blob: 728139ce0f15b588438cac69b3b063b92431afbf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
{
pkgs,
lib,
config,
...
}:
let
cfg = config.wilkuu.services.bulwark;
stalwart_cfg = config.stalwart-nix.stalwart;
hostname = config.networking.hostName;
# Importing stuff from stalwart and defaults etc.
_stalwart_jmap_domains = lib.optionals stalwart_cfg.enable (
[ stalwart_cfg.domain ] ++ stalwart_cfg.additionalDomains
);
# Secrets handling
sopsPath = ../secrets/${hostname}/bulwark.yaml;
secrets = [
"admin_password"
"session_secret"
"oauth_secret"
];
toSops = (sname: "bulwark/${sname}");
toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
toSopsPlaceholder = (name: config.sops.placeholder.${toSops name});
bulwark = pkgs.callPackage ../packages/bulwark/package.nix { };
in
{
options.wilkuu.services.bulwark = with lib; {
enable = mkEnableOption "Enable bulwark client";
doACME = mkEnableOption "Enable ACME for bulwark here";
package = mkOption {
type = types.package;
default = bulwark;
description = "The bulwark package to be used.";
};
domains = mkOption {
type = (types.listOf types.str);
default = [ ];
example = [ "bulwark.wilkuu.xyz" ];
description = "Domains for HTTP connections";
};
dataDir = mkOption {
type = types.path;
description = "Storage localtion for Bulwark user data";
default = "/var/lib/bulwark";
example = "/srv/data/bulwark";
};
jmap_servers = mkOption {
type = types.listOf types.str;
default = _stalwart_jmap_domains; # FIXME: What if someone does not want to use all of their stalwart domains here.
example = [ "jmap.example.com" ];
description = "A list of JMAP domains avalable for bulwark";
};
extraEnv = mkOption {
type = types.attrs; # TODO Better typing
default = { };
example = {
FAVICON_URL = "static.example.com/favicon.ico";
};
description = "Additional configuration, see https://bulwarkmail.org/docs/getting-started/configuration/environment-reference#server-listen-address for more info.";
};
stalwartInterop = mkOption {
type = types.bool;
default = stalwart_cfg.enable;
example = true;
description = "Whenever to allow stalwart-specific features.";
};
};
config.users = lib.mkIf cfg.enable {
users.bulwark = {
isSystemUser = true;
group = "uptimekuma";
};
groups.bulwark = { };
};
config.sops.secrets = (
lib.genAttrs (map toSops secrets) (_name: {
sopsFile = sopsPath;
mode = "0440";
owner = "bulwark";
})
);
config.sops.templates."bulwark-env" = lib.mkIf cfg.enable {
owner = "bulwark";
content =
pkgs.lib.generators.toKeyValue
{
mkKeyValue = key: value: "${key}=${lib.escapeShellArg (toString value)}";
}
(
{
STALWART_FEATURES = (if cfg.stalwartInterop then "true" else "false");
ADMIN_CONFIG_DIR = "${cfg.dataDir}/settings";
ADMIN_STATE_DIR = "${cfg.dataDir}/admin-state";
SETTINGS_SYNC_ENABLED = "true";
SETTINGS_DATA_DIR = "${cfg.dataDir}/settings";
BULWARK_TELEMETRY = "off";
TELEMETRY_DATA_DIR = "${cfg.dataDir}/telemetry";
VERSION_CHECK_DATA_DIR = "${cfg.dataDir}/version-check";
SESSION_SECRET_FILE = (toCredfilePath "session_secret");
ADMIN_PASSWORD = (toSopsPlaceholder "admin_password");
EXTENSION_DIRECTORY_URL = "https://extensions.bulwarkmail.org";
# Put into a option module
OAUTH_ENABLED = "true";
OAUTH_CLIENT_ID = "${hostname}-bulwark-webmail";
OAUTH_ONLY = "false";
# OAUTH_CLIENT_SECRET_FILE = ...
# TODO: OAUTH_[EXTRA_]SCOPES
HOSTNAME = "::";
PORT = 3081;
}
// cfg.extraEnv
)
+ "\nJMAP_SERVER_URL=${(lib.concatStringsSep ", " (map (d: "https://${d}") cfg.jmap_servers))}";
};
config.services.nginx.virtualHosts = lib.mkIf cfg.enable (
lib.genAttrs cfg.domains (_vhost: {
forceSSL = cfg.doACME;
enableACME = cfg.doACME;
locations."/" = {
proxyPass = "http://127.0.0.1:3081";
proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
proxy_cache_bypass $http_upgrade;
'';
};
})
);
config.systemd.services.bulwark = lib.mkIf cfg.enable ({
enable = cfg.enable;
serviceConfig = {
User = "bulwark";
# AllowedPorts = 3081;
# SocketBindAllow = "tcp:3081";
ExecStart = "${cfg.package}/bin/bulwark";
WorkingDirectory = "${cfg.dataDir}";
StateDirectory = "bulwark";
Restart = "always";
RestartSec = 5;
EnvironmentFile = config.sops.templates."bulwark-env".path;
};
});
}
|
