postfix configured

marks

@@ -12,6 +12,5 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
 systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>
 
 todo:
-- php-fpm, postgresql, certbot
 - postfix, dovecot, rspamd
-- vaultwarden, gitea, mediawiki
+- gitea, mediawiki

server/configuration.nix

@@ -2,10 +2,18 @@
 {
   imports = [ ../common.nix ./hardware-configuration.nix ];
   boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
-  users.users.nginx.extraGroups = [ "acme" ];
+  users = {
-  users.users.bogale.openssh.authorizedKeys.keys = [
+    groups.vmail.gid = 1819;
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1"
+    users = {
-  ];
+      nginx.extraGroups = [ "acme" ];
+      bogale.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ];
+      vmail = {
+        uid = 1819;
+        group = "vmail";
+        isSystemUser = true;
+      };
+    };
+  };
   networking = {
     hostName = "nixos-server";
     networkmanager.ensureProfiles.profiles.home-wifi = {
@@ -13,7 +21,7 @@
       wifi-security.psk = "$BOGALE_2_4_PSK";
     };
     firewall = {
-      allowedTCPPorts = [ 80 443 ];
+      allowedTCPPorts = [ 25 80 443 ];
       allowedUDPPorts = [ 443 ];
     };
   };
@@ -47,6 +55,33 @@
         "listen.group" = "nginx";
       };
     };
+    dovecot2 = {
+      enable = true;
+      settings = {
+        mail_uid = ;
+        mail_gid = ;
+      };
+    };
+    postfix = {
+      enable = true;
+      #enableSubmission = true;
+      virtualMapType = "regexp";
+      virtual = ''/.*@bogaledev.ru/ main@bogaledev.ru'';
+      mapFiles.mailbox = pkgs.writeText "mailbox" ''main@bogaledev.ru bogaledev.ru/'';
+      settings.main = {
+        virtual_uid_maps = "static:1819";
+        virtual_gid_maps = "static:1819";
+        smtp_tls_security_level = "encrypt";
+        smtpd_tls_security_level = "encrypt";
+        virtual_mailbox_domains = "bogaledev.ru";
+        virtual_mailbox_base = "/var/spool/mail/vmail";
+        virtual_mailbox_maps = "hash:/etc/postfix/mailbox";
+        smtpd_tls_chain_files = [
+          "/var/lib/acme/bogaledev.ru/key.pem"
+          "/var/lib/acme/bogaledev.ru/fullchain.pem"
+        ];
+      };
+    };
     vaultwarden = {
       enable = true;
       configureNginx = true;
@@ -80,9 +115,7 @@
         forceSSL = true;
         root = "/srv/http";
         useACMEHost = "bogaledev.ru";
-        extraConfig = ''
+        extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
-          add_header Alt-Svc 'h3=":443"; ma=86400' always;
-        '';
         locations = {
           "/".index = "index.php index.html";
           "~ \\.php$".extraConfig = ''
@@ -94,6 +127,7 @@
         quic = true;
         forceSSL = true;
         useACMEHost = "bogaledev.ru";
+        serverAliases = [ "vw-wl.bogaledev.ru" ];
         extraConfig = ''
           allow fc00::/64;
           allow 10.0.0.0/24;