surtr: mta-sts & dane

1 files changed, 29 insertions, 8 deletions

diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index e3437a6b..357ee668 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -640,15 +640,35 @@ in {
         };
       }) spmDomains) // {
         "mta-sts.bouncy.email" = {
-          locations."/".root = pkgs.runCommand "mta-sts" {} ''
-            mkdir -p $out/.well-known
-            cp ${pkgs.writeText "mta-sts.txt" ''
-              version: STSv1
-              mode: testing
-              mx: mailin.bouncy.email
-              max_age: 604800
-            ''} $out/.well-known/mta-sts.txt
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/mta-sts.bouncy.email.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/mta-sts.bouncy.email.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/mta-sts.bouncy.email.chain.pem";
+
+          extraConfig = ''
+            add_header Strict-Transport-Security "max-age=63072000" always;
+
+            add_header Access-Control-Allow-Origin '*';
+            add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, OPTIONS';
+            add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type, Authorization';
+            add_header Access-Control-Max-Age 7200;
           '';
+
+          locations."/" = {
+            extraConfig = ''
+              charset utf-8;
+              source_charset utf-8;
+            '';
+            root = pkgs.runCommand "mta-sts" {} ''
+              mkdir -p $out/.well-known
+              cp ${pkgs.writeText "mta-sts.txt" ''
+                version: STSv1
+                mode: testing
+                mx: mailin.bouncy.email
+                max_age: 604800
+              ''} $out/.well-known/mta-sts.txt
+            '';
+          };
         };
       };
     };
@@ -659,6 +679,7 @@ in {
     ]) spmDomains ++ [
       "mta-sts.bouncy.email.key.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/key.pem"
       "mta-sts.bouncy.email.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/fullchain.pem"
+      "mta-sts.bouncy.email.chain.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/chain.pem"
     ];
 
     systemd.services.spm = {