wurzel/fruitbasket
10
1
Fork 1
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity

refactor: split mail into modules

Browse source
This commit is contained in:
Rouven Seifert 2024-03-12 11:34:16 +01:00
parent 3979e9b2b9
commit 71fdea75be
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
7 changed files with 438 additions and 416 deletions
Download patch file Download diff file Expand all files Collapse all files

124
modules/mail/sogo.nix Normal file
View file

@ -0,0 +1,124 @@
{ config, lib, ... }:
let
sogo-hostname = "mail.${config.networking.domain}";
in
{
sops.secrets = {
sogo_ldap_search = {
key = "portunus/search-password";
owner = config.systemd.services.sogo.serviceConfig.User;
};
};
services = {
memcached.enable = true;
sogo = {
enable = true;
language = "German";
extraConfig = ''
WOWorkersCount = 10;
SOGoUserSources = ({
type = ldap;
CNFieldName = cn;
UIDFieldName = uid;
IDFieldName = uid;
baseDN = "ou=users, dc=ifsr, dc=de";
bindDN = "uid=search, ou=users, dc=ifsr, dc=de";
bindPassword = LDAP_SEARCH;
hostname = "ldap://localhost";
canAuthenticate = YES;
id = directory;
});
SOGoProfileURL = "postgresql://sogo@%2frun%2Fpostgresql/sogo/sogo_user_profile";
OCSSessionsFolderURL = "postgresql://sogo@%2frun%2Fpostgresql/sogo/sogo_sessions_folder";
OCSFolderInfoURL = "postgresql://sogo:POSTGRES_PASSWORD@%2frun%2Fpostgresql/sogo/sogo_folder_info";
SOGoSieveServer = sieve://127.0.0.1:4190;
SOGoSieveScriptsEnabled = YES;
SOGoVacationEnabled = YES;
SOGoJunkFolderName = Spam;
'';
configReplaces = {
"LDAP_SEARCH" = config.sops.secrets.sogo_ldap_search.path;
};
vhostName = "${sogo-hostname}";
timezone = "Europe/Berlin";
};
postgresql = {
enable = true;
ensureUsers = [
{
name = "sogo";
ensureDBOwnership = true;
}
];
ensureDatabases = [ "sogo" ];
};
nginx = {
recommendedProxySettings = true;
virtualHosts."${sogo-hostname}" = {
extraConfig = ''
proxy_busy_buffers_size 64k;
proxy_buffers 8 64k;
proxy_buffer_size 64k;
'';
forceSSL = true;
enableACME = true;
locations = {
"^~/SOGo".extraConfig = lib.mkForce ''
proxy_pass http://127.0.0.1:20000;
proxy_redirect http://127.0.0.1:20000 default;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_set_header x-webobjects-server-protocol HTTP/1.0;
proxy_set_header x-webobjects-remote-host 127.0.0.1;
proxy_set_header x-webobjects-server-port $server_port;
proxy_set_header x-webobjects-server-name $server_name;
proxy_set_header x-webobjects-server-url $scheme://$host;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
proxy_buffer_size 64k;
proxy_buffers 8 64k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
client_max_body_size 50m;
client_body_buffer_size 128k;
break;
'';
};
};
};
};
# one of these prevents access to sendmail, don't know which one
systemd.services.sogo.serviceConfig = {
LockPersonality = lib.mkForce false;
MemoryDenyWriteExecute = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
PrivateDevices = lib.mkForce false;
PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false;
ProtectHostname = lib.mkForce false;
ProtectKernelLogs = lib.mkForce false;
ProtectKernelModules = lib.mkForce false;
ProtectKernelTunables = lib.mkForce false;
RestrictAddressFamilies = lib.mkForce [ ];
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
SystemCallArchitectures = lib.mkForce "";
SystemCallFilter = lib.mkForce [ ];
ReadWriteDirectories = "/var/lib/postfix/queue/maildrop";
};
}