fi/nix-infra
1
1
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Enable TLS on mail relay

Browse source
This commit is contained in:
fi 2023-09-19 16:49:00 +02:00
parent 91bd9f3c1d
commit 9815afffdb
Signed by: fi
SSH key fingerprint: SHA256:d+6fQoDPMbSFK95zRVflRKZLRKF4cPSQb7VIxYkhFsA
4 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
config/hosts/mail-2/acme.nix Normal file
View file

@ -0,0 +1,9 @@
{ ... }:
{
security.acme.certs = {
"mail-2.grzb.de" = {
listenHTTP = ":80";
reloadServices = [ "postfix.service" ];
};
};
}

2
config/hosts/mail-2/configuration.nix
View file

@ -79,7 +79,7 @@
useDHCP = false;
firewall = {
enable = true;
allowedTCPPorts = [ 25 ];
allowedTCPPorts = [ 25 80 ];
};
};

1
config/hosts/mail-2/default.nix
View file

@ -3,5 +3,6 @@
imports = [
./configuration.nix
./postfix.nix
./acme.nix
];
}

5
config/hosts/mail-2/postfix.nix
View file

@ -1,4 +1,5 @@
{ ... }: {
{ config, ... }:
{
# Postfix relay configuration, see: https://www.postfix.org/STANDARD_CONFIGURATION_README.html#backup
services.postfix = {
enable = true;
@ -7,6 +8,8 @@
"grzb.de"
"nekover.se"
];
sslCert = "${config.security.acme.certs."mail-2.grzb.de".directory}/fullchain.pem";
sslKey = "${config.security.acme.certs."mail-2.grzb.de".directory}/key.pem";
extraConfig = ''
message_size_limit = 20971520
smtpd_relay_restrictions = permit_mynetworks reject_unauth_destination