1e80fb2594
flake.lock: Update
...
Flake lock file updates:
• Updated input 'git-hooks':
'github:cachix/git-hooks.nix/16ec914f6fb6f599ce988427d9d94efddf25fe6d' (2025-06-24)
→ 'github:cachix/git-hooks.nix/54df955a695a84cd47d4a43e08e1feaf90b1fd9b' (2025-09-17)
• Updated input 'nixpkgs':
'github:NixOS/nixpkgs/94def634a20494ee057c76998843c015909d6311' (2025-07-31)
→ 'github:NixOS/nixpkgs/e9f00bd893984bc8ce46c895c3bf7cac95331127' (2025-09-28)
• Updated input 'nixpkgs-25_05':
'github:NixOS/nixpkgs/1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a' (2025-07-29)
→ 'github:NixOS/nixpkgs/5ed4e25ab58fd4c028b59d5611e14ea64de51d23' (2025-09-29)
2025-10-01 12:18:02 +02:00
0ab40d0575
Merge branch 'fix/acme-extra-domains' into 'master'
...
fix(acme): request certificates for the extra domains too
See merge request simple-nixos-mailserver/nixos-mailserver!448
2025-09-30 05:33:00 +00:00
bf2b313365
fix(acme): request certificates for the extra domains too
...
Instead of just making it _possible_ to perform the name validation...
2025-09-28 19:03:32 +02:00
d2534fa431
Merge branch 'fix-jobset-generation' into 'master'
...
ci: disable command execution in jobset generation
See merge request simple-nixos-mailserver/nixos-mailserver!447
2025-09-22 13:27:17 +00:00
39ead49eb4
ci: disable command execution in jobset generation
...
When GitLab PR descriptions contain markdown inline code blocks they get
interpreted as command substitutions in bash.
This is because the here-doc string previously allowed for this behavior.
2025-09-22 15:23:26 +02:00
c709476ac5
Merge branch 'disable-plain-access' into 'master'
...
Disable plaintext access per RFC 8314
See merge request simple-nixos-mailserver/nixos-mailserver!446
2025-09-22 13:19:49 +00:00
54f37811dd
Disable plaintext access per RFC 8314
...
This deprecates the `enableImap` and `enablePop` options and opens them
up for future removal.
2025-09-22 03:46:43 +02:00
b49ae46f22
Merge branch 'rspamd-local-networks' into 'master'
...
rspamd: restrict addresses we disable checks for to localhost
Closes #326
See merge request simple-nixos-mailserver/nixos-mailserver!444
2025-08-25 13:55:52 +00:00
1a2d7a4bf5
rspamd: restrict addresses we disable checks for to localhost
...
By default this includes private network subnets, but those should really
use authentication instead, if they want to skip checks.
Closes : #326
2025-08-25 04:12:30 +02:00
cc5f180427
Merge branch 'test-enableSubmissionSsl' into 'master'
...
tests: also test client submission over `smtps://` instead of just `smtp://` with STARTTLS
See merge request simple-nixos-mailserver/nixos-mailserver!443
2025-08-24 00:41:08 +00:00
63b8e1615f
tests: also test client submission over smtps://
...
instead of just smtp:// with STARTTLS.
Opted to call the flag --ssl and not --tls to keep it consistent with
the module option (mailserver.enableSubmissionSsl), dovecot internals
and smtplib in mail-check.py.
2025-08-24 02:29:30 +02:00
958c112fba
Merge branch 'dkim-rsa2048' into 'master'
...
Increase default DKIM key bits to 2048
Closes #333
See merge request simple-nixos-mailserver/nixos-mailserver!442
2025-08-22 20:42:21 +00:00
2204f55329
Increase default DKIM key bits to 2048
...
This is the current recommendation in RFC 8301 from early 2018.
Fixes : #333
2025-08-22 22:38:31 +02:00
2be40a9653
Merge branch 'docs-fix-dovecot-links' into 'master'
...
docs/dovecot: fix dovecot URLs (again)
See merge request simple-nixos-mailserver/nixos-mailserver!441
2025-08-22 20:34:21 +00:00
b7d2f287f3
docs/dovecot: fix dovecot URLs (again)
...
https://doc.dovecot.org/configuration_manual moved to
https://doc.dovecot.org/2.3/configuration_manual to make room for
https://doc.dovecot.org/:version/ where :version can be any one of 2.3,
2.4.0, 2.4.1 or main.
Unfortunately, there is no redirect for the 2.3 manual pages, rendering
a few of those dovecot links dead. I figured we want to keep the old
docs at /2.3/ for now until we eventually migrate to 2.4, as there are
some differences in the ldap interface between those versions.
Previously: 90539a1a99
2025-08-22 22:06:29 +02:00
57d9624c71
Merge branch 'dmarc-reporter' into 'master'
...
Allow AF_UNIX sockets for dmarc reporter, tokenize commandline
Closes #331
See merge request simple-nixos-mailserver/nixos-mailserver!437
2025-08-07 22:31:50 +00:00
fc955088e3
Respect configureLocally flag for redis
2025-08-08 00:01:45 +02:00
43f87f5520
Tokenize dmarc reporter commandline
2025-08-08 00:01:45 +02:00
aa06b2f489
Allow AF_UNIX sockets for dmarc reporter and allow group access
...
This is required to use redis over UNIX domain sockets.
2025-08-08 00:01:45 +02:00
eb656cd361
Merge branch 'flake-bump' into 'master'
...
postfix: don't cast message_size_limit to string
See merge request simple-nixos-mailserver/nixos-mailserver!435
2025-08-02 00:27:02 +00:00
b76a547bec
treewide: reformat with nixfmt 1.0.0
2025-08-02 02:19:15 +02:00
cea6f25a40
flake.lock: Update
...
Flake lock file updates:
• Updated input 'nixpkgs':
'github:NixOS/nixpkgs/1fd8bada0b6117e6c7eb54aad5813023eed37ccb' (2025-07-06)
→ 'github:NixOS/nixpkgs/94def634a20494ee057c76998843c015909d6311' (2025-07-31)
• Updated input 'nixpkgs-25_05':
'github:NixOS/nixpkgs/29e290002bfff26af1db6f64d070698019460302' (2025-07-05)
→ 'github:NixOS/nixpkgs/1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a' (2025-07-29)
2025-08-02 02:12:47 +02:00
027e6bcd76
postfix: don't cast message_size_limit to string
...
On unstable this will become a signed integer and there was never a good
reason for this to be a string.
2025-08-02 02:11:11 +02:00
ce87c8a977
Merge branch 'options' into 'master'
...
acmeCertificateName: Set defaultText as the default is dynamic
See merge request simple-nixos-mailserver/nixos-mailserver!432
2025-07-23 15:47:20 +00:00
29de3e6865
acmeCertificateName: Set defaultText as the default is dynamic
2025-07-23 17:18:30 +02:00
80d21ed7a1
Merge branch 'system-options' into 'master'
...
Introduce system name and domain options
See merge request simple-nixos-mailserver/nixos-mailserver!427
2025-07-09 11:20:39 +00:00
e9953aa154
ruff: reject implicit string concat
...
This is a common mistake that could have been prevented.
```
migrations/nixos-mailserver-migration-03.py:42:9: ISC002 Implicitly concatenated string literals over multiple lines
|
40 | def is_maildir_related(path: Path, layout: FolderLayout) -> bool:
41 | if path.name in [
42 | / "subscriptions"
43 | | # https://doc.dovecot.org/2.3/admin_manual/mailbox_formats/maildir/#imap-uid-mapping
44 | | "dovecot-uidlist",
| |_________________________^ ISC002
45 | # https://doc.dovecot.org/2.3/admin_manual/mailbox_formats/maildir/#imap-keywords
46 | "dovecot-keywords",
|
```
2025-07-09 03:59:54 +02:00
dda91cfc15
Merge branch 'patch-1' into 'master'
...
migrations: add missing comma in list
See merge request simple-nixos-mailserver/nixos-mailserver!429
2025-07-09 01:43:03 +00:00
c2df33f76a
migrations: add missing comma in list
2025-07-09 01:39:51 +00:00
2b240501e0
Introduce system name and domain options
...
Bring them up from the DMARC reporting section to the mailserver toplevel
so they become reusable for the upcoming TLSRPT integration.
We default to the first domain in the domains option, if not set
explicitly, so that `systemDomain` doesn't become a blocker for existing
setups. We still encourage picking out the intended one, which is likely
the one used for the MX hostname.
This also simplifies the DMARC reporting configuration, which doesn't
need to be so fine-grained.
Co-Authored-By: Emily <git@emilylange.de >
2025-07-09 01:44:10 +02:00
0aeb2849ad
mail-check: fix format string
2025-07-08 04:39:36 +02:00
47786932cb
tests: fix deprecate machine config access
2025-07-08 03:58:37 +02:00
358a44674e
Merge branch 'flake-bump' into 'master'
...
flake.lock: Update
See merge request simple-nixos-mailserver/nixos-mailserver!428
2025-07-08 01:29:06 +00:00
679bce8bbb
flake.lock: Update
...
Flake lock file updates:
• Updated input 'git-hooks':
'github:cachix/git-hooks.nix/623c56286de5a3193aa38891a6991b28f9bab056' (2025-06-11)
→ 'github:cachix/git-hooks.nix/16ec914f6fb6f599ce988427d9d94efddf25fe6d' (2025-06-24)
• Updated input 'nixpkgs':
'github:NixOS/nixpkgs/3e3afe5174c561dee0df6f2c2b2236990146329f' (2025-06-07)
→ 'github:NixOS/nixpkgs/1fd8bada0b6117e6c7eb54aad5813023eed37ccb' (2025-07-06)
• Updated input 'nixpkgs-25_05':
'github:NixOS/nixpkgs/fd487183437963a59ba763c0cc4f27e3447dd6dd' (2025-06-12)
→ 'github:NixOS/nixpkgs/29e290002bfff26af1db6f64d070698019460302' (2025-07-05)
2025-07-08 03:20:45 +02:00
334e370c1f
Merge branch 'dovecot-unit-name-migration' into 'master'
...
dovecot: use marker option as unit name migration indicator
See merge request simple-nixos-mailserver/nixos-mailserver!426
2025-07-06 23:24:27 +00:00
d6d2053b80
dovecot: use marker option as unit name migration indicator
...
In nixpkgs we expose `services.dovecot.hasNewUnitName` option that can be
safely inspected to understand that whether to use the `dovecot` systemd
service name instead of `dovecot2`.
2025-07-07 01:10:19 +02:00
6004878dc6
Merge branch 'dovecot-migration-compat-fixup' into 'master'
...
dovecot: fix check for dovecot systemd unit name
See merge request simple-nixos-mailserver/nixos-mailserver!425
2025-07-06 03:22:41 +00:00
f9a52ca4b5
dovecot: fix check for dovecot systemd unit name
...
and migrate the preStart script in systemd.nix as well.
2025-07-06 05:18:01 +02:00
a40574beb5
Merge branch 'dovecot-migration-compat' into 'master'
...
dovecot: add compat shim for dovecot unit name migration
See merge request simple-nixos-mailserver/nixos-mailserver!424
2025-07-06 00:58:47 +00:00
b38dc8085c
dovecot: add compat shim for dovecot unit name migration
...
In nixpkgs I renamed dovecot2 to dovecot and made dovecot2 an alias, so
adding the script to the alias does us no good.
2025-07-06 02:52:31 +02:00
b10c54606b
migrations: ignore maildir when in folder layout
...
Otherwise we'd be tryhing to move the maildir into itself and error out.
2025-06-26 16:52:49 +02:00
c45b8a1253
Merge branch 'migrate-dovecot-control-files' into 'master'
...
migrations: also migrate dovecot control files
See merge request simple-nixos-mailserver/nixos-mailserver!423
2025-06-26 00:01:26 +00:00
d91d94be94
migrations: also migrate dovecot control files
2025-06-25 22:09:41 +02:00
b9e28e23af
migrations: fix move of subscriptions
...
It is a file and we skip over files in the location I added it before.
2025-06-23 03:48:18 +02:00
67f0b864cc
migrations: also migrate subscriptions file in maildir migration
...
Otherwise users will be unsubscribed from all maildir folders.
2025-06-23 02:38:01 +02:00
cfb3136cf0
Merge branch 'fix-cannot-compare-null-with-an-integer' into 'master'
...
assertions: fix eval error when `mailserver.stateVersion` is unset (null)
See merge request simple-nixos-mailserver/nixos-mailserver!421
2025-06-22 13:25:22 +00:00
6ef1eb9ce1
assertions: fix eval error when mailserver.stateVersion is unset (null)
...
Eval does not stop on the first assertion failure it encouters.
Instead, it tries to evaluate all assertions and returns with a list of
those that failed.
This means our very top `config.mailserver.stateVersion != null`
assertion does not gate against any other assertions trying to compare
null against an integer.
The error prior to this commit can be reproduced by removing
`mailserver.stateVersion = 999;` in tests/lib/config.nix and then trying
to evaluate any of the tests:
~~~bash
# nix eval --raw .#checks.x86_64-linux.internal-unstable
error:
… while evaluating the attribute 'outPath'
at /nix/store/syvnmj3hhckkbncm94kfkbl76qsdqqj3-source/lib/customisation.nix:421:7:
420| drv.drvPath;
421| outPath =
| ^
422| assert condition;
… while calling the 'getAttr' builtin
at «internal»:1:500:
(stack trace truncated; use '--show-trace' to show the full trace)
error: cannot compare null with an integer
~~~
2025-06-21 20:15:46 +02:00
9d8caf5944
Merge branch 'dovecot-home-mail-migration' into 'master'
...
dovecot: migrate to dedicated homedir and separate maildir paths
Closes #324
See merge request simple-nixos-mailserver/nixos-mailserver!408
2025-06-21 10:23:58 +00:00
3c1cff431c
tests: test for the expected maildir and index dir locations
...
These are not ideal yet, but we should make them a fixture, so that we
are always aware what they are for the different supported setups.
2025-06-21 10:28:43 +02:00
f25495cabf
dovecot: fix custom index dir configuration for ldap users
2025-06-21 09:47:03 +02:00
Martin Weinelt
lewo
Giel van Schijndel
Martin Weinelt
emilylange
Tom Hubrecht
Yureka