nix-conf/systems/hetzner/mail.nix

{
  config,
  pkgs,
  lib,
  ...
}:

{
  mailserver = {
    enable = true;
    fqdn = "mail.missing.ninja";
    domains = [
      "missing.ninja"
      "joens.zone"
      "joens.website"
      "joens.site"
      "joens.online"
      "joens.link"
      "joens.international"
      "joens.family"
      "joens.digital"
      "joens.blog"
      "net0loggy.net"
      "clan-war.net"
      "net0loggy.de"
      "dtg-c.de"
      "joens.email"
    ];

    # A list of all login accounts. To create the password hashes, use
    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
    loginAccounts = {
      "jopejoe1@missing.ninja" = {
        hashedPassword = "$2b$05$ZZk/X.gQqjRc08ej9XTuaO0aVnWjPGWUqo/xYGxHGsMEyDL.Hr8AS";
        aliases = [
          "@missing.ninja"
          "@joens.zone"
          "@joens.website"
          "@joens.site"
          "@joens.online"
          "@joens.link"
          "@joens.international"
          "@joens.family"
          "@joens.digital"
          "@joens.blog"
          "@net0loggy.net"
          "@clan-war.net"
          "@net0loggy.de"
          "@dtg-c.de"
          "@joens.email"
        ];
      };
    };

    fullTextSearch = {
      enable = true;
      # index new email as they arrive
      autoIndex = true;
      # this only applies to plain text attachments, binary attachments are never indexed
      indexAttachments = true;
      enforced = "body";
    };

    # Use Let's Encrypt certificates. Note that this needs to set up a stripped
    # down nginx and opens port 80.
    certificateScheme = "acme-nginx";
  };

  services.roundcube = {
    enable = true;
    # this is the url of the vhost, not necessarily the same as the fqdn of
    # the mailserver
    hostName = "webmail.missing.ninja";
    extraConfig = ''
      # starttls needed for authentication, so the fqdn required to match
      # the certificate
      $config['smtp_server'] = "tls://${config.mailserver.fqdn}";
      $config['smtp_user'] = "%u";
      $config['smtp_pass'] = "%p";
    '';
  };

  networking.firewall.allowedTCPPorts = [
    80
    443
  ];
}