diff options
Diffstat (limited to 'env')
| -rw-r--r-- | env/acme/default.nix | 6 | ||||
| -rw-r--r-- | env/users/mailbox.nix | 16 |
2 files changed, 14 insertions, 8 deletions
diff --git a/env/acme/default.nix b/env/acme/default.nix index 779b4e2..9b3db80 100644 --- a/env/acme/default.nix +++ b/env/acme/default.nix @@ -22,6 +22,11 @@ in defaults = { email = "security@${config.networking.domain}"; renewInterval = "weekly"; + + webroot = + if config.security.acme.defaults.dnsProvider == null + then "/var/lib/acme/acme-challenge" + else null; }; certs = @@ -31,7 +36,6 @@ in certConfig = domains: { domain = domains.main; extraDomainNames = domainSort (attrValues (filterAttrs (k: _: k != "main") domains)); - webroot = "/var/lib/acme/acme-challenge"; }; in mapAttrs' diff --git a/env/users/mailbox.nix b/env/users/mailbox.nix index e603214..9fe460e 100644 --- a/env/users/mailbox.nix +++ b/env/users/mailbox.nix @@ -6,6 +6,8 @@ in options.local.mailHost = with types; { enable = mkEnableOption "mailbox host service"; + security.acme.defaults.dnsProvider = "gandiv5"; + mdaListen = mkOption { type = str; }; @@ -33,8 +35,8 @@ in enablePAM = false; enableLmtp = true; - #sslServerKey = "${cert}/key.pem"; - #sslServerCert = "${cert}/fullchain.pem"; + sslServerKey = "${cert}/key.pem"; + sslServerCert = "${cert}/fullchain.pem"; modules = [ pkgs.dovecot_pigeonhole ]; @@ -146,9 +148,9 @@ in # Necesario debido a 'enablePAM = false' pam.services.dovecot2 = { }; - #acme.certs.${imapHostname} = { - # inherit (config.services.dovecot2) group; - #}; + acme.certs.${imapHostname} = { + inherit (config.services.dovecot2) group; + }; }; users = { @@ -156,8 +158,8 @@ in groups.${config.services.dovecot2.mailGroup}.gid = 993; }; - #networking.firewall.allowedTCPPorts = [ 143 993 ]; + networking.firewall.allowedTCPPorts = [ 143 587 993 ]; - #local.certs.imap.enable = true; + local.certs.imap.enable = true; }; } |