From 17d24a633e75592f8b0dd5346c919c261332c90c Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Tue, 27 Dec 2022 15:28:59 +0100
Subject: kleen.consulting

---
 hosts/surtr/email/default.nix | 52 +++++++++++++++++++++++++++++++++----------
 1 file changed, 40 insertions(+), 12 deletions(-)

(limited to 'hosts/surtr/email/default.nix')

diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index 80611c3c..22790fbb 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -112,6 +112,11 @@ in {
           mailin.bouncy.email /run/credentials/postfix.service/mailin.bouncy.email.full.pem
           mailsub.bouncy.email /run/credentials/postfix.service/mailsub.bouncy.email.full.pem
           .bouncy.email /run/credentials/postfix.service/bouncy.email.full.pem
+
+          kleen.consulting /run/credentials/postfix.service/kleen.consulting.full.pem
+          mailin.kleen.consulting /run/credentials/postfix.service/mailin.kleen.consulting.full.pem
+          mailsub.kleen.consulting /run/credentials/postfix.service/mailsub.kleen.consulting.full.pem
+          .kleen.consulting /run/credentials/postfix.service/kleen.consulting.full.pem
         ''}'';
 
         smtp_tls_policy_maps = "socketmap:unix:${config.services.postfix-mta-sts-resolver.settings.path}:postfix";
@@ -278,6 +283,7 @@ in {
       separator = "+";
       excludeDomains = [ "surtr.yggdrasil.li"
                          ".bouncy.email" "bouncy.email"
+                         ".kleen.consulting" "kleen.consulting"
                        ];
     };
 
@@ -285,7 +291,7 @@ in {
       enable = true;
       user = "postfix"; group = "postfix";
       socket = "local:/run/opendkim/opendkim.sock";
-      domains = ''csl:${concatStringsSep "," ["surtr.yggdrasil.li" "bouncy.email"]}'';
+      domains = ''csl:${concatStringsSep "," ["surtr.yggdrasil.li" "bouncy.email" "kleen.consulting"]}'';
       selector = "surtr";
       configFile = builtins.toFile "opendkim.conf" ''
         Syslog true
@@ -432,6 +438,15 @@ in {
           ssl_key = </run/credentials/dovecot2.service/bouncy.email.key.pem
         }
 
+        local_name imap.kleen.consulting {
+          ssl_cert = </run/credentials/dovecot2.service/imap.kleen.consulting.pem
+          ssl_key = </run/credentials/dovecot2.service/imap.kleen.consulting.key.pem
+        }
+        local_name kleen.consulting {
+          ssl_cert = </run/credentials/dovecot2.service/kleen.consulting.pem
+          ssl_key = </run/credentials/dovecot2.service/kleen.consulting.key.pem
+        }
+
         ssl_require_crl = no
         ssl_verify_client_cert = yes
 
@@ -651,12 +666,17 @@ in {
     };
 
     security.acme.domains = {
+      "surtr.yggdrasil.li" = {};
       "bouncy.email" = {};
       "mailin.bouncy.email" = {};
       "mailsub.bouncy.email" = {};
       "imap.bouncy.email" = {};
       "mta-sts.bouncy.email" = {};
-      "surtr.yggdrasil.li" = {};
+      "kleen.consulting" = {};
+      "mailin.kleen.consulting" = {};
+      "mailsub.kleen.consulting" = {};
+      "imap.kleen.consulting" = {};
+      "mta-sts.kleen.consulting" = {};
     } // listToAttrs (map (domain: nameValuePair "spm.${domain}" {}) spmDomains);
 
     systemd.services.postfix = {
@@ -666,6 +686,9 @@ in {
         "bouncy.email.full.pem:${config.security.acme.certs."bouncy.email".directory}/full.pem"
         "mailin.bouncy.email.full.pem:${config.security.acme.certs."mailin.bouncy.email".directory}/full.pem"
         "mailsub.bouncy.email.full.pem:${config.security.acme.certs."mailsub.bouncy.email".directory}/full.pem"
+        "kleen.consulting.full.pem:${config.security.acme.certs."kleen.consulting".directory}/full.pem"
+        "mailin.kleen.consulting.full.pem:${config.security.acme.certs."mailin.kleen.consulting".directory}/full.pem"
+        "mailsub.kleen.consulting.full.pem:${config.security.acme.certs."mailsub.kleen.consulting".directory}/full.pem"
       ];
     };
 
@@ -684,6 +707,10 @@ in {
           "bouncy.email.pem:${config.security.acme.certs."bouncy.email".directory}/fullchain.pem"
           "imap.bouncy.email.key.pem:${config.security.acme.certs."imap.bouncy.email".directory}/key.pem"
           "imap.bouncy.email.pem:${config.security.acme.certs."imap.bouncy.email".directory}/fullchain.pem"
+          "kleen.consulting.key.pem:${config.security.acme.certs."kleen.consulting".directory}/key.pem"
+          "kleen.consulting.pem:${config.security.acme.certs."kleen.consulting".directory}/fullchain.pem"
+          "imap.kleen.consulting.key.pem:${config.security.acme.certs."imap.kleen.consulting".directory}/key.pem"
+          "imap.kleen.consulting.pem:${config.security.acme.certs."imap.kleen.consulting".directory}/fullchain.pem"
         ];
       };
     };
@@ -713,12 +740,11 @@ in {
             proxy_set_header SPM-DOMAIN "${domain}";
           '';
         };
-      }) spmDomains) // {
-        "mta-sts.bouncy.email" = {
+      }) spmDomains) // listToAttrs (map (domain: nameValuePair "mta-sts.${domain}" {
           forceSSL = true;
-          sslCertificate = "/run/credentials/nginx.service/mta-sts.bouncy.email.pem";
-          sslCertificateKey = "/run/credentials/nginx.service/mta-sts.bouncy.email.key.pem";
-          sslTrustedCertificate = "/run/credentials/nginx.service/mta-sts.bouncy.email.chain.pem";
+          sslCertificate = "/run/credentials/nginx.service/mta-sts.${domain}.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/mta-sts.${domain}.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/mta-sts.${domain}.chain.pem";
 
           extraConfig = ''
             add_header Strict-Transport-Security "max-age=63072000" always;
@@ -734,18 +760,17 @@ in {
               charset utf-8;
               source_charset utf-8;
             '';
-            root = pkgs.runCommand "mta-sts" {} ''
+            root = pkgs.runCommand "mta-sts.${domain}" {} ''
               mkdir -p $out/.well-known
-              cp ${pkgs.writeText "mta-sts.txt" ''
+              cp ${pkgs.writeText "mta-sts.${domain}.txt" ''
                 version: STSv1
                 mode: enforce
                 max_age: 2419200
-                mx: mailin.bouncy.email
+                mx: mailin.${domain}
               ''} $out/.well-known/mta-sts.txt
             '';
           };
-        };
-      };
+      }) ["bouncy.email" "kleen.consulting"]);
     };
 
     systemd.services.nginx.serviceConfig.LoadCredential = concatMap (domain: [
@@ -755,6 +780,9 @@ in {
       "mta-sts.bouncy.email.key.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/key.pem"
       "mta-sts.bouncy.email.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/fullchain.pem"
       "mta-sts.bouncy.email.chain.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/chain.pem"
+      "mta-sts.kleen.consulting.key.pem:${config.security.acme.certs."mta-sts.kleen.consulting".directory}/key.pem"
+      "mta-sts.kleen.consulting.pem:${config.security.acme.certs."mta-sts.kleen.consulting".directory}/fullchain.pem"
+      "mta-sts.kleen.consulting.chain.pem:${config.security.acme.certs."mta-sts.kleen.consulting".directory}/chain.pem"
     ];
 
     systemd.services.spm = {
-- 
cgit v1.2.3