surtr.nix

{
  config,
  pkgs,
  callPackage,
  ...
}: {
  imports = [
    <nixpkgs/nixos/modules/virtualisation/openstack-config.nix>
    ./gandicloud.nix

    (builtins.fetchTarball {
      # Pick a commit from the branch you are interested in
      url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-22.05/nixos-mailserver-nixos-22.05.tar.gz";
      # And set its hash
      sha256 = "0csx2i8p7gbis0n5aqpm57z5f9cd8n9yabq04bg1h4mkfcf7mpl6";
    })

  ];

  networking.hostName = "surtr";
  networking.firewall.allowedTCPPorts = [
    22 # SSH
    25 # SMTP do I need this?
    80 # HTTP
    143 # IMAP with starttls
    443 # HTTPS
    465 # submission TLS
    587 # submission starttls
    993 # IMAP with TLS
    5000 # ZNC IRC bouncer
  ];

  # letsencrypt plz
  security.acme = {
    acceptTerms = true;
    defaults.email = "shae.erisson+acme@gmail.com";
    certs = {
      "scannedinavian.com" = {
        # webroot = "/var/www"; # THIS WILL MAKE YOU SAD, DON'T SET THIS
        extraDomainNames = [ "www.scannedinavian.com"  "tattletail.scannedinavian.com"];
      };
      # once I get everything else fixed up, uncomment these
      # "scannedinavian.org" = {
      #   extraDomainNames = [ "www.scannedinavian.com"  "tattletail.scannedinavian.com"];
      # };
      # "scannedinavian.net" = {
      #   extraDomainNames = [ "www.scannedinavian.net" ];
      # };
      # "erisson.org" = {
      #   extraDomainNames = [ "www.erisson.org" ];
      # };
    };
  };
  # for testing
  # security.acme.defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";

  services.nginx = {
    enable = true;
    logError = "stderr info";
    # adminAddr = "webmaster@scannedinavian.com"; # only in apache?
    # addSSL = true;
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;

    virtualHosts = {
      "scannedinavian.com" = {

        enableACME = true;
        forceSSL = true;
        root = "/var/www";

      };
    };
  };

  users.users.nginx.extraGroups = [ "acme" ];

  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_14;
    extraPlugins = [pkgs.postgresql14Packages.postgis pkgs.postgresql14Packages.pg_repack];
    dataDir = "/data/postgres";
  };

  users.users.shae = {
    home = "/home/shae";
    isNormalUser = true;
    shell = pkgs.zsh;
  };

  mailserver = {
    enable = true;
    fqdn = "surtr.scannedinavian.com";
    domains = [ "scannedinavian.com" ]; # "scannedinavian.net" "scannedinavian.org" "erisson.org" ];

    enableSubmission = true;
    enableSubmissionSsl = true;
    enableImapSsl = true;
    enableImap = true;
    sendingFqdn = "scannedinavian.com";

    # A list of all login accounts. To create the password hashes, use
    # nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2
    loginAccounts = {
      "shae@scannedinavian.com" = {
        hashedPasswordFile = "/etc/nixos/shae-email-hash";
        aliases = ["postmaster@scannedinavian.com"];
      };
      # "shae@scannedinavian.org" = {
      #   hashedPasswordFile = "/etc/nixos/shae-email-hash";
      # };
    };

    # specify locations and copy certificates there
    certificateScheme = 1;
    certificateFile = "/var/lib/acme/scannedinavian.com/fullchain.pem";
    keyFile = "/var/lib/acme/scannedinavian.com/key.pem";

  };

}