fricloud/server-configs
2
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

stalwart: exposes the http management panel now for encryption

Browse source 
Also added a LLDAP attribute
This commit is contained in:
eyjhb 2025-05-31 20:43:12 +02:00
parent c06d0844cd
commit d95717941d
Signed by: eyjhb
GPG key ID: 609F508E3239F920
3 changed files with 29 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
machines/gerd/services/lldap/default.nix
View file

@ -204,6 +204,7 @@ in {
in lib.concatStrings (cap parts); in lib.concatStrings (cap parts);
in { in {
uid = "uid"; uid = "uid";
creationdate = "creationdate";
firstname = "givenName"; firstname = "givenName";
lastname = "sn"; lastname = "sn";
email = "mail"; email = "mail";

8
machines/gerd/services/stalwart/default.nix
View file

@ -7,7 +7,13 @@
mine.shared.meta.stalwart = { mine.shared.meta.stalwart = {
name = "Stalwart Mail"; name = "Stalwart Mail";
description = "We host our own mailserver, which can be reached on ${config.mine.shared.settings.mail.domain} with your LDAP username and password."; description = ''
We host our own mailserver, which can be reached on ${config.mine.shared.settings.mail.domain} with your LDAP username and password.
From here encryption-at-rest can be setup with either OpenPGP or S/MIME. Keep in mind, Change Password, Two-factor Auth and App Passwords
do not work, as we are using LDAP for authentication instead.
'';
url = "https://${config.mine.shared.settings.mail.domain}";
package = let package = let
pkg = config.services.stalwart-mail.package; pkg = config.services.stalwart-mail.package;

28
machines/gerd/services/stalwart/stalwart.nix
View file

@ -1,7 +1,10 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
svc_domain = "mail.${config.mine.shared.settings.domain}"; svc_domain = "stalwart.${config.mine.shared.settings.domain}";
svc_domain_mail = "mail.${config.mine.shared.settings.domain}";
# TODO(eyJhb): in theory these domains are not used, they're just
# nice to have.. maybe.
svc_domain_smtp = "smtp.${config.mine.shared.settings.domain}"; svc_domain_smtp = "smtp.${config.mine.shared.settings.domain}";
svc_domain_imap = "imap.${config.mine.shared.settings.domain}"; svc_domain_imap = "imap.${config.mine.shared.settings.domain}";
@ -27,7 +30,7 @@ in {
openFirewall = true; openFirewall = true;
settings = { settings = {
lookup.default.hostname = svc_domain; lookup.default.hostname = svc_domain_mail;
store.db.path = "${stateDir}/db"; store.db.path = "${stateDir}/db";
@ -72,11 +75,15 @@ in {
quota = lconfig.attr.membermaildiskquota; quota = lconfig.attr.membermaildiskquota;
class = "objectClass"; class = "objectClass";
groups = "memberOf"; groups = "memberOf";
# we dont have access to this in lldap # we dont have access to this in lldap, and
# therefore we use secret-changed instead
# secret = lconfig.attr.stalwart_secret; # secret = lconfig.attr.stalwart_secret;
# TODO(eyJhb): remove once LLDAP gets
# plugin support, so we can make a plugin
# that updates a attribute on password updates
# https://github.com/lldap/lldap/pull/1119
secret-changed = lconfig.attr.creationdate;
}); });
}; };
storage.directory = "ldap"; storage.directory = "ldap";
@ -87,7 +94,7 @@ in {
submissions = { bind = [ "[::]:${builtins.toString ports.submissions}"]; protocol = "smtp"; tls.implicit = true; }; submissions = { bind = [ "[::]:${builtins.toString ports.submissions}"]; protocol = "smtp"; tls.implicit = true; };
imaptls = { bind = [ "[::]:${builtins.toString ports.imaptls}"]; protocol = "imap"; tls.implicit = true; }; imaptls = { bind = [ "[::]:${builtins.toString ports.imaptls}"]; protocol = "imap"; tls.implicit = true; };
management = { bind = [ "127.0.0.1:${builtins.toString ports.http_management}" ]; protocol = "http"; }; management = { bind = [ "[::]:${builtins.toString ports.http_management}" ]; protocol = "http"; };
}; };
certificate.domain = { certificate.domain = {
@ -139,13 +146,19 @@ in {
]; ];
# setup certs # setup certs
services.nginx.virtualHosts."${svc_domain}" = { services.nginx.virtualHosts."${svc_domain_mail}" = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
serverAliases = [ svc_domain_smtp svc_domain_imap ]; serverAliases = [ svc_domain_smtp svc_domain_imap ];
root = pkgs.writeTextDir "index.html" "Nothing."; root = pkgs.writeTextDir "index.html" "Nothing.";
}; };
services.nginx.virtualHosts."${svc_domain}" = {
forceSSL = true;
enableACME = true;
locations."/".proxyPass = "http://localhost:${builtins.toString ports.http_management}";
};
# need to change group to stalwart-mail for cert + add nginx to stalwart-mail group to do HTTP ACME # need to change group to stalwart-mail for cert + add nginx to stalwart-mail group to do HTTP ACME
users.users.nginx.extraGroups = [ stalwart_group ]; users.users.nginx.extraGroups = [ stalwart_group ];
security.acme.certs."${svc_domain}" = { security.acme.certs."${svc_domain}" = {
@ -160,6 +173,7 @@ in {
mine.shared.settings.mail = { mine.shared.settings.mail = {
domain = svc_domain; domain = svc_domain;
domain_mail = svc_domain_mail;
domain_smtp = svc_domain_smtp; domain_smtp = svc_domain_smtp;
domain_imap = svc_domain_imap; domain_imap = svc_domain_imap;