;;; Tyreunom's system administration and configuration tools.

;;;

;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>

;;;

;;; This program is free software: you can redistribute it and/or modify

;;; it under the terms of the GNU General Public License as published by

;;; the Free Software Foundation, either version 3 of the License, or

;;; (at your option) any later version.

;;;

;;; This program is distributed in the hope that it will be useful,

;;; but WITHOUT ANY WARRANTY; without even the implied warranty of

;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

;;; GNU General Public License for more details.

;;;

;;; You should have received a copy of the GNU General Public License

;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

;;

;; Email configuration

;;

(define-module (config mail)

  #:use-module (data dns)

  #:use-module (gnu services)

  #:use-module (gnu services mail)

  #:use-module (guix gexp)

  #:export (lepiller-mail-services))

(define aliases-file

  (plain-file "aliases" "postmaster root

@ tyreunom

"))

(define relays-file

  (plain-file "other-relays"

    (string-append ene-ip4 "\n" hermes-ip4 "\n" hermes-ip6 "\n" )))

(define blacklist-file

  (plain-file "blacklist" "

@yahoo.com.cn

@qq.com"))

(define opensmtpd-conf

  (mixed-text-file "smtpd.conf" "

# This is the smtpd server system-wide configuration file.

# See smtpd.conf(5) for more information.

# My TLS certificate and key

pki lepiller.eu certificate \"/etc/letsencrypt/live/lepiller.eu/fullchain.pem\"

pki lepiller.eu key \"/etc/letsencrypt/live/lepiller.eu/privkey.pem\"

# Edit this file to add more virtual users (passwords are read in that file

# instead of /etc/passwd.

table passwd file:/etc/mail/passwd

# port 25 is used only for receiving from external servers, and they may start a

# TLS session if the want.

listen on ens18 port 25 tls pki lepiller.eu

# For sending messages from outside of this server, you need to authenticate and

# use TLS.

listen on ens18 port 587 tls-require pki lepiller.eu auth <passwd>

# On this server, you only need to authenticate on one of the available ports,

# and you may use TLS.

listen on lo port 25 tls pki lepiller.eu auth <passwd>

listen on lo port 587 tls pki lepiller.eu auth <passwd>

# TODO: manage these files directly in the configuration?

# If you edit the file, you have to run \"smtpctl update table aliases\"

table aliases file:" aliases-file "

table other-relays file:" relays-file "

table blacklist file:" blacklist-file "

# We accept to relay any mail from authenticated users

accept for any authenticated relay

# Then, we reject on some other conditions:

# If the mail tries to impersonate us

reject from ! source <other-relays> sender \"@lepiller.eu\" for any

# If it comes from someone on the blacklist

reject from any sender <blacklist> for any

# Finaly, if we accept incoming messages

accept from any for domain \"lepiller.eu\" virtual <aliases> deliver to maildir

accept for local alias <aliases> deliver to maildir

"))

(define lepiller-imap-service

  (service dovecot-service-type

           (dovecot-configuration

	     (mail-location "maildir:~/Maildir")

	     (ssl-cert "</etc/letsencrypt/live/lepiller.eu/fullchain.pem")

	     (ssl-key  "</etc/letsencrypt/live/lepiller.eu/privkey.pem"))))

(define lepiller-smtp-service

  (service opensmtpd-service-type

	   (opensmtpd-configuration

	     (config-file opensmtpd-conf))))

(define lepiller-mail-services

  (list

    lepiller-smtp-service

    lepiller-imap-service))