@@ -56,0 +56,4 @@
+
+      overlays = [
+        (_: _: {
+          alias-to-sieve = inputs.alias-to-sieve.packages.x86_64-linux.default; # add custom package to convert alias files to sieve scripts on the stalwart machine

@@ -0,0 +41,4 @@
+  sops.secrets = {
+    # Password for the HRZ API that gets a list of mailaddresses that we serve
+    allowlistPassMatheball = {
+      sopsFile = ./allowlistPassMatheball.yaml;

@@ -0,0 +1,301 @@
+/*
+* Building: For some reason, stalwart is not served by cache.nixos.org and thus needs to be built locally.

@@ -0,0 +1,301 @@
+/*
+* Building: For some reason, stalwart is not served by cache.nixos.org and thus needs to be built locally.
+*   Be aware that this needs some hours, about 12Gb RAM and a few Gb free space in /tmp.

@@ -0,0 +2,4 @@
+* Building: For some reason, stalwart is not served by cache.nixos.org and thus needs to be built locally.
+*   Be aware that this needs some hours, about 12Gb RAM and a few Gb free space in /tmp.
+* Forwarding mails: Update the Sops-secrets in the machine directory, rebuild and deploy.
+*   Everything else should happen automatically but new redirects might take up to two hours due HRZ infrastructure.

@@ -0,0 +5,4 @@
+*   Everything else should happen automatically but new redirects might take up to two hours due HRZ infrastructure.
+* Using the web admin interface: Set your SSH to do portforwarding of some local port to port 80 of the VM and
+*   and use your personal admin account or create one using the fallback admin password.
+* Create users with mail boxes: Go to the admin interface and create them.

@@ -0,0 +31,4 @@
+      type = listOf (lib.types.submodule {
+        options = {
+          domain = mkOption {
+            type = str;

@@ -0,0 +47,4 @@
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [pkgs.alias-to-sieve]; # install converter from alias files to sieve scripts

@@ -0,0 +62,4 @@
+                protocol = "smtp";
+              };
+              "submissions" = {
+                # Enabling sending from these domains privately blocked on https://github.com/stalwartlabs/mail-server/issues/618

@@ -0,0 +73,4 @@
+                tls.implicit = true;
+              };
+              "management" = {
+                bind = ["[::]:80"]; # This must also bind publically for ACME to work.

@@ -0,0 +87,4 @@
+          };
+          spam.header.is-spam = "Dummyheader"; # disable moving to spam which would conflict with forwarding
+          auth = {
+            # TODO check if HRZ conforms to these standards and we can validate them strictly

@@ -0,0 +110,4 @@
+              }
+              {"else" = "'hrz'";}
+            ];
+            tls = {

@@ -0,0 +120,4 @@
+            address = "mailout.hrz.tu-darmstadt.de";
+            port = 25;
+            protocol = "smtp";
+            tls.implicit = false; # somehow this is needed here

@@ -0,0 +132,4 @@
+          session.rcpt = {
+            # In order to accept mail that we only forward
+            # without having to generate an account.
+            # Invalid addresses are filtered by DFN beforehand.

@@ -0,0 +142,4 @@
+              {"else" = false;}
+            ];
+          };
+          config.local-keys =

@@ -0,0 +165,4 @@
+
+          authentication.fallback-admin = {
+            user = "admin";
+            secret = "$argon2i$v=19$m=4096,t=3,p=1$d0hYOTkzclpzSmFTZUplWnhVeWE$I7q9uB19RWL0oZKaPlMPSlGfFp6FQ/vrx80FFKCsalg"; # see machine secret for plaintext

@@ -0,0 +167,4 @@
+            user = "admin";
+            secret = "$argon2i$v=19$m=4096,t=3,p=1$d0hYOTkzclpzSmFTZUplWnhVeWE$I7q9uB19RWL0oZKaPlMPSlGfFp6FQ/vrx80FFKCsalg"; # see machine secret for plaintext
+          };
+          tracer.stdout.level = "debug";

@@ -0,0 +202,4 @@
+            }: ''
+              echo "process ${domain}"
+              # Get the mail addresses' local-part
+              ${pkgs.curl}/bin/curl -s --header "authorization: Basic $(</run/secrets/stalwartAdmin)" http://localhost/api/principal | ${pkgs.gnugrep}/bin/grep -o -e "[A-Za-z0-9.!#\$%&'*+-/=?^_{|}~]*@${domain}" | tee /tmp/addresses

@@ -0,0 +205,4 @@
+              ${pkgs.curl}/bin/curl -s --header "authorization: Basic $(</run/secrets/stalwartAdmin)" http://localhost/api/principal | ${pkgs.gnugrep}/bin/grep -o -e "[A-Za-z0-9.!#\$%&'*+-/=?^_{|}~]*@${domain}" | tee /tmp/addresses
+              ${pkgs.gnugrep}/bin/grep -o -e "[A-Za-z0-9.!#\$%&'*+-/=?^_{|}~]*@${domain}" /tmp/virt_aliases >> /tmp/addresses # This doesn't catch all RFC conform local parts. Improve if you need.
+              # Post local-parts to HRZ
+              ${pkgs.curl}/bin/curl -s https://www-cgi.hrz.tu-darmstadt.de/mail/whitelist-update.php -F emaildomain=${domain} -F password=$(cat ${allowlistPass}) -F emailliste=@/tmp/addresses -F meldungen=voll