stura-infra/hosts/mail/default.nix

{
  config,
  lib,
  pkgs,
  ...
}:
let
  generatedAliases = pkgs.writeText "generated-aliases" (
    lib.concatStringsSep "\n" (
      lib.mapCartesianProduct
        ({ aliases, domain }: "${aliases}@${domain}  root@test.htw.stura-dresden.de")
        {
          aliases = [
            "abuse"
            "hostmaster"
            "noreply"
            "postmaster"
            "webmaster"
          ];
          domain = config.mailserver.domains;
        }
    )
  );

in
{
  imports = [
    ./hardware-configuration.nix
  ];

  security.pam.loginLimits = [
    {
      domain = "*";
      type = "soft";
      item = "nofile";
      value = "8192";
    }
  ];
  # nix.settings.trusted-users = [ "administration" ];
  # nix.settings.download-buffer-size = 6710886400;
  # boot.loader.grub.enable = true;
  # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
  # boot.loader.grub.enable = true;
  # boot.loader.grub.efiSupport = true;
  # boot.loader.grub.efiInstallAsRemovable = true;

  networking.hostName = "mail";
  networking.domain = "test.htw.stura-dresden.de";
  networking.interfaces.ens18.ipv4.addresses = [
    {
      address = "141.56.51.95";
      prefixLength = 24;
    }
  ];

  networking.defaultGateway.address = "141.56.51.254";
  networking.nameservers = [
    "9.9.9.9"
    "1.1.1.1"
  ];

  services.nginx.virtualHosts = {
    "lists.${config.networking.domain}" = {
      enableACME = true;
      forceSSL = true;
      # locations."/" = {
      #   proxyPass = "http://127.0.0.1:18507";
      # };
    };
  };
  services.automx2 = {
    enable = true;
    domain = "${config.networking.domain}";
    settings = {
      automx2 = {
        db_uri = "sqlite:////var/lib/automx2/db.sqlite";
        proxy_count = 1;
      };
    };
  };
  services.mailman = {
    enable = true;
    hyperkitty = {
      enable = true;
    };
    serve.enable = true;
    webHosts = [
      "lists.${config.networking.domain}"
    ];
  };

  services.mailman.siteOwner = "mailman@${config.networking.domain}";
  mailserver = {
    enable = true;
    fqdn = "mail.${config.networking.domain}";
    domains = [
      "${config.networking.domain}"
      "lists.${config.networking.domain}"
    ];
    ldap = {
      enable = true;
      bind = {
        # dn = "cn=dovecot,ou=users,DC=test,DC=htw,DC=stura-dresden,DC=de";
        dn = "cn=ldapuser,ou=users,dc=ldap,dc=goauthentik,dc=io";
        passwordFile = "/var/lib/dovecot_ldap_passwd";
      };
      dovecot = {
        userFilter = "(&(objectClass=posixAccount)(mail=%u))";
        passFilter = "(&(objectClass=posixAccount)(mail=%u))";
        userAttrs = "cn";
      };
      postfix = {
        filter = "(|(&(objectClass=posixAccount)(mail=%s))(&(objectClass=posixAccount)(cn=%s)))";
        mailAttribute = "mail";
        uidAttribute = "cn";
      };
      #searchBase = "DC=test,DC=htw,DC=stura-dresden,DC=de";
      searchBase = "DC=ldap,DC=goauthentik,DC=io";
      uris = [
        "ldap://auth.test.htw.stura-dresden.de:3389"
      ];
    };

    certificateScheme = "acme-nginx";
    enableImap = true;
    enableImapSsl = true;
    enableManageSieve = true;
    enableSubmission = true;
    enableSubmissionSsl = true;
    extraVirtualAliases = { };
    lmtpSaveToDetailMailbox = "no"; # DOS potential
    mailboxes = {
      Drafts = {
        auto = "subscribe";
        specialUse = "Drafts";
      };
      Sent = {
        auto = "subscribe";
        specialUse = "Sent";
      };
      Spam = {
        auto = "subscribe";
        specialUse = "Junk";
      };
      Trash = {
        auto = "subscribe";
        specialUse = "Trash";
      };
    };
    maxConnectionsPerUser = 10;
    messageSizeLimit = 10 * 1000 * 1024; # 10 MiB

    stateVersion = 3;
  };

  # services.dovecot2.mailLocation = lib.mkForce "maildir:/var/vmail/%n";
  services.postfix =
    let
      submissionOptions = {
        # hash:/etc/postfix/virtual,
        smtpd_sender_login_maps = lib.mkForce "ldap:/run/postfix/ldap-sender-login-map.cf";
        smtpd_client_restrictions = "permit_sasl_authenticated,reject";
      };
    in
    {
      masterConfig = {
        submission = {
          args = [ "-v" ];
        };
        submissions = {
          args = [ "-v" ];
        };
      };
      settings.main = {
        unknown_local_recipient_reject_code = 550;
        relay_domains = [
          "hash:/var/lib/mailman/data/postfix_domains"
        ];
        transport_maps = [
          "hash:/var/lib/mailman/data/postfix_lmtp"
        ];
        local_recipient_maps = [
          "hash:/var/lib/mailman/data/postfix_lmtp"
        ];
      };
      # mapFiles = {
      #   "valias" = lib.mkForce "/var/lib/postfix/valias";
      #   "virtual" = lib.mkForce "/var/lib/postfix/virtual";
      # };
      submissionOptions = submissionOptions;
      submissionsOptions = submissionOptions;
    };

  security.acme.acceptTerms = true;
  security.acme.defaults.email = "cert@stura.htw-dresden.de";

  networking.firewall.allowedTCPPorts = [
    25
    80
    443
    597
  ];

  system.stateVersion = "24.11";

}