First try to install Stalwart as a mail software

.sops.yaml

@@ -5,6 +5,7 @@ keys:
   - &nyarlathotep age1s99d0vlj5qlm287n98jratql5fypvjrxxal0k5jl2aw9dcc8kyvqw5yyt4
   - &bragi age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe
   - &lobon age12nz7dtc0m5wasxm4r9crtkgwnzvauyfp0xh0n8z8jld0arn9ea9qe0agvn
+  - &kaalut age1dhzugelagj6vge5jjxwwn0522ngf7fhxn04sxy2tm8557rtme5tstprwnj
 
 creation_rules:
   - path_regex: nixos/machines/nyarlathotep/.*
@@ -25,6 +26,12 @@ creation_rules:
         - *nerf
         - *gonne
         - *lobon
+  - path_regex: nixos/machines/kaalut/.*
+    key_groups:
+      - age:
+        - *nerf
+        - *gonne
+        - *kaalut
   # this is the catchall clause if nothing above machtes. Encrypt to users but not
   # to machines
   - key_groups:

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1719877454,
+        "lastModified": 1722555600,
-        "narHash": "sha256-g5N1yyOSsPNiOlFfkuI/wcUjmtah+nxdImJqrSATjOU=",
+        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4e3583423212f9303aa1a6337f8dffb415920e4f",
+        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
         "type": "github"
       },
       "original": {
@@ -35,11 +35,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1719091691,
+        "lastModified": 1724489415,
-        "narHash": "sha256-AxaLX5cBEcGtE02PeGsfscSb/fWMnyS7zMWBXQWDKbE=",
+        "narHash": "sha256-ey8vhwY/6XCKoh7fyTn3aIQs7WeYSYtLbYEG87VCzX4=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "23c1f06316b67cb5dabdfe2973da3785cfe9c34a",
+        "rev": "c7f5b394397398c023000cf843986ee2571a1fd7",
         "type": "github"
       },
       "original": {
@@ -56,11 +56,11 @@
         "nixpkgs-24_05": "nixpkgs-24_05"
       },
       "locked": {
-        "lastModified": 1718697807,
+        "lastModified": 1722877200,
-        "narHash": "sha256-Enla61WFisytTYbWygPynEbu8vozjeGc6Obkj2GRj7o=",
+        "narHash": "sha256-qgKDNJXs+od+1UbRy62uk7dYal3h98I4WojfIqMoGcg=",
         "ref": "refs/heads/master",
-        "rev": "290a995de5c3d3f08468fa548f0d55ab2efc7b6b",
+        "rev": "af7d3bf5daeba3fc28089b015c0dd43f06b176f2",
-        "revCount": 591,
+        "revCount": 593,
         "type": "git",
         "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git"
       },
@@ -71,11 +71,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1719848872,
+        "lastModified": 1724819573,
-        "narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=",
+        "narHash": "sha256-GnR7/ibgIH1vhoy8cYdmXE6iyZqKqFxQSVkFgosBh6w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8",
+        "rev": "71e91c409d1e654808b2621f28a327acfdad8dc2",
         "type": "github"
       },
       "original": {
@@ -102,28 +102,28 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1719876945,
+        "lastModified": 1722555339,
-        "narHash": "sha256-Fm2rDDs86sHy0/1jxTOKB1118Q0O3Uc7EC0iXvXKpbI=",
+        "narHash": "sha256-uFf2QeW7eAHlYXuDktm9c25OxOyCoUOQmh5SZ9amE5Q=",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
       }
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1719663039,
+        "lastModified": 1721524707,
-        "narHash": "sha256-tXlrgAQygNIy49LDVFuPXlWD2zTQV9/F8pfoqwwPJyo=",
+        "narHash": "sha256-5NctRsoE54N86nWd0psae70YSLfrOek3Kv1e8KoXe/0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4a1e673523344f6ccc84b37f4413ad74ea19a119",
+        "rev": "556533a23879fc7e5f98dd2e0b31a6911a213171",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -136,11 +136,11 @@
         "nixpkgs-stable": []
       },
       "locked": {
-        "lastModified": 1719259945,
+        "lastModified": 1724857454,
-        "narHash": "sha256-F1h+XIsGKT9TkGO3omxDLEb/9jOOsI6NnzsXFsZhry4=",
+        "narHash": "sha256-Qyl9Q4QMTLZnnBb/8OuQ9LSkzWjBU1T5l5zIzTxkkhk=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "0ff4381bbb8f7a52ca4a851660fc7a437a4c6e07",
+        "rev": "4509ca64f1084e73bc7a721b20c669a8d4c5ebe6",
         "type": "github"
       },
       "original": {
@@ -167,11 +167,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1719873517,
+        "lastModified": 1723501126,
-        "narHash": "sha256-D1dxZmXf6M2h5lNE1m6orojuUawVPjogbGRsqSBX+1g=",
+        "narHash": "sha256-N9IcHgj/p1+2Pvk8P4Zc1bfrMwld5PcosVA0nL6IGdE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "a11224af8d824935f363928074b4717ca2e280db",
+        "rev": "be0eec2d27563590194a9206f551a6f73d52fa34",
         "type": "github"
       },
       "original": {

nixos/machines/kaalut/configuration.nix

@@ -0,0 +1,41 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/mail.nix
+    ../../roles
+    ../../roles/vm.nix
+    ../../modules/vmNetwork.nix
+  ];
+
+  # System configuration here
+
+  services.mathebau-mail = {
+    enable = true;
+    /*
+      fqdn = "fb04184.mathematik.tu-darmstadt.de";
+    domain = "koma89.tu-darmstadt.de";
+    siteOwner = "root@mathebau.de";
+    */
+  };
+
+  networking.hostName = "kaalut";
+  vmNetwork.ipv4 = "192.168.0.17";
+  system.stateVersion = "24.05";
+
+  sops.secrets = {
+    /*
+      allowlistPass = {
+      sopsFile = ./allowlistPass.yaml;
+      owner = "stalwart-mail";
+      group = "stalwart-mail";
+      mode = "0400";
+    };
+    backupKey = {
+      sopsFile = ./backupKey.yaml;
+      owner = "stalwart-mail";
+      group = "stalwart-mail";
+      mode = "0400";
+    };
+    */
+  };
+}

nixos/machines/kaalut/hardware-configuration.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [];
+
+  fileSystems."/" = {
+    device = "root";
+    fsType = "tmpfs";
+    options = ["size=1G" "mode=755"];
+  };
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+    neededForBoot = true;
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "ext4";
+  };
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=nix"];
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/modules/mail.nix

@@ -0,0 +1,180 @@
+{
+  config,
+  lib,
+  #  pkgs,
+  ...
+}: let
+  inherit
+    (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    ;
+  inherit (lib.types) str;
+  cfg = config.services.mathebau-mail;
+in {
+  options.services.mathebau-mail = {
+    enable = mkEnableOption "mathebau mail service";
+    siteOwner = mkOption {
+      type = str;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services = {
+      stalwart-mail = {
+        enable = true;
+        openFirewall = true;
+        settings = {
+          server = {
+            lookup.default.hostname = "fb04184.mathematik.tu-darmstadt.de"; # Because the DNS PTR of 130.83.2.184 is this and this should be used in SMTP EHLO.
+            listener = {
+              "smtp" = {
+                bind = ["[::]:25"];
+                protocol = "smtp";
+              };
+              "submissions" = {
+                # Enabling sending from these domains privately blocked on https://github.com/stalwartlabs/mail-server/issues/618
+                bind = ["[::]:465"];
+                protocol = "smtp";
+                tls.implicit = true;
+              };
+              "imaptls" = {
+                bind = ["[::]:993"];
+                protocol = "imap";
+                tls.implicit = true;
+              };
+              "management" = {
+                bind = ["[::]:80"]; # This must also bind publically for ACME to work.
+                protocol = "http";
+              };
+            };
+          };
+          acme.letsencrypt = {
+            directory = "https://acme-v02.api.letsencrypt.org/directory"; # This setting is necessary for this block to be activated
+            challenge = "http-01";
+            contact = ["root@mathebau.de"];
+            domains = ["fb04184.mathematik.tu-darmstadt.de" "imap.mathebau.de" "smtp.mathebau.de"];
+            default = true;
+          };
+          auth = {
+            # TODO check if can be removed
+            dkim.verify = "relaxed";
+            arc.verify = "relaxed";
+            dmarc.verify = "relaxed";
+            iprev.verify = "relaxed";
+            spf.verify.ehlo = "relaxed";
+            spf.verify.mail-from = "relaxed";
+          };
+          #          tracer.stdout.level = "trace";
+          queue.outbound = {
+            # see https://stalw.art/docs/smtp/outbound/routing/ relay host example
+            next-hop = [
+              {
+                "if" = "is_local_domain('', rcpt_domain)";
+                "then" = "'local'";
+              }
+              {"else" = "'relay'";}
+            ];
+            tls.mta-sts = "disable";
+            tls.dane = "disable";
+          };
+          remote."relay" = {
+            address = "mailout.hrz.tu-darmstadt.de";
+            port = 25;
+            protocol = "smtp";
+            tls.implicit = false;
+            tls.allow-invalid-certs = false;
+          };
+          /*
+            sieve.trusted.scripts = {
+            redirects = ''
+              require ["envelope", "include"]; include :global "track-replies"; if envelope :is "to" "gonne@koma89.tu-darmstadt.de" { redirect "gonne@mathebau.de"; }
+            '';
+          };
+          session.data.script = "'redirects'";
+          */
+          authentication.fallback-admin = {
+            user = "admin";
+            secret = "$argon2i$v=19$m=4096,t=3,p=1$d0hYOTkzclpzSmFTZUplWnhVeWE$I7q9uB19RWL0oZKaPlMPSlGfFp6FQ/vrx80FFKCsalg";
+          };
+        };
+      };
+    };
+    environment.persistence.${config.impermanence.name} = {
+      directories = [
+        "/var/lib/stalwart-mail"
+      ];
+      files = ["/root/.ssh/known_hosts"]; # for the backup server bragi
+    };
+
+    # Update HRZ allowlist
+    # For account details see https://www-cgi.hrz.tu-darmstadt.de/mail/
+    # will stop working if no valid TUIDs are associated to our domain.
+    /*
+      systemd.timers."mailAllowlist" = {
+      wantedBy = ["timers.target"];
+      timerConfig = {
+        OnBootSec = "5m"; # Run every 5 minutes
+        OnUnitActiveSec = "5m";
+        RandomizedDelaySec = "2m"; # prevent overload on regular intervals
+        Unit = "mailAllowlist.service";
+      };
+    };
+    systemd.services."mailAllowlist" = {
+      description = "Allowlist update: Post the mail addresses to the HRZ allowllist";
+      script = ''
+        # Get the mail addresses' local-part
+        #TODO
+        # Post local-parts to HRZ
+        ${pkgs.curl}/bin/curl https://www-cgi.hrz.tu-darmstadt.de/mail/whitelist-update.php -F emaildomain=${cfg.domain} -F password=$(cat /run/secrets/allowlistPass) -F emailliste=@/tmp/addresses -F meldungen=voll
+        # Cleanup
+        rm /tmp/addresses
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        User = "stalwart-mail";
+        NoNewPrivileges = true;
+        # See https://www.man7.org/linux/man-pages/man5/systemd.exec.5.html
+        PrivateTmp = true;
+        ProtectHome = true;
+        ReadOnlyPaths = "/";
+        ReadWritePaths = "/tmp";
+        InaccessiblePaths = "-/lost+found";
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+    };
+    */
+    # Backups
+    /*
+      services.borgbackup.jobs.mail = {
+      paths = [
+        "/var/lib/stalwart-mail"
+      ];
+      encryption.mode = "none"; # Otherwise the key is next to the backup or we have human interaction.
+      environment = {
+        BORG_RSH = "ssh -i /run/secrets/backupKey";
+        # “Borg ensures that backups are not created on random drives that ‘just happen’ to contain a Borg repository.”
+        # https://borgbackup.readthedocs.io/en/stable/deployment/automated-local.html
+        # We don't want this in order to not need to persist borg cache and simplify new deployments.
+        BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes";
+      };
+      repo = "borg@192.168.1.11:kaluut"; # TODO for https://gitea.mathebau.de/Fachschaft/nixConfig/issues/33
+      startAt = "daily";
+      user = "root";
+      group = "root";
+    };
+    */
+  };
+}