Add pushing to hrz allowlist

nixos/modules/mailman.nix

@@ -37,7 +37,7 @@ in {
           proxy_interfaces = "130.83.2.184";
           smtputf8_enable = "no"; # HRZ does not know SMTPUTF8
         };
-        relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ
+        relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ (see https://www.hrz.tu-darmstadt.de/services/it_services/email_infrastruktur/index.de.jsp)
       };
       mailman = {
         enable = true;
@@ -45,11 +45,12 @@ in {
         hyperkitty.enable = true;
         webHosts = [cfg.hostName];
         serve.enable = true; #
+        # Don't include confirmation tokens in reply addresses, because we would need to send them to HRZ otherwise.
         settings.mta.verp_confirmations = "no";
       };
       nginx.virtualHosts.${cfg.hostName} = {
-        enableACME = true;
-        forceSSL = false;
+        enableACME = true; # Get certificates (primarily for postfix)
+        forceSSL = false; # Don't use HTTPS behind the proxy
       };
     };
 
@@ -67,22 +68,23 @@ in {
     networking.firewall.allowedTCPPorts = [25 80 443];
 
     # Update HRZ allowlist
-    #
+    # For account details see https://www-cgi.hrz.tu-darmstadt.de/mail/
+    # will stop working if no valid TUIDs are associated to our domain.
     systemd.timers."mailAllowlist" = {
       wantedBy = ["timers.target"];
       timerConfig = {
         OnBootSec = "5m"; # Run every 5 minutes
         OnUnitActiveSec = "5m";
-        RandomizedDelaySec = "1m"; # Randomized delay
+        RandomizedDelaySec = "2m"; # prevent overload on regular intervals
         Unit = "mailAllowlist.service";
       };
     };
     systemd.services."mailAllowlist" = {
-      description = "Post the mail addresses used by mailman to the HRZ allow list";
+      description = "Allowlist update: Post the mail addresses used by mailman to the HRZ allowllist";
       script = ''
-        # Parse addresses
+        # Get the mail addresses' local-part
         cut -d '@' -f 1 /var/lib/mailman/data/postfix_lmtp | grep -v '#' | grep "\S" > /tmp/addresses
-        # Post addresses to HRZ
+        # Post local-parts to HRZ
         ${pkgs.curl}/bin/curl https://www-cgi.hrz.tu-darmstadt.de/mail/whitelist-update.php -F emaildomain=lists.mathebau.de -F password=$(cat /run/secrets/allowlistPass) -F emailliste=@/tmp/addresses -F meldungen=voll
         # Cleanup
         rm /tmp/addresses