From ebd0f656eda09cb55ca78ee01ce1273f8b953483 Mon Sep 17 00:00:00 2001 From: John Boehr Date: Thu, 9 Nov 2017 13:13:27 -0800 Subject: [PATCH] Preliminary multi-domain support --- default.nix | 10 ++++++++-- mail-server/nginx.nix | 35 +++++++++++++++++++++++------------ mail-server/postfix.nix | 16 +++++++++------- mail-server/systemd.nix | 2 +- mail-server/users.nix | 2 +- nixops/single-server.nix | 13 +++++++++---- 6 files changed, 51 insertions(+), 27 deletions(-) diff --git a/default.nix b/default.nix index 6a07f7e..f9303a7 100644 --- a/default.nix +++ b/default.nix @@ -28,8 +28,14 @@ in domain = mkOption { type = types.str; - example = "example.com"; - description = "The domain that this mail server serves. So far only one domain is supported"; + example = "[ example.com ]"; + description = "The primary domain that this mail server serves."; + }; + + extraDomains = mkOption { + type = types.listOf types.str; + example = "[ example.com ]"; + description = "Extra domains that this mail server serves."; }; hostPrefix = mkOption { diff --git a/mail-server/nginx.nix b/mail-server/nginx.nix index 15bb596..71f6c28 100644 --- a/mail-server/nginx.nix +++ b/mail-server/nginx.nix @@ -21,23 +21,34 @@ with (import ./common.nix { inherit config; }); let cfg = config.mailserver; + allDomains = [ cfg.domain ] ++ cfg.extraDomains; + acmeRoot = "/var/lib/acme/acme-challenge"; in { config = with cfg; lib.mkIf (certificateScheme == 3) { - services.nginx = { enable = true; - virtualHosts = { - domain = { - serverName = "${hostPrefix}.${domain}"; - forceSSL = true; - enableACME = true; - locations."/" = { - root = "/var/www"; - }; - acmeRoot = "/var/lib/acme/acme-challenge"; - }; - }; + virtualHosts = genAttrs allDomains (domain: { + serverName = "${hostPrefix}.${domain}"; + forceSSL = true; + enableACME = true; + locations."/" = { + root = "/var/www"; + }; + acmeRoot = acmeRoot; + }); + }; + security.acme.certs."${hostPrefix}.${domain}" = { + # @todo what user/group should this run as? + user = "postfix"; # cfg.user; + group = "postfix"; # lib.mkDefault cfg.group; + domain = "${hostPrefix}.${domain}"; + extraDomains = map (domain: "${hostPrefix}.${domain}") extraDomains; + webroot = acmeRoot; + # @todo should we reload postfix here? + postRun = '' + systemctl reload nginx + ''; }; }; } diff --git a/mail-server/postfix.nix b/mail-server/postfix.nix index fedb53c..ee91da9 100644 --- a/mail-server/postfix.nix +++ b/mail-server/postfix.nix @@ -19,17 +19,19 @@ with (import ./common.nix { inherit config; }); let + inherit (lib.strings) concatStringsSep; cfg = config.mailserver; + allDomains = [ cfg.domain ] ++ cfg.extraDomains; # valiases_postfix :: [ String ] valiases_postfix = map (from: let to = cfg.virtualAliases.${from}; - in "${from}@${cfg.domain} ${to}@${cfg.domain}") + in "${from} ${to}") (builtins.attrNames cfg.virtualAliases); # accountToIdentity :: User -> String - accountToIdentity = account: "${account.name}@${cfg.domain} ${account.name}@${cfg.domain}"; + accountToIdentity = account: "${account.name} ${account.name}"; # vaccounts_identity :: [ String ] vaccounts_identity = map accountToIdentity (lib.attrValues cfg.loginAccounts); @@ -38,7 +40,7 @@ let valiases_file = builtins.toFile "valias" (lib.concatStringsSep "\n" valiases_postfix); # vhosts_file :: Path - vhosts_file = builtins.toFile "vhosts" cfg.domain; + vhosts_file = builtins.toFile "vhosts" (concatStringsSep ", " allDomains); # vaccounts_file :: Path # see @@ -47,7 +49,7 @@ let # every alias is owned (uniquely) by its user. We have to add the users own # address though vaccounts_file = builtins.toFile "vaccounts" (lib.concatStringsSep "\n" (vaccounts_identity ++ valiases_postfix)); - + submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" '' # Removes sensitive headers from mails handed in via the submission port. # See https://thomas-leister.de/mailserver-debian-stretch/ @@ -67,12 +69,12 @@ in enable = true; networksStyle = "host"; mapFiles."valias" = valiases_file; - mapFiles."vaccounts" = vaccounts_file; + mapFiles."vaccounts" = vaccounts_file; sslCert = certificatePath; sslKey = keyPath; enableSubmission = true; - extraConfig = + extraConfig = '' # Extra Config @@ -116,7 +118,7 @@ in ''; submissionOptions = - { + { smtpd_tls_security_level = "encrypt"; smtpd_sasl_auth_enable = "yes"; smtpd_sasl_type = "dovecot"; diff --git a/mail-server/systemd.nix b/mail-server/systemd.nix index 48f5a5e..b6556a8 100644 --- a/mail-server/systemd.nix +++ b/mail-server/systemd.nix @@ -64,7 +64,7 @@ in # Create certificates and maildir folder systemd.services.postfix = { after = (if (certificateScheme == 3) then [ "nginx.service" ] else []); - preStart = + preStart = '' # Create mail directory and set permissions. See # . diff --git a/mail-server/users.nix b/mail-server/users.nix index c55375c..f49be1f 100644 --- a/mail-server/users.nix +++ b/mail-server/users.nix @@ -30,7 +30,7 @@ let # accountsToUser :: String -> UserRecord accountsToUser = account: { - name = account.name + "@" + domain; + name = account.name; isNormalUser = false; group = vmailGroupName; inherit (account) hashedPassword; diff --git a/nixops/single-server.nix b/nixops/single-server.nix index 15e9e5e..8072233 100644 --- a/nixops/single-server.nix +++ b/nixops/single-server.nix @@ -11,17 +11,22 @@ mailserver = { enable = true; domain = "example.com"; + extraDomains = [ "example2.com" ]; hostPrefix = "mail"; loginAccounts = { - user1 = { + "user1@example.com" = { hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/"; }; }; virtualAliases = { - info = "user1"; - postmaster = "user1"; - abuse = "user1"; + "user1@example2.com" = "user1@example.com"; + "info@example.com" = "user1@example.com"; + "postmaster@example.com" = "user1@example.com"; + "abuse@example.com" = "user1@example.com"; + "info@example2.com" = "user1@example.com"; + "postmaster@example2.com" = "user1@example.com"; + "abuse@example2.com" = "user1@example.com"; }; }; };