients" = denied_recipients_file;
       mapFiles."reject_senders" = reject_senders_file;
       mapFiles."reject_recipients" = reject_recipients_file;
@@ -160,7 +223,7 @@ in
       config = {
         # Extra Config
         mydestination = "";
-        recipient_delimiter = "+";
+        recipient_delimiter = cfg.recipientDelimiter;
         smtpd_banner = "${fqdn} ESMTP NO UCE";
         disable_vrfy_command = true;
         message_size_limit = toString cfg.messageSizeLimit;
@@ -170,8 +233,19 @@ in
         virtual_gid_maps = "static:5000";
         virtual_mailbox_base = mailDirectory;
         virtual_mailbox_domains = vhosts_file;
-        virtual_mailbox_maps = mappedFile "valias";
+        virtual_mailbox_maps = [
+          (mappedFile "valias")
+        ] ++ lib.optionals (cfg.ldap.enable) [
+          "ldap:${ldapVirtualMailboxMapFile}"
+        ] ++ lib.optionals (regex_valiases_postfix != {}) [
+          (mappedRegexFile "regex_valias")
+        ];
+        virtual_alias_maps = lib.mkAfter (lib.optionals (regex_valiases_postfix != {}) [
+          (mappedRegexFile "regex_valias")
+        ]);
         virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
+        # Avoid leakage of X-Original-To, X-Delivered-To headers between recipients
+        lmtp_destination_recipient_limit = "1";
 
         # sasl with dovecot
         smtpd_sasl_type = "dovecot";
@@ -200,9 +274,6 @@ in
         # Submission by mail clients is handled in submissionOptions
         smtpd_tls_security_level = "may";
 
-        # strong might suffice and is computationally less expensive
-        smtpd_tls_eecdh_grade = "ultra";
-
         # Disable obselete protocols
         smtpd_tls_protocols = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
         smtp_tls_protocols = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
@@ -235,18 +306,26 @@ in
         milter_protocol = "6";
         milter_mail_macros = "i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer}";
 
+        # Fix for https://www.postfix.org/smtp-smuggling.html
+        smtpd_forbid_bare_newline = cfg.smtpdForbidBareNewline;
+        smtpd_forbid_bare_newline_exclusions = "$mynetworks";
       };
 
       submissionOptions = submissionOptions;
       submissionsOptions = submissionOptions;
 
       masterConfig = {
+        "lmtp" = {
+          # Add headers when delivering, see http://www.postfix.org/smtp.8.html
+          # D => Delivered-To, O => X-Original-To, R => Return-Path
+          args = [ "flags=O" ];
+        };
         "policy-spf" = {
           type = "unix";
           privileged = true;
           chroot = false;
           command = "spawn";
-          args = [ "user=nobody" "argv=${pkgs.pypolicyd-spf}/bin/policyd-spf" "${policyd-spf}"];
+          args = [ "user=nobody" "argv=${pkgs.spf-engine}/bin/policyd-spf" "${policyd-spf}"];
         };
         "submission-header-cleanup" = {
           type = "unix";

mail-server/rspamd.nix

@@ -30,7 +30,7 @@ in
       inherit debug;
       locals = {
           "milter_headers.conf" = { text = ''
-              extended_spam_headers = yes;
+              extended_spam_headers = true;
           ''; };
           "redis.conf" = { text = ''
               servers = "${cfg.redis.address}:${toString cfg.redis.port}";
@@ -56,14 +56,17 @@ in
               # Disable outbound email signing, we use opendkim for this
               enabled = false;
           ''; };
-      };
+          "dmarc.conf" = { text = ''
-
+              ${lib.optionalString cfg.dmarcReporting.enable ''
-      overrides = {
+              reporting {
-        "milter_headers.conf" = {
+                enabled = true;
-          text = ''
+                email = "${cfg.dmarcReporting.email}";
-            extended_spam_headers = true;
+                domain = "${cfg.dmarcReporting.domain}";
-          '';
+                org_name = "${cfg.dmarcReporting.organizationName}";
-        };
+                from_name = "${cfg.dmarcReporting.fromName}";
+                msgid_from = "dmarc-rua";
+              }''}
+          ''; };
       };
 
       workers.rspamd_proxy = {
@@ -98,11 +101,72 @@ in
 
     };
 
-    services.redis.enable = true;
+    services.redis.servers.rspamd = {
+      enable = lib.mkDefault true;
+      port = lib.mkDefault 6380;
+    };
 
     systemd.services.rspamd = {
-      requires = [ "redis.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");
+      requires = [ "redis-rspamd.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");
-      after = [ "redis.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");
+      after = [ "redis-rspamd.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");
+    };
+
+    systemd.services.rspamd-dmarc-reporter = lib.optionalAttrs (cfg.dmarcReporting.enable) {
+      # Explicitly select yesterday's date to work around broken
+      # default behaviour when called without a date.
+      # https://github.com/rspamd/rspamd/issues/4062
+      script = ''
+        ${pkgs.rspamd}/bin/rspamadm dmarc_report $(date -d "yesterday" "+%Y%m%d")
+      '';
+      serviceConfig = {
+        User = "${config.services.rspamd.user}";
+        Group = "${config.services.rspamd.group}";
+
+        AmbientCapabilities = [];
+        CapabilityBoundingSet = "";
+        DevicePolicy = "closed";
+        IPAddressAllow = "localhost";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
+      };
+    };
+
+    systemd.timers.rspamd-dmarc-reporter = lib.optionalAttrs (cfg.dmarcReporting.enable) {
+      description = "Daily delivery of aggregated DMARC reports";
+      wantedBy = [
+        "timers.target"
+      ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+        RandomizedDelaySec = 86400;
+        FixedRandomDelay = true;
+      };
     };
 
     systemd.services.postfix = {

mail-server/systemd.nix

@@ -19,9 +19,9 @@
 let
   cfg = config.mailserver;
   certificatesDeps =
-    if cfg.certificateScheme == 1 then
+    if cfg.certificateScheme == "manual" then
       []
-    else if cfg.certificateScheme == 2 then
+    else if cfg.certificateScheme == "selfsigned" then
       [ "mailserver-selfsigned-certificate.service" ]
     else
       [ "acme-finished-${cfg.fqdn}.target" ];
@@ -29,7 +29,7 @@ in
 {
   config = with cfg; lib.mkIf enable {
     # Create self signed certificate
-    systemd.services.mailserver-selfsigned-certificate = lib.mkIf (cfg.certificateScheme == 2) {
+    systemd.services.mailserver-selfsigned-certificate = lib.mkIf (cfg.certificateScheme == "selfsigned") {
       after = [ "local-fs.target" ];
       script = ''
         # Create certificates if they do not exist yet
@@ -59,13 +59,13 @@ in
       preStart = let
         directories = lib.strings.escapeShellArgs (
           [ mailDirectory ]
-          ++ lib.optional
+          ++ lib.optional (cfg.indexDir != null) cfg.indexDir
-            (cfg.fullTextSearch.enable && (cfg.fullTextSearch.indexDir != null))
-            cfg.fullTextSearch.indexDir
         );
       in ''
         # Create mail directory and set permissions. See
         # <http://wiki2.dovecot.org/SharedMailboxes/Permissions>.
+        # Prevent world-readable paths, even temporarily.
+        umask 007
         mkdir -p ${directories}
         chgrp "${vmailGroupName}" ${directories}
         chmod 02770 ${directories}

mail-server/users.nix

@@ -21,7 +21,7 @@ with config.mailserver;
 let
   vmail_user = {
     name = vmailUserName;
-    isNormalUser = false;
+    isSystemUser = true;
     uid = vmailUID;
     home = mailDirectory;
     createHome = true;
@@ -34,6 +34,9 @@ let
 
     set -euo pipefail
 
+    # Prevent world-readable paths, even temporarily.
+    umask 007
+
     # Create directory to store user sieve scripts if it doesn't exist
     if (! test -d "${sieveDirectory}"); then
       mkdir "${sieveDirectory}"

nix/sources.json

@@ -1,33 +0,0 @@
-{
-    "blobs": {
-        "sha256": "1g687x3b2r4ar5i4xyav5qzpy9fp1phx9wf70f4j3scwny0g7hn1",
-        "type": "tarball",
-        "url": "https://gitlab.com/simple-nixos-mailserver/blobs/-/archive/2cccdf1ca48316f2cfd1c9a0017e8de5a7156265/blobs-2cccdf1ca48316f2cfd1c9a0017e8de5a7156265.tar.gz",
-        "url_template": "https://gitlab.com/simple-nixos-mailserver/blobs/-/archive/<version>/blobs-<version>.tar.gz",
-        "version": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265"
-    },
-    "nixpkgs-20.09": {
-        "branch": "release-20.09",
-        "description": "A read-only mirror of NixOS/nixpkgs tracking the released channels. Send issues and PRs to",
-        "homepage": "https://github.com/NixOS/nixpkgs",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b6eefa48d8e10491e43c0c6155ac12b463f6fed3",
-        "sha256": "0hrp7gshy62bsj719xd6hk6z284pzr8ksw1vvxvyfrffq1f7d8k9",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/b6eefa48d8e10491e43c0c6155ac12b463f6fed3.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nixpkgs-unstable": {
-        "branch": "master",
-        "description": "A read-only mirror of NixOS/nixpkgs tracking the released channels. Send issues and PRs to",
-        "homepage": "https://github.com/NixOS/nixpkgs",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "ee9154c4c1a51a6b1129e8bf8b728ab6432eda3e",
-        "sha256": "1j1laj1b44022k2jmidp0gb8jx1yp4rsjgzcxmxkwlkv7b04bza3",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/ee9154c4c1a51a6b1129e8bf8b728ab6432eda3e.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    }
-}

nix/sources.nix

@@ -1,134 +0,0 @@
-# This file has been generated by Niv.
-
-let
-
-  #
-  # The fetchers. fetch_<type> fetches specs of type <type>.
-  #
-
-  fetch_file = pkgs: spec:
-    if spec.builtin or true then
-      builtins_fetchurl { inherit (spec) url sha256; }
-    else
-      pkgs.fetchurl { inherit (spec) url sha256; };
-
-  fetch_tarball = pkgs: spec:
-    if spec.builtin or true then
-      builtins_fetchTarball { inherit (spec) url sha256; }
-    else
-      pkgs.fetchzip { inherit (spec) url sha256; };
-
-  fetch_git = spec:
-    builtins.fetchGit { url = spec.repo; inherit (spec) rev ref; };
-
-  fetch_builtin-tarball = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-tarball" will soon be deprecated. You should
-          instead use `builtin = true`.
-
-          $ niv modify <package> -a type=tarball -a builtin=true
-      ''
-      builtins_fetchTarball { inherit (spec) url sha256; };
-
-  fetch_builtin-url = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-url" will soon be deprecated. You should
-          instead use `builtin = true`.
-
-          $ niv modify <package> -a type=file -a builtin=true
-      ''
-      (builtins_fetchurl { inherit (spec) url sha256; });
-
-  #
-  # Various helpers
-  #
-
-  # The set of packages used when specs are fetched using non-builtins.
-  mkPkgs = sources:
-    let
-      sourcesNixpkgs =
-        import (builtins_fetchTarball { inherit (sources.nixpkgs) url sha256; }) {};
-      hasNixpkgsPath = builtins.any (x: x.prefix == "nixpkgs") builtins.nixPath;
-      hasThisAsNixpkgsPath = <nixpkgs> == ./.;
-    in
-      if builtins.hasAttr "nixpkgs" sources
-      then sourcesNixpkgs
-      else if hasNixpkgsPath && ! hasThisAsNixpkgsPath then
-        import <nixpkgs> {}
-      else
-        abort
-          ''
-            Please specify either <nixpkgs> (through -I or NIX_PATH=nixpkgs=...) or
-            add a package called "nixpkgs" to your sources.json.
-          '';
-
-  # The actual fetching function.
-  fetch = pkgs: name: spec:
-
-    if ! builtins.hasAttr "type" spec then
-      abort "ERROR: niv spec ${name} does not have a 'type' attribute"
-    else if spec.type == "file" then fetch_file pkgs spec
-    else if spec.type == "tarball" then fetch_tarball pkgs spec
-    else if spec.type == "git" then fetch_git spec
-    else if spec.type == "builtin-tarball" then fetch_builtin-tarball spec
-    else if spec.type == "builtin-url" then fetch_builtin-url spec
-    else
-      abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
-
-  # Ports of functions for older nix versions
-
-  # a Nix version of mapAttrs if the built-in doesn't exist
-  mapAttrs = builtins.mapAttrs or (
-    f: set: with builtins;
-    listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
-  );
-
-  # fetchTarball version that is compatible between all the versions of Nix
-  builtins_fetchTarball = { url, sha256 }@attrs:
-    let
-      inherit (builtins) lessThan nixVersion fetchTarball;
-    in
-      if lessThan nixVersion "1.12" then
-        fetchTarball { inherit url; }
-      else
-        fetchTarball attrs;
-
-  # fetchurl version that is compatible between all the versions of Nix
-  builtins_fetchurl = { url, sha256 }@attrs:
-    let
-      inherit (builtins) lessThan nixVersion fetchurl;
-    in
-      if lessThan nixVersion "1.12" then
-        fetchurl { inherit url; }
-      else
-        fetchurl attrs;
-
-  # Create the final "sources" from the config
-  mkSources = config:
-    mapAttrs (
-      name: spec:
-        if builtins.hasAttr "outPath" spec
-        then abort
-          "The values in sources.json should not have an 'outPath' attribute"
-        else
-          spec // { outPath = fetch config.pkgs name spec; }
-    ) config.sources;
-
-  # The "config" used by the fetchers
-  mkConfig =
-    { sourcesFile ? ./sources.json
-    , sources ? builtins.fromJSON (builtins.readFile sourcesFile)
-    , pkgs ? mkPkgs sources
-    }: rec {
-      # The sources, i.e. the attribute set of spec name to spec
-      inherit sources;
-
-      # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
-      inherit pkgs;
-    };
-in
-mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); }

scripts/generate-options.py

@@ -0,0 +1,82 @@
+import json
+import sys
+
+header = """
+# Mailserver options
+
+## `mailserver`
+
+"""
+
+template = """
+`````{{option}} {key}
+{description}
+
+{type}
+{default}
+{example}
+`````
+"""
+
+f = open(sys.argv[1])
+options = json.load(f)
+
+groups = ["mailserver.loginAccounts",
+          "mailserver.certificate",
+          "mailserver.dkim",
+          "mailserver.dmarcReporting",
+          "mailserver.fullTextSearch",
+          "mailserver.redis",
+          "mailserver.ldap",
+          "mailserver.monitoring",
+          "mailserver.backup",
+          "mailserver.borgbackup"]
+
+def render_option_value(opt, attr):
+  if attr in opt:
+      if isinstance(opt[attr], dict) and '_type' in opt[attr]:
+          if opt[attr]['_type'] == 'literalExpression':
+              if '\n' in opt[attr]['text']:
+                  res = '\n```nix\n' + opt[attr]['text'].rstrip('\n') + '\n```'
+              else:
+                  res = '```{}```'.format(opt[attr]['text'])
+          elif opt[attr]['_type'] == 'literalMD':
+              res = opt[attr]['text']
+      else:
+          s = str(opt[attr])
+          if s == "":
+              res = '`""`'
+          elif '\n' in s:
+              res = '\n```\n' + s.rstrip('\n') + '\n```'
+          else:
+              res = '```{}```'.format(s)
+      res = '- ' + attr + ': ' + res
+  else:
+      res = ""
+  return res
+
+def print_option(opt):
+    if isinstance(opt['description'], dict) and '_type' in opt['description']: # mdDoc
+        description = opt['description']['text']
+    else:
+        description = opt['description']
+    print(template.format(
+        key=opt['name'],
+        description=description or "",
+        type="- type: ```{}```".format(opt['type']),
+        default=render_option_value(opt, 'default'),
+        example=render_option_value(opt, 'example')))
+
+
+print(header)
+for opt in options:
+    if any([opt['name'].startswith(c) for c in groups]):
+        continue
+    print_option(opt)
+
+for c in groups:
+    print('## `{}`'.format(c))
+    print()
+    for opt in options:
+        if opt['name'].startswith(c):
+            print_option(opt)

scripts/mail-check.py

@@ -9,7 +9,7 @@ import time
 
 RETRY = 100
 
-def _send_mail(smtp_host, smtp_port, from_addr, from_pwd, to_addr, subject, starttls):
+def _send_mail(smtp_host, smtp_port, smtp_username, from_addr, from_pwd, to_addr, subject, starttls):
     print("Sending mail with subject '{}'".format(subject))
     message = "\n".join([
         "From: {from_addr}",
@@ -30,7 +30,7 @@ def _send_mail(smtp_host, smtp_port, from_addr, from_pwd, to_addr, subject, star
                     if starttls:
                         smtp.starttls()
                     if from_pwd is not None:
-                        smtp.login(from_addr, from_pwd)
+                        smtp.login(smtp_username or from_addr, from_pwd)
 
                     smtp.sendmail(from_addr, [to_addr], message)
                     return
@@ -141,6 +141,7 @@ def send_and_read(args):
 
     _send_mail(smtp_host=args.smtp_host,
                smtp_port=args.smtp_port,
+               smtp_username=args.smtp_username,
                from_addr=args.from_addr,
                from_pwd=src_pwd,
                to_addr=args.to_addr,
@@ -171,6 +172,7 @@ parser_send_and_read = subparsers.add_parser('send-and-read', description="Send
 parser_send_and_read.add_argument('--smtp-host', type=str)
 parser_send_and_read.add_argument('--smtp-port', type=str, default=25)
 parser_send_and_read.add_argument('--smtp-starttls', action='store_true')
+parser_send_and_read.add_argument('--smtp-username', type=str, default='', help="username used for smtp login. If not specified, the from-addr value is used")
 parser_send_and_read.add_argument('--from-addr', type=str)
 parser_send_and_read.add_argument('--imap-host', required=True, type=str)
 parser_send_and_read.add_argument('--imap-port', type=str, default=993)

shell.nix

@@ -1 +1,10 @@
-(import (builtins.fetchGit "https://github.com/edolstra/flake-compat") { src = ./.; }).shellNix
+(import
+  (
+    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  { src = ./.; }
+).shellNix

tests/clamav.nix

@@ -14,19 +14,12 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ pkgs ? import <nixpkgs> {}}:
+{ pkgs ? import <nixpkgs> {}, blobs}:
 
 pkgs.nixosTest {
   name = "clamav";
   nodes = {
     server = { config, pkgs, lib, ... }:
-      let
-        sources = import ../nix/sources.nix;
-        blobs = pkgs.fetchzip {
-          url = sources.blobs.url;
-          sha256 = sources.blobs.sha256;
-        };
-      in
         {
             imports = [
                 ../default.nix
@@ -196,10 +189,10 @@ pkgs.nixosTest {
 
       # TODO put this blocking into the systemd units? I am not sure if rspamd already waits for the clamd socket.
       server.wait_until_succeeds(
-          "timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+          "set +e; timeout 1 ${nodes.server.nixpkgs.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
       )
       server.wait_until_succeeds(
-          "timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ $? -eq 124 ]"
+          "set +e; timeout 1 ${nodes.server.nixpkgs.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ $? -eq 124 ]"
       )
 
       client.execute("cp -p /etc/root/.* ~/")
@@ -224,12 +217,12 @@ pkgs.nixosTest {
 
       with subtest("virus scan file"):
           server.succeed(
-              'clamdscan $(readlink -f /etc/root/eicar.com.txt) | grep "Txt\\.Malware\\.Agent-1787597 FOUND" >&2'
+              'set +o pipefail; clamdscan $(readlink -f /etc/root/eicar.com.txt) | grep "Txt\\.Malware\\.Agent-1787597 FOUND" >&2'
           )
 
       with subtest("virus scan email"):
           client.succeed(
-              'msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | tee /dev/stderr | grep "server message: 554 5\\.7\\.1" >&2'
+              'set +o pipefail; msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | tee /dev/stderr | grep "server message: 554 5\\.7\\.1" >&2'
           )
           server.succeed("journalctl -u rspamd | grep -i eicar")
           # give the mail server some time to process the mail

tests/default.nix

@@ -1,47 +0,0 @@
-# Generate an attribute sets containing all tests for all releaeses
-# It looks like:
-# - extern.nixpkgs_20.03
-# - extern.nixpkgs_unstable
-# - intern.nixpkgs_20.03
-# - intern.nixpkgs_unstable
-
-with builtins;
-
-let
-  sources = import ../nix/sources.nix;
-
-  releases = listToAttrs (map genRelease releaseNames);
-
-  genRelease = name: {
-    name = name;
-    value = import sources."${name}" {};
-  };
-
-  genTest = testName: release:
-  let
-    pkgs = releases."${release}";
-    test = pkgs.callPackage (./. + "/${testName}.nix") { };
-  in {
-    "name"= builtins.replaceStrings ["." "-"] ["_" "_"] release;
-    "value"= test;
-  };
-
-  releaseNames = [
-    "nixpkgs-unstable"
-    "nixpkgs-20.09"
-  ];
-
-  testNames = [
-    "intern"
-    "extern"
-    "clamav"
-    "multiple"
-  ];
-
-  # Generate an attribute set containing one test per releases
-  genTests = testName: {
-    name = testName;
-    value = listToAttrs (map (genTest testName) (builtins.attrNames releases));
-  };
-  
-in listToAttrs (map genTests testNames)

tests/external.nix

@@ -14,10 +14,10 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ pkgs ? import <nixpkgs> {}}:
+{ pkgs ? import <nixpkgs> {}, ...}:
 
 pkgs.nixosTest {
-  name = "extern";
+  name = "external";
   nodes = {
     server = { config, pkgs, ... }:
         {
@@ -43,6 +43,11 @@ pkgs.nixosTest {
               domains = [ "example.com" "example2.com" ];
               rewriteMessageId = true;
               dkimKeyBits = 1535;
+              dmarcReporting = {
+                enable = true;
+                domain = "example.com";
+                organizationName = "ACME Corp";
+              };
 
               loginAccounts = {
                   "user1@example.com" = {
@@ -76,6 +81,8 @@ pkgs.nixosTest {
                 # special use depends on https://github.com/NixOS/nixpkgs/pull/93201
                 autoIndexExclude = [ (if (pkgs.lib.versionAtLeast pkgs.lib.version "21") then "\\Junk" else "Junk") ];
                 enforced = "yes";
+                # fts-xapian warns when memory is low, which makes the test fail
+                memoryLimit = 100000;
               };
             };
         };
@@ -343,7 +350,7 @@ pkgs.nixosTest {
 
       # TODO put this blocking into the systemd units?
       server.wait_until_succeeds(
-          "timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+          "set +e; timeout 1 ${nodes.server.nixpkgs.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
       )
 
       client.execute("cp -p /etc/root/.* ~/")
@@ -487,12 +494,13 @@ pkgs.nixosTest {
           client.fail("search Junk a >&2")
           # check that search really goes through the indexer
           server.succeed(
-              "journalctl -u dovecot2 | grep -E 'indexer-worker.*Indexed . messages in INBOX' >&2"
+              "journalctl -u dovecot2 | grep -E 'indexer-worker.* Done indexing .INBOX.' >&2"
           )
           # check that Junk is not indexed
-          server.fail(
+          server.fail("journalctl -u dovecot2 | grep 'indexer-worker' | grep -i 'JUNK' >&2")
-              "journalctl -u dovecot2 | grep -E 'indexer-worker.*Indexed . messages in Junk' >&2"
+
-          )
+      with subtest("dmarc reporting"):
+          server.systemctl("start rspamd-dmarc-reporter.service")
 
       with subtest("no warnings or errors"):
           server.fail("journalctl -u postfix | grep -i error >&2")
@@ -500,7 +508,7 @@ pkgs.nixosTest {
           server.fail("journalctl -u dovecot2 | grep -i error >&2")
           # harmless ? https://dovecot.org/pipermail/dovecot/2020-August/119575.html
           server.fail(
-              "journalctl -u dovecot2 |grep -v 'Expunged message reappeared, giving a new UID'| grep -i warning >&2"
+              "journalctl -u dovecot2 |grep -v 'Expunged message reappeared, giving a new UID'| grep -v 'FTS Xapian: Box is empty' | grep -i warning >&2"
           )
     '';
 }

tests/internal.nix

@@ -14,7 +14,7 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ pkgs ? import <nixpkgs> {}}:
+{ pkgs ? import <nixpkgs> {}, ...}:
 
 let
   sendMail = pkgs.writeTextFile {
@@ -29,15 +29,15 @@ let
 
   hashPassword = password: pkgs.runCommand
     "password-${password}-hashed"
-    { buildInputs = [ pkgs.apacheHttpd ]; } ''
+    { buildInputs = [ pkgs.mkpasswd ]; inherit password; } ''
-      htpasswd -nbB "" "${password}" | cut -d: -f2 > $out
+      mkpasswd -sm bcrypt <<<"$password" > $out
     '';
 
   hashedPasswordFile = hashPassword "my-password";
   passwordFile = pkgs.writeText "password" "my-password";
 in
 pkgs.nixosTest {
-  name = "intern";
+  name = "internal";
   nodes = {
     machine = { config, pkgs, ... }: {
       imports = [
@@ -55,7 +55,7 @@ pkgs.nixosTest {
       mailserver = {
         enable = true;
         fqdn = "mail.example.com";
-        domains = [ "example.com" ];
+        domains = [ "example.com" "domain.com" ];
         localDnsResolver = false;
 
         loginAccounts = {
@@ -64,6 +64,7 @@ pkgs.nixosTest {
           };
           "user2@example.com" = {
             hashedPasswordFile = hashedPasswordFile;
+            aliasesRegexp = [''/^user2.*@domain\.com$/''];
           };
           "send-only@example.com" = {
             hashedPasswordFile = hashPassword "send-only";
@@ -126,6 +127,46 @@ pkgs.nixosTest {
             )
         )
 
+    with subtest("regex email alias are received"):
+        # A mail sent to user2-regex-alias@domain.com is in the user2@example.com mailbox
+        machine.succeed(
+            " ".join(
+                [
+                    "mail-check send-and-read",
+                    "--smtp-port 587",
+                    "--smtp-starttls",
+                    "--smtp-host localhost",
+                    "--imap-host localhost",
+                    "--imap-username user2@example.com",
+                    "--from-addr user1@example.com",
+                    "--to-addr user2-regex-alias@domain.com",
+                    "--src-password-file ${passwordFile}",
+                    "--dst-password-file ${passwordFile}",
+                    "--ignore-dkim-spf",
+                ]
+            )
+        )
+
+    with subtest("user can send from regex email alias"):
+        # A mail sent from user2-regex-alias@domain.com, using user2@example.com credentials is received
+        machine.succeed(
+            " ".join(
+                [
+                    "mail-check send-and-read",
+                    "--smtp-port 587",
+                    "--smtp-starttls",
+                    "--smtp-host localhost",
+                    "--imap-host localhost",
+                    "--smtp-username user2@example.com",
+                    "--from-addr user2-regex-alias@domain.com",
+                    "--to-addr user1@example.com",
+                    "--src-password-file ${passwordFile}",
+                    "--dst-password-file ${passwordFile}",
+                    "--ignore-dkim-spf",
+                ]
+            )
+        )
+
     with subtest("vmail gid is set correctly"):
         machine.succeed("getent group vmail | grep 5000")
 
@@ -133,15 +174,15 @@ pkgs.nixosTest {
         machine.wait_for_open_port(25)
         # TODO put this blocking into the systemd units
         machine.wait_until_succeeds(
-            "timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+            "set +e; timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
         )
         machine.succeed(
-            "cat ${sendMail} | ${pkgs.netcat-gnu}/bin/nc localhost 25 | grep -q 'This account cannot receive emails'"
+            "cat ${sendMail} | ${pkgs.netcat-gnu}/bin/nc localhost 25 | grep -q '554 5.5.0 Error'"
         )
 
     with subtest("rspamd controller serves web ui"):
         machine.succeed(
-            "${pkgs.curl}/bin/curl --unix-socket /run/rspamd/worker-controller.sock http://localhost/ | grep -q '<body>'"
+            "set +o pipefail; ${pkgs.curl}/bin/curl --unix-socket /run/rspamd/worker-controller.sock http://localhost/ | grep -q '<body>'"
         )
 
     with subtest("imap port 143 is closed and imaps is serving SSL"):

tests/ldap.nix

@@ -0,0 +1,183 @@
+{ pkgs ? import <nixpkgs> {}
+, ...
+}:
+
+let
+  bindPassword = "unsafegibberish";
+  alicePassword = "testalice";
+  bobPassword = "testbob";
+in
+pkgs.nixosTest {
+  name = "ldap";
+  nodes = {
+    machine = { config, pkgs, ... }: {
+      imports = [
+        ./../default.nix
+        ./lib/config.nix
+      ];
+
+      virtualisation.memorySize = 1024;
+
+      services.openssh = {
+        enable = true;
+        permitRootLogin = "yes";
+      };
+
+      environment.systemPackages = [
+        (pkgs.writeScriptBin "mail-check" ''
+          ${pkgs.python3}/bin/python ${../scripts/mail-check.py} $@
+        '')];
+
+      environment.etc.bind-password.text = bindPassword;
+
+      services.openldap = {
+        enable = true;
+        settings = {
+          children = {
+            "cn=schema".includes = [
+              "${pkgs.openldap}/etc/schema/core.ldif"
+              "${pkgs.openldap}/etc/schema/cosine.ldif"
+              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+              "${pkgs.openldap}/etc/schema/nis.ldif"
+            ];
+            "olcDatabase={1}mdb" = {
+              attrs = {
+                objectClass = [
+                  "olcDatabaseConfig"
+                  "olcMdbConfig"
+                ];
+                olcDatabase = "{1}mdb";
+                olcDbDirectory = "/var/lib/openldap/example";
+                olcSuffix = "dc=example";
+              };
+            };
+          };
+        };
+        declarativeContents."dc=example" = ''
+          dn: dc=example
+          objectClass: domain
+          dc: example
+
+          dn: cn=mail,dc=example
+          objectClass: organizationalRole
+          objectClass: simpleSecurityObject
+          objectClass: top
+          cn: mail
+          userPassword: ${bindPassword}
+
+          dn: ou=users,dc=example
+          objectClass: organizationalUnit
+          ou: users
+
+          dn: cn=alice,ou=users,dc=example
+          objectClass: inetOrgPerson
+          cn: alice
+          sn: Foo
+          mail: alice@example.com
+          userPassword: ${alicePassword}
+
+          dn: cn=bob,ou=users,dc=example
+          objectClass: inetOrgPerson
+          cn: bob
+          sn: Bar
+          mail: bob@example.com
+          userPassword: ${bobPassword}
+        '';
+      };
+
+      mailserver = {
+        enable = true;
+        fqdn = "mail.example.com";
+        domains = [ "example.com" ];
+        localDnsResolver = false;
+
+        ldap = {
+          enable = true;
+          uris = [
+            "ldap://"
+          ];
+          bind = {
+            dn = "cn=mail,dc=example";
+            passwordFile = "/etc/bind-password";
+          };
+          searchBase = "ou=users,dc=example";
+          searchScope = "sub";
+        };
+
+        vmailGroupName = "vmail";
+        vmailUID = 5000;
+
+        enableImap = false;
+      };
+    };
+  };
+  testScript = ''
+    import sys
+    import re
+
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    # This function retrieves the ldap table file from a postconf
+    # command.
+    # A key lookup is achived and the returned value is compared
+    # to the expected value.
+    def test_lookup(postconf_cmdline, key, expected):
+      conf = machine.succeed(postconf_cmdline).rstrip()
+      ldap_table_path = re.match('.* =.*ldap:(.*)', conf).group(1)
+      value = machine.succeed(f"postmap -q {key} ldap:{ldap_table_path}").rstrip()
+      try:
+        assert value == expected
+      except AssertionError:
+        print(f"Expected {conf} lookup for key '{key}' to return '{expected}, but got '{value}'", file=sys.stderr)
+        raise
+
+    with subtest("Test postmap lookups"):
+      test_lookup("postconf virtual_mailbox_maps", "alice@example.com", "alice@example.com")
+      test_lookup("postconf -P submission/inet/smtpd_sender_login_maps", "alice@example.com", "alice@example.com")
+
+      test_lookup("postconf virtual_mailbox_maps", "bob@example.com", "bob@example.com")
+      test_lookup("postconf -P submission/inet/smtpd_sender_login_maps", "bob@example.com", "bob@example.com")
+
+    with subtest("Test doveadm lookups"):
+      machine.succeed("doveadm user -u alice@example.com")
+      machine.succeed("doveadm user -u bob@example.com")
+
+    with subtest("Files containing secrets are only readable by root"):
+      machine.succeed("ls -l /run/postfix/*.cf | grep -e '-rw------- 1 root root'")
+      machine.succeed("ls -l /run/dovecot2/dovecot-ldap.conf.ext | grep -e '-rw------- 1 root root'")
+
+    with subtest("Test account/mail address binding"):
+      machine.fail(" ".join([
+        "mail-check send-and-read",
+        "--smtp-port 587",
+        "--smtp-starttls",
+        "--smtp-host localhost",
+        "--smtp-username alice@example.com",
+        "--imap-host localhost",
+        "--imap-username bob@example.com",
+        "--from-addr bob@example.com",
+        "--to-addr aliceb@example.com",
+        "--src-password-file <(echo '${alicePassword}')",
+        "--dst-password-file <(echo '${bobPassword}')",
+        "--ignore-dkim-spf"
+      ]))
+      machine.succeed("journalctl -u postfix | grep -q 'Sender address rejected: not owned by user alice@example.com'")
+
+    with subtest("Test mail delivery"):
+      machine.succeed(" ".join([
+        "mail-check send-and-read",
+        "--smtp-port 587",
+        "--smtp-starttls",
+        "--smtp-host localhost",
+        "--smtp-username alice@example.com",
+        "--imap-host localhost",
+        "--imap-username bob@example.com",
+        "--from-addr alice@example.com",
+        "--to-addr bob@example.com",
+        "--src-password-file <(echo '${alicePassword}')",
+        "--dst-password-file <(echo '${bobPassword}')",
+        "--ignore-dkim-spf"
+      ]))
+  '';
+}

tests/minimal.nix

@@ -14,9 +14,9 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-import <nixpkgs/nixos/tests/make-test.nix> {
+import <nixpkgs/nixos/tests/make-test-python.nix> {
 
-  machine =
+  nodes.machine =
     { config, pkgs, ... }:
     {
         imports = [
@@ -26,6 +26,6 @@ import <nixpkgs/nixos/tests/make-test.nix> {
 
   testScript =
     ''
-      $machine->waitForUnit("multi-user.target");
+      machine.wait_for_unit("multi-user.target");
     '';
 }

tests/multiple.nix

@@ -1,13 +1,13 @@
 # This tests is used to test features requiring several mail domains.
 
-{ pkgs ? import <nixpkgs> {}}:
+{ pkgs ? import <nixpkgs> {}, ...}:
 
 let
     hashPassword = password: pkgs.runCommand
       "password-${password}-hashed"
-      { buildInputs = [ pkgs.apacheHttpd ]; }
+      { buildInputs = [ pkgs.mkpasswd ]; inherit password; }
       ''
-        htpasswd -nbB "" "${password}" | cut -d: -f2 > $out
+        mkpasswd -sm bcrypt <<<"$password" > $out
       '';
 
     password = pkgs.writeText "password" "password";
@@ -30,6 +30,8 @@ let
       };
       services.dnsmasq = {
         enable = true;
+        # Fixme: once nixos-22.11 has been removed, could be replaced by
+        # settings.mx-host = [ "domain1.com,domain1,10" "domain2.com,domain2,10" ];
         extraConfig = ''
           mx-host=domain1.com,domain1,10
           mx-host=domain2.com,domain2,10
@@ -68,10 +70,10 @@ pkgs.nixosTest {
 
     # TODO put this blocking into the systemd units?
     domain1.wait_until_succeeds(
-        "timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+        "set +e; timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
     )
     domain2.wait_until_succeeds(
-        "timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+        "set +e; timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
     )
 
     # user@domain1.com sends a mail to user@domain2.com