Initial commit

hosts/server/kazusa/services/mailserver.nix

@@ -0,0 +1,201 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  mailSecret = key: {
+    sopsFile = ../secrets/mailserver.yaml;
+    inherit key;
+    owner = "nginx";
+    group = "nginx";
+    mode = "0440";
+    restartUnits = [
+      "phpfpm-roundcube.service"
+      "dovecot.service"
+    ];
+  };
+
+  clientIdSecret = config.sops.secrets."mailserver/oauth/client-id".path;
+  clientSecret = config.sops.secrets."mailserver/oauth/client-secret".path;
+in
+{
+  sops.secrets."mailserver/oauth/client-id" = mailSecret "mailserver/oauth/client-id";
+
+  sops.secrets."mailserver/oauth/client-secret" = mailSecret "mailserver/oauth/client-secret";
+
+  imports = [
+    (builtins.fetchTarball {
+      url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/51726d7b7fd94aa69829fd42749a803914cbf3b7/nixos-mailserver-51726d7b7fd94aa69829fd42749a803914cbf3b7.tar.gz";
+      sha256 = "0449ssnpwbgfv0cyddzb8s6g641gy5xh1hd3shg32x8pv0a5qy3a";
+    })
+  ];
+
+  security.acme.acceptTerms = false;
+
+  services.roundcube = {
+    enable = true;
+    hostName = "mail.mizuki.guru";
+
+    package = pkgs.roundcube.withPlugins (
+      plugins: with plugins; [
+        persistent_login
+      ]
+    );
+
+    plugins = [
+      "persistent_login"
+      "managesieve"
+    ];
+
+    dicts = with pkgs.aspellDicts; [
+      en
+    ];
+
+    maxAttachmentSize = config.mailserver.messageSizeLimit / 1024 / 1024;
+
+    extraConfig = ''
+      $_SERVER['HTTPS'] = 'on';
+      $_SERVER['SERVER_PORT'] = 443;
+      $_SERVER['HTTP_X_FORWARDED_PORT'] = 443;
+      $_SERVER['HTTP_X_FORWARDED_PROTO'] = 'https';
+      $_SERVER['HTTP_HOST'] = 'mail.mizuki.guru';
+
+      $config['proxy_ips'] = '127.0.0.1';
+
+      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+
+      $config['managesieve_host'] = "tls://${config.mailserver.fqdn}";
+      $config['managesieve_port'] = 4190;
+      $config['managesieve_usetls'] = true;
+
+      $config['oauth_provider'] = 'generic';
+      $config['oauth_provider_name'] = 'authentik';
+
+      $config['oauth_client_id'] =
+        trim(file_get_contents('${clientIdSecret}'));
+
+      $config['oauth_client_secret'] =
+        trim(file_get_contents('${clientSecret}'));
+
+      $config['oauth_auth_uri'] =
+        'https://auth.mizuki.guru/application/o/authorize/';
+
+      $config['oauth_token_uri'] =
+        'https://auth.mizuki.guru/application/o/token/';
+
+      $config['oauth_identity_uri'] =
+        'https://auth.mizuki.guru/application/o/userinfo/';
+
+      $config['oauth_scope'] =
+        "email openid dovecotprofile offline_access";
+
+      $config['oauth_auth_parameters'] = [];
+      $config['oauth_identity_fields'] = ['email'];
+    '';
+  };
+
+  services.nginx.virtualHosts.${config.services.roundcube.hostName} = {
+    forceSSL = false;
+    enableACME = false;
+
+    listen = [
+      {
+        addr = "127.0.0.1";
+        port = 5656;
+      }
+    ];
+
+    extraConfig = ''
+      set_real_ip_from 127.0.0.1;
+      real_ip_header X-Forwarded-For;
+      real_ip_recursive on;
+    '';
+  };
+
+  services.caddy = {
+    enable = true;
+
+    virtualHosts."mail.mizuki.guru" = {
+      extraConfig = ''
+        reverse_proxy localhost:5656
+      '';
+    };
+  };
+
+  services.dovecot2.settings = {
+    auth_mechanisms = lib.mkForce [
+      "plain"
+      "login"
+      "xoauth2"
+      "oauthbearer"
+    ];
+
+    oauth2_tokeninfo_url = "https://auth.mizuki.guru/application/o/userinfo/?access_token=";
+
+    # 주의:
+    # 여기는 아직 secret '값'이 아니라 secret '경로'가 들어감.
+    # Dovecot이 URL 안에서 file_get_contents 같은 처리를 안 하므로
+    # 이 방식은 제대로 동작하지 않을 가능성이 큼.
+    oauth2_introspection_url = "https://auth.mizuki.guru/application/o/introspect/";
+
+    oauth2_introspection_mode = "post";
+    oauth2_force_introspection = "yes";
+    oauth2_active_attribute = "active";
+    oauth2_active_value = "true";
+    oauth2_username_attribute = "email";
+  };
+
+  users.users.dovecot = {
+    isSystemUser = true;
+    group = "dovecot";
+    extraGroups = [ "caddy" ];
+  };
+
+  users.groups.dovecot = { };
+
+  users.users.postfix.extraGroups = [ "caddy" ];
+
+  mailserver = {
+    enable = true;
+    stateVersion = 4;
+    fqdn = "mail.mizuki.guru";
+    domains = [ "mizuki.guru" ];
+
+    x509 = {
+      certificateFile = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.mizuki.guru/mail.mizuki.guru.crt";
+
+      privateKeyFile = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.mizuki.guru/mail.mizuki.guru.key";
+    };
+
+    ldap = {
+      enable = true;
+      uris = [ "ldap://10.11.8.102" ];
+
+      bind = {
+        dn = "cn=mailserver,ou=users,dc=ldap,dc=goauthentik,dc=io";
+        passwordFile = "/var/lib/secrets/authentik-ldap-bind-pw";
+      };
+
+      base = "ou=users,dc=ldap,dc=goauthentik,dc=io";
+      scope = "sub";
+
+      attributes = {
+        uuid = "uid";
+        username = "mail";
+        mail = "mail";
+      };
+
+      dovecot = {
+        passFilter = "mail=%{user}\n  bind = yes";
+      };
+    };
+
+    accounts = { };
+  };
+}