Martin Weinelt
e9337b346f
The "login" prefix makes this option more confusing rather than clearer, because what other account types are there? LDAP ones for example, but you can login with those too, so the prefix is pointless.
56 lines
1.9 KiB
Nix
56 lines
1.9 KiB
Nix
{
|
|
config,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
(builtins.fetchTarball {
|
|
# This is a quick and dirty way to import a NixOS mailserver release. What
|
|
# you should do long-term is use a proper dependency pinning tool like npins
|
|
# or flakes.
|
|
|
|
# URL to the tarball for the release matching your NixOS release
|
|
url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-25.11/nixos-mailserver-nixos-25.11.tar.gz";
|
|
|
|
# Hash of the unpacked tarball, run the following command to retrieve it
|
|
# release="nixos-25.11" nix-prefetch-url "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz" --unpack
|
|
sha256 = "0000000000000000000000000000000000000000000000000000";
|
|
})
|
|
];
|
|
|
|
# https://letsencrypt.org/repository/#let-s-encrypt-subscriber-agreement
|
|
security.acme.acceptTerms = true;
|
|
|
|
# Allow incoming HTTP connections
|
|
networking.firewall.allowedTCPPorts = [ 80 ];
|
|
|
|
# Enable ACME HTTP-01 challenge with nginx
|
|
services.nginx.virtualHosts.${config.mailserver.fqdn}.enableACME = true;
|
|
|
|
mailserver = {
|
|
enable = true;
|
|
stateVersion = 3;
|
|
fqdn = "mail.example.com";
|
|
domains = [ "example.com" ];
|
|
|
|
# Reference the existing ACME configuration created by nginx
|
|
x509.useACMEHost = config.mailserver.fqdn;
|
|
|
|
# A list of all login accounts. To create the password hashes, use
|
|
# nix-shell -p mkpasswd --run 'mkpasswd -s'
|
|
accounts = {
|
|
"user1@example.com" = {
|
|
# Reads the password hash from a file on the server
|
|
hashedPasswordFile = "/a/file/containing/a/hashed/password";
|
|
|
|
# Additional addresses delivered to this mailbox
|
|
aliases = [ "postmaster@example.com" ];
|
|
};
|
|
"user2@example.com" = {
|
|
# Provides the password hash inline
|
|
hashedPassword = "$y$j9T$JqqefR6flaaJBRjD4KVZc1$QM6h4Spr5.yn/FuIT.ydTV22daEbiVd8ZprV/POtPgB";
|
|
};
|
|
};
|
|
};
|
|
}
|