Add pushing to hrz allowlist

nixos/modules/mailman.nix

@@ -2,6 +2,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }: let
   inherit
@@ -44,6 +45,7 @@ in {
         hyperkitty.enable = true;
         webHosts = [cfg.hostName];
         serve.enable = true; #
+        settings.mta.verp_confirmations = "no";
       };
       nginx.virtualHosts.${cfg.hostName} = {
         enableACME = true;
@@ -63,5 +65,39 @@ in {
     security.acme.acceptTerms = true;
 
     networking.firewall.allowedTCPPorts = [25 80 443];
+
+    # Update HRZ allowlist
+    #
+    systemd.timers."mailAllowlist" = {
+      wantedBy = ["timers.target"];
+      timerConfig = {
+        OnBootSec = "5m"; # Run every 5 minutes
+        OnUnitActiveSec = "5m";
+        RandomizedDelaySec = "1m"; # Randomized delay
+        Unit = "mailAllowlist.service";
+      };
+    };
+    systemd.services."mailAllowlist" = {
+      description = "Post the mail addresses used by mailman to the HRZ allow list";
+      script = ''
+        # Parse addresses
+        cut -d '@' -f 1 /var/lib/mailman/data/postfix_lmtp | grep -v '#' | grep "\S" > /tmp/addresses
+        # Post addresses to HRZ
+        ${pkgs.curl}/bin/curl https://www-cgi.hrz.tu-darmstadt.de/mail/whitelist-update.php -F emaildomain=lists.mathebau.de -F password=$(cat /run/secrets/allowlistPass) -F emailliste=@/tmp/addresses -F meldungen=voll
+        # Cleanup
+        rm /tmp/addresses
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        User = "mailman";
+        PrivateTmp = true;
+      };
+    };
+    sops.secrets.allowlistPass = {
+      sopsFile = ../machines/lobon/allowlistPass.yaml;
+      owner = "mailman";
+      group = "mailman";
+      mode = "0400";
+    };
   };
 }