87 lines
2.6 KiB
Nix
87 lines
2.6 KiB
Nix
{ config, flake, ... }:
|
|
|
|
{
|
|
age.secrets.mail-hensoko.file = "${flake.self}/secrets/mail/hensoko.age";
|
|
age.secrets.mail-teutat3s.file = "${flake.self}/secrets/mail/teutat3s.age";
|
|
age.secrets.mail-admins.file = "${flake.self}/secrets/mail/admins.age";
|
|
age.secrets.mail-bot.file = "${flake.self}/secrets/mail/bot.age";
|
|
age.secrets.mail-crew.file = "${flake.self}/secrets/mail/crew.age";
|
|
age.secrets.mail-erpnext.file = "${flake.self}/secrets/mail/erpnext.age";
|
|
age.secrets.mail-hakkonaut.file = "${flake.self}/secrets/mail/hakkonaut.age";
|
|
|
|
mailserver = {
|
|
enable = true;
|
|
fqdn = "mail.pub.solar";
|
|
domains = [ "pub.solar" ];
|
|
|
|
# A list of all login accounts. To create the password hashes, use
|
|
# nix-shell -p mkpasswd --run 'mkpasswd -R11 -m bcrypt'
|
|
loginAccounts = {
|
|
"hensoko@pub.solar" = {
|
|
hashedPasswordFile = config.age.secrets.mail-hensoko.path;
|
|
quota = "2G";
|
|
};
|
|
"teutat3s@pub.solar" = {
|
|
hashedPasswordFile = config.age.secrets.mail-teutat3s.path;
|
|
quota = "2G";
|
|
};
|
|
"admins@pub.solar" = {
|
|
hashedPasswordFile = config.age.secrets.mail-admins.path;
|
|
quota = "2G";
|
|
aliases = [
|
|
"abuse@pub.solar"
|
|
"alerts@pub.solar"
|
|
"forgejo@pub.solar"
|
|
"keycloak@pub.solar"
|
|
"mastodon-notifications@pub.solar"
|
|
"matrix@pub.solar"
|
|
"postmaster@pub.solar"
|
|
"nextcloud@pub.solar"
|
|
"no-reply@pub.solar"
|
|
"security@pub.solar"
|
|
];
|
|
};
|
|
"bot@pub.solar" = {
|
|
hashedPasswordFile = config.age.secrets.mail-bot.path;
|
|
quota = "2G";
|
|
aliases = [ "hackernews-bot@pub.solar" ];
|
|
};
|
|
"crew@pub.solar" = {
|
|
hashedPasswordFile = config.age.secrets.mail-crew.path;
|
|
quota = "2G";
|
|
aliases = [ "moderation@pub.solar" ];
|
|
};
|
|
"erpnext@pub.solar" = {
|
|
hashedPasswordFile = config.age.secrets.mail-erpnext.path;
|
|
quota = "2G";
|
|
};
|
|
"hakkonaut@pub.solar" = {
|
|
hashedPasswordFile = config.age.secrets.mail-hakkonaut.path;
|
|
quota = "2G";
|
|
};
|
|
};
|
|
|
|
# Use Let's Encrypt certificates. Note that this needs to set up a stripped
|
|
# down nginx and opens port 80.
|
|
certificateScheme = "acme-nginx";
|
|
};
|
|
security.acme.acceptTerms = true;
|
|
security.acme.defaults.email = "security@pub.solar";
|
|
|
|
pub-solar-os.backups.restic.mail = {
|
|
paths = [
|
|
"/var/vmail"
|
|
"/var/dkim"
|
|
];
|
|
timerConfig = {
|
|
OnCalendar = "*-*-* 02:00:00 Etc/UTC";
|
|
};
|
|
initialize = true;
|
|
pruneOpts = [
|
|
"--keep-daily 7"
|
|
"--keep-weekly 4"
|
|
"--keep-monthly 3"
|
|
];
|
|
};
|
|
}
|