jet/extremist-software
jet/extremist-software
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: fix qemu onto hetzner and fix mailserver

Browse source
This commit is contained in:
Jet Pham 2026-02-20 02:46:08 -08:00
parent d800c6a180
commit afd3360582
No known key found for this signature in database
5 changed files with 77 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

39
modules/mail.nix
View file

@ -3,29 +3,56 @@
{
services.stalwart = {
enable = true;
# Let stalwart open its own ports if needed for the main services
openFirewall = true;
settings = {
server = {
hostname = "mail.extremist.software";
hostname = "extremist.software";
tls = {
enable = true;
implicit = false; # StartTLS usually on 587
};
listener = {
smtp = {
protocol = "smtp";
bind = "[::]:25";
};
submissions = {
bind = "[::]:465";
protocol = "smtp";
tls.implicit = true;
};
imaps = {
bind = "[::]:993";
protocol = "imap";
tls.implicit = true;
};
management = {
bind = [ "127.0.0.1:8080" ];
protocol = "http";
};
};
};
# Use the certificate procured by security.acme for Caddy
certificate."default" = {
cert = "%{file:/var/lib/acme/extremist.software/fullchain.pem}%";
private-key = "%{file:/var/lib/acme/extremist.software/key.pem}%";
};
authentication.fallback-admin = {
user = "admin";
secret = config.mySecrets.stalwartAdmin;
};
# Stalwart configuration is quite extensive.
# By default it listens on standard ports (25, 465, 587, 993, 4190)
# and provides a web admin UI on 8080.
};
};
# Allow Stalwart to read the ACME certificate procured for Caddy
systemd.services.stalwart.serviceConfig.SupplementaryGroups = [ "acme" ];
# Open Firewalls for Mail
networking.firewall.allowedTCPPorts = [
25 465 587 # SMTP
993 # IMAP (Secure)
4190 # Sieve
8080 # Admin UI (Reverse proxied, but good to double check loopback)