diff options
author | Jonas Heinrich <onny@project-insanity.org> | 2023-04-21 08:59:13 +0200 |
---|---|---|
committer | Jonas Heinrich <onny@project-insanity.org> | 2023-05-01 19:12:26 +0200 |
commit | 616ba4ae5cad56b00154da4889925eb767b51ce8 (patch) | |
tree | 422fb293988c5bc9d7f237312caef63113ae21f2 /nixos/modules/services/mail | |
parent | 8d82c9c90f465b4ef4ca111b7307702e229401a3 (diff) |
nixos/maddy: Add tls option
Diffstat (limited to 'nixos/modules/services/mail')
-rw-r--r-- | nixos/modules/services/mail/maddy.nix | 83 |
1 files changed, 80 insertions, 3 deletions
diff --git a/nixos/modules/services/mail/maddy.nix b/nixos/modules/services/mail/maddy.nix index d0b525bcb0027..e11a18cc14289 100644 --- a/nixos/modules/services/mail/maddy.nix +++ b/nixos/modules/services/mail/maddy.nix @@ -13,8 +13,6 @@ let # configuration here https://github.com/foxcpp/maddy/blob/master/maddy.conf # Do not use this in production! - tls off - auth.pass_table local_authdb { table sql_table { driver sqlite3 @@ -35,6 +33,7 @@ let } optional_step file /etc/maddy/aliases } + msgpipeline local_routing { destination postmaster $(local_domains) { modify { @@ -215,6 +214,63 @@ in { ''; }; + tls = { + loader = mkOption { + type = with types; nullOr (enum [ "file" "off" ]); + default = "off"; + description = lib.mdDoc '' + TLS certificates are obtained by modules called "certificate + loaders". Currently only the file loader is supported which reads + certificates from files specifying the options `keyPaths` and + `certPaths`. + ''; + }; + + certificates = mkOption { + type = with types; listOf (submodule { + options = { + keyPath = mkOption { + type = types.path; + example = "/etc/ssl/mx1.example.org.key"; + description = lib.mdDoc '' + Path to the private key used for TLS. + ''; + }; + certPath = mkOption { + type = types.path; + example = "/etc/ssl/mx1.example.org.crt"; + description = lib.mdDoc '' + Path to the certificate used for TLS. + ''; + }; + }; + }); + default = []; + example = lib.literalExpression '' + [{ + keyPath = "/etc/ssl/mx1.example.org.key"; + certPath = "/etc/ssl/mx1.example.org.crt"; + }] + ''; + description = lib.mdDoc '' + A list of attribute sets containing paths to TLS certificates and + keys. Maddy will use SNI if multiple pairs are selected. + ''; + }; + + extraConfig = mkOption { + type = with types; nullOr lines; + description = lib.mdDoc '' + Arguments for the specific certificate loader. Note that Maddy uses + secure defaults for the TLS configuration so there is no need to + change anything in most cases. + See [upstream manual](https://maddy.email/reference/tls/) for + available options. + ''; + default = ""; + }; + }; + openFirewall = mkOption { type = types.bool; default = false; @@ -224,7 +280,7 @@ in { }; ensureAccounts = mkOption { - type = types.listOf types.str; + type = with types; listOf str; default = []; description = lib.mdDoc '' List of IMAP accounts which get automatically created. Note that for @@ -270,6 +326,16 @@ in { config = mkIf cfg.enable { + assertions = [{ + assertion = cfg.tls.loader == "file" -> cfg.tls.certificates != []; + message = '' + If maddy is configured to use TLS, tls.certificates with attribute sets + of certPath and keyPath must be provided. + Read more about obtaining TLS certificates here: + https://maddy.email/tutorials/setting-up/#tls-certificates + ''; + }]; + systemd = { packages = [ pkgs.maddy ]; @@ -318,6 +384,17 @@ in { $(primary_domain) = ${cfg.primaryDomain} $(local_domains) = ${toString cfg.localDomains} hostname ${cfg.hostname} + + ${if (cfg.tls.loader == "file") then '' + tls file ${concatStringsSep " " ( + map (x: x.certPath + " " + x.keyPath + ) cfg.tls.certificates)} ${optionalString (cfg.tls.extraConfig != "") '' + { ${cfg.tls.extraConfig} } + ''} + '' else if (cfg.tls.loader == "off") then '' + tls off + '' else ""} + ${cfg.config} ''; }; |