mirrors/nixos-mailserver
1
0
Fork 0
mirror of https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git synced 2025-01-12 23:36:56 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'acme-cert-name-option' into 'master'

Browse source 
acme: Add new option acmeCertificateName

See merge request simple-nixos-mailserver/nixos-mailserver!303
This commit is contained in:
Matthew Leach 2024-03-15 02:51:27 +00:00
commit ed0fbae77c
4 changed files with 22 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
default.nix
View file

@ -675,6 +675,19 @@ in
'';
};
acmeCertificateName = mkOption {
type = types.str;
default = cfg.fqdn;
example = "example.com";
description = ''
({option}`mailserver.certificateScheme` == `acme`)
When the `acme` `certificateScheme` is selected, you can use this option
to override the default certificate name. This is useful if you've
generated a wildcard certificate, for example.
'';
};
enableImap = mkOption {
type = types.bool;
default = true;

5
mail-server/assertions.nix
View file

@ -13,5 +13,10 @@
assertion = config.mailserver.forwards == {};
message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.forwards";
}
] ++ lib.optionals (config.mailserver.certificateScheme != "acme") [
{
assertion = config.mailserver.acmeCertificateName == config.mailserver.fqdn;
message = "When the certificate scheme is not 'acme' (mailserver.certificateScheme != \"acme\"), it is not possible to define mailserver.acmeCertificateName";
}
];
}

4
mail-server/common.nix
View file

@ -26,7 +26,7 @@ in
else if cfg.certificateScheme == "selfsigned"
then "${cfg.certificateDirectory}/cert-${cfg.fqdn}.pem"
else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx"
then "${config.security.acme.certs.${cfg.fqdn}.directory}/fullchain.pem"
then "${config.security.acme.certs.${cfg.acmeCertificateName}.directory}/fullchain.pem"
else throw "unknown certificate scheme";
# key :: PATH
@ -35,7 +35,7 @@ in
else if cfg.certificateScheme == "selfsigned"
then "${cfg.certificateDirectory}/key-${cfg.fqdn}.pem"
else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx"
then "${config.security.acme.certs.${cfg.fqdn}.directory}/key.pem"
then "${config.security.acme.certs.${cfg.acmeCertificateName}.directory}/key.pem"
else throw "unknown certificate scheme";
passwordFiles = let

4
mail-server/nginx.nix
View file

@ -17,7 +17,7 @@
{ config, pkgs, lib, ... }:
with (import ./common.nix { inherit config; });
with (import ./common.nix { inherit config lib pkgs; });
let
cfg = config.mailserver;
@ -36,7 +36,7 @@ in
};
};
security.acme.certs."${cfg.fqdn}".reloadServices = [
security.acme.certs."${cfg.acmeCertificateName}".reloadServices = [
"postfix.service"
"dovecot2.service"
];