This commit is contained in:
Nek0 - 2022-12-18 20:34:20 +01:00
parent 070aa33d2d
commit c60b5f0161
1 changed files with 160 additions and 156 deletions

View File

@ -30,7 +30,8 @@ in
hostName = "mailtng";
firewall.allowedTCPPorts = [
# postfix (smtp and submission)
25 587
25
587
# dovecot (imap)
143
# managesieve
@ -45,7 +46,7 @@ in
hq.statistics.enable = true;
deployment = {
server = "server10";
mounts = [ "etc" "var"];
mounts = [ "etc" "var" ];
};
};
@ -62,164 +63,167 @@ in
};
services = {
postfix = {
enable = true;
enableSmtp = true;
enableSubmission = true;
enableHeaderChecks = true;
domain = "${domain}";
hostname = "${domain}";
sslCert = "/var/lib/acme/${domain}/fullchain.pem";
sslKey = "/var/lib/acme/${domain}/key.pem";
networks = [
postfix = {
enable = true;
enableSmtp = true;
enableSubmission = true;
enableHeaderChecks = true;
domain = "${domain}";
hostname = "${domain}";
sslCert = "/var/lib/acme/${domain}/fullchain.pem";
sslKey = "/var/lib/acme/${domain}/key.pem";
networks = [
"127.0.0.1"
"172.20.77.10" #TODO: take ip directly from server10 config
"10.0.0.0/8"
"[2a00:8180:2c00:284::1a]/64"
];
virtual = ''
postmaster root
abuse root
root root
garbage root
'';
config = {
myorigin = "${domain}";
mydestination = [
"127.0.0.1"
"172.20.77.10" #TODO: take ip directly from server10 config
"10.0.0.0/8"
"[2a00:8180:2c00:284::1a]/64"
];
virtual = ''
postmaster root
abuse root
root root
garbage root
'';
config = {
myorigin = "${domain}";
mydestination = [
"127.0.0.1"
];
mail_owner = "postfix";
smtp_use_tls = true;
smtp_tls_security_level = "encrypt";
smtpd_use_tls = true;
smtpd_tls_security_level = lib.mkForce "encrypt";
smtpd_recipient_restrictions = [
"permit_mynetworks"
"permit_sasl_authenticated"
"reject_unauth_destination"
];
smtpd_relay_restrictions = [
"permit_mynetworks"
"permit_sasl_authenticated"
"reject_unauth_destination"
];
smtpd_sasl_auth_enable = true;
smtpd_tls_auth_only = true;
smtpd_tls_protocols = [
"!SSLv2" "!SSLv3" "!TLSv1" "!TLSv1.1"
];
smtpd_tls_mandatory_ciphers = "high";
smtpd_sasl_path = "/var/lib/postfix/auth";
smtpd_sasl_type = "dovecot";
virtual_mailbox_domains = [
"${domain}"
];
virtual_gid_maps = "static:5000";
virtual_uid_maps = "static:5000";
virtual_minimum_uid = "1000";
virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
virtual_mailbox_base = "/var/spool/mail";
message_size_limit = "40960000";
};
};
dovecot2 = {
enable = true;
enableImap = true;
enableLmtp = true;
enablePop3 = false;
enablePAM = false;
enableQuota = true;
createMailUser = true;
mailLocation = "maildir:~/maildir";
mailboxes = {
Spam = {
auto = "create";
specialUse = "Junk";
};
Sent = {
auto = "create";
specialUse = "Sent";
};
Drafts = {
auto = "create";
specialUse = "Drafts";
};
Trash = {
auto = "create";
specialUse = "Trash";
};
};
modules = [
pkgs.dovecot_pigeonhole
mail_owner = "postfix";
smtp_use_tls = true;
smtp_tls_security_level = "encrypt";
smtpd_use_tls = true;
smtpd_tls_security_level = lib.mkForce "encrypt";
smtpd_recipient_restrictions = [
"permit_mynetworks"
"permit_sasl_authenticated"
"reject_unauth_destination"
];
quotaGlobalPerUser = "1G";
sslServerCert = "/var/lib/acme/${domain}/fullchain.pem";
sslServerKey = "/var/lib/acme/${domain}/key.pem";
protocols = [ ];
mailPlugins = {
perProtocol = {
imap = {
enable = [ ];
};
lmtp = {
enable = [ ];
};
};
};
extraConfig = ''
passdb ldap {
args = ${ldap-auth-config}
}
userdb ldap{
args = ${ldap-auth-config}
}
service lmtp {
unix_listener dovecot-lmtp {
group = postfix
mode = 0660
user = postfix
}
}
service auth {
unix_listener /var/lib/postfix/auth {
group = postfix
mode = 0660
user = postfix
}
user = dovecot2
}
protocol lmtp {
postmaster_address = root@c3d2.de
}
protocol imap {
mail_max_userip_connections = 100
}
'';
};
nginx = {
enable = true;
virtualHosts."${domain}" = {
forceSSL = true;
enableACME = true;
/*
locations."/rspamd/" = {
proxyPass = "http://127.0.0.1:11334/";
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
'';
};
*/
};
};
security.acme.certs."${domain}" = {
reloadServices = [
"postfix.service"
"dovecot2.service"
smtpd_relay_restrictions = [
"permit_mynetworks"
"permit_sasl_authenticated"
"reject_unauth_destination"
];
smtpd_sasl_auth_enable = true;
smtpd_tls_auth_only = true;
smtpd_tls_protocols = [
"!SSLv2"
"!SSLv3"
"!TLSv1"
"!TLSv1.1"
];
smtpd_tls_mandatory_ciphers = "high";
smtpd_sasl_path = "/var/lib/postfix/auth";
smtpd_sasl_type = "dovecot";
virtual_mailbox_domains = [
"${domain}"
];
virtual_gid_maps = "static:5000";
virtual_uid_maps = "static:5000";
virtual_minimum_uid = "1000";
virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
virtual_mailbox_base = "/var/spool/mail";
message_size_limit = "40960000";
};
};
dovecot2 = {
enable = true;
enableImap = true;
enableLmtp = true;
enablePop3 = false;
enablePAM = false;
enableQuota = true;
createMailUser = true;
mailLocation = "maildir:~/maildir";
mailboxes = {
Spam = {
auto = "create";
specialUse = "Junk";
};
Sent = {
auto = "create";
specialUse = "Sent";
};
Drafts = {
auto = "create";
specialUse = "Drafts";
};
Trash = {
auto = "create";
specialUse = "Trash";
};
};
modules = [
pkgs.dovecot_pigeonhole
];
quotaGlobalPerUser = "1G";
sslServerCert = "/var/lib/acme/${domain}/fullchain.pem";
sslServerKey = "/var/lib/acme/${domain}/key.pem";
protocols = [ ];
mailPlugins = {
perProtocol = {
imap = {
enable = [ ];
};
lmtp = {
enable = [ ];
};
};
};
extraConfig = ''
passdb ldap {
args = ${ldap-auth-config}
}
userdb ldap{
args = ${ldap-auth-config}
}
service lmtp {
unix_listener dovecot-lmtp {
group = postfix
mode = 0660
user = postfix
}
}
service auth {
unix_listener /var/lib/postfix/auth {
group = postfix
mode = 0660
user = postfix
}
user = dovecot2
}
protocol lmtp {
postmaster_address = root@c3d2.de
}
protocol imap {
mail_max_userip_connections = 100
}
'';
};
nginx = {
enable = true;
virtualHosts."${domain}" = {
forceSSL = true;
enableACME = true;
/*
locations."/rspamd/" = {
proxyPass = "http://127.0.0.1:11334/";
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
'';
};
*/
};
};
};
security.acme.certs."${domain}" = {
reloadServices = [
"postfix.service"
"dovecot2.service"
];
};
}