From fa46d01d16aad10b28e2ad25957df7727dfc4854 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Tue, 27 Dec 2022 15:54:58 +0100
Subject: generalize surtr email setup

---
 hosts/surtr/email/default.nix | 107 +++++++++++++++---------------------------
 1 file changed, 39 insertions(+), 68 deletions(-)

(limited to 'hosts')

diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index 22790fbb..a2e93e32 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -42,6 +42,7 @@ let
   };
 
   spmDomains = ["bouncy.email"];
+  emailDomains = spmDomains ++ ["kleen.consulting"];
 in {
   config = {
     nixpkgs.overlays = [
@@ -107,17 +108,12 @@ in {
 
         smtp_tls_connection_reuse = true;
 
-        tls_server_sni_maps = ''texthash:${pkgs.writeText "sni" ''
-          bouncy.email /run/credentials/postfix.service/bouncy.email.full.pem
-          mailin.bouncy.email /run/credentials/postfix.service/mailin.bouncy.email.full.pem
-          mailsub.bouncy.email /run/credentials/postfix.service/mailsub.bouncy.email.full.pem
-          .bouncy.email /run/credentials/postfix.service/bouncy.email.full.pem
-
-          kleen.consulting /run/credentials/postfix.service/kleen.consulting.full.pem
-          mailin.kleen.consulting /run/credentials/postfix.service/mailin.kleen.consulting.full.pem
-          mailsub.kleen.consulting /run/credentials/postfix.service/mailsub.kleen.consulting.full.pem
-          .kleen.consulting /run/credentials/postfix.service/kleen.consulting.full.pem
-        ''}'';
+        tls_server_sni_maps = ''texthash:${pkgs.writeText "sni" (
+          concatMapStringsSep "\n\n" (domain:
+            concatMapStringsSep "\n" (subdomain: "${subdomain} /run/credentials/postfix.service/${subdomain}.full.pem")
+              [domain "mailin.${domain}" "mailsub.${domain}" ".${domain}"]
+          ) emailDomains
+        )}'';
 
         smtp_tls_policy_maps = "socketmap:unix:${config.services.postfix-mta-sts-resolver.settings.path}:postfix";
 
@@ -282,16 +278,14 @@ in {
       domain = "surtr.yggdrasil.li";
       separator = "+";
       excludeDomains = [ "surtr.yggdrasil.li"
-                         ".bouncy.email" "bouncy.email"
-                         ".kleen.consulting" "kleen.consulting"
-                       ];
+                       ] ++ concatMap (domain: [".${domain}" domain]) emailDomains;
     };
 
     services.opendkim = {
       enable = true;
       user = "postfix"; group = "postfix";
       socket = "local:/run/opendkim/opendkim.sock";
-      domains = ''csl:${concatStringsSep "," ["surtr.yggdrasil.li" "bouncy.email" "kleen.consulting"]}'';
+      domains = ''csl:${concatStringsSep "," (["surtr.yggdrasil.li"] ++ emailDomains)}'';
       selector = "surtr";
       configFile = builtins.toFile "opendkim.conf" ''
         Syslog true
@@ -429,23 +423,14 @@ in {
         first_valid_gid = ${toString config.users.groups.dovecot2.gid}
         last_valid_gid = ${toString config.users.groups.dovecot2.gid}
 
-        local_name imap.bouncy.email {
-          ssl_cert = </run/credentials/dovecot2.service/imap.bouncy.email.pem
-          ssl_key = </run/credentials/dovecot2.service/imap.bouncy.email.key.pem
-        }
-        local_name bouncy.email {
-          ssl_cert = </run/credentials/dovecot2.service/bouncy.email.pem
-          ssl_key = </run/credentials/dovecot2.service/bouncy.email.key.pem
-        }
-
-        local_name imap.kleen.consulting {
-          ssl_cert = </run/credentials/dovecot2.service/imap.kleen.consulting.pem
-          ssl_key = </run/credentials/dovecot2.service/imap.kleen.consulting.key.pem
-        }
-        local_name kleen.consulting {
-          ssl_cert = </run/credentials/dovecot2.service/kleen.consulting.pem
-          ssl_key = </run/credentials/dovecot2.service/kleen.consulting.key.pem
-        }
+        ${concatMapStringsSep "\n\n" (domain:
+          concatMapStringsSep "\n" (subdomain: ''
+            local_name ${subdomain} {
+              ssl_cert = </run/credentials/dovecot2.service/${subdomain}.pem
+              ssl_key = </run/credentials/dovecot2.service/${subdomain}.key.pem
+            }
+          '') ["imap.${domain}" domain]
+        ) emailDomains}
 
         ssl_require_crl = no
         ssl_verify_client_cert = yes
@@ -667,29 +652,20 @@ in {
 
     security.acme.domains = {
       "surtr.yggdrasil.li" = {};
-      "bouncy.email" = {};
-      "mailin.bouncy.email" = {};
-      "mailsub.bouncy.email" = {};
-      "imap.bouncy.email" = {};
-      "mta-sts.bouncy.email" = {};
-      "kleen.consulting" = {};
-      "mailin.kleen.consulting" = {};
-      "mailsub.kleen.consulting" = {};
-      "imap.kleen.consulting" = {};
-      "mta-sts.kleen.consulting" = {};
-    } // listToAttrs (map (domain: nameValuePair "spm.${domain}" {}) spmDomains);
+    } // listToAttrs (map (domain: nameValuePair "spm.${domain}" {}) spmDomains)
+    // listToAttrs (concatMap (domain:
+      map (subdomain: nameValuePair subdomain {})
+        [domain "mailin.${domain}" "mailsub.${domain}" "imap.${domain}" "mta-sts.${domain}"]
+    ) emailDomains);
 
     systemd.services.postfix = {
       serviceConfig.LoadCredential = [
         "surtr.yggdrasil.li.key.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/key.pem"
         "surtr.yggdrasil.li.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/fullchain.pem"
-        "bouncy.email.full.pem:${config.security.acme.certs."bouncy.email".directory}/full.pem"
-        "mailin.bouncy.email.full.pem:${config.security.acme.certs."mailin.bouncy.email".directory}/full.pem"
-        "mailsub.bouncy.email.full.pem:${config.security.acme.certs."mailsub.bouncy.email".directory}/full.pem"
-        "kleen.consulting.full.pem:${config.security.acme.certs."kleen.consulting".directory}/full.pem"
-        "mailin.kleen.consulting.full.pem:${config.security.acme.certs."mailin.kleen.consulting".directory}/full.pem"
-        "mailsub.kleen.consulting.full.pem:${config.security.acme.certs."mailsub.kleen.consulting".directory}/full.pem"
-      ];
+      ] ++ concatMap (domain:
+        map (subdomain: "${subdomain}.full.pem:${config.security.acme.certs.${subdomain}.directory}/full.pem")
+          [domain "mailin.${domain}" "mailsub.${domain}"]
+      ) emailDomains;
     };
 
     systemd.services.dovecot2 = {
@@ -703,15 +679,13 @@ in {
         LoadCredential = [
           "surtr.yggdrasil.li.key.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/key.pem"
           "surtr.yggdrasil.li.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/fullchain.pem"
-          "bouncy.email.key.pem:${config.security.acme.certs."bouncy.email".directory}/key.pem"
-          "bouncy.email.pem:${config.security.acme.certs."bouncy.email".directory}/fullchain.pem"
-          "imap.bouncy.email.key.pem:${config.security.acme.certs."imap.bouncy.email".directory}/key.pem"
-          "imap.bouncy.email.pem:${config.security.acme.certs."imap.bouncy.email".directory}/fullchain.pem"
-          "kleen.consulting.key.pem:${config.security.acme.certs."kleen.consulting".directory}/key.pem"
-          "kleen.consulting.pem:${config.security.acme.certs."kleen.consulting".directory}/fullchain.pem"
-          "imap.kleen.consulting.key.pem:${config.security.acme.certs."imap.kleen.consulting".directory}/key.pem"
-          "imap.kleen.consulting.pem:${config.security.acme.certs."imap.kleen.consulting".directory}/fullchain.pem"
-        ];
+        ] ++ concatMap (domain:
+          concatMap (subdomain: [
+            "${subdomain}.key.pem:${config.security.acme.certs.${subdomain}.directory}/key.pem"
+            "${subdomain}.pem:${config.security.acme.certs.${subdomain}.directory}/fullchain.pem"
+          ])
+            [domain "imap.${domain}"]
+        ) emailDomains;
       };
     };
 
@@ -770,20 +744,17 @@ in {
               ''} $out/.well-known/mta-sts.txt
             '';
           };
-      }) ["bouncy.email" "kleen.consulting"]);
+      }) emailDomains);
     };
 
     systemd.services.nginx.serviceConfig.LoadCredential = concatMap (domain: [
       "spm.${domain}.key.pem:${config.security.acme.certs."spm.${domain}".directory}/key.pem"
       "spm.${domain}.pem:${config.security.acme.certs."spm.${domain}".directory}/fullchain.pem"
-    ]) spmDomains ++ [
-      "mta-sts.bouncy.email.key.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/key.pem"
-      "mta-sts.bouncy.email.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/fullchain.pem"
-      "mta-sts.bouncy.email.chain.pem:${config.security.acme.certs."mta-sts.bouncy.email".directory}/chain.pem"
-      "mta-sts.kleen.consulting.key.pem:${config.security.acme.certs."mta-sts.kleen.consulting".directory}/key.pem"
-      "mta-sts.kleen.consulting.pem:${config.security.acme.certs."mta-sts.kleen.consulting".directory}/fullchain.pem"
-      "mta-sts.kleen.consulting.chain.pem:${config.security.acme.certs."mta-sts.kleen.consulting".directory}/chain.pem"
-    ];
+    ]) spmDomains ++ concatMap (domain: [
+      "mta-sts.${domain}.key.pem:${config.security.acme.certs."mta-sts.${domain}".directory}/key.pem"
+      "mta-sts.${domain}.pem:${config.security.acme.certs."mta-sts.${domain}".directory}/fullchain.pem"
+      "mta-sts.${domain}.chain.pem:${config.security.acme.certs."mta-sts.${domain}".directory}/chain.pem"
+    ]) emailDomains;
 
     systemd.services.spm = {
       serviceConfig = {
-- 
cgit v1.2.3