mailsystem: Add option to use selfsigned certificates in preparation for testing

mailsystem/common.nix

@@ -1,9 +1,21 @@
 {config, ...}: let
   cfg = config.mailsystem;
 in rec {
-  sslCertPath = "${config.security.acme.certs.${cfg.fqdn}.directory}/fullchain.pem";
+  certificateDirectory = "/var/certs";
-  sslKeyPath = "${config.security.acme.certs.${cfg.fqdn}.directory}/key.pem";
+  sslCertPath =
-  sslCertService = ["acme-finished-${cfg.fqdn}.target"];
+    if cfg.certificateScheme == "acme"
+    then "${config.security.acme.certs.${cfg.fqdn}.directory}/fullchain.pem"
+    else "${certificateDirectory}/cert-${cfg.fqdn}.pem";
+
+  sslKeyPath =
+    if cfg.certificateScheme == "acme"
+    then "${config.security.acme.certs.${cfg.fqdn}.directory}/key.pem"
+    else "${certificateDirectory}/key-${cfg.fqdn}.pem";
+
+  sslCertService =
+    if cfg.certificateScheme == "acme"
+    then ["acme-finished-${cfg.fqdn}.target"]
+    else ["mailsystem-selfsigned-certificate.service"];
 
   dovecotDynamicStateDir = "/var/lib/dovecot";
   dovecotDynamicPasswdFile = "${dovecotDynamicStateDir}/passwd";

mailsystem/default.nix

@@ -154,6 +154,19 @@ in {
       '';
       default = {};
     };
+
+    certificateScheme = lib.mkOption {
+      type = lib.types.enum ["acme" "selfsigned"];
+      default = "acme";
+      description = ''
+        The scheme to use for managing TLS certificates:
+
+        1. `acme`: The server retrieves letsencrypt certificates via NixOS's acme module using nginx.
+        2. `selfsigned`: The server creates self-signed certificates on the fly (intended for testing).
+      '';
+      internal = true;
+      visible = false;
+    };
   };
 
   imports = [
@@ -164,6 +177,7 @@ in {
     ./redis.nix
     ./roundcube.nix
     ./rspamd.nix
+    ./selfsigned.nix
     ./user.nix
   ];
 }

mailsystem/nginx.nix

@@ -3,20 +3,25 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+with (import ./common.nix {inherit config;}); let
   cfg = config.mailsystem;
 in {
-  config = lib.mkIf cfg.enable {
+  config =
+    lib.mkIf cfg.enable {
       services.nginx = {
         enable = true;
         virtualHosts."${cfg.fqdn}" = {
           forceSSL = true;
-        enableACME = true;
+          enableACME = cfg.certificateScheme == "acme";
+          sslCertificate = lib.mkIf (cfg.certificateScheme == "selfsigned") sslCertPath;
+          sslCertificateKey = lib.mkIf (cfg.certificateScheme == "selfsigned") sslKeyPath;
         };
       };
 
       networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [80 443];
-
+    }
+    // lib.mkIf (cfg.enable && cfg.certificateScheme == "acme") {
       security.acme.certs."${cfg.fqdn}".reloadServices = [
         "postfix.service"
         "dovecot2.service"

mailsystem/rspamd.nix

@@ -121,6 +121,8 @@ in {
           proxyPass = "http://unix:${rspamdControllerSocket}:/";
           basicAuthFile = cfg.rspamd.webUi.basicAuthFile;
         };
+        sslCertificate = lib.mkIf (cfg.certificateScheme == "selfsigned") sslCertPath;
+        sslCertificateKey = lib.mkIf (cfg.certificateScheme == "selfsigned") sslKeyPath;
       };
     };
   };

mailsystem/selfsigned.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with (import ./common.nix {inherit config;}); let
+  cfg = config.mailsystem;
+in {
+  config = lib.mkIf (cfg.enable && cfg.certificateScheme == "selfsigned") {
+    systemd.services.mailsystem-selfsigned-certificate = {
+      after = ["local-fs.target"];
+      script = ''
+        # Create certificates if they do not exist yet
+        dir="${certificateDirectory}"
+        fqdn="${cfg.fqdn}"
+        [[ $fqdn == /* ]] && fqdn=$(< "$fqdn")
+        key="${sslKeyPath}"
+        cert="${sslCertPath}"
+
+        if [[ ! -f $key || ! -f $cert ]]; then
+          mkdir -p "$dir"
+          (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "$key" 4096) &&
+          "${pkgs.openssl}/bin/openssl" req -new -key "$key" -x509 -subj "/CN=$fqdn" -days 3650 -out "$cert"
+        fi
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        PrivateTmp = true;
+      };
+    };
+  };
+}