env/users: enable IMAP TLS

1 files changed, 9 insertions, 7 deletions

diff --git a/env/users/mailbox.nix b/env/users/mailbox.nix
index e603214..9fe460e 100644
--- a/env/users/mailbox.nix
+++ b/env/users/mailbox.nix
@@ -6,6 +6,8 @@ in
   options.local.mailHost = with types; {
     enable = mkEnableOption "mailbox host service";
 
+    security.acme.defaults.dnsProvider = "gandiv5";
+
     mdaListen = mkOption {
       type = str;
     };
@@ -33,8 +35,8 @@ in
           enablePAM = false;
           enableLmtp = true;
 
-          #sslServerKey = "${cert}/key.pem";
-          #sslServerCert = "${cert}/fullchain.pem";
+          sslServerKey = "${cert}/key.pem";
+          sslServerCert = "${cert}/fullchain.pem";
 
           modules = [ pkgs.dovecot_pigeonhole ];
 
@@ -146,9 +148,9 @@ in
         # Necesario debido a 'enablePAM = false'
         pam.services.dovecot2 = { };
 
-        #acme.certs.${imapHostname} = {
-        #  inherit (config.services.dovecot2) group;
-        #};
+        acme.certs.${imapHostname} = {
+          inherit (config.services.dovecot2) group;
+        };
       };
 
       users = {
@@ -156,8 +158,8 @@ in
         groups.${config.services.dovecot2.mailGroup}.gid = 993;
       };
 
-      #networking.firewall.allowedTCPPorts = [ 143 993 ];
+      networking.firewall.allowedTCPPorts = [ 143 587 993 ];
 
-      #local.certs.imap.enable = true;
+      local.certs.imap.enable = true;
     };
 }