diff options
author | Naïm Favier <n@monade.li> | 2020-11-29 14:35:15 +0100 |
---|---|---|
committer | lewo <lewo@abesis.fr> | 2020-12-04 08:20:25 +0000 |
commit | 7c06f610f15642e3664f01a51c08c64cc8835f51 (patch) | |
tree | 69506c22efb2256c27dc3e30136313947776d8d0 | |
parent | de84ba1aeb2d2aee4671c6e4ab4f7ea9818d392c (diff) |
Update systemd.nix
-rw-r--r-- | default.nix | 2 | ||||
-rw-r--r-- | mail-server/systemd.nix | 51 |
2 files changed, 23 insertions, 30 deletions
diff --git a/default.nix b/default.nix index 7452ebd..2de9b8a 100644 --- a/default.nix +++ b/default.nix @@ -385,7 +385,7 @@ in type = types.path; default = "/var/certs"; description = '' - Sceme 2) + Scheme 2) This is the folder where the certificate will be created. The name is hardcoded to "cert-<domain>.pem" and "key-<domain>.pem" and the certificate is valid for 10 years. diff --git a/mail-server/systemd.nix b/mail-server/systemd.nix index 378e07d..cff6ee4 100644 --- a/mail-server/systemd.nix +++ b/mail-server/systemd.nix @@ -18,40 +18,32 @@ let cfg = config.mailserver; - preliminarySelfsigned = config.security.acme.preliminarySelfsigned; - acmeWantsTarget = [ "acme-certificates.target" ] - ++ (lib.optional preliminarySelfsigned "acme-selfsigned-certificates.target"); - acmeAfterTarget = if preliminarySelfsigned - then [ "acme-selfsigned-certificates.target" ] - else [ "acme-certificates.target" ]; + certificatesDeps = + if cfg.certificateScheme == 1 then + [] + else if cfg.certificateScheme == 2 then + [ "mailserver-selfsigned-certificate.service" ] + else + [ "acme-finished-${cfg.fqdn}.target" ]; in { config = with cfg; lib.mkIf enable { - # Add target for when certificates are available - systemd.targets."mailserver-certificates" = { - wants = lib.mkIf (cfg.certificateScheme == 3) acmeWantsTarget; - after = lib.mkIf (cfg.certificateScheme == 3) acmeAfterTarget; - }; - # Create self signed certificate systemd.services.mailserver-selfsigned-certificate = lib.mkIf (cfg.certificateScheme == 2) { - wantedBy = [ "mailserver-certificates.target" ]; - after = [ "local-fs.target" ]; - before = [ "mailserver-certificates.target" ]; + after = [ "local-fs.target" ]; script = '' # Create certificates if they do not exist yet dir="${cfg.certificateDirectory}" fqdn="${cfg.fqdn}" - case $fqdn in /*) fqdn=$(cat "$fqdn");; esac - key="''${dir}/key-${cfg.fqdn}.pem"; - cert="''${dir}/cert-${cfg.fqdn}.pem"; + [[ $fqdn == /* ]] && fqdn=$(< "$fqdn") + key="$dir/key-${cfg.fqdn}.pem"; + cert="$dir/cert-${cfg.fqdn}.pem"; - if [ ! -f "''${key}" ] || [ ! -f "''${cert}" ] - then + if [[ ! -f $key || ! -f $cert ]]; then mkdir -p "${cfg.certificateDirectory}" - (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "''${key}" 2048) && - "${pkgs.openssl}/bin/openssl" req -new -key "''${key}" -x509 -subj "/CN=''${fqdn}" \ - -days 3650 -out "''${cert}" + (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "$key" 2048) && + "${pkgs.openssl}/bin/openssl" req -new -key "$key" -x509 -subj "/CN=$fqdn" \ + -days 3650 -out "$cert" fi ''; serviceConfig = { @@ -62,8 +54,8 @@ in # Create maildir folder before dovecot startup systemd.services.dovecot2 = { - after = [ "mailserver-certificates.target" ]; - wants = [ "mailserver-certificates.target" ]; + wants = certificatesDeps; + after = certificatesDeps; preStart = '' # Create mail directory and set permissions. See # <http://wiki2.dovecot.org/SharedMailboxes/Permissions>. @@ -75,11 +67,12 @@ in # Postfix requires dovecot lmtp socket, dovecot auth socket and certificate to work systemd.services.postfix = { - after = [ "dovecot2.service" "mailserver-certificates.target" ] - ++ (lib.optional cfg.dkimSigning "opendkim.service"); - wants = [ "mailserver-certificates.target" ]; + wants = certificatesDeps; + after = [ "dovecot2.service" ] + ++ lib.optional cfg.dkimSigning "opendkim.service" + ++ certificatesDeps; requires = [ "dovecot2.service" ] - ++ (lib.optional cfg.dkimSigning "opendkim.service"); + ++ lib.optional cfg.dkimSigning "opendkim.service"; }; }; } |