fi-nix-infra/config/hosts/mail-1/simple-nixos-mailserver.nix

{ simple-nixos-mailserver, config, ... }:
{
  imports = [
    simple-nixos-mailserver.nixosModule {
      mailserver = {
        enable = true;
        stateVersion = 3;
        openFirewall = true;
        fqdn = "mail-1.grzb.de";
        enableImap = false;
        enableImapSsl = true;
        enableSubmission = false;
        enableSubmissionSsl = true;
        lmtpSaveToDetailMailbox = false;
        domains = [ "grzb.de" "vs.grzb.de" "wg.grzb.de" "nekover.se" ];
        accounts = {
          "fiona@grzb.de" = {
            hashedPasswordFile = "/run/secrets/mail-fiona-grzb-de";
            aliases = [ "@grzb.de" ];
            catchAll = [ "grzb.de" ];
          };
          "yuri@nekover.se" = {
            hashedPasswordFile = "/run/secrets/mail-yuri-nekover-se";
            aliases = [ "@nekover.se" ];
            catchAll = [ "nekover.se" ];
          };
          "mio@vs.grzb.de" = {
            hashedPasswordFile = "/run/secrets/mail-mio-vs-grzb-de";
            sendOnly = true;
            aliases = [ "root@vs.grzb.de" ];
          };
          "fubuki@wg.grzb.de" = {
            hashedPasswordFile = "/run/secrets/mail-fubuki-wg-grzb-de";
            sendOnly = true;
            aliases = [ "root@wg.grzb.de" ];
          };
          "cloud@nekover.se" = {
            hashedPasswordFile = "/run/secrets/mail-cloud-nekover-se";
            sendOnly = true;
          };
          "status@nekover.se" = {
            hashedPasswordFile = "/run/secrets/mail-status-nekover-se";
            sendOnly = true;
          };
          "matrix@nekover.se" = {
            hashedPasswordFile = "/run/secrets/mail-matrix-nekover-se";
            sendOnly = true;
            aliases = [ "nyareply@nekover.se" ];
          };
          "nekomesh@nekover.se" = {
            hashedPasswordFile = "/run/secrets/mail-nekomesh-nekover-se";
            sendOnly = true;
            aliases = [ "nyareply@nekover.se" ];
          };
          "social@nekover.se" = {
            hashedPasswordFile = "/run/secrets/mail-social-nekover-se";
            sendOnly = true;
            aliases = [ "nyareply@nekover.se" ];
          };
          "id@nekover.se" = {
            hashedPasswordFile = "/run/secrets/mail-id-nekover-se";
            sendOnly = true;
            aliases = [ "nyareply@nekover.se" ];
          };
          "forgejo@nekover.se" = {
            hashedPasswordFile = "/run/secrets/mail-forgejo-nekover-se";
            sendOnly = true;
            aliases = [ "nyareply@nekover.se" ];
          };
        };
        # Reference the existing ACME configuration created by nginx
        x509.useACMEHost = config.mailserver.fqdn;
      };
    }
  ];

  services.postfix = {
    transport = "relay:[mail-2.grzb.de]";
    settings.main = {
      proxy_interfaces = "212.53.203.19";
    };
  };

  # https://letsencrypt.org/repository/#let-s-encrypt-subscriber-agreement
  security.acme.acceptTerms = true;

  # Allow incoming HTTP connections
  networking.firewall.allowedTCPPorts = [ 80 ];

  # Enable ACME HTTP-01 challenge with nginx
  services.nginx = {
    enable = true;
    virtualHosts.${config.mailserver.fqdn}.enableACME = true;
  };

  sops.secrets."mail-fiona-grzb-de" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-yuri-nekover-se" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-mio-vs-grzb-de" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-fubuki-wg-grzb-de" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-cloud-nekover-se" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-status-nekover-se" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-matrix-nekover-se" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-nekomesh-nekover-se" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-social-nekover-se" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-id-nekover-se" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
  sops.secrets."mail-forgejo-nekover-se" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "postfix.service" ];
  };
}