Add mail server configuration with Stalwart Mail, secrets management, and Traefik integration

nix-system-configs/modules/system/blank_system_USE_THIS_AS_COPY.nix

@@ -35,6 +35,7 @@ in {
     (choose [./modules/bootloader/seabios-assigned-iso-at-birth.nix ../bootloader/seabios-assigned-iso-at-birth.nix])
     (choose [./modules/lix-default.nix ../lix-default.nix])
     (choose [./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix])
+    (choose [./modules/toolsets/grafana_metric.nix ../toolsets/grafana_metric.nix])
   ];
 
   config = {

nix-system-configs/modules/system/mail-server.nix

@@ -0,0 +1,135 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  choose = paths: lib.findFirst builtins.pathExists null paths;
+in {
+  options.local = {
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "nixos-default";
+      description = "System hostname";
+    };
+    username = lib.mkOption {
+      type = lib.types.str;
+      default = "user";
+      description = "Primary user username";
+    };
+    userDescription = lib.mkOption {
+      type = lib.types.str;
+      default = "NixOS User";
+      description = "Primary user description";
+    };
+    address = lib.mkOption {
+      type = lib.types.str;
+      default = "10.1.1.100";
+      description = "Static IP address";
+    };
+  };
+
+  imports = lib.filter (x: x != null) [
+    (choose [./modules/desktop-manager/sway_greetd_homemanager.nix ../desktop-manager/sway_greetd_homemanager.nix])
+    (choose [./modules/local/hostname_username.nix ../local/hostname_username.nix])
+    (choose [./modules/local/networking_local.nix ../local/networking_local.nix])
+    (choose [./modules/bootloader/seabios-assigned-proxmox-at-birth.nix ../bootloader/seabios-assigned-proxmox-at-birth.nix])
+    (choose [./modules/lix-default.nix ../lix-default.nix])
+    (choose [./modules/secrets-config/sops-the-blank-system.nix ../secrets-config/sops-the-blank-system.nix])
+    (choose [./modules/toolsets/grafana_metric.nix ../toolsets/grafana_metric.nix])
+    (choose [./modules/secrets-config/sops-mail.nix ../secrets-config/sops-mail.nix])
+  ];
+
+  config = {
+    local.hostname = "nixos-mailserver";
+    local.username = "mailprg";
+    local.userDescription = "NixOS PRG Mailing Service";
+    local.address = "10.1.1.15";
+    system.stateVersion = "25.11";
+
+    services.stalwart-mail = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        server = {
+          hostname = "mail.prg-radio.org";
+          tls = {
+            enable = true;
+            implicit = true;
+          };
+          listener = {
+            smtp = {
+              protocol = "smtp";
+              bind = "[::]:25";
+              proxy.trusted-networks = [
+                "10.1.1.250/32"
+              ];
+            };
+            submissions = {
+              bind = "[::]:465";
+              protocol = "smtp";
+              tls.implicit = true;
+              # Also trust proxy for SMTPS
+              proxy.trusted-networks = ["10.1.1.250/32"];
+            };
+            imaps = {
+              bind = "[::]:993";
+              protocol = "imap";
+              tls.implicit = true;
+              proxy.trusted-networks = ["10.1.1.250/32"];
+            };
+            jmap = {
+              bind = "[::]:8080";
+              url = "https://mail.prg-radio.org";
+              protocol = "http";
+            };
+            management = {
+              bind = ["127.0.0.1:8080"];
+              protocol = "http";
+            };
+          };
+        };
+        lookup.default = {
+          hostname = "mail.prg-radio.org";
+          domain = "prg-radio.org";
+        };
+        acme."letsencrypt" = {
+          directory = "https://acme-v02.api.letsencrypt.org/directory";
+          challenge = "dns-01";
+          contact = config.sops.secrets."cloudflare-username".path;
+          domains = ["prg-radio.org" "mail.prg-radio.org"];
+          provider = "cloudflare";
+          secret = config.sops.secrets."cloudflare-dns-token".path;
+        };
+        session.auth = {
+          mechanisms = "[plain]";
+          directory = "'in-memory'";
+        };
+        storage.directory = "in-memory";
+        session.rcpt.directory = "'in-memory'";
+        directory."imap".lookup.domains = ["prg-radio.org"];
+        directory."in-memory" = {
+          type = "memory";
+          principals = [
+            {
+              class = "individual";
+              name = "Polyteknisk Radiogruppe Board Member";
+              secret = config.sops.secrets."board-member-password".path;
+              email = ["board@prg-radio.org"];
+            }
+            {
+              class = "individual";
+              name = "postmaster";
+              secret = config.sops.secrets."board-member-password".path;
+              email = ["postmaster@prg-radio.org"];
+            }
+          ];
+        };
+        authentication.fallback-admin = {
+          user = "admin";
+          secret = config.sops.secrets."admin-password".path;
+        };
+      };
+    };
+  };
+}

nix-system-configs/modules/system/traefik.nix

@@ -265,6 +265,20 @@ in {
           teamspeak-data = {
             address = "[::]:30033/tcp";
           };
+
+          # Mail entrypoints: plain SMTP, implicit SMTPS (465) and IMAPS (993)
+          #smtp = {
+          #  # plain SMTP (port 25) - TCP passthrough to backend
+          #  address = "[::]:25";
+          # };
+          smtps = {
+            # implicit TLS SMTP (port 465) - passthrough to backend
+            address = "[::]:465";
+          };
+          imaps = {
+            # implicit TLS IMAP (port 993) - passthrough to backend
+            address = "[::]:993";
+          };
         };
         log = {
           level = "INFO";
@@ -350,6 +364,14 @@ in {
             tls = {};
             middlewares = ["anubisForwardAuth"];
           };
+
+          # Mail HTTP (JMAP / web) - terminate TLS at Traefik and forward to Stalwart JMAP HTTP listener
+          mail = {
+            rule = "Host(`mail.prg-radio.org`)";
+            service = "mail-jmap";
+            entryPoints = ["websecure"];
+            tls = {certresolver = "acme";};
+          };
         };
 
         http.services = {
@@ -387,6 +409,11 @@ in {
               {url = "http://10.1.1.10:3000";}
             ];
           };
+
+          # Mail JMAP HTTP backend
+          mail-jmap.loadBalancer = {
+            servers = [{url = "http://10.1.1.15:8080";}];
+          };
         };
 
         # TCP routing for TeamSpeak
@@ -424,6 +451,30 @@ in {
               passthrough = true;
             };
           };
+
+          # Mail TCP routers: SMTP (25), SMTPS (465 implicit TLS), IMAPS (993 implicit TLS)
+          #mail-smtp = {
+          #  # catch-all TCP router for port 25
+          #   rule = "HostSNI(`*`)";
+          #  service = "mail-smtp";
+          #  entryPoints = ["smtp"];
+          # };
+
+          mail-smtps = {
+            # SMTPS implicit TLS - passthrough to backend
+            rule = "HostSNI(`*`)";
+            service = "mail-smtps";
+            entryPoints = ["smtps"];
+            tls = {passthrough = true;};
+          };
+
+          mail-imaps = {
+            # IMAPS implicit TLS - passthrough to backend
+            rule = "HostSNI(`*`)";
+            service = "mail-imaps";
+            entryPoints = ["imaps"];
+            tls = {passthrough = true;};
+          };
         };
 
         tcp.services = {
@@ -442,6 +493,19 @@ in {
               {address = "10.1.1.248:12244";}
             ];
           };
+
+          # Mail TCP services
+          #  mail-smtp.loadBalancer = {
+          #     servers = [ { address = "10.1.1.15:25"; } ];
+          #   };
+
+          mail-smtps.loadBalancer = {
+            servers = [{address = "10.1.1.15:465";}];
+          };
+
+          mail-imaps.loadBalancer = {
+            servers = [{address = "10.1.1.15:993";}];
+          };
         };
 
         # UDP routing for TeamSpeak voice