SelfPrivacy
/
selfprivacy-nixos-config
6
3
Fork 6
Code Issues 19 Pull Requests 1 Projects Releases Wiki Activity

clean configuration; simple-nixos-mailserver is an ordinary SP module

pull/55/head
Alexander 2023-12-12 08:25:06 +04:00
parent 25bd151ef3
commit defaca8793
8 changed files with 90 additions and 128 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
configuration.nix
View File

@ -1,7 +1,7 @@
{ config, pkgs, lib, ... }:
{
imports = [
./variables-module.nix
./selfprivacy-module.nix
./volumes.nix
./users.nix
./letsencrypt/acme.nix

3
flake.nix
View File

@ -25,9 +25,10 @@
deployment
./configuration.nix
(import ./files.nix top-level-flake.outPath)
(import ./userdata-variables.nix userdata)
selfprivacy-api.nixosModules.default
{
# pass userdata (parsed from JSON) options to selfprivacy module
selfprivacy = userdata;
# embed top-level flake source folder into the build
environment.etc."selfprivacy/nixos-config-source".source =
top-level-flake.outPath;

21
variables-module.nix → selfprivacy-module.nix
View File

@ -86,32 +86,25 @@ with lib;
#############
dns = {
provider = mkOption {
description = "DNS provider that was defined at the initial setup process. Default is ClOUDFLARE";
description = "DNS provider that was defined at the initial setup process.";
type = types.nullOr types.str;
};
useStagingACME = mkOption {
description = "Use staging ACME server. Default is false";
type = types.nullOr types.bool;
default = false;
};
};
backup = {
bucket = mkOption {
description = "Bucket name used for userdata backups";
type = types.nullOr types.str;
default = "";
};
};
server = {
provider = mkOption {
description = "Server provider that was defined at the initial setup process. Default is HETZNER";
type = types.nullOr types.str;
};
};
##############
# Services #
##############
email = {
location = mkOption {
default = "sda1";
description = "Server provider that was defined at the initial setup process.";
type = types.nullOr types.str;
};
};
@ -125,7 +118,7 @@ with lib;
};
rootKeys = mkOption {
description = ''
Root SSH Keys
Root SSH authorized keys
'';
type = types.nullOr (types.listOf types.str);
default = [ "" ];
@ -163,9 +156,5 @@ with lib;
default = false;
description = "Whether to bind-mount vmail and sieve folders";
};
##############
# Modules #
##############
# modules =
};
}

1
sp-modules/simple-nixos-mailserver/config-paths-needed.json
View File

@ -1,7 +1,6 @@
[
[ "mailserver" ],
[ "selfprivacy", "domain" ],
[ "selfprivacy", "email" ],
[ "selfprivacy", "hashedMasterPassword" ],
[ "selfprivacy", "useBinds" ],
[ "selfprivacy", "username" ],

122
sp-modules/simple-nixos-mailserver/config.nix
View File

@ -2,21 +2,23 @@ mailserverDate: { config, lib, ... }:
let
sp = config.selfprivacy;
in
lib.mkIf sp.modules.simple-nixos-mailserver.enable
{
fileSystems =
lib.mkIf (sp.modules.simple-nixos-mailserver.enable && sp.useBinds)
{
"/var/vmail" = {
device = "/volumes/${sp.email.location}/vmail";
options = [ "bind" ];
};
"/var/sieve" = {
device = "/volumes/${sp.email.location}/sieve";
options = [ "bind" ];
};
fileSystems = lib.mkIf sp.useBinds
{
"/var/vmail" = {
device =
"/volumes/${sp.modules.simple-nixos-mailserver.location}/vmail";
options = [ "bind" ];
};
"/var/sieve" = {
device =
"/volumes/${sp.modules.simple-nixos-mailserver.location}/sieve";
options = [ "bind" ];
};
};
users.users = lib.mkIf sp.modules.simple-nixos-mailserver.enable {
users.users = {
virtualMail = {
isNormalUser = false;
};
@ -24,16 +26,30 @@ in
users.groups.acmereceivers.members = [ "dovecot2" "postfix" "virtualMail" ];
selfprivacy.modules.simple-nixos-mailserver =
lib.mkIf sp.modules.simple-nixos-mailserver.enable {
fqdn = sp.domain;
domains = [ sp.domain ];
mailserver = {
enable = true;
fqdn = sp.domain;
domains = [ sp.domain ];
# A list of all login accounts. To create the password hashes, use
# mkpasswd -m sha-512 "super secret password"
loginAccounts = {
"${sp.username}@${sp.domain}" = {
hashedPassword = sp.hashedMasterPassword;
# A list of all login accounts. To create the password hashes, use
# mkpasswd -m sha-512 "super secret password"
loginAccounts = {
"${sp.username}@${sp.domain}" = {
hashedPassword = sp.hashedMasterPassword;
sieveScript = ''
require ["fileinto", "mailbox"];
if header :contains "Chat-Version" "1.0"
{
fileinto :create "DeltaChat";
stop;
}
'';
};
} // builtins.listToAttrs (builtins.map
(user: {
name = "${user.username}@${sp.domain}";
value = {
hashedPassword = user.hashedPassword;
sieveScript = ''
require ["fileinto", "mailbox"];
if header :contains "Chat-Version" "1.0"
@ -43,45 +59,31 @@ in
}
'';
};
} // builtins.listToAttrs (builtins.map
(user: {
name = "${user.username}@${sp.domain}";
value = {
hashedPassword = user.hashedPassword;
sieveScript = ''
require ["fileinto", "mailbox"];
if header :contains "Chat-Version" "1.0"
{
fileinto :create "DeltaChat";
stop;
}
'';
};
})
sp.users);
})
sp.users);
extraVirtualAliases = {
"admin@${sp.domain}" = "${sp.username}@${sp.domain}";
};
certificateScheme =
if builtins.compareVersions mailserverDate "20230525011002"
>= 0
then "manual"
else 1;
certificateFile = "/var/lib/acme/${sp.domain}/fullchain.pem";
keyFile = "/var/lib/acme/${sp.domain}/key.pem";
# Enable IMAP and POP3
enableImap = true;
enableImapSsl = true;
enablePop3 = false;
enablePop3Ssl = false;
dkimSelector = "selector";
# Enable the ManageSieve protocol
enableManageSieve = true;
virusScanning = false;
extraVirtualAliases = {
"admin@${sp.domain}" = "${sp.username}@${sp.domain}";
};
certificateScheme =
if builtins.compareVersions mailserverDate "20230525011002"
>= 0
then "manual"
else 1;
certificateFile = "/var/lib/acme/${sp.domain}/fullchain.pem";
keyFile = "/var/lib/acme/${sp.domain}/key.pem";
# Enable IMAP and POP3
enableImap = true;
enableImapSsl = true;
enablePop3 = false;
enablePop3Ssl = false;
dkimSelector = "selector";
# Enable the ManageSieve protocol
enableManageSieve = true;
virusScanning = false;
};
}

24
sp-modules/simple-nixos-mailserver/flake.nix
View File

@ -5,23 +5,13 @@
gitlab:simple-nixos-mailserver/nixos-mailserver;
outputs = { self, mailserver }: {
nixosModules.default = args@{ config, ... }:
let
module = mailserver.nixosModules.default args;
in
{
imports = [
module
{
# tricks to rename (alias) the original module
config.mailserver =
config.selfprivacy.modules.simple-nixos-mailserver;
options.selfprivacy.modules.simple-nixos-mailserver =
module.options.mailserver;
}
(import ./config.nix mailserver.lastModifiedDate)
];
};
nixosModules.default = _: {
imports = [
mailserver.nixosModules.default
./options.nix
(import ./config.nix mailserver.lastModifiedDate)
];
};
configPathsNeeded =
builtins.fromJSON (builtins.readFile ./config-paths-needed.json);

13
sp-modules/simple-nixos-mailserver/options.nix Normal file
View File

@ -0,0 +1,13 @@
{ lib, ... }:
{
options.selfprivacy.modules.simple-nixos-mailserver = {
enable = lib.mkOption {
default = false;
type = with lib.types; nullOr bool;
};
location = lib.mkOption {
default = "sda1";
type = with lib.types; nullOr str;
};
};
}

32
userdata-variables.nix
View File

@ -1,32 +0,0 @@
jsonData: { lib, ... }:
{
selfprivacy = jsonData // {
hostname = lib.attrsets.attrByPath [ "hostname" ] null jsonData;
domain = lib.attrsets.attrByPath [ "domain" ] null jsonData;
timezone = lib.attrsets.attrByPath [ "timezone" ] "Europe/Uzhgorod" jsonData;
stateVersion = lib.attrsets.attrByPath [ "stateVersion" ] "22.05" jsonData;
username = lib.attrsets.attrByPath [ "username" ] null jsonData;
hashedMasterPassword = lib.attrsets.attrByPath [ "hashedMasterPassword" ] null jsonData;
sshKeys = lib.attrsets.attrByPath [ "sshKeys" ] [ ] jsonData;
dns = {
provider = lib.attrsets.attrByPath [ "dns" "provider" ] "CLOUDFLARE" jsonData;
useStagingACME = lib.attrsets.attrByPath [ "dns" "useStagingACME" ] false jsonData;
};
backup = {
bucket = lib.attrsets.attrByPath [ "backup" "bucket" ] (lib.attrsets.attrByPath [ "backblaze" "bucket" ] "" jsonData) jsonData;
};
server = {
provider = lib.attrsets.attrByPath [ "server" "provider" ] "HETZNER" jsonData;
};
ssh = {
enable = lib.attrsets.attrByPath [ "ssh" "enable" ] true jsonData;
rootKeys = lib.attrsets.attrByPath [ "ssh" "rootKeys" ] [ "" ] jsonData;
passwordAuthentication = lib.attrsets.attrByPath [ "ssh" "passwordAuthentication" ] true jsonData;
};
email = {
location = lib.attrsets.attrByPath [ "email" "location" ] "sda1" jsonData;
};
users = lib.attrsets.attrByPath [ "users" ] [ ] jsonData;
volumes = lib.attrsets.attrByPath [ "volumes" ] [ ] jsonData;
};
}