89 lines
2.7 KiB
Nix
89 lines
2.7 KiB
Nix
{moduleWithSystem, ...}: {
|
|
flake.nixosModules.containerMail = moduleWithSystem ({pkgs, ...}: {config, ...}: {
|
|
# Containers
|
|
virtualisation.oci-containers.containers."mailserver" = {
|
|
image = "ghcr.io/docker-mailserver/docker-mailserver:latest";
|
|
environment = {
|
|
"DEFAULT_RELAY_HOST" = "[smtp-relay.brevo.com]:587";
|
|
"DOMAINNAME" = "voidarc.co.uk";
|
|
"ENABLE_CLAMAV" = "1";
|
|
"ENABLE_FAIL2BAN" = "1";
|
|
"ENABLE_POSTFIX_VIRTUAL_TRANSPORT" = "1";
|
|
"ENABLE_POSTGREY" = "1";
|
|
"ENABLE_SPAMASSASSIN" = "1";
|
|
"HOSTNAME" = "mail.voidarc.co.uk";
|
|
"ONE_DIR" = "1";
|
|
"PERMIT_DOCKER" = "network";
|
|
"POSTMASTER_ADDRESS" = "postmaster@voidarc.co.uk";
|
|
"SPOOF_PROTECTION" = "1";
|
|
"SSL_DOMAIN" = "mail.voidarc.co.uk";
|
|
"SSL_TYPE" = "letsencrypt";
|
|
};
|
|
environmentFiles = [config.sops.templates."mail.env".path];
|
|
volumes = [
|
|
"/containers/mail/config:/tmp/docker-mailserver:rw"
|
|
"/containers/mail/maildata:/var/mail:rw"
|
|
"/containers/mail/mailstate:/var/mail-state:rw"
|
|
"/etc/letsencrypt:/etc/letsencrypt:rw"
|
|
"/etc/localtime:/etc/localtime:ro"
|
|
];
|
|
ports = [
|
|
"25:25/tcp"
|
|
"143:143/tcp"
|
|
"465:465/tcp"
|
|
"587:587/tcp"
|
|
"993:993/tcp"
|
|
];
|
|
log-driver = "journald";
|
|
extraOptions = [
|
|
"--cap-add=NET_ADMIN"
|
|
"--hostname=mail.voidarc.co.uk"
|
|
"--network-alias=mail"
|
|
"--network=mail_default"
|
|
];
|
|
};
|
|
systemd.services."podman-mailserver" = {
|
|
serviceConfig = {
|
|
Restart = pkgs.lib.mkOverride 90 "always";
|
|
};
|
|
after = [
|
|
"podman-network-mail_default.service"
|
|
];
|
|
requires = [
|
|
"podman-network-mail_default.service"
|
|
];
|
|
partOf = [
|
|
"podman-compose-mail-root.target"
|
|
];
|
|
wantedBy = [
|
|
"podman-compose-mail-root.target"
|
|
];
|
|
};
|
|
|
|
# Networks
|
|
systemd.services."podman-network-mail_default" = {
|
|
path = [pkgs.podman];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ExecStop = "podman network rm -f mail_default";
|
|
};
|
|
script = ''
|
|
podman network inspect mail_default || podman network create mail_default
|
|
'';
|
|
partOf = ["podman-compose-mail-root.target"];
|
|
wantedBy = ["podman-compose-mail-root.target"];
|
|
};
|
|
|
|
# Root service
|
|
# When started, this will automatically create all resources and start
|
|
# the containers. When stopped, this will teardown all resources.
|
|
systemd.targets."podman-compose-mail-root" = {
|
|
unitConfig = {
|
|
Description = "Root target generated by compose2nix.";
|
|
};
|
|
wantedBy = ["multi-user.target"];
|
|
};
|
|
});
|
|
}
|