Migrate mailserver config to 25.11

hosts/iron/services/mail.nix

@@ -1,15 +1,9 @@
-{ config, ... }:
-
-let
-  inherit (config.networking) ports;
-in
 {
   #sops.secrets."domain_key_jalr.de".owner = "rspamd";
   jalr = {
     mailserver = {
       enable = true;
       fqdn = "hha.jalr.de";
-      relayPort = ports.postfix-relay.tcp;
       domains = [
         {
           domain = "jalr.de";
@@ -25,15 +19,19 @@ in
     };
   };
   services.postfix = {
-    config = {
+    settings = {
+      main = {
         smtp_bind_address = "159.69.103.126";
         smtp_bind_address_enforce = true;
       };
-    masterConfig.smtp.args = [
+      master = {
+        smtp.args = [
           "-o"
           "inet_protocols=ipv4"
         ];
       };
+    };
+  };
   services.nginx.virtualHosts."hha.jalr.de" = {
     enableACME = true;
     forceSSL = true;

modules/mailserver/default.nix

@@ -5,11 +5,6 @@ in
 {
   options.jalr.mailserver = with lib; with lib.types; {
     enable = mkEnableOption "simple mail server";
-    relayPort = mkOption {
-      description = "SMTP port for relay mail relay.";
-      type = port;
-      default = 25;
-    };
     fqdn = mkOption {
       type = str;
       description = ''

modules/mailserver/dovecot.nix

@@ -8,6 +8,26 @@ let
       "\n"
       ({ address, passwordHash, ... }: "${address}:${passwordHash}")
       cfg.users);
+
+  sieveScripts = {
+    learn-spam = pkgs.writeText "learn-spam.sieve" ''
+      require ["vnd.dovecot.pipe", "copy", "imapsieve"];
+      pipe :copy "rspamc" ["learn_spam"];
+    '';
+    learn-ham = pkgs.writeText "learn-ham.sieve" ''
+      require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];
+
+      if environment :matches "imap.mailbox" "*" {
+          set "mailbox" "''${1}";
+      }
+
+      if string "''${mailbox}" "Trash" {
+          stop;
+      }
+
+      pipe :copy "rspamc" ["learn_ham"];
+    '';
+  };
 in
 lib.mkIf cfg.enable {
   services.dovecot2 = {
@@ -111,12 +131,12 @@ lib.mkIf cfg.enable {
         ${lib.optionalString cfg.spam.enable ''
         imapsieve_mailbox1_name = Spam
         imapsieve_mailbox1_causes = COPY
-        imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/learn-spam.sieve
+        imapsieve_mailbox1_before = file:${sieveScripts.learn-spam}
 
         imapsieve_mailbox2_name = *
         imapsieve_mailbox2_from = Spam
         imapsieve_mailbox2_causes = COPY
-        imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/learn-ham.sieve
+        imapsieve_mailbox2_before = file:${sieveScripts.learn-ham}
         sieve_pipe_bin_dir = ${pkgs.symlinkJoin { name = "sieve-pipe-bin-dir"; paths = with pkgs; [ rspamd ]; } }/bin
         ''}
       }
@@ -125,37 +145,12 @@ lib.mkIf cfg.enable {
 
   environment.systemPackages = [ pkgs.dovecot_pigeonhole ];
 
+  /*
     systemd.services.dovecot2 = {
     wants = [ "acme-finished-${cfg.fqdn}.target" ];
     after = [ "acme-finished-${cfg.fqdn}.target" ];
-
-    preStart = lib.mkIf cfg.spam.enable
-      (lib.mkAfter
-        (lib.concatStrings
-          (lib.mapAttrsToList
-            (name: content: ''
-              cp ${pkgs.writeText name content} /var/lib/dovecot/sieve/${name}
-            '')
-            {
-              "learn-spam.sieve" = ''
-                require ["vnd.dovecot.pipe", "copy", "imapsieve"];
-                pipe :copy "rspamc" ["learn_spam"];
-              '';
-              "learn-ham.sieve" = ''
-                require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];
-
-                if environment :matches "imap.mailbox" "*" {
-                    set "mailbox" "''${1}";
-                }
-
-                if string "''${mailbox}" "Trash" {
-                    stop;
-                }
-
-                pipe :copy "rspamc" ["learn_ham"];
-              '';
-            })));
     };
+  */
 
   networking.firewall.allowedTCPPorts = [
     143 # IMAP

modules/mailserver/postfix.nix

@@ -38,32 +38,25 @@ lib.mkIf cfg.enable {
   services.postfix = {
     enable = true;
 
-    inherit (cfg) relayPort;
-
     enableSubmission = false; # plain/STARTTLS (latter is forced in submissionOptions)
     enableSubmissions = true; # submission with implicit TLS (TCP/465)
 
-    hostname = cfg.fqdn;
+    settings = {
-    networksStyle = "host";
+      main = {
-
+        smtpd_tls_chain_files = [
-    settings.main.smtpd_tls_chain_files = [
           "${cfg.certDir}/key.pem"
           "${cfg.certDir}/fullchain.pem"
         ];
+        recipient_delimiter = "+";
+        myhostname = cfg.fqdn;
+        mynetworks_style = "host";
 
-    recipientDelimiter = "+";
-
-    mapFiles = {
-      inherit valiases;
-    };
-
-    config = {
         # General
         smtpd_banner = "${cfg.fqdn} ESMTP";
         disable_vrfy_command = true; # disable check if mailbox exists
         enable_long_queue_ids = true; # better for debugging
         strict_rfc821_envelopes = true; # only accept properly formatted envelope
-      message_size_limit = toString cfg.messageSizeLimit;
+        message_size_limit = cfg.messageSizeLimit;
 
         virtual_mailbox_domains = listToString (map (x: x.domain) cfg.domains);
         virtual_mailbox_maps = "hash:/var/lib/postfix/conf/valiases";
@@ -106,6 +99,19 @@ lib.mkIf cfg.enable {
         ];
         tls_preempt_cipherlist = "no";
       };
+      master = {
+        submission-header-cleanup = {
+          private = false;
+          maxproc = 0;
+          command = "cleanup";
+          args = [ "-o" "header_checks=pcre:${submissionHeaderCleanupRules}" ];
+        };
+      };
+    };
+
+    mapFiles = {
+      inherit valiases;
+    };
 
     # plain/STARTTLS (forced with smtpd_tls_security_level)
     submissionOptions = {
@@ -132,15 +138,6 @@ lib.mkIf cfg.enable {
     };
     # implicit TLS
     submissionsOptions = config.services.postfix.submissionOptions;
-
-    masterConfig = {
-      submission-header-cleanup = {
-        private = false;
-        maxproc = 0;
-        command = "cleanup";
-        args = [ "-o" "header_checks=pcre:${submissionHeaderCleanupRules}" ];
-      };
-    };
   };
 
   networking.firewall.allowedTCPPorts = [