mirrors/nixos-mailserver
1
0
Fork 0
mirror of https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git synced 2025-01-27 13:28:23 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'acme-cert-name-option' into 'master'

Browse source 
acme: Add new option acmeCertificateName

See merge request simple-nixos-mailserver/nixos-mailserver!303
This commit is contained in:
Matthew Leach 2024-03-15 02:51:27 +00:00
commit ed0fbae77c
4 changed files with 22 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
default.nix
View file

@ -675,6 +675,19 @@ in
''; '';
}; };
acmeCertificateName = mkOption {
type = types.str;
default = cfg.fqdn;
example = "example.com";
description = ''
({option}`mailserver.certificateScheme` == `acme`)
When the `acme` `certificateScheme` is selected, you can use this option
to override the default certificate name. This is useful if you've
generated a wildcard certificate, for example.
'';
};
enableImap = mkOption { enableImap = mkOption {
type = types.bool; type = types.bool;
default = true; default = true;

5
mail-server/assertions.nix
View file

@ -13,5 +13,10 @@
assertion = config.mailserver.forwards == {}; assertion = config.mailserver.forwards == {};
message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.forwards"; message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.forwards";
} }
] ++ lib.optionals (config.mailserver.certificateScheme != "acme") [
{
assertion = config.mailserver.acmeCertificateName == config.mailserver.fqdn;
message = "When the certificate scheme is not 'acme' (mailserver.certificateScheme != \"acme\"), it is not possible to define mailserver.acmeCertificateName";
}
]; ];
} }

4
mail-server/common.nix
View file

@ -26,7 +26,7 @@ in
else if cfg.certificateScheme == "selfsigned" else if cfg.certificateScheme == "selfsigned"
then "${cfg.certificateDirectory}/cert-${cfg.fqdn}.pem" then "${cfg.certificateDirectory}/cert-${cfg.fqdn}.pem"
else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx" else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx"
then "${config.security.acme.certs.${cfg.fqdn}.directory}/fullchain.pem" then "${config.security.acme.certs.${cfg.acmeCertificateName}.directory}/fullchain.pem"
else throw "unknown certificate scheme"; else throw "unknown certificate scheme";
# key :: PATH # key :: PATH
@ -35,7 +35,7 @@ in
else if cfg.certificateScheme == "selfsigned" else if cfg.certificateScheme == "selfsigned"
then "${cfg.certificateDirectory}/key-${cfg.fqdn}.pem" then "${cfg.certificateDirectory}/key-${cfg.fqdn}.pem"
else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx" else if cfg.certificateScheme == "acme" || cfg.certificateScheme == "acme-nginx"
then "${config.security.acme.certs.${cfg.fqdn}.directory}/key.pem" then "${config.security.acme.certs.${cfg.acmeCertificateName}.directory}/key.pem"
else throw "unknown certificate scheme"; else throw "unknown certificate scheme";
passwordFiles = let passwordFiles = let

4
mail-server/nginx.nix
View file

@ -17,7 +17,7 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
with (import ./common.nix { inherit config; }); with (import ./common.nix { inherit config lib pkgs; });
let let
cfg = config.mailserver; cfg = config.mailserver;
@ -36,7 +36,7 @@ in
}; };
}; };
security.acme.certs."${cfg.fqdn}".reloadServices = [ security.acme.certs."${cfg.acmeCertificateName}".reloadServices = [
"postfix.service" "postfix.service"
"dovecot2.service" "dovecot2.service"
]; ];