preisi/mailnix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mailsystem: Add option to use selfsigned certificates in preparation for testing

Browse source
This commit is contained in:
Thomas Preisner 2024-12-05 16:04:01 +01:00
parent 8a64eb9287
commit e185d301ff
5 changed files with 84 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

35
mailsystem/nginx.nix
View file

@ -3,23 +3,28 @@
pkgs,
lib,
...
}: let
}:
with (import ./common.nix {inherit config;}); let
cfg = config.mailsystem;
in {
config = lib.mkIf cfg.enable {
services.nginx = {
enable = true;
virtualHosts."${cfg.fqdn}" = {
forceSSL = true;
enableACME = true;
config =
lib.mkIf cfg.enable {
services.nginx = {
enable = true;
virtualHosts."${cfg.fqdn}" = {
forceSSL = true;
enableACME = cfg.certificateScheme == "acme";
sslCertificate = lib.mkIf (cfg.certificateScheme == "selfsigned") sslCertPath;
sslCertificateKey = lib.mkIf (cfg.certificateScheme == "selfsigned") sslKeyPath;
};
};
networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [80 443];
}
// lib.mkIf (cfg.enable && cfg.certificateScheme == "acme") {
security.acme.certs."${cfg.fqdn}".reloadServices = [
"postfix.service"
"dovecot2.service"
];
};
networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [80 443];
security.acme.certs."${cfg.fqdn}".reloadServices = [
"postfix.service"
"dovecot2.service"
];
};
}