Configurable sieve script directory

(cherry picked from commit c00fc587f5)

.forgejo/workflows/build.yaml

@@ -1,17 +0,0 @@
-name: Build
-
-on:
-  push:
-    branches:
-      - 'master'
-
-jobs:
-  # deploy it upstream
-  deploy:
-    runs-on: docker
-    steps:
-      - name: "Deploy to Skynet"
-        uses: https://forgejo.skynet.ie/Skynet/actions-deploy-to-skynet@v2
-        with:
-          input: 'simple-nixos-mailserver'
-          token: ${{ secrets.API_TOKEN_FORGEJO }}

.gitlab-ci.yml

@@ -3,11 +3,11 @@ hydra-pr:
     - merge_requests
   image: nixos/nix
   script:
-    - nix-shell -I nixpkgs=channel:nixos-22.05 -p hydra-cli --run 'hydra-cli -H https://hydra.nix-community.org jobset-wait simple-nixos-mailserver ${CI_MERGE_REQUEST_IID}'
+    - nix run -f channel:nixos-unstable hydra-cli -c hydra-cli -H https://hydra.nix-community.org jobset-wait simple-nixos-mailserver ${CI_MERGE_REQUEST_IID} || (echo Go to https://hydra.nix-community.org/jobset/simple-nixos-mailserver/${CI_MERGE_REQUEST_IID}/latest-eval for details; exit 1)
 
 hydra-master:
   only:
     - master
   image: nixos/nix
   script:
-    - nix-shell -I nixpkgs=channel:nixos-22.05 -p hydra-cli --run 'hydra-cli -H https://hydra.nix-community.org jobset-wait simple-nixos-mailserver master'
+    - nix run -f channel:nixos-unstable hydra-cli -c hydra-cli -H https://hydra.nix-community.org jobset-wait simple-nixos-mailserver master || (echo Go to https://hydra.nix-community.org/jobset/simple-nixos-mailserver/master/latest-eval for details; exit 1)

.hydra/declarative-jobsets.nix

@@ -1,4 +1,4 @@
-{ nixpkgs, pulls, ... }:
+{ nixpkgs, declInput, pulls }:
 
 let
   pkgs = import nixpkgs {};
@@ -8,37 +8,85 @@ let
     { enabled = 1;
       hidden = false;
       description = "PR ${num}: ${info.title}";
+      nixexprinput = "snm";
+      nixexprpath = ".hydra/default.nix";
       checkinterval = 30;
       schedulingshares = 20;
       enableemail = false;
       emailoverride = "";
       keepnr = 1;
-      type = 1;
+      type = 0;
-      flake = "gitlab:simple-nixos-mailserver/nixos-mailserver/merge-requests/${info.iid}/head";
+      inputs = {
+        snm = {
+          type = "git";
+          value = "${info.target_repo_url} merge-requests/${info.iid}/head";
+          emailresponsible = false;
+        };
+      };
     }
   ) prs;
-  mkFlakeJobset = branch: {
-    description = "Build ${branch} branch of Simple NixOS MailServer";
-    checkinterval = "60";
-    enabled = "1";
-    schedulingshares = 100;
-    enableemail = false;
-    emailoverride = "";
-    keepnr = 3;
-    hidden = false;
-    type = 1;
-    flake = "gitlab:simple-nixos-mailserver/nixos-mailserver/${branch}";
-  };
 
   desc = prJobsets // {
-    "master" = mkFlakeJobset "master";
+    master = {
-    "nixos-23.11" = mkFlakeJobset "nixos-23.11";
+      description = "Build master branch of Simple NixOS MailServer";
-    "nixos-24.05" = mkFlakeJobset "nixos-24.05";
+      checkinterval = "60";
-  };
+      enabled = "1";
-
+      nixexprinput = "snm";
-  log = {
+      nixexprpath = ".hydra/default.nix";
-    pulls = prs;
+      schedulingshares = 100;
-    jobsets = desc;
+      enableemail = false;
+      emailoverride = "";
+      keepnr = 3;
+      hidden = false;
+      type = 0;
+      inputs = {
+        snm = {
+          value = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver master";
+          type = "git";
+          emailresponsible = false;
+        };
+      };
+    };
+    "nixos-20.03" = {
+      description = "Build the nixos-20.03 branch of Simple NixOS MailServer";
+      checkinterval = "60";
+      enabled = "1";
+      nixexprinput = "snm";
+      nixexprpath = ".hydra/default.nix";
+      schedulingshares = 100;
+      enableemail = false;
+      emailoverride = "";
+      keepnr = 3;
+      hidden = false;
+      type = 0;
+      inputs = {
+        snm = {
+          value = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver nixos-20.03";
+          type = "git";
+          emailresponsible = false;
+        };
+      };
+    };
+    "nixos-19.09" = {
+      description = "Build the nixos-19.09 branch of Simple NixOS MailServer";
+      checkinterval = "60";
+      enabled = "1";
+      nixexprinput = "snm";
+      nixexprpath = ".hydra/default.nix";
+      schedulingshares = 100;
+      enableemail = false;
+      emailoverride = "";
+      keepnr = 3;
+      hidden = false;
+      type = 0;
+      inputs = {
+        snm = {
+          value = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver nixos-19.09";
+          type = "git";
+          emailresponsible = false;
+        };
+      };
+    };
   };
 
 in {
@@ -46,10 +94,5 @@ in {
     cat >$out <<EOF
     ${builtins.toJSON desc}
     EOF
-    # This is to get nice .jobsets build logs on Hydra
-    cat >tmp <<EOF
-    ${builtins.toJSON log}
-    EOF
-    ${pkgs.jq}/bin/jq . tmp
   '';
 }

.readthedocs.yaml

@@ -1,29 +0,0 @@
-# Read the Docs configuration file
-# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
-
-# Required
-version: 2
-
-build:
-  os: ubuntu-22.04
-  tools:
-    python: "3"
-  apt_packages:
-    - nix
-    - proot
-  jobs:
-    pre_install:
-      - mkdir -p ~/.nix ~/.config/nix
-      - echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
-      - proot -b ~/.nix:/nix /bin/sh -c "nix build -L .#optionsDoc && cp -v result docs/options.md"
-
-sphinx:
-   configuration: docs/conf.py
-
-formats:
-  - pdf
-  - epub
-
-python:
-   install:
-   - requirements: docs/requirements.txt

README.md

@@ -8,21 +8,27 @@
 For each NixOS release, we publish a branch. You then have to use the
 SNM branch corresponding to your NixOS version.
 
-* For NixOS 24.05
+* For NixOS 20.09
-   - Use the [SNM branch `nixos-24.05`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/nixos-24.05)
+   - Use the [SNM branch `nixos-20.09`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/nixos-20.09)
-   - [Documentation](https://nixos-mailserver.readthedocs.io/en/nixos-24.05/)
+   - [Documentation](https://nixos-mailserver.readthedocs.io/en/nixos-20.09/)
-   - [Release notes](https://nixos-mailserver.readthedocs.io/en/nixos-24.05/release-notes.html#nixos-24-05)
+   - [Release notes](https://nixos-mailserver.readthedocs.io/en/nixos-20.09/release-notes.html#nixos-20-09)
-* For NixOS 23.11
+* For NixOS 20.03
-   - Use the [SNM branch `nixos-23.11`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/nixos-23.11)
+   - Use the [SNM branch `nixos-20.03`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/nixos-20.03)
-   - [Documentation](https://nixos-mailserver.readthedocs.io/en/nixos-23.11/)
+   - [Release notes](#nixos-2003)
-   - [Release notes](https://nixos-mailserver.readthedocs.io/en/nixos-23.11/release-notes.html#nixos-23-11)
 * For NixOS unstable
    - Use the [SNM branch `master`](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/tree/master)
-   - [Documentation](https://nixos-mailserver.readthedocs.io/en/latest/)
+   - This branch is currently supporting the NixOS release 20.09 but
+     we could remove this support on any NixOS unstable breaking
+     change.
 
 [Subscribe to SNM Announcement List](https://www.freelists.org/list/snm)
 This is a very low volume list where new releases of SNM are announced, so you
-can stay up to date with bug fixes and updates.
+can stay up to date with bug fixes and updates. All announcements are signed by
+the gpg key with fingerprint
+
+```
+D9FE 4119 F082 6F15 93BD  BD36 6162 DBA5 635E A16A
+```
 
 
 ## Features
@@ -66,20 +72,75 @@ can stay up to date with bug fixes and updates.
   * DKIM Signing
     - [ ] Allow a per domain selector
 
-### Get in touch
+### Changelog and How to Stay Up-to-Date
+
+See the [mailing list archive](https://www.freelists.org/archive/snm/)
+
+### Quick Start
+
+```nix
+   { config, pkgs, ... }:
+   let release = "nixos-20.09";
+   in {
+     imports = [
+       (builtins.fetchTarball {
+         url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz";
+         # This hash needs to be updated
+         sha256 = "0000000000000000000000000000000000000000000000000000";
+       })
+     ];
+
+     mailserver = {
+       enable = true;
+       fqdn = "mail.example.com";
+       domains = [ "example.com" "example2.com" ];
+       loginAccounts = {
+           "user1@example.com" = {
+               # mkpasswd -m sha-512 "super secret password" > /hashed/password/file/location
+               hashedPasswordFile = "/hashed/password/file/location";
+
+               aliases = [
+                   "info@example.com"
+                   "postmaster@example.com"
+                   "postmaster@example2.com"
+               ];
+           };
+       };
+     };
+   }
+```
+
+For a complete list of options, see `default.nix`.
+
 
-- Subscribe to the [mailing list](https://www.freelists.org/archive/snm/)
-- Join the Libera Chat IRC channel `#nixos-mailserver`
 
 ## How to Set Up a 10/10 Mail Server Guide
+Check out the [Complete Setup Guide](https://nixos-mailserver.readthedocs.io/en/latest/setup-guide.html) in the project's documentation.
 
-Check out the [Setup Guide](https://nixos-mailserver.readthedocs.io/en/latest/setup-guide.html) in the project's documentation.
+## How to Backup
 
-For a complete list of options, [see in readthedocs](https://nixos-mailserver.readthedocs.io/en/latest/options.html).
+Checkout the [Complete Backup Guide](https://nixos-mailserver.readthedocs.io/en/latest/backup-guide.html). Backups are easy with `SNM`.
 
 ## Development
 
-See the [How to Develop SNM](https://nixos-mailserver.readthedocs.io/en/latest/howto-develop.html) documentation page.
+See the [How to Develop SNM](https://nixos-mailserver.readthedocs.io/en/latest/howto-develop.html) wiki page.
+
+## Release notes
+
+### nixos-20.03
+
+- Rspamd is upgraded to 2.0 which deprecates the SQLite Bayes
+  backend. We then moved to the Redis backend (the default since
+  Rspamd 2.0). If you don't want to relearn the Redis backend from the
+  scratch, we could manually run
+
+      rspamadm statconvert --spam-db /var/lib/rspamd/bayes.spam.sqlite --ham-db /var/lib/rspamd/bayes.ham.sqlite -h 127.0.0.1:6379 --symbol-ham BAYES_HAM --symbol-spam BAYES_SPAM
+
+  See the [Rspamd migration
+  notes](https://rspamd.com/doc/migration.html#migration-to-rspamd-20)
+  and [this SNM Merge
+  Request](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/164)
+  for details.
 
 ## Contributors
 See the [contributor tab](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/graphs/master)
@@ -94,4 +155,6 @@ See the [contributor tab](https://gitlab.com/simple-nixos-mailserver/nixos-mails
  * Logo made with [Logomakr.com](https://logomakr.com)
 
 
-[logo]: docs/logo.png
+
+
+[logo]: logo/logo.png

default.nix

@@ -25,12 +25,6 @@ in
   options.mailserver = {
     enable = mkEnableOption "nixos-mailserver";
 
-    openFirewall = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Automatically open ports in the firewall.";
-    };
-
     fqdn = mkOption {
       type = types.str;
       example = "mx.example.com";
@@ -44,17 +38,6 @@ in
       description = "The domains that this mail server serves.";
     };
 
-    certificateDomains = mkOption {
-      type = types.listOf types.str;
-      example = [ "imap.example.com" "pop3.example.com" ];
-      default = [];
-      description = ''
-        ({option}`mailserver.certificateScheme` == `acme-nginx`)
-
-        Secondary domains and subdomains for which it is necessary to generate a certificate.
-      '';
-    };
-
     messageSizeLimit = mkOption {
       type = types.int;
       example = 52428800;
@@ -79,11 +62,11 @@ in
               The user's hashed password. Use `mkpasswd` as follows
 
               ```
-              nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+              mkpasswd -m sha-512 "super secret password"
               ```
 
               Warning: this is stored in plaintext in the Nix store!
-              Use {option}`mailserver.loginAccounts.<name>.hashedPasswordFile` instead.
+              Use `hashedPasswordFile` instead.
             '';
           };
 
@@ -95,7 +78,7 @@ in
               A file containing the user's hashed password. Use `mkpasswd` as follows
 
               ```
-              nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+              mkpasswd -m sha-512 "super secret password"
               ```
             '';
           };
@@ -111,15 +94,6 @@ in
             '';
           };
 
-          aliasesRegexp = mkOption {
-            type = with types; listOf types.str;
-            example = [''/^tom\..*@domain\.com$/''];
-            default = [];
-            description = ''
-              Same as {option}`mailserver.aliases` but using PCRE (Perl compatible regex).
-            '';
-          };
-
           catchAll = mkOption {
             type = with types; listOf (enum cfg.domains);
             example = ["example.com" "example2.com"];
@@ -169,7 +143,7 @@ in
             description = ''
               Specifies if the account should be a send-only account.
               Emails sent to send-only accounts will be rejected from
-              unauthorized senders with the `sendOnlyRejectMessage`
+              unauthorized senders with the sendOnlyRejectMessage
               stating the reason.
             '';
           };
@@ -201,255 +175,12 @@ in
         follows
 
         ```
-        nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+        mkpasswd -m sha-512 "super secret password"
         ```
       '';
       default = {};
     };
 
-    ldap = {
-      enable = mkEnableOption "LDAP support";
-
-      uris  = mkOption {
-        type = types.listOf types.str;
-        example = literalExpression ''
-          [
-            "ldaps://ldap1.example.com"
-            "ldaps://ldap2.example.com"
-          ]
-        '';
-        description = ''
-          URIs where your LDAP server can be reached
-        '';
-      };
-
-      startTls = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to enable StartTLS upon connection to the server.
-        '';
-      };
-
-      tlsCAFile = mkOption {
-        type = types.path;
-        default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-        defaultText = lib.literalMD "see [source](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/blob/master/default.nix)";
-        description = ''
-          Certifificate trust anchors used to verify the LDAP server certificate.
-        '';
-      };
-
-      bind = {
-        dn = mkOption {
-          type = types.str;
-          example = "cn=mail,ou=accounts,dc=example,dc=com";
-          description = ''
-            Distinguished name used by the mail server to do lookups
-            against the LDAP servers.
-          '';
-        };
-
-        passwordFile = mkOption {
-          type = types.str;
-          example = "/run/my-secret";
-          description = ''
-            A file containing the password required to authenticate against the LDAP servers.
-          '';
-        };
-      };
-
-      searchBase = mkOption {
-        type = types.str;
-        example = "ou=people,ou=accounts,dc=example,dc=com";
-        description = ''
-          Base DN at below which to search for users accounts.
-        '';
-      };
-
-      searchScope = mkOption {
-        type = types.enum [ "sub" "base" "one" ];
-        default = "sub";
-        description = ''
-          Search scope below which users accounts are looked for.
-        '';
-      };
-
-      dovecot = {
-        userAttrs = mkOption {
-          type = types.nullOr types.str;
-          default = "";
-          description = ''
-            LDAP attributes to be retrieved during userdb lookups.
-
-            See the users_attrs reference at
-            https://doc.dovecot.org/configuration_manual/authentication/ldap_settings_auth/#user-attrs
-            in the Dovecot manual.
-          '';
-        };
-
-        userFilter = mkOption {
-          type = types.str;
-          default = "mail=%u";
-          example = "(&(objectClass=inetOrgPerson)(mail=%u))";
-          description = ''
-            Filter for user lookups in Dovecot.
-
-            See the user_filter reference at
-            https://doc.dovecot.org/configuration_manual/authentication/ldap_settings_auth/#user-filter
-            in the Dovecot manual.
-          '';
-        };
-
-        passAttrs = mkOption {
-          type = types.str;
-          default = "userPassword=password";
-          description = ''
-            LDAP attributes to be retrieved during passdb lookups.
-
-            See the pass_attrs reference at
-            https://doc.dovecot.org/configuration_manual/authentication/ldap_settings_auth/#pass-attrs
-            in the Dovecot manual.
-          '';
-        };
-
-        passFilter = mkOption {
-          type = types.nullOr types.str;
-          default = "mail=%u";
-          example = "(&(objectClass=inetOrgPerson)(mail=%u))";
-          description = ''
-            Filter for password lookups in Dovecot.
-
-            See the pass_filter reference for
-            https://doc.dovecot.org/configuration_manual/authentication/ldap_settings_auth/#pass-filter
-            in the Dovecot manual.
-          '';
-        };
-      };
-
-      postfix = {
-        filter = mkOption {
-          type = types.str;
-          default = "mail=%s";
-          example = "(&(objectClass=inetOrgPerson)(mail=%s))";
-          description = ''
-            LDAP filter used to search for an account by mail, where
-            `%s` is a substitute for the address in
-            question.
-          '';
-        };
-
-        uidAttribute = mkOption {
-          type = types.str;
-          default = "mail";
-          example = "uid";
-          description = ''
-            The LDAP attribute referencing the account name for a user.
-          '';
-        };
-
-        mailAttribute = mkOption {
-          type = types.str;
-          default = "mail";
-          description = ''
-            The LDAP attribute holding mail addresses for a user.
-          '';
-        };
-      };
-    };
-
-    indexDir = mkOption {
-      type = types.nullOr types.str;
-      default = null;
-      description = ''
-        Folder to store search indices. If null, indices are stored
-        along with email, which could not necessarily be desirable,
-        especially when {option}`mailserver.fullTextSearch.enable` is `true` since
-        indices it creates are voluminous and do not need to be backed
-        up.
-
-        Be careful when changing this option value since all indices
-        would be recreated at the new location (and clients would need
-        to resynchronize).
-
-        Note the some variables can be used in the file path. See
-        https://doc.dovecot.org/configuration_manual/mail_location/#variables
-        for details.
-      '';
-      example = "/var/lib/dovecot/indices";
-    };
-
-    fullTextSearch = {
-      enable = mkEnableOption "Full text search indexing with xapian. This has significant performance and disk space cost.";
-      autoIndex = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Enable automatic indexing of messages as they are received or modified.";
-      };
-      autoIndexExclude = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        example = [ "\\Trash" "SomeFolder" "Other/*" ];
-        description = ''
-          Mailboxes to exclude from automatic indexing.
-        '';
-      };
-
-      indexAttachments = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Also index text-only attachements. Binary attachements are never indexed.";
-      };
-
-      enforced = mkOption {
-        type = types.enum [ "yes" "no" "body" ];
-        default = "no";
-        description = ''
-          Fail searches when no index is available. If set to
-          `body`, then only body searches (as opposed to
-          header) are affected. If set to `no`, searches may
-          fall back to a very slow brute force search.
-        '';
-      };
-
-      minSize = mkOption {
-        type = types.int;
-        default = 2;
-        description = "Size of the smallest n-gram to index.";
-      };
-      maxSize = mkOption {
-        type = types.int;
-        default = 20;
-        description = "Size of the largest n-gram to index.";
-      };
-      memoryLimit = mkOption {
-        type = types.nullOr types.int;
-        default = null;
-        example = 2000;
-        description = "Memory limit for the indexer process, in MiB. If null, leaves the default (which is rather low), and if 0, no limit.";
-      };
-
-      maintenance = {
-        enable = mkOption {
-          type = types.bool;
-          default = true;
-          description = "Regularly optmize indices, as recommended by upstream.";
-        };
-
-        onCalendar = mkOption {
-          type = types.str;
-          default = "daily";
-          description = "When to run the maintenance job. See systemd.time(7) for more information about the format.";
-        };
-
-        randomizedDelaySec = mkOption {
-          type = types.int;
-          default = 1000;
-          description = "Run the maintenance job not exactly at the time specified with `onCalendar`, but plus or minus this many seconds.";
-        };
-      };
-    };
-
     lmtpSaveToDetailMailbox = mkOption {
       type = types.enum ["yes" "no"];
       default = "yes";
@@ -464,6 +195,7 @@ in
       type = let
         loginAccount = mkOptionType {
           name = "Login Account";
+          check = (account: builtins.elem account (builtins.attrNames cfg.loginAccounts));
         };
       in with types; attrsOf (either loginAccount (nonEmptyListOf loginAccount));
       example = {
@@ -488,6 +220,7 @@ in
 
     forwards = mkOption {
       type = with types; attrsOf (either (listOf str) str);
+      default = {};
       example = {
         "user@example.com" = "user@elsewhere.com";
       };
@@ -496,7 +229,7 @@ in
         the value {`"user@example.com" = "user@elsewhere.com";}`
         means that mails to `user@example.com` are forwarded to
         `user@elsewhere.com`. The difference with the
-        {option}`mailserver.extraVirtualAliases` option is that `user@elsewhere.com`
+        `extraVirtualAliases` option is that `user@elsewhere.com`
         can't send mail as `user@example.com`. Also, this option
         allows to forward mails to external addresses.
       '';
@@ -530,7 +263,7 @@ in
       description = ''
         The unix UID of the virtual mail user.  Be mindful that if this is
         changed, you will need to manually adjust the permissions of
-        `mailDirectory`.
+        mailDirectory.
       '';
     };
 
@@ -573,14 +306,6 @@ in
       '';
     };
 
-    useUTF8FolderNames = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Store mailbox names on disk using UTF-8 instead of modified UTF-7 (mUTF-7).
-      '';
-    };
-
     hierarchySeparator = mkOption {
       type = types.str;
       default = ".";
@@ -599,46 +324,42 @@ in
         The mailboxes for dovecot.
         Depending on the mail client used it might be necessary to change some mailbox's name.
       '';
-      default = {
+      default = let
-        Trash = {
+        defMailBoxes = {
-          auto = "no";
+          Trash = {
-          specialUse = "Trash";
+            auto = "no";
+            specialUse = "Trash";
+          };
+          Junk = {
+            auto = "subscribe";
+            specialUse = "Junk";
+          };
+          Drafts = {
+            auto = "subscribe";
+            specialUse = "Drafts";
+          };
+          Sent = {
+            auto = "subscribe";
+            specialUse = "Sent";
+          };
         };
-        Junk = {
+      in if (versionAtLeast version "20.09pre") then defMailBoxes
-          auto = "subscribe";
+      else (flip mapAttrsToList defMailBoxes (name: options: { inherit name; } // options));
-          specialUse = "Junk";
-        };
-        Drafts = {
-          auto = "subscribe";
-          specialUse = "Drafts";
-        };
-        Sent = {
-          auto = "subscribe";
-          specialUse = "Sent";
-        };
-      };
     };
 
-    certificateScheme = let
+    certificateScheme = mkOption {
-      schemes = [ "manual" "selfsigned" "acme-nginx" "acme" ];
+      type = types.enum [ 1 2 3 ];
-      translate = i: warn "Setting mailserver.certificateScheme by number is deprecated, please use names instead: 'mailserver.certificateScheme = ${builtins.toString i}' can be replaced by 'mailserver.certificateScheme = \"${(builtins.elemAt schemes (i - 1))}\"'."
+      default = 2;
-        (builtins.elemAt schemes (i - 1));
-    in mkOption {
-      type = with types; coercedTo (enum [ 1 2 3 ]) translate (enum schemes);
-      default = "selfsigned";
       description = ''
-        The scheme to use for managing TLS certificates:
+        Certificate Files. There are three options for these.
 
-        1. `manual`: you specify locations via {option}`mailserver.certificateFile` and
+        1) You specify locations and manually copy certificates there.
-           {option}`mailserver.keyFile` and manually copy certificates there.
+        2) You let the server create new (self signed) certificates on the fly.
-        2. `selfsigned`: you let the server create new (self-signed) certificates on the fly.
+        3) You let the server create a certificate via `Let's Encrypt`. Note that
-        3. `acme-nginx`: you let the server request certificates from [Let's Encrypt](https://letsencrypt.org)
+           this implies that a stripped down webserver has to be started. This also
-           via NixOS' ACME module. By default, this will set up a stripped-down Nginx server for
+           implies that the FQDN must be set as an `A` record to point to the IP of
-           {option}`mailserver.fqdn` and open port 80. For this to work, the FQDN must be properly
+           the server. In particular port 80 on the server will be opened. For details
-           configured to point to your server (see the [setup guide](setup-guide.rst) for more information).
+           on how to set up the domain records, see the guide in the readme.
-        4. `acme`: you already have an ACME certificate set up (for example, you're already running a TLS-enabled
-           Nginx server on the FQDN). This is better than `manual` because the appropriate services will be reloaded
-           when the certificate is renewed.
       '';
     };
 
@@ -646,9 +367,8 @@ in
       type = types.path;
       example = "/root/mail-server.crt";
       description = ''
-        ({option}`mailserver.certificateScheme` == `manual`)
+        Scheme 1)
-
+        Location of the certificate
-        Location of the certificate.
       '';
     };
 
@@ -656,9 +376,8 @@ in
       type = types.path;
       example = "/root/mail-server.key";
       description = ''
-        ({option}`mailserver.certificateScheme` == `manual`)
+        Scheme 1)
-
+        Location of the key file
-        Location of the key file.
       '';
     };
 
@@ -666,27 +385,13 @@ in
       type = types.path;
       default = "/var/certs";
       description = ''
-        ({option}`mailserver.certificateScheme` == `selfsigned`)
+        Sceme 2)
-
+        This is the folder where the certificate will be created. The name is
-        This is the folder where the self-signed certificate will be created. The name is
+        hardcoded to "cert-<domain>.pem" and "key-<domain>.pem" and the
-        hardcoded to "cert-DOMAIN.pem" and "key-DOMAIN.pem" and the
         certificate is valid for 10 years.
       '';
     };
 
-    acmeCertificateName = mkOption {
-      type = types.str;
-      default = cfg.fqdn;
-      example = "example.com";
-      description = ''
-          ({option}`mailserver.certificateScheme` == `acme`)
-
-        When the `acme` `certificateScheme` is selected, you can use this option
-        to override the default certificate name. This is useful if you've
-        generated a wildcard certificate, for example.
-      '';
-    };
-
     enableImap = mkOption {
       type = types.bool;
       default = true;
@@ -776,7 +481,7 @@ in
       type = types.str;
       default = "mail";
       description = ''
-        The DKIM selector.
+
       '';
     };
 
@@ -784,7 +489,7 @@ in
       type = types.path;
       default = "/var/dkim";
       description = ''
-        The DKIM directory.
+
       '';
     };
 
@@ -795,93 +500,12 @@ in
             How many bits in generated DKIM keys. RFC6376 advises minimum 1024-bit keys.
 
             If you have already deployed a key with a different number of bits than specified
-            here, then you should use a different selector ({option}`mailserver.dkimSelector`). In order to get
+            here, then you should use a different selector (dkimSelector). In order to get
             this package to generate a key with the new number of bits, you will either have to
             change the selector or delete the old key file.
         '';
     };
 
-    dkimHeaderCanonicalization = mkOption {
-        type = types.enum ["relaxed" "simple"];
-        default = "relaxed";
-        description = ''
-          DKIM canonicalization algorithm for message headers.
-
-          See https://datatracker.ietf.org/doc/html/rfc6376/#section-3.4 for details.
-        '';
-    };
-
-    dkimBodyCanonicalization = mkOption {
-        type = types.enum ["relaxed" "simple"];
-        default = "relaxed";
-        description = ''
-          DKIM canonicalization algorithm for message bodies.
-
-          See https://datatracker.ietf.org/doc/html/rfc6376/#section-3.4 for details.
-        '';
-    };
-
-    dmarcReporting = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to send out aggregated, daily DMARC reports in response to incoming
-          mail, when the sender domain defines a DMARC policy including the RUA tag.
-
-          This is helpful for the mail ecosystem, because it allows third parties to
-          get notified about SPF/DKIM violations originating from their sender domains.
-
-          See https://rspamd.com/doc/modules/dmarc.html#reporting
-        '';
-      };
-
-      localpart = mkOption {
-        type = types.str;
-        default = "dmarc-noreply";
-        example = "dmarc-report";
-        description = ''
-          The local part of the email address used for outgoing DMARC reports.
-        '';
-      };
-
-      domain = mkOption {
-        type = types.enum (cfg.domains);
-        example = "example.com";
-        description = ''
-          The domain from which outgoing DMARC reports are served.
-        '';
-      };
-
-      email = mkOption {
-        type = types.str;
-        default = with cfg.dmarcReporting; "${localpart}@${domain}";
-        defaultText = literalExpression ''"''${localpart}@''${domain}"'';
-        readOnly = true;
-        description = ''
-          The email address used for outgoing DMARC reports. Read-only.
-        '';
-      };
-
-      organizationName = mkOption {
-        type = types.str;
-        example = "ACME Corp.";
-        description = ''
-          The name of your organization used in the `org_name` attribute in
-          DMARC reports.
-        '';
-      };
-
-      fromName = mkOption {
-        type = types.str;
-        default = cfg.dmarcReporting.organizationName;
-        defaultText = literalMD "{option}`mailserver.dmarcReporting.organizationName`";
-        description = ''
-          The sender name for DMARC reports. Defaults to the organization name.
-        '';
-      };
-    };
-
     debug = mkOption {
       type = types.bool;
       default = false;
@@ -910,20 +534,12 @@ in
       '';
     };
 
-    recipientDelimiter = mkOption {
-      type = types.str;
-      default = "+";
-      description = ''
-        Configure the recipient delimiter.
-      '';
-    };
-
     redis = {
       address = mkOption {
         type = types.str;
         # read the default from nixos' redis module
         default = let
-          cf = config.services.redis.servers.rspamd.bind;
+          cf = config.services.redis.bind;
           cfdefault = if cf == null then "127.0.0.1" else cf;
           ips = lib.strings.splitString " " cfdefault;
           ip = lib.lists.head (ips ++ [ "127.0.0.1" ]);
@@ -932,27 +548,28 @@ in
         if (ip == "0.0.0.0" || ip == "::")
         then "127.0.0.1"
         else if isIpv6 ip then "[${ip}]" else ip;
-        defaultText = lib.literalMD "computed from `config.services.redis.servers.rspamd.bind`";
         description = ''
-          Address that rspamd should use to contact redis.
+          Address that rspamd should use to contact redis. The default value
+          is read from <literal>config.services.redis.bind</literal>.
         '';
       };
 
       port = mkOption {
         type = types.port;
-        default = config.services.redis.servers.rspamd.port;
+        default = config.services.redis.port;
-        defaultText = lib.literalExpression "config.services.redis.servers.rspamd.port";
         description = ''
-          Port that rspamd should use to contact redis.
+          Port that rspamd should use to contact redis. The default value is
+          read from <literal>config.services.redis.port<literal>.
         '';
       };
 
       password = mkOption {
         type = types.nullOr types.str;
-        default = config.services.redis.servers.rspamd.requirePass;
+        default = config.services.redis.requirePass;
-        defaultText = lib.literalExpression "config.services.redis.servers.rspamd.requirePass";
         description = ''
-          Password that rspamd should use to contact redis, or null if not required.
+          Password that rspamd should use to contact redis, or null if not
+          required. The default value is read from
+          <literal>config.services.redis.requirePass<literal>.
         '';
       };
     };
@@ -967,25 +584,10 @@ in
       '';
     };
 
-    smtpdForbidBareNewline = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        With "smtpd_forbid_bare_newline = yes", the Postfix SMTP server
-        disconnects a remote SMTP client that sends a line ending in a 'bare
-        newline'.
-
-        This feature was added in Postfix 3.8.4 against SMTP Smuggling and will
-        default to "yes" in Postfix 3.9.
-
-        https://www.postfix.org/smtp-smuggling.html
-      '';
-    };
-
     sendingFqdn = mkOption {
       type = types.str;
       default = cfg.fqdn;
-      defaultText = lib.literalMD "{option}`mailserver.fqdn`";
+      defaultText = "config.mailserver.fqdn";
       example = "myserver.example.com";
       description = ''
         The fully qualified domain name of the mail server used to
@@ -1001,7 +603,7 @@ in
 
         This setting allows the server to identify as
         myserver.example.com when forwarding mail, independently of
-        {option}`mailserver.fqdn` (which, for SSL reasons, should generally be the name
+        `fqdn` (which, for SSL reasons, should generally be the name
         to which the user connects).
 
         Set this to the name to which the sending IP's reverse DNS
@@ -1069,11 +671,10 @@ in
                 stop program = "${pkgs.systemd}/bin/systemctl stop dovecot2"
                 if failed host ${cfg.fqdn} port 993 type tcpssl sslauto protocol imap for 5 cycles then restart
 
-          check process rspamd with matching "rspamd: main process"
+          check process rspamd with pidfile /var/run/rspamd.pid
                 start program = "${pkgs.systemd}/bin/systemctl start rspamd"
                 stop program = "${pkgs.systemd}/bin/systemctl stop rspamd"
         '';
-        defaultText = lib.literalMD "see [source](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/blob/master/default.nix)";
         description = ''
           The configuration used for monitoring via monit.
           Use a mail address that you actively check and set it via 'set alert ...'.
@@ -1090,8 +691,7 @@ in
         description = ''
           The location where borg saves the backups.
           This can be a local path or a remote location such as user@host:/path/to/repo.
-          It is exported and thus available as an environment variable to
+          It is exported and thus available as an environment variable to cmdPreexec and cmdPostexec.
-          {option}`mailserver.borgbackup.cmdPreexec` and {option}`mailserver.borgbackup.cmdPostexec`.
         '';
       };
 
@@ -1151,14 +751,13 @@ in
           default = "none";
           description = ''
             The backup can be encrypted by choosing any other value than 'none'.
-            When using encryption the password/passphrase must be provided in `passphraseFile`.
+            When using encryption the password / passphrase must be provided in passphraseFile.
           '';
         };
 
         passphraseFile = mkOption {
           type = types.nullOr types.path;
           default = null;
-          description = "Path to a file containing the encryption password or passphrase.";
         };
       };
 
@@ -1174,7 +773,6 @@ in
       locations = mkOption {
         type = types.listOf types.path;
         default = [cfg.mailDirectory];
-        defaultText = lib.literalExpression "[ config.mailserver.mailDirectory ]";
         description = "The locations that are to be backed up by borg.";
       };
 
@@ -1195,10 +793,9 @@ in
         default = null;
         description = ''
           The command to be executed before each backup operation.
-          This is called prior to borg init in the same script that runs borg init and create and `cmdPostexec`.
+          This is called prior to borg init in the same script that runs borg init and create and cmdPostexec.
-        '';
+          Example:
-        example = ''
+            export BORG_RSH="ssh -i /path/to/private/key"
-          export BORG_RSH="ssh -i /path/to/private/key"
         '';
       };
 
@@ -1208,7 +805,7 @@ in
         description = ''
           The command to be executed after each backup operation.
           This is called after borg create completed successfully and in the same script that runs
-          `cmdPreexec`, borg init and create.
+          cmdPreexec, borg init and create.
         '';
       };
 
@@ -1221,7 +818,7 @@ in
         example = true;
         description = ''
           Whether to enable automatic reboot after kernel upgrades.
-          This is to be used in conjunction with `system.autoUpgrade.enable = true;`
+          This is to be used in conjunction with system.autoUpgrade.enable = true"
         '';
       };
       method = mkOption {
@@ -1296,9 +893,7 @@ in
   };
 
   imports = [
-    ./mail-server/assertions.nix
     ./mail-server/borgbackup.nix
-    ./mail-server/debug.nix
     ./mail-server/rsnapshot.nix
     ./mail-server/clamav.nix
     ./mail-server/monit.nix

docs/add-roundcube.rst

@@ -1,32 +0,0 @@
-Add Roundcube, a webmail
-========================
-
-The NixOS module for roundcube nearly works out of the box with SNM. By
-default, it sets up a nginx virtual host to serve the webmail, other web
-servers may require more work.
-
-.. code:: nix
-
-   { config, pkgs, lib, ... }:
-
-   with lib;
-
-   {
-     services.roundcube = {
-        enable = true;
-        # this is the url of the vhost, not necessarily the same as the fqdn of
-        # the mailserver
-        hostName = "webmail.example.com";
-        extraConfig = ''
-          # starttls needed for authentication, so the fqdn required to match
-          # the certificate
-          $config['smtp_host'] = "tls://${config.mailserver.fqdn}";
-          $config['smtp_user'] = "%u";
-          $config['smtp_pass'] = "%p";
-        '';
-     };
-
-     services.nginx.enable = true;
-
-     networking.firewall.allowedTCPPorts = [ 80 443 ];
-   }

docs/autodiscovery.rst

@@ -1,18 +0,0 @@
-Autodiscovery
-=============
-
-`RFC6186 <https://www.rfc-editor.org/rfc/rfc6186>`_ allows supporting email clients to automatically discover SMTP / IMAP addresses
-of the mailserver. For that, the following records are required:
-
-================= ==== ==== ======== ====== ==== =================
-Record            TTL  Type Priority Weight Port Value
-================= ==== ==== ======== ====== ==== =================
-_submission._tcp  3600 SRV  5        0      587  mail.example.com.
-_submissions._tcp 3600 SRV  5        0      465  mail.example.com.
-_imap._tcp        3600 SRV  5        0      143  mail.example.com.
-_imaps._tcp       3600 SRV  5        0      993  mail.example.com.
-================= ==== ==== ======== ====== ==== =================
-
-Please note that only a few MUAs currently implement this. For vendor-specific
-discovery mechanisms `automx <https://github.com/rseichter/automx2>`_ can be used instead.
-

docs/backup-guide.rst

@@ -1,9 +1,9 @@
-Backup Guide
+A Complete Backup Guide
-============
+=======================
 
-First off you should have a backup of your ``configuration.nix`` file
+This is really easy. First off you should have a backup of your
-where you have the server config (but that is already in a git
+``configuration.nix`` file where you have the server config (but that is
-repository right?)
+already in a git repository right?)
 
 Next you need to backup ``/var/vmail`` or whatever you have specified
 for the option ``mailDirectory``. This is where all the mails reside.

docs/conf.py

@@ -18,7 +18,7 @@
 # -- Project information -----------------------------------------------------
 
 project = 'NixOS Mailserver'
-copyright = '2022, NixOS Mailserver Contributors'
+copyright = '2020, NixOS Mailserver Contributors'
 author = 'NixOS Mailserver Contributors'
 
 
@@ -28,16 +28,8 @@ author = 'NixOS Mailserver Contributors'
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
 extensions = [
-    'myst_parser'
 ]
 
-myst_enable_extensions = [
-    'colon_fence',
-    'linkify',
-]
-
-smartquotes = False
-
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
 
@@ -58,4 +50,4 @@ html_theme = 'sphinx_rtd_theme'
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = []
+html_static_path = ['_static']

docs/faq.rst

@@ -1,22 +0,0 @@
-FAQ
-===
-
-``catchAll`` users can't send email as user other than themself
----------------------------------------------------------------
-
-To allow a ``catchAll`` user to send mail with the address used as
-recipient, the option ``aliases`` has to be used instead of ``catchAll``.
-
-For instance, to allow ``user@example.com`` to catch all mails to the
-domain ``example.com`` and send mails with any address of this domain:
-
-
-.. code:: nix
-
-    mailserver.loginAccounts = {
-        "user@example.com" = {
-            aliases = [ "@example.com" ];
-        };
-    };
-
-See also `this discussion <https://github.com/r-raymond/nixos-mailserver/issues/49>`__ for details.

docs/flakes.rst

@@ -1,30 +0,0 @@
-Nix Flakes
-==========
-
-If you're using `flakes <https://nixos.wiki/wiki/Flakes>`__, you can use
-the following minimal ``flake.nix`` as an example:
-
-.. code:: nix
-
-   {
-     description = "NixOS configuration";
-
-     inputs.simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-20.09";
-
-     outputs = { self, nixpkgs, simple-nixos-mailserver }: {
-       nixosConfigurations = {
-         hostname = nixpkgs.lib.nixosSystem {
-           system = "x86_64-linux";
-           modules = [
-             simple-nixos-mailserver.nixosModule
-             {
-               mailserver = {
-                 enable = true;
-                 # ...
-               };
-             }
-           ];
-         };
-       };
-     };
-   }

docs/fts.rst

@@ -1,69 +0,0 @@
-Full text search
-==========================
-
-By default, when your IMAP client searches for an email containing some
-text in its *body*, dovecot will read all your email sequentially. This
-is very slow and IO intensive. To speed body searches up, it is possible to
-*index* emails with a plugin to dovecot, ``fts_xapian``.
-
-Enabling full text search
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To enable indexing for full text search here is an example configuration.
-
-.. code:: nix
-
-  {
-    mailserver = {
-      # ...
-      fullTextSearch = {
-        enable = true;
-        # index new email as they arrive
-        autoIndex = true;
-        # this only applies to plain text attachments, binary attachments are never indexed
-        indexAttachments = true;
-        enforced = "body";
-      };
-    };
-  }
-
-
-The ``enforced`` parameter tells dovecot to fail any body search query that cannot
-use an index. This prevents dovecot to fall back to the IO-intensive brute
-force search.
-
-If you set ``autoIndex`` to ``false``, indices will be created when the IMAP client
-issues a search query, so latency will be high.
-
-Resource requirements
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-Indices created by the full text search feature can take more disk
-space than the emails themselves. By default, they are kept in the
-emails location. When enabling the full text search feature, it is
-recommended to move indices in a different location, such as
-(``/var/lib/dovecot/indices``) by using the option
-``mailserver.indexDir``.
-
-.. warning::
-
-   When the value of the ``indexDir`` option is changed, all dovecot
-   indices needs to be recreated: clients would need to resynchronize.
-
-Indexation itself is rather resouces intensive, in CPU, and for emails with
-large headers, in memory as well. Initial indexation of existing emails can take
-hours. If the indexer worker is killed or segfaults during indexation, it can
-be that it tried to allocate more memory than allowed. You can increase the memory
-limit by eg ``mailserver.fullTextSearch.memoryLimit = 2000`` (in MiB).
-
-Mitigating resources requirements
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-You can:
-
-* disable indexation of attachements ``mailserver.fullTextSearch.indexAttachments = false``
-* reduce the size of ngrams to be indexed ``mailserver.fullTextSearch.minSize`` and ``maxSize``
-* disable automatic indexation for some folders with
-  ``mailserver.fullTextSearch.autoIndexExclude``.  Folders can be specified by
-  name (``"Trash"``), by special use (``"\\Junk"``) or with a wildcard.
-

docs/howto-add-radicale.rst

@@ -1,12 +1,8 @@
-Add Radicale
+How to Add Radicale to SNM
-============
+==========================
 
 Configuration by @dotlambda
 
-Starting with Radicale 3 (first introduced in NixOS 20.09) the traditional
-crypt passwords are no longer supported.  Instead bcrypt passwords
-have to be used. These can still be generated using `mkpasswd -m bcrypt`.
-
 .. code:: nix
 
    { config, pkgs, lib, ... }:
@@ -24,13 +20,12 @@ have to be used. These can still be generated using `mkpasswd -m bcrypt`.
    in {
      services.radicale = {
        enable = true;
-       settings = {
+       config = ''
-         auth = {
+         [auth]
-           type = "htpasswd";
+         type = htpasswd
-           htpasswd_filename = "${htpasswd}";
+         htpasswd_filename = ${htpasswd}
-           htpasswd_encryption = "bcrypt";
+         htpasswd_encryption = crypt
-         };
+       '';
-       };
      };
 
      services.nginx = {

docs/howto-develop.rst

@@ -1,49 +1,35 @@
-Contribute or troubleshoot
+How to Develop SNM
-==========================
+==================
-
-To report an issue, please go to
-`<https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues>`_.
-
-You can also chat with us on the Libera IRC channel ``#nixos-mailserver``.
 
 Run NixOS tests
 ---------------
 
-To run the test suite, you need to enable `Nix Flakes
+You can run the testsuite via
-<https://nixos.wiki/wiki/Flakes#Installing_flakes>`_.
-
-You can then run the testsuite via
 
 ::
 
-   $ nix flake check -L
+   $ nix-build tests -A extern.nixpkgs_20_03
-
+   $ nix-build tests -A intern.nixpkgs_unstable
-Since Nix doesn't garantee your machine have enough resources to run
+   ...
-all test VMs in parallel, some tests can fail. You would then haev to
-run tests manually. For instance:
-
-::
-
-   $ nix build .#hydraJobs.x86_64-linux.external-unstable -L
-
 
 Contributing to the documentation
 ---------------------------------
 
-The documentation is written in RST (except option documentation which is in CommonMark),
+The documentation is written in RST, build with Sphinx and published
-built with Sphinx and published by `Read the Docs <https://readthedocs.org/>`_.
+by `Read the Docs <https://readthedocs.org/>`_.
 
-For the syntax, see the `RST/Sphinx primer
+For the syntax, see `RST/Sphinx Cheatsheet
-<https://www.sphinx-doc.org/en/master/usage/restructuredtext/basics.html>`_.
+<https://sphinx-tutorial.readthedocs.io/cheatsheet/>`_.
-
-To build the documentation, you need to enable `Nix Flakes
-<https://nixos.wiki/wiki/Flakes#Installing_flakes>`_.
 
+The ``shell.nix`` provides all the tooling required to build the
+documentation:
 
 ::
 
-   $ nix build .#documentation
+   $ nix-shell
-   $ xdg-open result/index.html
+   $ cd docs
+   $ make html
+   $ firefox ./_build/html/index.html
 
 Nixops
 ------

docs/index.rst

@@ -6,31 +6,20 @@
 Welcome to NixOS Mailserver's documentation!
 ============================================
 
-.. image:: logo.png
+.. image:: ../logo/logo.png
    :width: 400
    :alt: SNM Logo
 
 .. toctree::
    :maxdepth: 2
 
+   quick-start
    setup-guide
    howto-develop
-   faq
-   release-notes
-   options
-
-.. toctree::
-   :maxdepth: 1
-   :caption: How-to
-
    backup-guide
-   add-radicale
+   howto-add-radicale
-   add-roundcube
    rspamd-tuning
-   fts
+   release-notes
-   flakes
-   autodiscovery
-   ldap
 
 Indices and tables
 ==================

docs/ldap.rst

@@ -1,14 +0,0 @@
-LDAP Support
-============
-
-It is possible to manage mail user accounts with LDAP rather than with
-the option `loginAccounts <options.html#mailserver-loginaccounts>`_.
-
-All related LDAP options are described in the `LDAP options section
-<options.html#mailserver-ldap>`_ and the `LDAP test
-<https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/blob/master/tests/ldap.nix>`_
-provides a getting started example.
-
-.. note::
-   The LDAP support can not be enabled if some accounts are also defined with ``mailserver.loginAccounts``.
-

docs/quick-start.rst

@@ -0,0 +1,34 @@
+Quick Start
+===========
+
+.. code:: nix
+
+   { config, pkgs, ... }:
+   let release = "nixos-20.09";
+   in {
+     imports = [
+       (builtins.fetchTarball {
+         url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz";
+         # This hash needs to be updated
+         sha256 = "0000000000000000000000000000000000000000000000000000";
+       })
+     ];
+
+     mailserver = {
+       enable = true;
+       fqdn = "mail.example.com";
+       domains = [ "example.com" "example2.com" ];
+       loginAccounts = {
+           "user1@example.com" = {
+               # mkpasswd -m sha-512 "super secret password" > /hashed/password/file/location
+               hashedPasswordFile = "/hashed/password/file/location";
+
+               aliases = [
+                   "info@example.com"
+                   "postmaster@example.com"
+                   "postmaster@example2.com"
+               ];
+           };
+       };
+     };
+   }

docs/release-notes.rst

@@ -1,61 +1,6 @@
 Release Notes
 =============
 
-NixOS 24.05
------------
-
-- Add new option ``acmeCertificateName`` which can be used to support
-  wildcard certificates
-
-NixOS 23.11
------------
-
-- Add basic support for LDAP users
-- Add support for regex (PCRE) aliases
-
-NixOS 23.05
------------
-
-- Existing ACME certificates can be reused without configuring NGINX
-- Certificate scheme is no longer a number, but a meaningful string instead
-
-NixOS 22.11
------------
-
-- Allow Rspamd to send DMARC reporting
-  (`merge request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/244>`__)
-
-NixOS 22.05
------------
-
-- Make NixOS Mailserver options discoverable from search.nixos.org
-- Add a roundcube setup guide in the documentation
-
-NixOS 21.11
------------
-
-- Switch default DKIM body policy from simple to relaxed
-  (`merge request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/247>`__)
-- Ensure locally-delivered mails have the X-Original-To header
-  (`merge request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/243>`__)
-- NixOS Mailserver options are detailed in the `documentation
-  <https://nixos-mailserver.readthedocs.io/en/latest/options.html>`__
-- New options ``dkimBodyCanonicalization`` and
-  ``dkimHeaderCanonicalization``
-- New option ``certificateDomains`` to generate certificate for
-  additional domains (such as ``imap.example.com``)
-
-
-NixOS 21.05
------------
-
-- New `fullTextSearch` option to search in messages (based on Xapian)
-  (`Merge Request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/212>`__)
-- Flake support
-  (`Merge Request <https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/200>`__)
-- New `openFirewall` option defaulting to `true`
-- We moved from Freenode to Libera Chat
-
 NixOS 20.09
 -----------
 

docs/requirements.txt

@@ -1,4 +0,0 @@
-sphinx ~= 5.3
-sphinx_rtd_theme ~= 1.1
-myst-parser ~= 0.18
-linkify-it-py ~= 2.0

docs/rspamd-tuning.rst

@@ -1,19 +1,19 @@
-Tune spam filtering
+How to tune spam filtering
-===================
+==========================
 
 SNM comes with the `rspamd spam filtering system <https://rspamd.com/>`_
 enabled by default. Although its out-of-the-box performance is good, you
 can increase its efficiency by tuning its behaviour.
 
-Auto-learning
+A) Auto-learning
-~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~
 
 Moving spam email to the Junk folder (and false-positives out of it) will
 trigger an automatic training of the Bayesian filters, improving filtering
 of future emails.
 
-Train from existing folders
+B) Train from existing folders
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 If you kept previous spam, you can train the filter from it. Note that the
 `rspamd FAQ <https://rspamd.com/doc/faq.html#how-can-i-learn-messages>`_
@@ -36,8 +36,8 @@ You can run the training in a root shell as follows:
   # Check that training was successful
   rspamc -h $RSOCK stat | grep learned
 
-Tune symbol weight
+C) Tune symbol weight
-~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~
 
 The ``X-Spamd-Result`` header is automatically added to your emails, detailing
 the scoring decisions. The `modules documentation <https://rspamd.com/doc/modules/>`_
@@ -52,8 +52,8 @@ details the meaning of each symbol. You can tune the weight if a symbol if neede
       }'';
   };
 
-Tune action thresholds
+D) Tune action thresholds
-~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~
 
 After scoring the message, rspamd decides on an action based on configurable thresholds.
 By default, rspamd will tell postfix to reject any message with a score higher than 15.
@@ -71,8 +71,8 @@ this behaviour by tuning the configuration. For example:
   '';
 
 
-Access the rspamd web UI
+E) Access the rspamd web UI
-~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Rspamd comes with `a web interface <https://rspamd.com/webui/>`_ that displays statistics
 and history of past scans. **We do NOT recommend using it to change the configuration**

docs/setup-guide.rst

@@ -1,219 +1,248 @@
-Setup Guide
+A Complete Setup Guide
-===========
+======================
 
 Mail servers can be a tricky thing to set up. This guide is supposed to
 run you through the most important steps to achieve a 10/10 score on
-`<https://mail-tester.com>`_.
+``mail-tester.com``.
 
-What you need is:
+What you need:
 
-- a server running NixOS with a public IP
+-  A server with a public IP (referred to as ``server-IP``)
-- a domain name.
+-  A Fully Qualified Domain Name (``FQDN``) where your server is
+   reachable, so that other servers can find yours. Common FQDN include
+   ``mx.example.com`` (where ``example.com`` is a domain you own) or
+   ``mail.example.com``. The domain is referred to as ``server-domain``
+   (``example.com`` in the above example) and the ``FQDN`` is referred
+   to by ``server-FQDN`` (``mx.example.com`` above).
+-  A list of domains you want to your email server to serve. (Note that
+   this does not have to include ``server-domain``, but may of course).
+   These will be referred to as ``domains``. As an example,
+   ``domains = [ example1.com, example2.com ]``.
 
-.. note::
+A) Setup server
-
+~~~~~~~~~~~~~~~
-   In the following, we consider a server with the public IP ``1.2.3.4``
-   and the domain ``example.com``.
-
-First, we will set the minimum DNS configuration to be able to deploy
-an up and running mail server. Once the server is deployed, we could
-then set all DNS entries required to send and receive mails on this
-server.
-
-Setup DNS A record for server
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Add a DNS record to the domain ``example.com`` with the following
-entries
-
-==================== ===== ==== =============
-Name (Subdomain)     TTL   Type Value
-==================== ===== ==== =============
-``mail.example.com`` 10800 A    ``1.2.3.4``
-==================== ===== ==== =============
-
-You can check this with
-
-::
-
-   $ ping mail.example.com
-   64 bytes from mail.example.com (1.2.3.4): icmp_seq=1 ttl=46 time=21.3 ms
-   ...
-
-Note that it can take a while until a DNS entry is propagated. This
-DNS entry is required for the Let's Encrypt certificate generation
-(which is used in the below configuration example).
-
-Setup the server
-~~~~~~~~~~~~~~~~
 
 The following describes a server setup that is fairly complete. Even
-though there are more possible options (see the `NixOS Mailserver
+though there are more possible options (see ``default.nix``), these
-options documentation <options.html>`_), these should be the most
+should be the most common ones.
-common ones.
 
 .. code:: nix
 
-   { config, pkgs, ... }: {
+   { config, pkgs, ... }:
+   {
      imports = [
        (builtins.fetchTarball {
-         # Pick a release version you are interested in and set its hash, e.g.
+         # Pick a commit from the branch you are interested in
-         url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-23.05/nixos-mailserver-nixos-23.05.tar.gz";
+         url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/A-COMMIT-ID/nixos-mailserver-A-COMMIT-ID.tar.gz";
-         # To get the sha256 of the nixos-mailserver tarball, we can use the nix-prefetch-url command:
+         # And set its hash
-         # release="nixos-23.05"; nix-prefetch-url "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz" --unpack
          sha256 = "0000000000000000000000000000000000000000000000000000";
        })
      ];
 
+
      mailserver = {
        enable = true;
-       fqdn = "mail.example.com";
+       fqdn = <server-FQDN>;
-       domains = [ "example.com" ];
+       domains = [ <domains> ];
 
        # A list of all login accounts. To create the password hashes, use
-       # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+       # mkpasswd -m sha-512 "super secret password"
        loginAccounts = {
-         "user1@example.com" = {
+           "user1@example.com" = {
-           hashedPasswordFile = "/a/file/containing/a/hashed/password";
+               hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/";
-           aliases = ["postmaster@example.com"];
+
-         };
+               aliases = [
-         "user2@example.com" = { ... };
+                   "postmaster@example.com"
+                   "postmaster@example2.com"
+               ];
+
+               # Make this user the catchAll address for domains example.com and
+               # example2.com
+               catchAll = [
+                   "example.com"
+                   "example2.com"
+               ];
+           };
+
+           "user2@example.com" = { ... };
+       };
+
+       # Extra virtual aliases. These are email addresses that are forwarded to
+       # loginAccounts addresses.
+       extraVirtualAliases = {
+           # address = forward address;
+           "abuse@example.com" = "user1@example.com";
        };
 
        # Use Let's Encrypt certificates. Note that this needs to set up a stripped
        # down nginx and opens port 80.
-       certificateScheme = "acme-nginx";
+       certificateScheme = 3;
+
+       # Enable IMAP and POP3
+       enableImap = true;
+       enablePop3 = true;
+       enableImapSsl = true;
+       enablePop3Ssl = true;
+
+       # Enable the ManageSieve protocol
+       enableManageSieve = true;
+
+       # whether to scan inbound emails for viruses (note that this requires at least
+       # 1 Gb RAM for the server. Without virus scanning 256 MB RAM should be plenty)
+       virusScanning = false;
      };
-     security.acme.acceptTerms = true;
-     security.acme.defaults.email = "security@example.com";
    }
 
-After a ``nixos-rebuild switch`` your server should be running all
+After a ``nixos-rebuild switch --upgrade`` your server should be good to
-mail components.
+go. If you want to use ``nixops`` to deploy the server, look in the
+subfolder ``nixops`` for some inspiration.
 
-Setup all other DNS requirements
+B) Setup everything else
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~
 
-Set rDNS (reverse DNS) entry for server
+Step 1: Set DNS entry for server
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Add a DNS record to the domain ``server-domain`` with the following
+entries
+
+================ ===== ==== ======== =============
+Name (Subdomain) TTL   Type Priority Value
+================ ===== ==== ======== =============
+``server-FQDN``  10800 A             ``server-IP``
+================ ===== ==== ======== =============
+
+This resolves DNS queries for ``server-FQDN`` to ``server-IP``. You can
+test if your setting is correct by
+
+::
+
+   ping <server-FQDN>
+
+Expected output:
+
+::
+
+   64 bytes from <server-FQDN> (<server-IP>): icmp_seq=1 ttl=46 time=21.3 ms
+   ...
+
+Note that it can take a while until a DNS entry is propagated.
+
+Step 2: Set rDNS (reverse DNS) entry for server
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Wherever you have rented your server, you should be able to set reverse
-DNS entries for the IP’s you own. Add an entry resolving ``1.2.3.4``
+DNS entries for the IP’s you own. Add an entry resolving ``server-IP``
-to ``mail.example.com``.
+to ``server-FQDN``
 
-.. warning::
+You can test if your setting is correct by
-
-   We don't recommend setting up a mail server if you are not able to
-   set a reverse DNS on your public IP because sent emails would be
-   mostly marked as spam. Note that many residential ISP providers
-   don't allow you to set a reverse DNS entry.
-
-You can check this with
 
 ::
 
-   $ nix-shell -p bind --command "host 1.2.3.4"
+   host <server-IP>
-   4.3.2.1.in-addr.arpa domain name pointer mail.example.com.
+
+Expected output:
+
+::
+
+   <server-IP-octets-reversed>.in-addr.arpa domain name pointer <server-FQDN>.
 
 Note that it can take a while until a DNS entry is propagated.
 
-Set a ``MX`` record
+Step 3: Set ``MX`` Records
-^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-
+For every ``domain`` in ``domains`` do: \* Add a ``MX`` record to the
-Add a ``MX`` record to the domain ``example.com``.
+domain ``domain``
-
-================ ==== ======== =================
-Name (Subdomain) Type Priority Value
-================ ==== ======== =================
-example.com      MX   10       mail.example.com
-================ ==== ======== =================
-
-You can check this with
 
 ::
 
-   $ nix-shell -p bind --command "host -t mx example.com"
+   | Name (Subdomain) | TTL   | Type | Priority | Value             |
-   example.com mail is handled by 10 mail.example.com.
+   | ---------------- | ----- | ---- | -------- | ----------------- |
+   | `domain`         |       | MX   | 10       | `server-FQDN`     |
+
+You can test this via
+
+::
+
+   dig -t MX <domain>
+
+Expected output:
+
+::
+
+   ...
+   ;; ANSWER SECTION:
+   <domain>    10800   IN  MX  10 <server-FQDN>
+   ...
 
 Note that it can take a while until a DNS entry is propagated.
 
-Set a ``SPF`` record
+Step 4: Set ``SPF`` Records
-^^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Add a `SPF <https://en.wikipedia.org/wiki/Sender_Policy_Framework>`_
+For every ``domain`` in ``domains`` do: \* Add a ``SPF`` record to the
-record to the domain ``example.com``.
+domain ``domain``
-
-================ ===== ==== ================================
-Name (Subdomain) TTL   Type Value
-================ ===== ==== ================================
-example.com      10800 TXT  `v=spf1 a:mail.example.com -all`
-================ ===== ==== ================================
-
-You can check this with
 
 ::
 
-   $ nix-shell -p bind --command "host -t TXT example.com"
+   | Name (Subdomain) | TTL   | Type | Priority | Value                         |
-   example.com descriptive text "v=spf1 a:mail.example.com -all"
+   | ---------------- | ----- | ---- | -------- | -----------------             |
+   | `domain`         | 10800 | TXT  |          | `v=spf1 ip4:<server-IP> -all` |
+
+You can check this with ``dig -t TXT <domain>`` similar to the last
+section. Note that ``SPF`` records are set as ``TXT`` records since
+RFC1035.
+
+Note that it can take a while until a DNS entry is propagated. If you
+want to use multiple servers for your email handling, don’t forget to
+add all server IP’s to this list.
+
+Step 5: Set ``DKIM`` signature
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+In this section we assume that your ``dkimSelector`` is set to ``mail``.
+If you have a different selector, replace all ``mail``\ ’s below
+accordingly.
+
+For every ``domain`` in ``domains`` do: \* Go to your server and
+navigate to the dkim key directory (by default ``/var/dkim``). There you
+will find a public key for any domain in the ``domain.txt`` file. It
+will look like
+``mail._domainkey IN TXT "v=DKIM1; r=postmaster; g=*; k=rsa; p=<really-long-key>" ; ----- DKIM mail for domain.tld``
+\* Add a ``DKIM`` record to the domain ``domain``
+
+::
+
+   | Name (Subdomain)         | TTL   | Type | Priority | Value                          |
+   | ----------------         | ----- | ---- | -------- | -----------------              |
+   | mail._domainkey.`domain` | 10800 | TXT  |          | `v=DKIM1; p=<really-long-key>` |
+
+You can check this with ``dig -t TXT mail._domainkey.<domain>`` similar
+to the last section.
 
 Note that it can take a while until a DNS entry is propagated.
 
-Set ``DKIM`` signature
+Step 6: Set ``DMARC`` record
-^^^^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-On your server, the ``opendkim`` systemd service generated a file
+For every ``domain`` in ``domains`` do:
-containing your DKIM public key in the file
-``/var/dkim/example.com.mail.txt``. The content of this file looks
-like
 
-::
+-  Add a ``DMARC`` record to the domain ``domain``
 
-   mail._domainkey IN TXT "v=DKIM1; k=rsa; s=email; p=<really-long-key>" ; ----- DKIM mail for domain.tld
+   ==================== ===== ==== ======== ====================
+   Name (Subdomain)     TTL   Type Priority Value
+   ==================== ===== ==== ======== ====================
+   \_dmarc.\ ``domain`` 10800 TXT           ``v=DMARC1; p=none``
+   ==================== ===== ==== ======== ====================
 
-where ``really-long-key`` is your public key.
+You can check this with ``dig -t TXT _dmarc.<domain>`` similar to the
-
+last section.
-Based on the content of this file, we can add a ``DKIM`` record to the
-domain ``example.com``.
-
-=========================== ===== ==== ==============================
-Name (Subdomain)            TTL   Type Value
-=========================== ===== ==== ==============================
-mail._domainkey.example.com 10800 TXT  ``v=DKIM1; p=<really-long-key>``
-=========================== ===== ==== ==============================
-
-You can check this with
-
-::
-
-   $ nix-shell -p bind --command "host -t txt mail._domainkey.example.com"
-   mail._domainkey.example.com descriptive text "v=DKIM1;p=<really-long-key>"
 
 Note that it can take a while until a DNS entry is propagated.
 
-Set a ``DMARC`` record
+C) Test your Setup
-^^^^^^^^^^^^^^^^^^^^^^
+~~~~~~~~~~~~~~~~~~
-
-Add a ``DMARC`` record to the domain ``example.com``.
-
-======================== ===== ==== ====================
-Name (Subdomain)         TTL   Type Value
-======================== ===== ==== ====================
-_dmarc.example.com       10800 TXT  ``v=DMARC1; p=none``
-======================== ===== ==== ====================
-
-You can check this with
-
-::
-
-   $ nix-shell -p bind --command "host -t TXT _dmarc.example.com"
-   _dmarc.example.com descriptive text "v=DMARC1; p=none"
-
-Note that it can take a while until a DNS entry is propagated.
-
-
-Test your Setup
-~~~~~~~~~~~~~~~
 
 Write an email to your aunt (who has been waiting for your reply far too
 long), and sign up for some of the finest newsletters the Internet has.

flake.lock

@@ -1,76 +0,0 @@
-{
-  "nodes": {
-    "blobs": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1604995301,
-        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
-        "owner": "simple-nixos-mailserver",
-        "repo": "blobs",
-        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "simple-nixos-mailserver",
-        "repo": "blobs",
-        "type": "gitlab"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1717602782,
-        "narHash": "sha256-pL9jeus5QpX5R+9rsp3hhZ+uplVHscNJh8n8VpqscM0=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e8057b67ebf307f01bdcc8fba94d94f75039d1f6",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-unstable",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs-24_05": {
-      "locked": {
-        "lastModified": 1717144377,
-        "narHash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "805a384895c696f802a9bf5bf4720f37385df547",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-24.05",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "blobs": "blobs",
-        "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs",
-        "nixpkgs-24_05": "nixpkgs-24_05"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,127 +0,0 @@
-{
-  description = "A complete and Simple Nixos Mailserver";
-
-  inputs = {
-    flake-compat = {
-      url = "github:edolstra/flake-compat";
-      flake = false;
-    };
-    nixpkgs.url = "flake:nixpkgs/nixos-unstable";
-    nixpkgs-24_05.url = "flake:nixpkgs/nixos-24.05";
-    blobs = {
-      url = "gitlab:simple-nixos-mailserver/blobs";
-      flake = false;
-    };
-  };
-
-  outputs = { self, blobs, nixpkgs, nixpkgs-24_05, ... }: let
-    lib = nixpkgs.lib;
-    system = "x86_64-linux";
-    pkgs = nixpkgs.legacyPackages.${system};
-    releases = [
-      {
-        name = "unstable";
-        pkgs = nixpkgs.legacyPackages.${system};
-      }
-      {
-        name = "24.05";
-        pkgs = nixpkgs-24_05.legacyPackages.${system};
-      }
-    ];
-    testNames = [
-      "internal"
-      "external"
-      "clamav"
-      "multiple"
-      "ldap"
-    ];
-    genTest = testName: release: {
-      "name"= "${testName}-${builtins.replaceStrings ["."] ["_"] release.name}";
-      "value"= import (./tests/. + "/${testName}.nix") {
-        pkgs = release.pkgs;
-        inherit blobs;
-      };
-    };
-    # Generate an attribute set such as
-    # {
-    #   external-unstable = <derivation>;
-    #   external-21_05 = <derivation>;
-    #   ...
-    # }
-    allTests = lib.listToAttrs (
-      lib.flatten (map (t: map (r: genTest t r) releases) testNames));
-
-    mailserverModule = import ./.;
-
-    # Generate a MarkDown file describing the options of the NixOS mailserver module
-    optionsDoc = let
-      eval = lib.evalModules {
-        modules = [
-          mailserverModule
-          {
-            _module.check = false;
-            mailserver = {
-              fqdn = "mx.example.com";
-              domains = [
-                "example.com"
-              ];
-              dmarcReporting = {
-                organizationName = "Example Corp";
-                domain = "example.com";
-              };
-            };
-          }
-        ];
-      };
-      options = builtins.toFile "options.json" (builtins.toJSON
-        (lib.filter (opt: opt.visible && !opt.internal && lib.head opt.loc == "mailserver")
-          (lib.optionAttrSetToDocList eval.options)));
-    in pkgs.runCommand "options.md" { buildInputs = [pkgs.python3Minimal]; } ''
-      echo "Generating options.md from ${options}"
-      python ${./scripts/generate-options.py} ${options} > $out
-    '';
-
-    documentation = pkgs.stdenv.mkDerivation {
-      name = "documentation";
-      src = lib.sourceByRegex ./docs ["logo\\.png" "conf\\.py" "Makefile" ".*\\.rst"];
-      buildInputs = [(
-        pkgs.python3.withPackages (p: with p; [
-          sphinx
-          sphinx_rtd_theme
-          myst-parser
-          linkify-it-py
-        ])
-      )];
-      buildPhase = ''
-        cp ${optionsDoc} options.md
-        # Workaround for https://github.com/sphinx-doc/sphinx/issues/3451
-        unset SOURCE_DATE_EPOCH
-        make html
-      '';
-      installPhase = ''
-        cp -Tr _build/html $out
-      '';
-    };
-
-  in {
-    nixosModules = rec {
-      mailserver = mailserverModule;
-      default = mailserver;
-    };
-    nixosModule = self.nixosModules.default; # compatibility
-    hydraJobs.${system} = allTests // {
-      inherit documentation;
-    };
-    checks.${system} = allTests;
-    packages.${system} = {
-      inherit optionsDoc documentation;
-    };
-    devShells.${system}.default = pkgs.mkShell {
-      inputsFrom = [ documentation ];
-      packages = with pkgs; [
-        clamav
-      ];
-    };
-    devShell.${system} = self.devShells.${system}.default; # compatibility
-  };
-}

mail-server/assertions.nix

@@ -1,18 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  assertions = lib.optionals config.mailserver.ldap.enable [
-    {
-      assertion = config.mailserver.loginAccounts == {};
-      message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.loginAccounts";
-    }
-    {
-      assertion = config.mailserver.forwards == {};
-      message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.forwards";
-    }
-  ] ++ lib.optionals (config.mailserver.enable && config.mailserver.certificateScheme != "acme") [
-    {
-      assertion = config.mailserver.acmeCertificateName == config.mailserver.fqdn;
-      message = "When the certificate scheme is not 'acme' (mailserver.certificateScheme != \"acme\"), it is not possible to define mailserver.acmeCertificateName";
-    }
-  ];
-}

mail-server/clamav.nix

@@ -14,17 +14,19 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ config, pkgs, lib, options, ... }:
+{ config, pkgs, lib, ... }:
 
 let
   cfg = config.mailserver;
 in
 {
   config = lib.mkIf (cfg.enable && cfg.virusScanning) {
-    services.clamav.daemon = {
+    services.clamav.daemon.enable = true;
-      enable = true;
-      settings.PhishingScanURLs = "no";
-    };
     services.clamav.updater.enable = true;
+
+    services.clamav.daemon.extraConfig = ''
+      PhishingScanURLs no
+    '';
   };
 }
+

mail-server/common.nix

@@ -21,22 +21,22 @@ let
 in
 {
   # cert :: PATH
-  certificatePath = if cfg.certificateScheme == "manual"
+  certificatePath = if cfg.certificateScheme == 1
              then cfg.certificateFile
-             else if cfg.certificateScheme == "selfsigned"
+             else if cfg.certificateScheme == 2
                   then "${cfg.certificateDirectory}/cert-${cfg.fqdn}.pem"
-                  else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx"
+                  else if cfg.certificateScheme == 3
-                       then "${config.security.acme.certs.${cfg.acmeCertificateName}.directory}/fullchain.pem"
+                       then "/var/lib/acme/${cfg.fqdn}/fullchain.pem"
-                       else throw "unknown certificate scheme";
+                       else throw "Error: Certificate Scheme must be in { 1, 2, 3 }";
 
   # key :: PATH
-  keyPath = if cfg.certificateScheme == "manual"
+  keyPath = if cfg.certificateScheme == 1
         then cfg.keyFile
-        else if cfg.certificateScheme == "selfsigned"
+        else if cfg.certificateScheme == 2
              then "${cfg.certificateDirectory}/key-${cfg.fqdn}.pem"
-              else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx"
+              else if cfg.certificateScheme == 3
-                   then "${config.security.acme.certs.${cfg.acmeCertificateName}.directory}/key.pem"
+                   then "/var/lib/acme/${cfg.fqdn}/key.pem"
-                   else throw "unknown certificate scheme";
+                   else throw "Error: Certificate Scheme must be in { 1, 2, 3 }";
 
   passwordFiles = let
     mkHashFile = name: hash: pkgs.writeText "${builtins.hashString "sha256" name}-password-hash" hash;
@@ -45,26 +45,4 @@ in
     if value.hashedPasswordFile == null then
       builtins.toString (mkHashFile name value.hashedPassword)
     else value.hashedPasswordFile) cfg.loginAccounts;
-
-  # Appends the LDAP bind password to files to avoid writing this
-  # password into the Nix store.
-  appendLdapBindPwd = {
-    name, file, prefix, suffix ? "", passwordFile, destination
-  }: pkgs.writeScript "append-ldap-bind-pwd-in-${name}" ''
-    #!${pkgs.stdenv.shell}
-    set -euo pipefail
-
-    baseDir=$(dirname ${destination})
-    if (! test -d "$baseDir"); then
-      mkdir -p $baseDir
-      chmod 755 $baseDir
-    fi
-
-    cat ${file} > ${destination}
-    echo -n '${prefix}' >> ${destination}
-    cat ${passwordFile} >> ${destination}
-    echo -n '${suffix}' >> ${destination}
-    chmod 600 ${destination}
-  '';
-
 }

mail-server/debug.nix

@@ -1,4 +0,0 @@
-{ config, lib, ... }:
-{
-  mailserver.policydSPFExtraConfig = lib.mkIf config.mailserver.debug "debugLevel = 4";
-}

mail-server/dovecot.nix

@@ -23,20 +23,11 @@ let
 
   passwdDir = "/run/dovecot2";
   passwdFile = "${passwdDir}/passwd";
-  userdbFile = "${passwdDir}/userdb";
-  # This file contains the ldap bind password
-  ldapConfFile = "${passwdDir}/dovecot-ldap.conf.ext";
-  bool2int = x: if x then "1" else "0";
 
   maildirLayoutAppendix = lib.optionalString cfg.useFsLayout ":LAYOUT=fs";
-  maildirUTF8FolderNames = lib.optionalString cfg.useUTF8FolderNames ":UTF-8";
 
   # maildir in format "/${domain}/${user}"
-  dovecotMaildir =
+  dovecotMaildir = "maildir:${cfg.mailDirectory}/%d/%n${maildirLayoutAppendix}";
-    "maildir:${cfg.mailDirectory}/%d/%n${maildirLayoutAppendix}${maildirUTF8FolderNames}"
-    + (lib.optionalString (cfg.indexDir != null)
-       ":INDEX=${cfg.indexDir}/%d/%n"
-      );
 
   postfixCfg = config.services.postfix;
   dovecot2Cfg = config.services.dovecot2;
@@ -60,42 +51,6 @@ let
     '';
   };
 
-
-  ldapConfig = pkgs.writeTextFile {
-    name = "dovecot-ldap.conf.ext.template";
-    text = ''
-      ldap_version = 3
-      uris = ${lib.concatStringsSep " " cfg.ldap.uris}
-      ${lib.optionalString cfg.ldap.startTls ''
-      tls = yes
-      ''}
-      tls_require_cert = hard
-      tls_ca_cert_file = ${cfg.ldap.tlsCAFile}
-      dn = ${cfg.ldap.bind.dn}
-      sasl_bind = no
-      auth_bind = yes
-      base = ${cfg.ldap.searchBase}
-      scope = ${mkLdapSearchScope cfg.ldap.searchScope}
-      ${lib.optionalString (cfg.ldap.dovecot.userAttrs != null) ''
-      user_attrs = ${cfg.ldap.dovecot.userAttrs}
-      ''}
-      user_filter = ${cfg.ldap.dovecot.userFilter}
-      ${lib.optionalString (cfg.ldap.dovecot.passAttrs != "") ''
-      pass_attrs = ${cfg.ldap.dovecot.passAttrs}
-      ''}
-      pass_filter = ${cfg.ldap.dovecot.passFilter}
-    '';
-  };
-
-  setPwdInLdapConfFile = appendLdapBindPwd {
-    name = "ldap-conf-file";
-    file = ldapConfig;
-    prefix = ''dnpass = "'';
-    suffix = ''"'';
-    passwordFile = cfg.ldap.bind.passwordFile;
-    destination = ldapConfFile;
-  };
-
   genPasswdScript = pkgs.writeScript "generate-password-file" ''
     #!${pkgs.stdenv.shell}
 
@@ -106,9 +61,6 @@ let
       chmod 755 "${passwdDir}"
     fi
 
-    # Prevent world-readable password files, even temporarily.
-    umask 077
-
     for f in ${builtins.toString (lib.mapAttrsToList (name: value: passwordFiles."${name}") cfg.loginAccounts)}; do
       if [ ! -f "$f" ]; then
         echo "Expected password hash file $f does not exist!"
@@ -118,48 +70,18 @@ let
 
     cat <<EOF > ${passwdFile}
     ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:
-      "${name}:${"$(head -n 1 ${passwordFiles."${name}"})"}::::::"
+      "${name}:${"$(cat ${passwordFiles."${name}"})"}:${builtins.toString cfg.vmailUID}:${builtins.toString cfg.vmailUID}::${cfg.mailDirectory}:/run/current-system/sw/bin/nologin:"
-    ) cfg.loginAccounts)}
-    EOF
-
-    cat <<EOF > ${userdbFile}
-    ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:
-      "${name}:::::::"
         + (if lib.isString value.quota
               then "userdb_quota_rule=*:storage=${value.quota}"
               else "")
     ) cfg.loginAccounts)}
     EOF
+
+    chmod 600 ${passwdFile}
   '';
-
-  junkMailboxes = builtins.attrNames (lib.filterAttrs (n: v: v ? "specialUse" && v.specialUse == "Junk") cfg.mailboxes);
-  junkMailboxNumber = builtins.length junkMailboxes;
-  # The assertion garantees there is exactly one Junk mailbox.
-  junkMailboxName = if junkMailboxNumber == 1 then builtins.elemAt junkMailboxes 0 else "";
-
-  mkLdapSearchScope = scope: (
-    if scope == "sub" then "subtree"
-    else if scope == "one" then "onelevel"
-    else scope
-  );
-
 in
 {
   config = with cfg; lib.mkIf enable {
-    assertions = [
-      {
-        assertion = junkMailboxNumber == 1;
-        message = "nixos-mailserver requires exactly one dovecot mailbox with the 'special use' flag set to 'Junk' (${builtins.toString junkMailboxNumber} have been found)";
-      }
-    ];
-
-    # for sieve-test. Shelling it in on demand usually doesnt' work, as it reads
-    # the global config and tries to open shared libraries configured in there,
-    # which are usually not compatible.
-    environment.systemPackages = [
-      pkgs.dovecot_pigeonhole
-    ];
-
     services.dovecot2 = {
       enable = true;
       enableImap = enableImap || enableImapSsl;
@@ -172,52 +94,20 @@ in
       sslServerCert = certificatePath;
       sslServerKey = keyPath;
       enableLmtp = true;
-      modules = [ pkgs.dovecot_pigeonhole ] ++ (lib.optional cfg.fullTextSearch.enable pkgs.dovecot_fts_xapian );
+      modules = [ pkgs.dovecot_pigeonhole ];
-      mailPlugins.globally.enable = lib.optionals cfg.fullTextSearch.enable [ "fts" "fts_xapian" ];
       protocols = lib.optional cfg.enableManageSieve "sieve";
 
-      pluginSettings = {
+      sieveScripts = {
-        sieve = "file:${cfg.sieveDirectory}/%u/scripts;active=${cfg.sieveDirectory}/%u/active.sieve";
+        after = builtins.toFile "spam.sieve" ''
-        sieve_default = "file:${cfg.sieveDirectory}/%u/default.sieve";
-        sieve_default_name = "default";
-      };
-
-      sieve = {
-        extensions = [
-          "fileinto"
-        ];
-
-        scripts.after = builtins.toFile "spam.sieve" ''
           require "fileinto";
 
           if header :is "X-Spam" "Yes" {
-              fileinto "${junkMailboxName}";
+              fileinto "Junk";
               stop;
           }
         '';
-
-        pipeBins = map lib.getExe [
-          (pkgs.writeShellScriptBin "sa-learn-ham.sh"
-            "exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/worker-controller.sock learn_ham")
-          (pkgs.writeShellScriptBin "sa-learn-spam.sh"
-            "exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/worker-controller.sock learn_spam")
-        ];
       };
 
-      imapsieve.mailbox = [
-        {
-          name = junkMailboxName;
-          causes = [ "COPY" "APPEND" ];
-          before = ./dovecot/imap_sieve/report-spam.sieve;
-        }
-        {
-          name = "*";
-          from = junkMailboxName;
-          causes = [ "COPY" ];
-          before = ./dovecot/imap_sieve/report-ham.sieve;
-        }
-      ];
-
       mailboxes = cfg.mailboxes;
 
       extraConfig = ''
@@ -293,7 +183,7 @@ in
           }
         }
 
-        recipient_delimiter = ${cfg.recipientDelimiter}
+        recipient_delimiter = +
         lmtp_save_to_detail_mailbox = ${cfg.lmtpSaveToDetailMailbox}
 
         protocol lmtp {
@@ -307,23 +197,9 @@ in
 
         userdb {
           driver = passwd-file
-          args = ${userdbFile}
+          args = ${passwdFile}
-          default_fields = uid=${builtins.toString cfg.vmailUID} gid=${builtins.toString cfg.vmailUID} home=${cfg.mailDirectory}
         }
 
-        ${lib.optionalString cfg.ldap.enable ''
-        passdb {
-          driver = ldap
-          args = ${ldapConfFile}
-        }
-
-        userdb {
-          driver = ldap
-          args = ${ldapConfFile}
-          default_fields = home=/var/vmail/ldap/%u uid=${toString cfg.vmailUID} gid=${toString cfg.vmailUID}
-        }
-        ''}
-
         service auth {
           unix_listener auth {
             mode = 0660
@@ -339,26 +215,28 @@ in
           inbox = yes
         }
 
-        ${lib.optionalString cfg.fullTextSearch.enable ''
         plugin {
-          plugin = fts fts_xapian
+          sieve_plugins = sieve_imapsieve sieve_extprograms
-          fts = xapian
+          sieve = file:${cfg.sieveDirectory}/%u/scripts;active=${cfg.sieveDirectory}/%u/active.sieve
-          fts_xapian = partial=${toString cfg.fullTextSearch.minSize} full=${toString cfg.fullTextSearch.maxSize} attachments=${bool2int cfg.fullTextSearch.indexAttachments} verbose=${bool2int cfg.debug}
+          sieve_default = file:${cfg.sieveDirectory}/%u/default.sieve
+          sieve_default_name = default
 
-          fts_autoindex = ${if cfg.fullTextSearch.autoIndex then "yes" else "no"}
+          # From elsewhere to Spam folder
+          imapsieve_mailbox1_name = Junk
+          imapsieve_mailbox1_causes = COPY
+          imapsieve_mailbox1_before = file:${stateDir}/imap_sieve/report-spam.sieve
 
-          ${lib.strings.concatImapStringsSep "\n" (n: x: "fts_autoindex_exclude${if n==1 then "" else toString n} = ${x}") cfg.fullTextSearch.autoIndexExclude}
+          # From Spam folder to elsewhere
+          imapsieve_mailbox2_name = *
+          imapsieve_mailbox2_from = Junk
+          imapsieve_mailbox2_causes = COPY
+          imapsieve_mailbox2_before = file:${stateDir}/imap_sieve/report-ham.sieve
 
-          fts_enforced = ${cfg.fullTextSearch.enforced}
+          sieve_pipe_bin_dir = ${pipeBin}/pipe/bin
+
+          sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
         }
 
-        ${lib.optionalString (cfg.fullTextSearch.memoryLimit != null) ''
-        service indexer-worker {
-          vsz_limit = ${toString (cfg.fullTextSearch.memoryLimit*1024*1024)}
-        }
-        ''}
-        ''}
-
         lda_mailbox_autosubscribe = yes
         lda_mailbox_autocreate = yes
       '';
@@ -367,33 +245,16 @@ in
     systemd.services.dovecot2 = {
       preStart = ''
         ${genPasswdScript}
-      '' + (lib.optionalString cfg.ldap.enable setPwdInLdapConfFile);
+        rm -rf '${stateDir}/imap_sieve'
+        mkdir '${stateDir}/imap_sieve'
+        cp -p "${./dovecot/imap_sieve}"/*.sieve '${stateDir}/imap_sieve/'
+        for k in "${stateDir}/imap_sieve"/*.sieve ; do
+          ${pkgs.dovecot_pigeonhole}/bin/sievec "$k"
+        done
+        chown -R '${dovecot2Cfg.mailUser}:${dovecot2Cfg.mailGroup}' '${stateDir}/imap_sieve'
+      '';
     };
 
-    systemd.services.postfix.restartTriggers = [ genPasswdScript ] ++ (lib.optional cfg.ldap.enable [setPwdInLdapConfFile]);
+    systemd.services.postfix.restartTriggers = [ genPasswdScript ];
-
-    systemd.services.dovecot-fts-xapian-optimize = lib.mkIf (cfg.fullTextSearch.enable && cfg.fullTextSearch.maintenance.enable) {
-      description = "Optimize dovecot indices for fts_xapian";
-      requisite = [ "dovecot2.service" ];
-      after = [ "dovecot2.service" ];
-      startAt = cfg.fullTextSearch.maintenance.onCalendar;
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.dovecot}/bin/doveadm fts optimize -A";
-        PrivateDevices = true;
-        PrivateNetwork = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectSystem = true;
-        PrivateTmp = true;
-      };
-    };
-    systemd.timers.dovecot-fts-xapian-optimize = lib.mkIf (cfg.fullTextSearch.enable && cfg.fullTextSearch.maintenance.enable && cfg.fullTextSearch.maintenance.randomizedDelaySec != 0) {
-      timerConfig = {
-        RandomizedDelaySec = cfg.fullTextSearch.maintenance.randomizedDelaySec;
-      };
-    };
   };
 }

mail-server/environment.nix

@@ -23,6 +23,6 @@ in
   config = with cfg; lib.mkIf enable {
     environment.systemPackages = with pkgs; [
       dovecot opendkim openssh postfix rspamd
-    ] ++ (if certificateScheme == "selfsigned" then [ openssl ] else []);
+    ] ++ (if certificateScheme == 2 then [ openssl ] else []);
   };
 }

mail-server/kresd.nix

@@ -22,6 +22,7 @@ in
 {
   config = lib.mkIf (cfg.enable && cfg.localDnsResolver) {
     services.kresd.enable = true;
+    networking.nameservers = [ "127.0.0.1" ];
   };
 }
 

mail-server/networking.nix

@@ -14,13 +14,13 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ config, lib, ... }:
+{ config, pkgs, lib, ... }:
 
 let
   cfg = config.mailserver;
 in
 {
-  config = with cfg; lib.mkIf (enable && openFirewall) {
+  config = with cfg; lib.mkIf enable {
 
     networking.firewall = {
       allowedTCPPorts = [ 25 ]
@@ -31,7 +31,7 @@ in
         ++ lib.optional enablePop3 110
         ++ lib.optional enablePop3Ssl 995
         ++ lib.optional enableManageSieve 4190
-        ++ lib.optional (certificateScheme == "acme-nginx") 80;
+        ++ lib.optional (certificateScheme == 3) 80;
     };
   };
 }

mail-server/nginx.nix

@@ -17,26 +17,28 @@
 
 { config, pkgs, lib, ... }:
 
-with (import ./common.nix { inherit config lib pkgs; });
+with (import ./common.nix { inherit config; });
 
 let
   cfg = config.mailserver;
+  acmeRoot = "/var/lib/acme/acme-challenge";
 in
 {
-  config = lib.mkIf (cfg.enable && (cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx")) {
+  config = lib.mkIf (cfg.enable && cfg.certificateScheme == 3) {
-    services.nginx = lib.mkIf (cfg.certificateScheme == "acme-nginx") {
+    services.nginx = {
       enable = true;
       virtualHosts."${cfg.fqdn}" = {
         serverName = cfg.fqdn;
-        serverAliases = cfg.certificateDomains;
         forceSSL = true;
         enableACME = true;
+        acmeRoot = acmeRoot;
       };
     };
 
-    security.acme.certs."${cfg.acmeCertificateName}".reloadServices = [
+    security.acme.certs."${cfg.fqdn}".postRun = ''
-      "postfix.service"
+      systemctl reload nginx
-      "dovecot2.service"
+      systemctl reload postfix
-    ];
+      systemctl reload dovecot2
+    '';
   };
 }

mail-server/opendkim.nix

@@ -29,7 +29,7 @@ let
       dkim_txt = "${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.txt";
     in
         ''
-          if [ ! -f "${dkim_key}" ]
+          if [ ! -f "${dkim_key}" ] || [ ! -f "${dkim_txt}" ]
           then
               ${pkgs.opendkim}/bin/opendkim-genkey -s "${cfg.dkimSelector}" \
                                                    -d "${dom}" \
@@ -37,16 +37,15 @@ let
                                                    --directory="${cfg.dkimKeyDirectory}"
               mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.private" "${dkim_key}"
               mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.txt" "${dkim_txt}"
-              chmod 644 "${dkim_txt}"
               echo "Generated key for domain ${dom} selector ${cfg.dkimSelector}"
           fi
         '';
   createAllCerts = lib.concatStringsSep "\n" (map createDomainDkimCert cfg.domains);
 
-  keyTable = pkgs.writeText "opendkim-KeyTable"
+  keyTable = pkgs.writeText "opendkim-KeyTable" 
-    (lib.concatStringsSep "\n" (lib.flip map cfg.domains
+    (lib.concatStringsSep "\n" (lib.flip map cfg.domains 
       (dom: "${dom} ${dom}:${cfg.dkimSelector}:${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.key")));
-  signingTable = pkgs.writeText "opendkim-SigningTable"
+  signingTable = pkgs.writeText "opendkim-SigningTable" 
     (lib.concatStringsSep "\n" (lib.flip map cfg.domains (dom: "${dom} ${dom}")));
 
   dkim = config.services.opendkim;
@@ -60,7 +59,7 @@ in
         keyPath = cfg.dkimKeyDirectory;
         domains = "csl:${builtins.concatStringsSep "," cfg.domains}";
         configFile = pkgs.writeText "opendkim.conf" (''
-          Canonicalization ${cfg.dkimHeaderCanonicalization}/${cfg.dkimBodyCanonicalization}
+          Canonicalization relaxed/simple
           UMask 0002
           Socket ${dkim.socket}
           KeyTable file:${keyTable}

mail-server/postfix.nix

@@ -22,57 +22,25 @@ let
   inherit (lib.strings) concatStringsSep;
   cfg = config.mailserver;
 
-  # Merge several lookup tables. A lookup table is a attribute set where
+  # valiases_postfix :: [ String ]
-  # - the key is an address (user@example.com) or a domain (@example.com)
+  valiases_postfix = lib.flatten (lib.mapAttrsToList
-  # - the value is a list of addresses
-  mergeLookupTables = tables: lib.zipAttrsWith (n: v: lib.flatten v) tables;
-
-  # valiases_postfix :: Map String [String]
-  valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList
     (name: value:
       let to = name;
-      in map (from: {"${from}" = to;}) (value.aliases ++ lib.singleton name))
+          in map (from: "${from} ${to}") (value.aliases ++ lib.singleton name))
-    cfg.loginAccounts));
+    cfg.loginAccounts);
-  regex_valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList
+
+  # catchAllPostfix :: [ String ]
+  catchAllPostfix = lib.flatten (lib.mapAttrsToList
     (name: value:
       let to = name;
-      in map (from: {"${from}" = to;}) value.aliasesRegexp)
+          in map (from: "@${from} ${to}") value.catchAll)
-    cfg.loginAccounts));
+    cfg.loginAccounts);
 
-  # catchAllPostfix :: Map String [String]
+  # extra_valiases_postfix :: [ String ]
-  catchAllPostfix =  mergeLookupTables (lib.flatten (lib.mapAttrsToList
+  extra_valiases_postfix = attrsToAliasList cfg.extraVirtualAliases;
-    (name: value:
-      let to = name;
-      in map (from: {"@${from}" = to;}) value.catchAll)
-      cfg.loginAccounts));
 
-  # all_valiases_postfix :: Map String [String]
+  # all_valiases_postfix :: [ String ]
-  all_valiases_postfix = mergeLookupTables [valiases_postfix extra_valiases_postfix];
+  all_valiases_postfix = valiases_postfix ++ extra_valiases_postfix;
-
-  # attrsToLookupTable :: Map String (Either String [ String ]) -> Map String [String]
-  attrsToLookupTable = aliases: let
-    lookupTables = lib.mapAttrsToList (from: to: {"${from}" = to;}) aliases;
-  in mergeLookupTables lookupTables;
-
-  # extra_valiases_postfix :: Map String [String]
-  extra_valiases_postfix = attrsToLookupTable cfg.extraVirtualAliases;
-
-  # forwards :: Map String [String]
-  forwards = attrsToLookupTable cfg.forwards;
-
-  # lookupTableToString :: Map String [String] -> String
-  lookupTableToString = attrs: let
-    valueToString = value: lib.concatStringsSep ", " value;
-  in lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value: "${name} ${valueToString value}") attrs);
-
-  # valiases_file :: Path
-  valiases_file = let
-    content = lookupTableToString (mergeLookupTables [all_valiases_postfix catchAllPostfix]);
-  in builtins.toFile "valias" content;
-
-  regex_valiases_file = let
-    content = lookupTableToString regex_valiases_postfix;
-  in builtins.toFile "regex_valias" content;
 
   # denied_recipients_postfix :: [ String ]
   denied_recipients_postfix = (map
@@ -80,12 +48,29 @@ let
     (lib.filter (acct: acct.sendOnly) (lib.attrValues cfg.loginAccounts)));
   denied_recipients_file = builtins.toFile "denied_recipients" (lib.concatStringsSep "\n" denied_recipients_postfix);
 
+  # attrsToAliasList :: Map String (Either String [ String ]) -> [ String ]
+  attrsToAliasList = aliases:
+    let
+      toList = to: if builtins.isList to then to else [to];
+    in lib.mapAttrsToList
+         (from: to: "${from} " + (lib.concatStringsSep ", " (toList to)))
+         aliases;
+
+  # forwards :: [ String ]
+  forwards = attrsToAliasList cfg.forwards;
+
+  # valiases_file :: Path
+  valiases_file = builtins.toFile "valias"
+                      (lib.concatStringsSep "\n" (all_valiases_postfix ++
+                                                  catchAllPostfix));
+
   reject_senders_postfix = (map
     (sender:
       "${sender} REJECT")
     (cfg.rejectSender));
   reject_senders_file = builtins.toFile "reject_senders" (lib.concatStringsSep "\n" (reject_senders_postfix))  ;
 
+
   reject_recipients_postfix = (map
     (recipient:
       "${recipient} REJECT")
@@ -102,8 +87,7 @@ let
   # for details on how this file looks. By using the same file as valiases,
   # every alias is owned (uniquely) by its user.
   # The user's own address is already in all_valiases_postfix.
-  vaccounts_file = builtins.toFile "vaccounts" (lookupTableToString all_valiases_postfix);
+  vaccounts_file = builtins.toFile "vaccounts" (lib.concatStringsSep "\n" all_valiases_postfix);
-  regex_vaccounts_file = builtins.toFile "regex_vaccounts" (lookupTableToString regex_valiases_postfix);
 
   submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" (''
      # Removes sensitive headers from mails handed in via the submission port.
@@ -130,10 +114,13 @@ let
    (lib.optional cfg.dkimSigning "unix:/run/opendkim/opendkim.sock")
    ++ [ "unix:/run/rspamd/rspamd-milter.sock" ];
 
-  policyd-spf = pkgs.writeText "policyd-spf.conf" cfg.policydSPFExtraConfig;
+  policyd-spf = pkgs.writeText "policyd-spf.conf" (
+    cfg.policydSPFExtraConfig
+    + (lib.optionalString cfg.debug ''
+    debugLevel = 4
+  ''));
 
   mappedFile = name: "hash:/var/lib/postfix/conf/${name}";
-  mappedRegexFile = name: "pcre:/var/lib/postfix/conf/${name}";
 
   submissionOptions =
     {
@@ -144,73 +131,21 @@ let
       smtpd_sasl_security_options = "noanonymous";
       smtpd_sasl_local_domain = "$myhostname";
       smtpd_client_restrictions = "permit_sasl_authenticated,reject";
-      smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts${lib.optionalString cfg.ldap.enable ",ldap:${ldapSenderLoginMapFile}"}${lib.optionalString (regex_valiases_postfix != {}) ",pcre:/etc/postfix/regex_vaccounts"}";
+      smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
       smtpd_sender_restrictions = "reject_sender_login_mismatch";
       smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
       cleanup_service_name = "submission-header-cleanup";
     };
-
-  commonLdapConfig = ''
-    server_host = ${lib.concatStringsSep " " cfg.ldap.uris}
-    start_tls = ${if cfg.ldap.startTls then "yes" else "no"}
-    version = 3
-    tls_ca_cert_file = ${cfg.ldap.tlsCAFile}
-    tls_require_cert = yes
-
-    search_base = ${cfg.ldap.searchBase}
-    scope = ${cfg.ldap.searchScope}
-
-    bind = yes
-    bind_dn = ${cfg.ldap.bind.dn}
-  '';
-
-  ldapSenderLoginMap = pkgs.writeText "ldap-sender-login-map.cf" ''
-    ${commonLdapConfig}
-    query_filter = ${cfg.ldap.postfix.filter}
-    result_attribute = ${cfg.ldap.postfix.mailAttribute}
-  '';
-  ldapSenderLoginMapFile = "/run/postfix/ldap-sender-login-map.cf";
-  appendPwdInSenderLoginMap = appendLdapBindPwd {
-    name = "ldap-sender-login-map";
-    file = ldapSenderLoginMap;
-    prefix = "bind_pw = ";
-    passwordFile = cfg.ldap.bind.passwordFile;
-    destination = ldapSenderLoginMapFile;
-  };
-
-  ldapVirtualMailboxMap = pkgs.writeText "ldap-virtual-mailbox-map.cf" ''
-    ${commonLdapConfig}
-    query_filter = ${cfg.ldap.postfix.filter}
-    result_attribute = ${cfg.ldap.postfix.uidAttribute}
-  '';
-  ldapVirtualMailboxMapFile = "/run/postfix/ldap-virtual-mailbox-map.cf";
-  appendPwdInVirtualMailboxMap = appendLdapBindPwd {
-    name = "ldap-virtual-mailbox-map";
-    file = ldapVirtualMailboxMap;
-    prefix = "bind_pw = ";
-    passwordFile = cfg.ldap.bind.passwordFile;
-    destination = ldapVirtualMailboxMapFile;
-  };
 in
 {
   config = with cfg; lib.mkIf enable {
 
-    systemd.services.postfix-setup = lib.mkIf cfg.ldap.enable {
-      preStart = ''
-        ${appendPwdInVirtualMailboxMap}
-        ${appendPwdInSenderLoginMap}
-      '';
-      restartTriggers = [ appendPwdInVirtualMailboxMap appendPwdInSenderLoginMap ];
-    };
-
     services.postfix = {
       enable = true;
       hostname = "${sendingFqdn}";
       networksStyle = "host";
       mapFiles."valias" = valiases_file;
-      mapFiles."regex_valias" = regex_valiases_file;
       mapFiles."vaccounts" = vaccounts_file;
-      mapFiles."regex_vaccounts" = regex_vaccounts_file;
       mapFiles."denied_recipients" = denied_recipients_file;
       mapFiles."reject_senders" = reject_senders_file;
       mapFiles."reject_recipients" = reject_recipients_file;
@@ -218,12 +153,13 @@ in
       sslKey = keyPath;
       enableSubmission = cfg.enableSubmission;
       enableSubmissions = cfg.enableSubmissionSsl;
-      virtual = lookupTableToString (mergeLookupTables [all_valiases_postfix catchAllPostfix forwards]);
+      virtual =
+        (lib.concatStringsSep "\n" (all_valiases_postfix ++ catchAllPostfix ++ forwards));
 
       config = {
         # Extra Config
         mydestination = "";
-        recipient_delimiter = cfg.recipientDelimiter;
+        recipient_delimiter = "+";
         smtpd_banner = "${fqdn} ESMTP NO UCE";
         disable_vrfy_command = true;
         message_size_limit = toString cfg.messageSizeLimit;
@@ -233,19 +169,8 @@ in
         virtual_gid_maps = "static:5000";
         virtual_mailbox_base = mailDirectory;
         virtual_mailbox_domains = vhosts_file;
-        virtual_mailbox_maps = [
+        virtual_mailbox_maps = mappedFile "valias";
-          (mappedFile "valias")
-        ] ++ lib.optionals (cfg.ldap.enable) [
-          "ldap:${ldapVirtualMailboxMapFile}"
-        ] ++ lib.optionals (regex_valiases_postfix != {}) [
-          (mappedRegexFile "regex_valias")
-        ];
-        virtual_alias_maps = lib.mkAfter (lib.optionals (regex_valiases_postfix != {}) [
-          (mappedRegexFile "regex_valias")
-        ]);
         virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
-        # Avoid leakage of X-Original-To, X-Delivered-To headers between recipients
-        lmtp_destination_recipient_limit = "1";
 
         # sasl with dovecot
         smtpd_sasl_type = "dovecot";
@@ -274,6 +199,9 @@ in
         # Submission by mail clients is handled in submissionOptions
         smtpd_tls_security_level = "may";
 
+        # strong might suffice and is computationally less expensive
+        smtpd_tls_eecdh_grade = "ultra";
+
         # Disable obselete protocols
         smtpd_tls_protocols = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
         smtp_tls_protocols = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
@@ -306,26 +234,18 @@ in
         milter_protocol = "6";
         milter_mail_macros = "i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer}";
 
-        # Fix for https://www.postfix.org/smtp-smuggling.html
-        smtpd_forbid_bare_newline = cfg.smtpdForbidBareNewline;
-        smtpd_forbid_bare_newline_exclusions = "$mynetworks";
       };
 
       submissionOptions = submissionOptions;
       submissionsOptions = submissionOptions;
 
       masterConfig = {
-        "lmtp" = {
-          # Add headers when delivering, see http://www.postfix.org/smtp.8.html
-          # D => Delivered-To, O => X-Original-To, R => Return-Path
-          args = [ "flags=O" ];
-        };
         "policy-spf" = {
           type = "unix";
           privileged = true;
           chroot = false;
           command = "spawn";
-          args = [ "user=nobody" "argv=${pkgs.spf-engine}/bin/policyd-spf" "${policyd-spf}"];
+          args = [ "user=nobody" "argv=${pkgs.pypolicyd-spf}/bin/policyd-spf" "${policyd-spf}"];
         };
         "submission-header-cleanup" = {
           type = "unix";

mail-server/rspamd.nix

@@ -30,7 +30,7 @@ in
       inherit debug;
       locals = {
           "milter_headers.conf" = { text = ''
-              extended_spam_headers = true;
+              extended_spam_headers = yes;
           ''; };
           "redis.conf" = { text = ''
               servers = "${cfg.redis.address}:${toString cfg.redis.port}";
@@ -52,21 +52,14 @@ in
                 scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all
               }
           ''; };
-          "dkim_signing.conf" = { text = ''
+      };
-              # Disable outbound email signing, we use opendkim for this
+
-              enabled = false;
+      overrides = {
-          ''; };
+        "milter_headers.conf" = {
-          "dmarc.conf" = { text = ''
+          text = ''
-              ${lib.optionalString cfg.dmarcReporting.enable ''
+            extended_spam_headers = true;
-              reporting {
+          '';
-                enabled = true;
+        };
-                email = "${cfg.dmarcReporting.email}";
-                domain = "${cfg.dmarcReporting.domain}";
-                org_name = "${cfg.dmarcReporting.organizationName}";
-                from_name = "${cfg.dmarcReporting.fromName}";
-                msgid_from = "dmarc-rua";
-              }''}
-          ''; };
       };
 
       workers.rspamd_proxy = {
@@ -101,72 +94,11 @@ in
 
     };
 
-    services.redis.servers.rspamd = {
+    services.redis.enable = true;
-      enable = lib.mkDefault true;
-      port = lib.mkDefault 6380;
-    };
 
     systemd.services.rspamd = {
-      requires = [ "redis-rspamd.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");
+      requires = [ "redis.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");
-      after = [ "redis-rspamd.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");
+      after = [ "redis.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");
-    };
-
-    systemd.services.rspamd-dmarc-reporter = lib.optionalAttrs (cfg.dmarcReporting.enable) {
-      # Explicitly select yesterday's date to work around broken
-      # default behaviour when called without a date.
-      # https://github.com/rspamd/rspamd/issues/4062
-      script = ''
-        ${pkgs.rspamd}/bin/rspamadm dmarc_report $(date -d "yesterday" "+%Y%m%d")
-      '';
-      serviceConfig = {
-        User = "${config.services.rspamd.user}";
-        Group = "${config.services.rspamd.group}";
-
-        AmbientCapabilities = [];
-        CapabilityBoundingSet = "";
-        DevicePolicy = "closed";
-        IPAddressAllow = "localhost";
-        LockPersonality = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProcSubset = "pid";
-        ProtectSystem = "strict";
-        RemoveIPC = true;
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
-        UMask = "0077";
-      };
-    };
-
-    systemd.timers.rspamd-dmarc-reporter = lib.optionalAttrs (cfg.dmarcReporting.enable) {
-      description = "Daily delivery of aggregated DMARC reports";
-      wantedBy = [
-        "timers.target"
-      ];
-      timerConfig = {
-        OnCalendar = "daily";
-        Persistent = true;
-        RandomizedDelaySec = 86400;
-        FixedRandomDelay = true;
-      };
     };
 
     systemd.services.postfix = {

mail-server/systemd.nix

@@ -18,32 +18,40 @@
 
 let
   cfg = config.mailserver;
-  certificatesDeps =
+  preliminarySelfsigned = config.security.acme.preliminarySelfsigned;
-    if cfg.certificateScheme == "manual" then
+  acmeWantsTarget = [ "acme-certificates.target" ]
-      []
+    ++ (lib.optional preliminarySelfsigned "acme-selfsigned-certificates.target");
-    else if cfg.certificateScheme == "selfsigned" then
+  acmeAfterTarget = if preliminarySelfsigned
-      [ "mailserver-selfsigned-certificate.service" ]
+    then [ "acme-selfsigned-certificates.target" ]
-    else
+    else [ "acme-certificates.target" ];
-      [ "acme-finished-${cfg.fqdn}.target" ];
 in
 {
   config = with cfg; lib.mkIf enable {
+    # Add target for when certificates are available
+    systemd.targets."mailserver-certificates" = {
+      wants = lib.mkIf (cfg.certificateScheme == 3) acmeWantsTarget;
+      after = lib.mkIf (cfg.certificateScheme == 3) acmeAfterTarget;
+    };
+
     # Create self signed certificate
-    systemd.services.mailserver-selfsigned-certificate = lib.mkIf (cfg.certificateScheme == "selfsigned") {
+    systemd.services.mailserver-selfsigned-certificate = lib.mkIf (cfg.certificateScheme == 2) {
-      after = [ "local-fs.target" ];
+      wantedBy = [ "mailserver-certificates.target" ];
+      after    = [ "local-fs.target" ];
+      before   = [ "mailserver-certificates.target" ];
       script = ''
         # Create certificates if they do not exist yet
         dir="${cfg.certificateDirectory}"
         fqdn="${cfg.fqdn}"
-        [[ $fqdn == /* ]] && fqdn=$(< "$fqdn")
+        case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
-        key="$dir/key-${cfg.fqdn}.pem";
+        key="''${dir}/key-${cfg.fqdn}.pem";
-        cert="$dir/cert-${cfg.fqdn}.pem";
+        cert="''${dir}/cert-${cfg.fqdn}.pem";
 
-        if [[ ! -f $key || ! -f $cert ]]; then
+        if [ ! -f "''${key}" ] || [ ! -f "''${cert}" ]
+        then
             mkdir -p "${cfg.certificateDirectory}"
-            (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "$key" 2048) &&
+            (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "''${key}" 2048) &&
-                "${pkgs.openssl}/bin/openssl" req -new -key "$key" -x509 -subj "/CN=$fqdn" \
+                "${pkgs.openssl}/bin/openssl" req -new -key "''${key}" -x509 -subj "/CN=''${fqdn}" \
-                        -days 3650 -out "$cert"
+                        -days 3650 -out "''${cert}"
         fi
       '';
       serviceConfig = {
@@ -54,32 +62,24 @@ in
 
     # Create maildir folder before dovecot startup
     systemd.services.dovecot2 = {
-      wants = certificatesDeps;
+      after = [ "mailserver-certificates.target" ];
-      after = certificatesDeps;
+      wants = [ "mailserver-certificates.target" ];
-      preStart = let
+      preStart = ''
-        directories = lib.strings.escapeShellArgs (
-          [ mailDirectory ]
-          ++ lib.optional (cfg.indexDir != null) cfg.indexDir
-        );
-      in ''
         # Create mail directory and set permissions. See
         # <http://wiki2.dovecot.org/SharedMailboxes/Permissions>.
-        # Prevent world-readable paths, even temporarily.
+        mkdir -p "${mailDirectory}"
-        umask 007
+        chgrp "${vmailGroupName}" "${mailDirectory}"
-        mkdir -p ${directories}
+        chmod 02770 "${mailDirectory}"
-        chgrp "${vmailGroupName}" ${directories}
-        chmod 02770 ${directories}
       '';
     };
 
     # Postfix requires dovecot lmtp socket, dovecot auth socket and certificate to work
     systemd.services.postfix = {
-      wants = certificatesDeps;
+      after = [ "dovecot2.service" "mailserver-certificates.target" ]
-      after = [ "dovecot2.service" ]
+        ++ (lib.optional cfg.dkimSigning "opendkim.service");
-        ++ lib.optional cfg.dkimSigning "opendkim.service"
+      wants = [ "mailserver-certificates.target" ];
-        ++ certificatesDeps;
       requires = [ "dovecot2.service" ]
-        ++ lib.optional cfg.dkimSigning "opendkim.service";
+        ++ (lib.optional cfg.dkimSigning "opendkim.service");
     };
   };
 }

mail-server/users.nix

@@ -21,7 +21,7 @@ with config.mailserver;
 let
   vmail_user = {
     name = vmailUserName;
-    isSystemUser = true;
+    isNormalUser = false;
     uid = vmailUID;
     home = mailDirectory;
     createHome = true;
@@ -34,9 +34,6 @@ let
 
     set -euo pipefail
 
-    # Prevent world-readable paths, even temporarily.
-    umask 007
-
     # Create directory to store user sieve scripts if it doesn't exist
     if (! test -d "${sieveDirectory}"); then
       mkdir "${sieveDirectory}"

nix/sources.json

@@ -0,0 +1,33 @@
+{
+    "blobs": {
+        "sha256": "1g687x3b2r4ar5i4xyav5qzpy9fp1phx9wf70f4j3scwny0g7hn1",
+        "type": "tarball",
+        "url": "https://gitlab.com/simple-nixos-mailserver/blobs/-/archive/2cccdf1ca48316f2cfd1c9a0017e8de5a7156265/blobs-2cccdf1ca48316f2cfd1c9a0017e8de5a7156265.tar.gz",
+        "url_template": "https://gitlab.com/simple-nixos-mailserver/blobs/-/archive/<version>/blobs-<version>.tar.gz",
+        "version": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265"
+    },
+    "nixpkgs-20.09": {
+        "branch": "release-20.09",
+        "description": "A read-only mirror of NixOS/nixpkgs tracking the released channels. Send issues and PRs to",
+        "homepage": "https://github.com/NixOS/nixpkgs",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b6eefa48d8e10491e43c0c6155ac12b463f6fed3",
+        "sha256": "0hrp7gshy62bsj719xd6hk6z284pzr8ksw1vvxvyfrffq1f7d8k9",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/b6eefa48d8e10491e43c0c6155ac12b463f6fed3.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "nixpkgs-unstable": {
+        "branch": "master",
+        "description": "A read-only mirror of NixOS/nixpkgs tracking the released channels. Send issues and PRs to",
+        "homepage": "https://github.com/NixOS/nixpkgs",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ee9154c4c1a51a6b1129e8bf8b728ab6432eda3e",
+        "sha256": "1j1laj1b44022k2jmidp0gb8jx1yp4rsjgzcxmxkwlkv7b04bza3",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/ee9154c4c1a51a6b1129e8bf8b728ab6432eda3e.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    }
+}

nix/sources.nix

@@ -0,0 +1,134 @@
+# This file has been generated by Niv.
+
+let
+
+  #
+  # The fetchers. fetch_<type> fetches specs of type <type>.
+  #
+
+  fetch_file = pkgs: spec:
+    if spec.builtin or true then
+      builtins_fetchurl { inherit (spec) url sha256; }
+    else
+      pkgs.fetchurl { inherit (spec) url sha256; };
+
+  fetch_tarball = pkgs: spec:
+    if spec.builtin or true then
+      builtins_fetchTarball { inherit (spec) url sha256; }
+    else
+      pkgs.fetchzip { inherit (spec) url sha256; };
+
+  fetch_git = spec:
+    builtins.fetchGit { url = spec.repo; inherit (spec) rev ref; };
+
+  fetch_builtin-tarball = spec:
+    builtins.trace
+      ''
+        WARNING:
+          The niv type "builtin-tarball" will soon be deprecated. You should
+          instead use `builtin = true`.
+
+          $ niv modify <package> -a type=tarball -a builtin=true
+      ''
+      builtins_fetchTarball { inherit (spec) url sha256; };
+
+  fetch_builtin-url = spec:
+    builtins.trace
+      ''
+        WARNING:
+          The niv type "builtin-url" will soon be deprecated. You should
+          instead use `builtin = true`.
+
+          $ niv modify <package> -a type=file -a builtin=true
+      ''
+      (builtins_fetchurl { inherit (spec) url sha256; });
+
+  #
+  # Various helpers
+  #
+
+  # The set of packages used when specs are fetched using non-builtins.
+  mkPkgs = sources:
+    let
+      sourcesNixpkgs =
+        import (builtins_fetchTarball { inherit (sources.nixpkgs) url sha256; }) {};
+      hasNixpkgsPath = builtins.any (x: x.prefix == "nixpkgs") builtins.nixPath;
+      hasThisAsNixpkgsPath = <nixpkgs> == ./.;
+    in
+      if builtins.hasAttr "nixpkgs" sources
+      then sourcesNixpkgs
+      else if hasNixpkgsPath && ! hasThisAsNixpkgsPath then
+        import <nixpkgs> {}
+      else
+        abort
+          ''
+            Please specify either <nixpkgs> (through -I or NIX_PATH=nixpkgs=...) or
+            add a package called "nixpkgs" to your sources.json.
+          '';
+
+  # The actual fetching function.
+  fetch = pkgs: name: spec:
+
+    if ! builtins.hasAttr "type" spec then
+      abort "ERROR: niv spec ${name} does not have a 'type' attribute"
+    else if spec.type == "file" then fetch_file pkgs spec
+    else if spec.type == "tarball" then fetch_tarball pkgs spec
+    else if spec.type == "git" then fetch_git spec
+    else if spec.type == "builtin-tarball" then fetch_builtin-tarball spec
+    else if spec.type == "builtin-url" then fetch_builtin-url spec
+    else
+      abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
+
+  # Ports of functions for older nix versions
+
+  # a Nix version of mapAttrs if the built-in doesn't exist
+  mapAttrs = builtins.mapAttrs or (
+    f: set: with builtins;
+    listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
+  );
+
+  # fetchTarball version that is compatible between all the versions of Nix
+  builtins_fetchTarball = { url, sha256 }@attrs:
+    let
+      inherit (builtins) lessThan nixVersion fetchTarball;
+    in
+      if lessThan nixVersion "1.12" then
+        fetchTarball { inherit url; }
+      else
+        fetchTarball attrs;
+
+  # fetchurl version that is compatible between all the versions of Nix
+  builtins_fetchurl = { url, sha256 }@attrs:
+    let
+      inherit (builtins) lessThan nixVersion fetchurl;
+    in
+      if lessThan nixVersion "1.12" then
+        fetchurl { inherit url; }
+      else
+        fetchurl attrs;
+
+  # Create the final "sources" from the config
+  mkSources = config:
+    mapAttrs (
+      name: spec:
+        if builtins.hasAttr "outPath" spec
+        then abort
+          "The values in sources.json should not have an 'outPath' attribute"
+        else
+          spec // { outPath = fetch config.pkgs name spec; }
+    ) config.sources;
+
+  # The "config" used by the fetchers
+  mkConfig =
+    { sourcesFile ? ./sources.json
+    , sources ? builtins.fromJSON (builtins.readFile sourcesFile)
+    , pkgs ? mkPkgs sources
+    }: rec {
+      # The sources, i.e. the attribute set of spec name to spec
+      inherit sources;
+
+      # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
+      inherit pkgs;
+    };
+in
+mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); }

nixops/single-server.nix

@@ -5,7 +5,7 @@
     { config, pkgs, ... }:
     {
         imports = [
-            ../default.nix
+            ./../default.nix
         ];
 
         mailserver = {

scripts/generate-options.py

@@ -1,82 +0,0 @@
-import json
-import sys
-
-header = """
-# Mailserver options
-
-## `mailserver`
-
-"""
-
-template = """
-`````{{option}} {key}
-{description}
-
-{type}
-{default}
-{example}
-`````
-"""
-
-f = open(sys.argv[1])
-options = json.load(f)
-
-groups = ["mailserver.loginAccounts",
-          "mailserver.certificate",
-          "mailserver.dkim",
-          "mailserver.dmarcReporting",
-          "mailserver.fullTextSearch",
-          "mailserver.redis",
-          "mailserver.ldap",
-          "mailserver.monitoring",
-          "mailserver.backup",
-          "mailserver.borgbackup"]
-
-def render_option_value(opt, attr):
-  if attr in opt:
-      if isinstance(opt[attr], dict) and '_type' in opt[attr]:
-          if opt[attr]['_type'] == 'literalExpression':
-              if '\n' in opt[attr]['text']:
-                  res = '\n```nix\n' + opt[attr]['text'].rstrip('\n') + '\n```'
-              else:
-                  res = '```{}```'.format(opt[attr]['text'])
-          elif opt[attr]['_type'] == 'literalMD':
-              res = opt[attr]['text']
-      else:
-          s = str(opt[attr])
-          if s == "":
-              res = '`""`'
-          elif '\n' in s:
-              res = '\n```\n' + s.rstrip('\n') + '\n```'
-          else:
-              res = '```{}```'.format(s)
-      res = '- ' + attr + ': ' + res
-  else:
-      res = ""
-  return res
-
-def print_option(opt):
-    if isinstance(opt['description'], dict) and '_type' in opt['description']: # mdDoc
-        description = opt['description']['text']
-    else:
-        description = opt['description']
-    print(template.format(
-        key=opt['name'],
-        description=description or "",
-        type="- type: ```{}```".format(opt['type']),
-        default=render_option_value(opt, 'default'),
-        example=render_option_value(opt, 'example')))
-
-
-print(header)
-for opt in options:
-    if any([opt['name'].startswith(c) for c in groups]):
-        continue
-    print_option(opt)
-
-for c in groups:
-    print('## `{}`'.format(c))
-    print()
-    for opt in options:
-        if opt['name'].startswith(c):
-            print_option(opt)

scripts/mail-check.py

@@ -9,7 +9,7 @@ import time
 
 RETRY = 100
 
-def _send_mail(smtp_host, smtp_port, smtp_username, from_addr, from_pwd, to_addr, subject, starttls):
+def _send_mail(smtp_host, smtp_port, from_addr, from_pwd, to_addr, subject, starttls):
     print("Sending mail with subject '{}'".format(subject))
     message = "\n".join([
         "From: {from_addr}",
@@ -24,36 +24,28 @@ def _send_mail(smtp_host, smtp_port, smtp_username, from_addr, from_pwd, to_addr
 
     retry = RETRY
     while True:
-        try:
+        with smtplib.SMTP(smtp_host, port=smtp_port) as smtp:
-            with smtplib.SMTP(smtp_host, port=smtp_port) as smtp:
+            if starttls:
-                try:
+                smtp.starttls()
-                    if starttls:
+            if from_pwd is not None:
-                        smtp.starttls()
+                smtp.login(from_addr, from_pwd)
-                    if from_pwd is not None:
+            try:
-                        smtp.login(smtp_username or from_addr, from_pwd)
+                smtp.sendmail(from_addr, [to_addr], message)
-
+                return
-                    smtp.sendmail(from_addr, [to_addr], message)
+            except smtplib.SMTPResponseException as e:
-                    return
+                # This is a service unavailable error
-                except smtplib.SMTPResponseException as e:
+                # In this situation, we want to retry.
-                    if e.smtp_code == 451:  # service unavailable error
+                if e.smtp_code == 451:
-                        print(e)
+                    if retry > 0:
-                    elif e.smtp_code == 454:  # smtplib.SMTPResponseException: (454, b'4.3.0 Try again later')
+                        retry = retry - 1
-                        print(e)
+                        time.sleep(1)
+                        continue
                     else:
-                        raise
+                        print("Error while sending mail: %s" % e)
-        except OSError as e:
+                        exit(5)
-            if e.errno in [16, -2]:
+            except Exception as e:
-                print("OSError exception message: ", e)
+                print("Error while sending mail: %s" % e)
-            else:
+                exit(4)
-                raise
-
-        if retry > 0:
-            retry = retry - 1
-            time.sleep(1)
-            print("Retrying")
-        else:
-            print("Retry attempts exhausted")
-            exit(5)
 
 def _read_mail(
         imap_host,
@@ -141,7 +133,6 @@ def send_and_read(args):
 
     _send_mail(smtp_host=args.smtp_host,
                smtp_port=args.smtp_port,
-               smtp_username=args.smtp_username,
                from_addr=args.from_addr,
                from_pwd=src_pwd,
                to_addr=args.to_addr,
@@ -172,7 +163,6 @@ parser_send_and_read = subparsers.add_parser('send-and-read', description="Send
 parser_send_and_read.add_argument('--smtp-host', type=str)
 parser_send_and_read.add_argument('--smtp-port', type=str, default=25)
 parser_send_and_read.add_argument('--smtp-starttls', action='store_true')
-parser_send_and_read.add_argument('--smtp-username', type=str, default='', help="username used for smtp login. If not specified, the from-addr value is used")
 parser_send_and_read.add_argument('--from-addr', type=str)
 parser_send_and_read.add_argument('--imap-host', required=True, type=str)
 parser_send_and_read.add_argument('--imap-port', type=str, default=993)

shell.nix

@@ -1,10 +1,11 @@
-(import
+let
-  (
+  nixpkgs = (import ./nix/sources.nix).nixpkgs-unstable;
-    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+  pkgs = import nixpkgs {};
-    fetchTarball {
+in
-      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+pkgs.mkShell {
-      sha256 = lock.nodes.flake-compat.locked.narHash;
+  buildInputs = with pkgs; [
-    }
+  (python3.withPackages(p: [p.sphinx p.sphinx_rtd_theme]))
-  )
+  niv
-  { src = ./.; }
+  jq clamav
-).shellNix
+  ];
+}

tests/clamav.nix

@@ -14,12 +14,19 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ pkgs ? import <nixpkgs> {}, blobs}:
+{ pkgs ? import <nixpkgs> {}}:
 
 pkgs.nixosTest {
   name = "clamav";
   nodes = {
     server = { config, pkgs, lib, ... }:
+      let
+        sources = import ../nix/sources.nix;
+        blobs = pkgs.fetchzip {
+          url = sources.blobs.url;
+          sha256 = sources.blobs.sha256;
+        };
+      in
         {
             imports = [
                 ../default.nix
@@ -189,10 +196,10 @@ pkgs.nixosTest {
 
       # TODO put this blocking into the systemd units? I am not sure if rspamd already waits for the clamd socket.
       server.wait_until_succeeds(
-          "set +e; timeout 1 ${nodes.server.nixpkgs.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+          "timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
       )
       server.wait_until_succeeds(
-          "set +e; timeout 1 ${nodes.server.nixpkgs.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ $? -eq 124 ]"
+          "timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ $? -eq 124 ]"
       )
 
       client.execute("cp -p /etc/root/.* ~/")
@@ -217,12 +224,12 @@ pkgs.nixosTest {
 
       with subtest("virus scan file"):
           server.succeed(
-              'set +o pipefail; clamdscan $(readlink -f /etc/root/eicar.com.txt) | grep "Txt\\.Malware\\.Agent-1787597 FOUND" >&2'
+              'clamdscan $(readlink -f /etc/root/eicar.com.txt) | grep "Txt\\.Malware\\.Agent-1787597 FOUND" >&2'
           )
 
       with subtest("virus scan email"):
           client.succeed(
-              'set +o pipefail; msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | tee /dev/stderr | grep "server message: 554 5\\.7\\.1" >&2'
+              'msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | tee /dev/stderr | grep "server message: 554 5\\.7\\.1" >&2'
           )
           server.succeed("journalctl -u rspamd | grep -i eicar")
           # give the mail server some time to process the mail

tests/default.nix

@@ -0,0 +1,47 @@
+# Generate an attribute sets containing all tests for all releaeses
+# It looks like:
+# - extern.nixpkgs_20.03
+# - extern.nixpkgs_unstable
+# - intern.nixpkgs_20.03
+# - intern.nixpkgs_unstable
+
+with builtins;
+
+let
+  sources = import ../nix/sources.nix;
+
+  releases = listToAttrs (map genRelease releaseNames);
+
+  genRelease = name: {
+    name = name;
+    value = import sources."${name}" {};
+  };
+
+  genTest = testName: release:
+  let
+    pkgs = releases."${release}";
+    test = pkgs.callPackage (./. + "/${testName}.nix") { };
+  in {
+    "name"= builtins.replaceStrings ["." "-"] ["_" "_"] release;
+    "value"= test;
+  };
+
+  releaseNames = [
+    "nixpkgs-unstable"
+    "nixpkgs-20.09"
+  ];
+
+  testNames = [
+    "intern"
+    "extern"
+    "clamav"
+    "multiple"
+  ];
+
+  # Generate an attribute set containing one test per releases
+  genTests = testName: {
+    name = testName;
+    value = listToAttrs (map (genTest testName) (builtins.attrNames releases));
+  };
+  
+in listToAttrs (map genTests testNames)

tests/extern.nix

@@ -14,10 +14,10 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ pkgs ? import <nixpkgs> {}, ...}:
+{ pkgs ? import <nixpkgs> {}}:
 
 pkgs.nixosTest {
-  name = "external";
+  name = "extern";
   nodes = {
     server = { config, pkgs, ... }:
         {
@@ -43,11 +43,6 @@ pkgs.nixosTest {
               domains = [ "example.com" "example2.com" ];
               rewriteMessageId = true;
               dkimKeyBits = 1535;
-              dmarcReporting = {
-                enable = true;
-                domain = "example.com";
-                organizationName = "ACME Corp";
-              };
 
               loginAccounts = {
                   "user1@example.com" = {
@@ -75,15 +70,6 @@ pkgs.nixosTest {
 
               enableImap = true;
               enableImapSsl = true;
-              fullTextSearch = {
-                enable = true;
-                autoIndex = true;
-                # special use depends on https://github.com/NixOS/nixpkgs/pull/93201
-                autoIndexExclude = [ (if (pkgs.lib.versionAtLeast pkgs.lib.version "21") then "\\Junk" else "Junk") ];
-                enforced = "yes";
-                # fts-xapian warns when memory is low, which makes the test fail
-                memoryLimit = 100000;
-              };
             };
         };
       client = { nodes, config, pkgs, ... }: let
@@ -153,32 +139,12 @@ pkgs.nixosTest {
 
             imap.close()
         '';
-        search = pkgs.writeScriptBin "search" ''
-          #!${pkgs.python3.interpreter}
-          import imaplib
-          import sys
-
-          [_, mailbox, needle] = sys.argv
-
-          with imaplib.IMAP4_SSL('${serverIP}') as imap:
-            imap.login('user1@example.com', 'user1')
-            imap.select(mailbox)
-            status, [response] = imap.search(None, 'BODY', repr(needle))
-            msg_ids = [ i for i in response.decode("utf-8").split(' ') if i ]
-            print(msg_ids)
-            assert status == 'OK'
-            assert len(msg_ids) == 1
-            status, response = imap.fetch(msg_ids[0], '(RFC822)')
-            assert status == "OK"
-            assert needle in repr(response)
-            imap.close()
-        '';
       in {
         imports = [
             ./lib/config.nix
         ];
         environment.systemPackages = with pkgs; [
-          fetchmail msmtp procmail findutils grep-ip check-mail-id test-imap-spam test-imap-ham search
+          fetchmail msmtp procmail findutils grep-ip check-mail-id test-imap-spam test-imap-ham
         ];
         environment.etc = {
           "root/.fetchmailrc" = {
@@ -310,33 +276,6 @@ pkgs.nixosTest {
 
             XOXO User1
           '';
-          "root/email6".text = ''
-            Message-ID: <123457qwerty@host.local.network>
-            From: User2 <user2@example.com>
-            To: User1 <user1@example.com>
-            Cc:
-            Bcc:
-            Subject: This is a test Email from user2 to user1
-            Reply-To:
-
-            Hello User1,
-
-            this email contains the needle:
-            576a4565b70f5a4c1a0925cabdb587a6 
-          '';
-          "root/email7".text = ''
-            Message-ID: <1234578qwerty@host.local.network>
-            From: User2 <user2@example.com>
-            To: User1 <user1@example.com>
-            Cc:
-            Bcc:
-            Subject: This is a test Email from user2 to user1
-            Reply-To:
-
-            Hello User1,
-
-            this email does not contain the needle :(
-          '';
         };
       };
     };
@@ -350,7 +289,7 @@ pkgs.nixosTest {
 
       # TODO put this blocking into the systemd units?
       server.wait_until_succeeds(
-          "set +e; timeout 1 ${nodes.server.nixpkgs.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+          "timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
       )
 
       client.execute("cp -p /etc/root/.* ~/")
@@ -477,38 +416,10 @@ pkgs.nixosTest {
           client.succeed("imap-mark-ham >&2")
           server.wait_until_succeeds("journalctl -u dovecot2 | grep -i sa-learn-ham.sh >&2")
 
-      with subtest("full text search and indexation"):
-          # send 2 email from user2 to user1
-          client.succeed(
-              "msmtp -a test --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email6 >&2"
-          )
-          client.succeed(
-              "msmtp -a test --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email7 >&2"
-          )
-          # give the mail server some time to process the mail
-          server.wait_until_fails('[ "$(postqueue -p)" != "Mail queue is empty" ]')
-
-          # should find exactly one email containing this
-          client.succeed("search INBOX 576a4565b70f5a4c1a0925cabdb587a6 >&2")
-          # should fail because this folder is not indexed
-          client.fail("search Junk a >&2")
-          # check that search really goes through the indexer
-          server.succeed(
-              "journalctl -u dovecot2 | grep -E 'indexer-worker.* Done indexing .INBOX.' >&2"
-          )
-          # check that Junk is not indexed
-          server.fail("journalctl -u dovecot2 | grep 'indexer-worker' | grep -i 'JUNK' >&2")
-
-      with subtest("dmarc reporting"):
-          server.systemctl("start rspamd-dmarc-reporter.service")
-
       with subtest("no warnings or errors"):
           server.fail("journalctl -u postfix | grep -i error >&2")
           server.fail("journalctl -u postfix | grep -i warning >&2")
           server.fail("journalctl -u dovecot2 | grep -i error >&2")
-          # harmless ? https://dovecot.org/pipermail/dovecot/2020-August/119575.html
+          server.fail("journalctl -u dovecot2 | grep -i warning >&2")
-          server.fail(
-              "journalctl -u dovecot2 |grep -v 'Expunged message reappeared, giving a new UID'| grep -v 'FTS Xapian: Box is empty' | grep -i warning >&2"
-          )
     '';
 }

tests/intern.nix

@@ -0,0 +1,99 @@
+#  nixos-mailserver: a simple mail server
+#  Copyright (C) 2016-2018  Robin Raymond
+#
+#  This program is free software: you can redistribute it and/or modify
+#  it under the terms of the GNU General Public License as published by
+#  the Free Software Foundation, either version 3 of the License, or
+#  (at your option) any later version.
+#
+#  This program is distributed in the hope that it will be useful,
+#  but WITHOUT ANY WARRANTY; without even the implied warranty of
+#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#  GNU General Public License for more details.
+#
+#  You should have received a copy of the GNU General Public License
+#  along with this program. If not, see <http://www.gnu.org/licenses/>
+
+{ pkgs ? import <nixpkgs> {}}:
+
+let
+  sendMail = pkgs.writeTextFile {
+    "name" = "send-mail-to-send-only-account";
+    "text" = ''
+      EHLO mail.example.com
+      MAIL FROM: none@example.com
+      RCPT TO: send-only@example.com
+      QUIT
+    '';
+  };
+
+  hashPassword = password: pkgs.runCommand
+    "password-${password}-hashed"
+    { buildInputs = [ pkgs.mkpasswd ]; } ''
+      mkpasswd -m sha-512 ${password} > $out
+    '';
+
+in
+pkgs.nixosTest {
+  name = "intern";
+  nodes = {
+    machine = { config, pkgs, ... }: {
+      imports = [
+        ./../default.nix
+        ./lib/config.nix
+      ];
+
+      virtualisation.memorySize = 1024;
+
+      mailserver = {
+        enable = true;
+        fqdn = "mail.example.com";
+        domains = [ "example.com" ];
+
+        loginAccounts = {
+          "user1@example.com" = {
+            hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/";
+          };
+          "send-only@example.com" = {
+            hashedPasswordFile = hashPassword "send-only";
+            sendOnly = true;
+          };
+        };
+
+        vmailGroupName = "vmail";
+        vmailUID = 5000;
+
+        enableImap = false;
+      };
+    };
+  };
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("vmail gid is set correctly"):
+        machine.succeed("getent group vmail | grep 5000")
+
+    with subtest("mail to send only accounts is rejected"):
+        machine.wait_for_open_port(25)
+        # TODO put this blocking into the systemd units
+        machine.wait_until_succeeds(
+            "timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+        )
+        machine.succeed(
+            "cat ${sendMail} | ${pkgs.netcat-gnu}/bin/nc localhost 25 | grep -q 'This account cannot receive emails'"
+        )
+
+    with subtest("rspamd controller serves web ui"):
+        machine.succeed(
+            "${pkgs.curl}/bin/curl --unix-socket /run/rspamd/worker-controller.sock http://localhost/ | grep -q '<body>'"
+        )
+
+    with subtest("imap port 143 is closed and imaps is serving SSL"):
+        machine.wait_for_closed_port(143)
+        machine.wait_for_open_port(993)
+        machine.succeed(
+            "echo | ${pkgs.openssl}/bin/openssl s_client -connect localhost:993 | grep 'New, TLS'"
+        )
+  '';
+}

tests/internal.nix

@@ -1,195 +0,0 @@
-#  nixos-mailserver: a simple mail server
-#  Copyright (C) 2016-2018  Robin Raymond
-#
-#  This program is free software: you can redistribute it and/or modify
-#  it under the terms of the GNU General Public License as published by
-#  the Free Software Foundation, either version 3 of the License, or
-#  (at your option) any later version.
-#
-#  This program is distributed in the hope that it will be useful,
-#  but WITHOUT ANY WARRANTY; without even the implied warranty of
-#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#  GNU General Public License for more details.
-#
-#  You should have received a copy of the GNU General Public License
-#  along with this program. If not, see <http://www.gnu.org/licenses/>
-
-{ pkgs ? import <nixpkgs> {}, ...}:
-
-let
-  sendMail = pkgs.writeTextFile {
-    "name" = "send-mail-to-send-only-account";
-    "text" = ''
-      EHLO mail.example.com
-      MAIL FROM: none@example.com
-      RCPT TO: send-only@example.com
-      QUIT
-    '';
-  };
-
-  hashPassword = password: pkgs.runCommand
-    "password-${password}-hashed"
-    { buildInputs = [ pkgs.mkpasswd ]; inherit password; } ''
-      mkpasswd -sm bcrypt <<<"$password" > $out
-    '';
-
-  hashedPasswordFile = hashPassword "my-password";
-  passwordFile = pkgs.writeText "password" "my-password";
-in
-pkgs.nixosTest {
-  name = "internal";
-  nodes = {
-    machine = { config, pkgs, ... }: {
-      imports = [
-        ./../default.nix
-        ./lib/config.nix
-      ];
-
-      virtualisation.memorySize = 1024;
-
-      environment.systemPackages = [
-        (pkgs.writeScriptBin "mail-check" ''
-          ${pkgs.python3}/bin/python ${../scripts/mail-check.py} $@
-        '')];
-
-      mailserver = {
-        enable = true;
-        fqdn = "mail.example.com";
-        domains = [ "example.com" "domain.com" ];
-        localDnsResolver = false;
-
-        loginAccounts = {
-          "user1@example.com" = {
-            hashedPasswordFile = hashedPasswordFile;
-          };
-          "user2@example.com" = {
-            hashedPasswordFile = hashedPasswordFile;
-            aliasesRegexp = [''/^user2.*@domain\.com$/''];
-          };
-          "send-only@example.com" = {
-            hashedPasswordFile = hashPassword "send-only";
-            sendOnly = true;
-          };
-        };
-        forwards = {
-          # user2@example.com is a local account and its mails are
-          # also forwarded to user1@example.com
-          "user2@example.com" = "user1@example.com";
-        };
-
-        vmailGroupName = "vmail";
-        vmailUID = 5000;
-
-        enableImap = false;
-      };
-    };
-  };
-  testScript = ''
-    machine.start()
-    machine.wait_for_unit("multi-user.target")
-
-    # Regression test for https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues/205
-    with subtest("mail forwarded can are locally kept"):
-        # A mail sent to user2@example.com is in the user1@example.com mailbox
-        machine.succeed(
-            " ".join(
-                [
-                    "mail-check send-and-read",
-                    "--smtp-port 587",
-                    "--smtp-starttls",
-                    "--smtp-host localhost",
-                    "--imap-host localhost",
-                    "--imap-username user1@example.com",
-                    "--from-addr user1@example.com",
-                    "--to-addr user2@example.com",
-                    "--src-password-file ${passwordFile}",
-                    "--dst-password-file ${passwordFile}",
-                    "--ignore-dkim-spf",
-                ]
-            )
-        )
-        # A mail sent to user2@example.com is in the user2@example.com mailbox
-        machine.succeed(
-            " ".join(
-                [
-                    "mail-check send-and-read",
-                    "--smtp-port 587",
-                    "--smtp-starttls",
-                    "--smtp-host localhost",
-                    "--imap-host localhost",
-                    "--imap-username user2@example.com",
-                    "--from-addr user1@example.com",
-                    "--to-addr user2@example.com",
-                    "--src-password-file ${passwordFile}",
-                    "--dst-password-file ${passwordFile}",
-                    "--ignore-dkim-spf",
-                ]
-            )
-        )
-
-    with subtest("regex email alias are received"):
-        # A mail sent to user2-regex-alias@domain.com is in the user2@example.com mailbox
-        machine.succeed(
-            " ".join(
-                [
-                    "mail-check send-and-read",
-                    "--smtp-port 587",
-                    "--smtp-starttls",
-                    "--smtp-host localhost",
-                    "--imap-host localhost",
-                    "--imap-username user2@example.com",
-                    "--from-addr user1@example.com",
-                    "--to-addr user2-regex-alias@domain.com",
-                    "--src-password-file ${passwordFile}",
-                    "--dst-password-file ${passwordFile}",
-                    "--ignore-dkim-spf",
-                ]
-            )
-        )
-
-    with subtest("user can send from regex email alias"):
-        # A mail sent from user2-regex-alias@domain.com, using user2@example.com credentials is received
-        machine.succeed(
-            " ".join(
-                [
-                    "mail-check send-and-read",
-                    "--smtp-port 587",
-                    "--smtp-starttls",
-                    "--smtp-host localhost",
-                    "--imap-host localhost",
-                    "--smtp-username user2@example.com",
-                    "--from-addr user2-regex-alias@domain.com",
-                    "--to-addr user1@example.com",
-                    "--src-password-file ${passwordFile}",
-                    "--dst-password-file ${passwordFile}",
-                    "--ignore-dkim-spf",
-                ]
-            )
-        )
-
-    with subtest("vmail gid is set correctly"):
-        machine.succeed("getent group vmail | grep 5000")
-
-    with subtest("mail to send only accounts is rejected"):
-        machine.wait_for_open_port(25)
-        # TODO put this blocking into the systemd units
-        machine.wait_until_succeeds(
-            "set +e; timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
-        )
-        machine.succeed(
-            "cat ${sendMail} | ${pkgs.netcat-gnu}/bin/nc localhost 25 | grep -q '554 5.5.0 Error'"
-        )
-
-    with subtest("rspamd controller serves web ui"):
-        machine.succeed(
-            "set +o pipefail; ${pkgs.curl}/bin/curl --unix-socket /run/rspamd/worker-controller.sock http://localhost/ | grep -q '<body>'"
-        )
-
-    with subtest("imap port 143 is closed and imaps is serving SSL"):
-        machine.wait_for_closed_port(143)
-        machine.wait_for_open_port(993)
-        machine.succeed(
-            "echo | ${pkgs.openssl}/bin/openssl s_client -connect localhost:993 | grep 'New, TLS'"
-        )
-  '';
-}

tests/ldap.nix

@@ -1,183 +0,0 @@
-{ pkgs ? import <nixpkgs> {}
-, ...
-}:
-
-let
-  bindPassword = "unsafegibberish";
-  alicePassword = "testalice";
-  bobPassword = "testbob";
-in
-pkgs.nixosTest {
-  name = "ldap";
-  nodes = {
-    machine = { config, pkgs, ... }: {
-      imports = [
-        ./../default.nix
-        ./lib/config.nix
-      ];
-
-      virtualisation.memorySize = 1024;
-
-      services.openssh = {
-        enable = true;
-        permitRootLogin = "yes";
-      };
-
-      environment.systemPackages = [
-        (pkgs.writeScriptBin "mail-check" ''
-          ${pkgs.python3}/bin/python ${../scripts/mail-check.py} $@
-        '')];
-
-      environment.etc.bind-password.text = bindPassword;
-
-      services.openldap = {
-        enable = true;
-        settings = {
-          children = {
-            "cn=schema".includes = [
-              "${pkgs.openldap}/etc/schema/core.ldif"
-              "${pkgs.openldap}/etc/schema/cosine.ldif"
-              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
-              "${pkgs.openldap}/etc/schema/nis.ldif"
-            ];
-            "olcDatabase={1}mdb" = {
-              attrs = {
-                objectClass = [
-                  "olcDatabaseConfig"
-                  "olcMdbConfig"
-                ];
-                olcDatabase = "{1}mdb";
-                olcDbDirectory = "/var/lib/openldap/example";
-                olcSuffix = "dc=example";
-              };
-            };
-          };
-        };
-        declarativeContents."dc=example" = ''
-          dn: dc=example
-          objectClass: domain
-          dc: example
-
-          dn: cn=mail,dc=example
-          objectClass: organizationalRole
-          objectClass: simpleSecurityObject
-          objectClass: top
-          cn: mail
-          userPassword: ${bindPassword}
-
-          dn: ou=users,dc=example
-          objectClass: organizationalUnit
-          ou: users
-
-          dn: cn=alice,ou=users,dc=example
-          objectClass: inetOrgPerson
-          cn: alice
-          sn: Foo
-          mail: alice@example.com
-          userPassword: ${alicePassword}
-
-          dn: cn=bob,ou=users,dc=example
-          objectClass: inetOrgPerson
-          cn: bob
-          sn: Bar
-          mail: bob@example.com
-          userPassword: ${bobPassword}
-        '';
-      };
-
-      mailserver = {
-        enable = true;
-        fqdn = "mail.example.com";
-        domains = [ "example.com" ];
-        localDnsResolver = false;
-
-        ldap = {
-          enable = true;
-          uris = [
-            "ldap://"
-          ];
-          bind = {
-            dn = "cn=mail,dc=example";
-            passwordFile = "/etc/bind-password";
-          };
-          searchBase = "ou=users,dc=example";
-          searchScope = "sub";
-        };
-
-        vmailGroupName = "vmail";
-        vmailUID = 5000;
-
-        enableImap = false;
-      };
-    };
-  };
-  testScript = ''
-    import sys
-    import re
-
-    machine.start()
-    machine.wait_for_unit("multi-user.target")
-
-    # This function retrieves the ldap table file from a postconf
-    # command.
-    # A key lookup is achived and the returned value is compared
-    # to the expected value.
-    def test_lookup(postconf_cmdline, key, expected):
-      conf = machine.succeed(postconf_cmdline).rstrip()
-      ldap_table_path = re.match('.* =.*ldap:(.*)', conf).group(1)
-      value = machine.succeed(f"postmap -q {key} ldap:{ldap_table_path}").rstrip()
-      try:
-        assert value == expected
-      except AssertionError:
-        print(f"Expected {conf} lookup for key '{key}' to return '{expected}, but got '{value}'", file=sys.stderr)
-        raise
-
-    with subtest("Test postmap lookups"):
-      test_lookup("postconf virtual_mailbox_maps", "alice@example.com", "alice@example.com")
-      test_lookup("postconf -P submission/inet/smtpd_sender_login_maps", "alice@example.com", "alice@example.com")
-
-      test_lookup("postconf virtual_mailbox_maps", "bob@example.com", "bob@example.com")
-      test_lookup("postconf -P submission/inet/smtpd_sender_login_maps", "bob@example.com", "bob@example.com")
-
-    with subtest("Test doveadm lookups"):
-      machine.succeed("doveadm user -u alice@example.com")
-      machine.succeed("doveadm user -u bob@example.com")
-
-    with subtest("Files containing secrets are only readable by root"):
-      machine.succeed("ls -l /run/postfix/*.cf | grep -e '-rw------- 1 root root'")
-      machine.succeed("ls -l /run/dovecot2/dovecot-ldap.conf.ext | grep -e '-rw------- 1 root root'")
-
-    with subtest("Test account/mail address binding"):
-      machine.fail(" ".join([
-        "mail-check send-and-read",
-        "--smtp-port 587",
-        "--smtp-starttls",
-        "--smtp-host localhost",
-        "--smtp-username alice@example.com",
-        "--imap-host localhost",
-        "--imap-username bob@example.com",
-        "--from-addr bob@example.com",
-        "--to-addr aliceb@example.com",
-        "--src-password-file <(echo '${alicePassword}')",
-        "--dst-password-file <(echo '${bobPassword}')",
-        "--ignore-dkim-spf"
-      ]))
-      machine.succeed("journalctl -u postfix | grep -q 'Sender address rejected: not owned by user alice@example.com'")
-
-    with subtest("Test mail delivery"):
-      machine.succeed(" ".join([
-        "mail-check send-and-read",
-        "--smtp-port 587",
-        "--smtp-starttls",
-        "--smtp-host localhost",
-        "--smtp-username alice@example.com",
-        "--imap-host localhost",
-        "--imap-username bob@example.com",
-        "--from-addr alice@example.com",
-        "--to-addr bob@example.com",
-        "--src-password-file <(echo '${alicePassword}')",
-        "--dst-password-file <(echo '${bobPassword}')",
-        "--ignore-dkim-spf"
-      ]))
-  '';
-}

tests/minimal.nix

@@ -14,9 +14,9 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-import <nixpkgs/nixos/tests/make-test-python.nix> {
+import <nixpkgs/nixos/tests/make-test.nix> {
 
-  nodes.machine =
+  machine =
     { config, pkgs, ... }:
     {
         imports = [
@@ -26,6 +26,6 @@ import <nixpkgs/nixos/tests/make-test-python.nix> {
 
   testScript =
     ''
-      machine.wait_for_unit("multi-user.target");
+      $machine->waitForUnit("multi-user.target");
     '';
 }

tests/multiple.nix

@@ -1,13 +1,13 @@
 # This tests is used to test features requiring several mail domains.
 
-{ pkgs ? import <nixpkgs> {}, ...}:
+{ pkgs ? import <nixpkgs> {}}:
 
 let
     hashPassword = password: pkgs.runCommand
       "password-${password}-hashed"
-      { buildInputs = [ pkgs.mkpasswd ]; inherit password; }
+      { buildInputs = [ pkgs.mkpasswd ]; }
       ''
-        mkpasswd -sm bcrypt <<<"$password" > $out
+        mkpasswd -m sha-512 ${password} > $out
       '';
 
     password = pkgs.writeText "password" "password";
@@ -30,8 +30,6 @@ let
       };
       services.dnsmasq = {
         enable = true;
-        # Fixme: once nixos-22.11 has been removed, could be replaced by
-        # settings.mx-host = [ "domain1.com,domain1,10" "domain2.com,domain2,10" ];
         extraConfig = ''
           mx-host=domain1.com,domain1,10
           mx-host=domain2.com,domain2,10
@@ -70,10 +68,10 @@ pkgs.nixosTest {
 
     # TODO put this blocking into the systemd units?
     domain1.wait_until_succeeds(
-        "set +e; timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+        "timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
     )
     domain2.wait_until_succeeds(
-        "set +e; timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
+        "timeout 1 ${pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ $? -eq 124 ]"
     )
 
     # user@domain1.com sends a mail to user@domain2.com