95 lines
3.4 KiB
Nix
95 lines
3.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
self,
|
|
...
|
|
}: let
|
|
# Source: https://github.com/NixOS/nixpkgs/blob/nixos-22.11/nixos/modules/services/mail/mailman.nix#L9C10-L10
|
|
# webEnv is required by the mailman-uwsgi systemd service
|
|
inherit (pkgs.mailmanPackages.buildEnvs {}) webEnv;
|
|
in {
|
|
networking.firewall.allowedTCPPorts = [25];
|
|
|
|
services.postfix = {
|
|
enable = true;
|
|
relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"];
|
|
# get TLS certs for list.pub.solar from caddy
|
|
# TODO: when caddy renews certs, postfix doesn't know about it
|
|
# implement custom built caddy with events exec handler or systemd-reload
|
|
# hook so postfix reloads, too
|
|
sslCert = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.crt";
|
|
sslKey = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.key";
|
|
config = {
|
|
transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
|
|
local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
|
|
};
|
|
rootAlias = "admins@pub.solar";
|
|
postmasterAlias = "admins@pub.solar";
|
|
hostname = "list.pub.solar";
|
|
};
|
|
|
|
systemd.paths.watcher-caddy-ssl-file = {
|
|
description = "Watches for changes in caddy's TLS cert file (after renewals) to reload postfix";
|
|
pathConfig = {
|
|
PathChanged = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/list.pub.solar/list.pub.solar.crt";
|
|
Unit = "postfix-reload.service";
|
|
};
|
|
partOf = ["postfix.service"];
|
|
};
|
|
|
|
systemd.services."postfix-reload" = {
|
|
description = "Reloads postfix config";
|
|
serviceConfig.Type = "oneshot";
|
|
script = ''
|
|
${pkgs.systemd}/bin/systemctl reload postfix
|
|
'';
|
|
};
|
|
|
|
services.mailman = {
|
|
enable = true;
|
|
# We use caddy instead of nginx
|
|
#serve.enable = true;
|
|
hyperkitty.enable = true;
|
|
webHosts = ["list.pub.solar"];
|
|
siteOwner = "admins@pub.solar";
|
|
};
|
|
|
|
# TODO add django-keycloak as auth provider
|
|
# https://django-keycloak.readthedocs.io/en/latest/
|
|
## Extend settings.py directly since this can't be done via JSON
|
|
## settings (services.mailman.webSettings)
|
|
#environment.etc."mailman3/settings.py".text = ''
|
|
# INSTALLED_APPS.extend([
|
|
# "allauth.socialaccount.providers.github",
|
|
# "allauth.socialaccount.providers.gitlab"
|
|
# ])
|
|
#'';
|
|
|
|
systemd.services.mailman-uwsgi = let
|
|
uwsgiConfig.uwsgi = {
|
|
type = "normal";
|
|
plugins = ["python3"];
|
|
home = webEnv;
|
|
manage-script-name = true;
|
|
mount = "/=mailman_web.wsgi:application";
|
|
http = "127.0.0.1:18507";
|
|
};
|
|
uwsgiConfigFile = pkgs.writeText "uwsgi-mailman.json" (builtins.toJSON uwsgiConfig);
|
|
in {
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["postgresql.service"];
|
|
requires = ["mailman-web-setup.service" "postgresql.service"];
|
|
restartTriggers = [config.environment.etc."mailman3/settings.py".source];
|
|
serviceConfig = {
|
|
# Since the mailman-web settings.py obstinately creates a logs
|
|
# dir in the cwd, change to the (writable) runtime directory before
|
|
# starting uwsgi.
|
|
ExecStart = "${pkgs.coreutils}/bin/env -C $RUNTIME_DIRECTORY ${pkgs.uwsgi.override {plugins = ["python3"];}}/bin/uwsgi --json ${uwsgiConfigFile}";
|
|
User = "mailman-web";
|
|
Group = "mailman";
|
|
RuntimeDirectory = "mailman-uwsgi";
|
|
};
|
|
};
|
|
}
|