summaryrefslogtreecommitdiff
path: root/hosts/surtr/email/default.nix
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/surtr/email/default.nix')
-rw-r--r--hosts/surtr/email/default.nix37
1 files changed, 29 insertions, 8 deletions
diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index e3437a6b..357ee668 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -640,15 +640,35 @@ in {
640 }; 640 };
641 }) spmDomains) // { 641 }) spmDomains) // {
642 "mta-sts.bouncy.email" = { 642 "mta-sts.bouncy.email" = {
643 locations."/".root = pkgs.runCommand "mta-sts" {} '' 643 forceSSL = true;
644 mkdir -p $out/.well-known 644 sslCertificate = "/run/credentials/nginx.service/mta-sts.bouncy.email.pem";
645 cp ${pkgs.writeText "mta-sts.txt" '' 645 sslCertificateKey = "/run/credentials/nginx.service/mta-sts.bouncy.email.key.pem";
646 version: STSv1 646 sslTrustedCertificate = "/run/credentials/nginx.service/mta-sts.bouncy.email.chain.pem";
647 mode: testing 647
648 mx: mailin.bouncy.email 648 extraConfig = ''
649 max_age: 604800 649 add_header Strict-Transport-Security "max-age=63072000" always;
650 ''} $out/.well-known/mta-sts.txt 650
651 add_header Access-Control-Allow-Origin '*';
652 add_header Access-Control-Allow-Methods 'GET, POST, PUT, DELETE, OPTIONS';
653 add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type, Authorization';
654 add_header Access-Control-Max-Age 7200;
651 ''; 655 '';
656
657 locations."/" = {
658 extraConfig = ''
659 charset utf-8;
660 source_charset utf-8;
661 '';
662 root = pkgs.runCommand "mta-sts" {} ''
663 mkdir -p $out/.well-known
664 cp ${pkgs.writeText "mta-sts.txt" ''
665 version: STSv1
666 mode: testing
667 mx: mailin.bouncy.email
668 max_age: 604800
669 ''} $out/.well-known/mta-sts.txt
670 '';
671 };
652 }; 672 };
653 }; 673 };
654 }; 674 };
@@ -659,6 +679,7 @@ in {
659 ]) spmDomains ++ [ 679 ]) spmDomains ++ [
660 "mta-sts.bouncy.email.key.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/key.pem" 680 "mta-sts.bouncy.email.key.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/key.pem"
661 "mta-sts.bouncy.email.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/fullchain.pem" 681 "mta-sts.bouncy.email.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/fullchain.pem"
682 "mta-sts.bouncy.email.chain.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/chain.pem"
662 ]; 683 ];
663 684
664 systemd.services.spm = { 685 systemd.services.spm = {