surtr: ...

1 files changed, 7 insertions, 15 deletions

diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index 165e0eb2..0c625325 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -47,10 +47,10 @@ with lib;
         smtp_dns_support_level = "dnssec";
 
         tls_server_sni_maps = ''texthash:${pkgs.writeText "sni" ''
-          bouncy.email /run/credentials/postfix.service/bouncy.email.sni.pem
-          mailin.bouncy.email /run/credentials/postfix.service/mailin.bouncy.email.sni.pem
-          mailsub.bouncy.email /run/credentials/postfix.service/mailsub.bouncy.email.sni.pem
-          .bouncy.email /run/credentials/postfix.service/bouncy.email.sni.pem
+          bouncy.email /run/credentials/postfix.service/bouncy.email.full.pem
+          mailin.bouncy.email /run/credentials/postfix.service/mailin.bouncy.email.full.pem
+          mailsub.bouncy.email /run/credentials/postfix.service/mailsub.bouncy.email.full.pem
+          .bouncy.email /run/credentials/postfix.service/bouncy.email.full.pem
         ''}'';
 
         local_recipient_maps = "";
@@ -166,20 +166,12 @@ with lib;
     };
 
     systemd.services.postfix = {
-      preStart = concatMapStringsSep "\n" (domain: ''
-        (
-          umask 0037
-          cat /var/lib/acme/${domain}/key.pem /var/lib/acme/${domain}/full.pem > /var/lib/acme/${domain}/sni.pem
-          chown acme:acme /var/lib/acme/${domain}/sni.pem
-        )
-      '') ["bouncy.email" "mailin.bouncy.email" "mailsub.bouncy.email" "surtr.yggdrasil.li"];
-      
       serviceConfig.LoadCredential = [
         "surtr.yggdrasil.li.key.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/key.pem"
         "surtr.yggdrasil.li.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/fullchain.pem"
-        "bouncy.email.sni.pem:${config.security.acme.certs."bouncy.email".directory}/sni.pem"
-        "mailin.bouncy.email.sni.pem:${config.security.acme.certs."mailin.bouncy.email".directory}/sni.pem"
-        "mailsub.bouncy.email.sni.pem:${config.security.acme.certs."mailsub.bouncy.email".directory}/sni.pem"
+        "bouncy.email.sni.pem:${config.security.acme.certs."bouncy.email".directory}/full.pem"
+        "mailin.bouncy.email.sni.pem:${config.security.acme.certs."mailin.bouncy.email".directory}/full.pem"
+        "mailsub.bouncy.email.sni.pem:${config.security.acme.certs."mailsub.bouncy.email".directory}/full.pem"
       ];
     };
   };