os/hosts/frikandel/email.nix

{
  flake,
  config,
  pkgs,
  lib,
  ...
}: let
  restartMaddyOnCertRenewal = pkgs.writeShellScriptBin "restart-maddy-on-cert-renewal" ''
    if [ "$1" == "mail.b12f.io"]; then
      ${pkgs.systemd}/bin/systemctl restart maddy.service;
    fi
  '';
in {
  age.secrets."b12f.io-dkim-private-rsa" = {
    file = "${flake.self}/secrets/b12f.io-dkim-private-rsa.age";
    mode = "400";
    owner = "rspamd";
  };

  age.secrets."mail@b12f.io-password" = {
    file = "${flake.self}/secrets/mail@b12f.io-password.age";
    mode = "400";
    owner = "maddy";
  };

  services.caddy = {
    globalConfig = ''
      events {
        on cert_obtained exec ${restartMaddyOnCertRenewal}/bin/restart-maddy-on-cert-renewal {event.data.name}
      }
    '';

    virtualHosts = {
      "mail.b12f.io".extraConfig = ''
        respond "404 Not Found"
      '';

      "mta-sts.b12f.io".extraConfig = ''
        encode gzip
        file_server
        root * ${
          pkgs.runCommand "testdir" {} ''
            mkdir -p "$out/.well-known"
            echo "
              version: STSv1
              mode: enforce
              max_age: 604800
              mx: mail.b12f.io
            " > "$out/.well-known/mta-sts.txt"
          ''
        }
      '';
    };
  };

  services.maddy = {
    enable = false;

    openFirewall = true;

    hostname = "mail.b12f.io";

    primaryDomain = "b12f.io";

    ensureAccounts = [
      "mail@b12f.io"
    ];

    ensureCredentials = {
      # Do not use this in production. This will make passwords world-readable
      # in the Nix store
      "mail@b12f.io".passwordFile = config.age.secrets."mail@b12f.io-password".path;
    };

    tls = {
      certificates = [
        {
          keyPath = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.b12f.io/mail.b12f.io.key";
          certPath = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.b12f.io/mail.b12f.io.crt";
        }
      ];
    };

    config = (builtins.replaceStrings ["msgpipeline local_routing {"] [''msgpipeline local_routing {
    check {
      rspamd {
        api_path http://localhost:11334
      }
    }''] config.services.maddy.config.default) ++ ''
      modify {
          domains b12f.io
          selector default
          key_path ${config.age.secrets."b12f.io-dkim-private-rsa".path}
      }
    '';

  };

  services.rspamd = {
    enable = true;
    locals."dkim_signing.conf".text = ''
      enabled = false;
    '';
  };

  systemd.services.rspamd.serviceConfig.SupplementaryGroups = [ "maddy" ];
}