Martin Weinelt
33ba1ff52b
Drop most of the existing certificate handling, because we're effectively duplicating functionality that NixOS offers for free with better design, testing and maintainance than what we could provide downstream. The remaining two options are to reference an existing `security.acme.certs` configuration through `mailserver.x509.useACMEHost` or to provide existing key material via `mailserver.x509.certificateFile` and `mailserver.x509.privateKeyFile`. Support for automatic creation of self-signed certificates has been removed, because it is undesirable in public mail setups. The updated setup guide now displays the recommended configuration that relies on the NixOS ACME module, but requires further customization to select a suitable challenge. Co-Authored-By: Emily <git@emilylange.de>
94 lines
3.6 KiB
Nix
94 lines
3.6 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
let
|
|
mailserverRelease = "26.05";
|
|
nixpkgsRelease = lib.trivial.release;
|
|
releaseMismatch =
|
|
config.mailserver.enableNixpkgsReleaseCheck && mailserverRelease != nixpkgsRelease;
|
|
in
|
|
|
|
{
|
|
warnings = lib.optional releaseMismatch ''
|
|
You are using
|
|
|
|
NixOS Mailserver version ${mailserverRelease} and
|
|
Nixpkgs version ${nixpkgsRelease}.
|
|
|
|
Using mismatched versions is likely to cause compatibility issues
|
|
and may require migrations that make an eventual rollback tricky.
|
|
|
|
It is therefore highly recommended to use a release of
|
|
NixOS mailserver that corresponds with your chosen release of Nixpkgs.
|
|
|
|
If you insist then you can disable this warning by adding
|
|
|
|
mailserver.enableNixpkgsReleaseCheck = false;
|
|
|
|
to your configuration.
|
|
'';
|
|
|
|
# We guard all assertions by requiring mailserver to be actually enabled
|
|
assertions = lib.optionals config.mailserver.enable (
|
|
[
|
|
{
|
|
assertion = config.mailserver.stateVersion != null;
|
|
message = "The `mailserver.stateVersion` option is not set. Check https://nixos-mailserver.readthedocs.io/en/latest/migrations.html to determine the proper value to initialize it at.";
|
|
}
|
|
{
|
|
assertion =
|
|
config.mailserver.x509.useACMEHost != null
|
|
-> config.mailserver.x509.certificateFile == null && config.mailserver.x509.privateKeyFile == null;
|
|
message = "Configuring an ACME certificate (`mailserver.x509.useACMEHost`) is not possible while also passing an existing certificate (`mailserver.x509.certificateFile`, `mailserver.x509.privateKeyFile`).";
|
|
}
|
|
{
|
|
assertion =
|
|
config.mailserver.x509.useACMEHost != null
|
|
|| (
|
|
config.mailserver.x509.certificateFile != null && config.mailserver.x509.privateKeyFile != null
|
|
);
|
|
message = "Configure either an ACME certificate (`mailserver.x509.useACMEHost`) or pass an existing certificate (`mailserver.x509.certificateFile`, `mailserver.x509.privateKeyFile`).";
|
|
}
|
|
]
|
|
++ lib.optionals config.mailserver.ldap.enable [
|
|
{
|
|
assertion = config.mailserver.loginAccounts == { };
|
|
message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.loginAccounts";
|
|
}
|
|
{
|
|
assertion = config.mailserver.extraVirtualAliases == { };
|
|
message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.extraVirtualAliases";
|
|
}
|
|
]
|
|
++
|
|
lib.optionals (config.mailserver.ldap.enable && config.mailserver.mailDirectory != "/var/vmail")
|
|
[
|
|
{
|
|
assertion = config.mailserver.stateVersion != null -> config.mailserver.stateVersion >= 2;
|
|
message = ''
|
|
Issue: The dovecot homedir for LDAP users was previously not respecting `mailserver.mailDirectory`.
|
|
Remediation:
|
|
- Stop the `dovecot2.service`
|
|
- Move `/var/vmail/ldap` below your `mailserver.mailDirectory`
|
|
- Increase the `stateVersion` to 2.
|
|
|
|
Check https://nixos-mailserver.readthedocs.io/en/latest/migrations.html#dovecot-ldap-home-directory-migration for more information.
|
|
'';
|
|
}
|
|
]
|
|
++ [
|
|
{
|
|
assertion = config.mailserver.stateVersion != null -> config.mailserver.stateVersion >= 3;
|
|
message = ''
|
|
Issue: The dovecot mail location for all users has changed and need to be migrated.
|
|
|
|
Check https://nixos-mailserver.readthedocs.io/en/latest/migrations.html#dovecot-mail-directory-migration for the required remediation steps.
|
|
'';
|
|
}
|
|
]
|
|
);
|
|
}
|