small update

modules/services/stalwart.mod.nix

@@ -0,0 +1,133 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib.modules) mkIf;
+  inherit (lib.options) mkEnableOption;
+
+  domain = "charlieroot.dev";
+
+  cfg = config.modules.system.services.stalwart;
+in {
+  options.modules.system.services.stalwart.enable = mkEnableOption "stalwart";
+  config = mkIf cfg.enable {
+    # create the stallwart user
+    users.users.stalwart = {
+      home = "/var/lib/stalwart-mail";
+      useDefaultShell = true;
+      group = "stalwart";
+      isSystemUser = true;
+    };
+    users.groups.stalwart = {};
+
+    services.stalwart-mail = {
+      enable = true;
+      package = pkgs.stalwart-mail;
+      openFirewall = true;
+      settings = {
+        email = {
+          # All incoming messages via SMTP or LMTP are automatically encrypted before they are written to disk,
+          # provided the user has uploaded their S/MIME certificate or OpenPGP public key.
+
+          encryption.enable = true;
+        };
+        server = {
+          # The default server hostname is utilized in SMTP EHLO commands,
+          # as well as included in message headers and reports.
+          hostname = domain;
+          tls = {
+            # Specifies whether the TLS encryption is available for the listener.
+            enable = true;
+
+            # Specifies whether the listener should use implicit or explicit TLS encryption.
+            # If set to false (the default), the listener will use explicit TLS encryption,
+            # which requires clients to initiate a STARTTLS command before upgrading the connection
+            # to an encrypted one. If set to true, the listener will use implicit TLS encryption,
+            # which requires the connection to be encrypted from the start.
+            implicit = true;
+          };
+
+          # Listeners are responsible for receiving incoming TCP connections.
+          listener = {
+            # Unencrypted SMTP connections are received on port 25 by default.
+            # This is the standard port for SMTP, and is used by mail servers to send email to each other.
+            smtp = {
+              protocol = "smtp";
+              bind = ["[::]:25"];
+              tls.implicit = true;
+            };
+            # SMTP submissions with implicit TLS are received on port 465 by default.
+            # This is the standard port for SMTP submissions with native implicit TLS,
+            # and is used by mail clients to send email to mail servers.
+
+            submissions = {
+              bind = ["[::]:465"];
+              protocol = "smtp";
+              tls.implicit = true;
+            };
+            imaps = {
+              bind = ["[::]:993"];
+              protocol = "imap";
+              tls.implicit = true;
+            };
+            management = {
+              bind = ["127.0.0.1:8080"];
+              protocol = "http";
+              tls.implicit = true;
+            };
+          };
+          lookup.default = {
+            hostname = "mail.${domain}";
+            inherit domain;
+          };
+        };
+        # storage = {
+        #   data = "postgresql";
+        #   blob = "postgresql";
+        #   fts = "postgresql";
+        #   lookup = "postgresql";
+        #   full-text = {
+        #     default-language = "en";
+        #   };
+        # };
+        #   store = {
+        #     postgresql = {
+        #       # Specifies the database type, set to "postgresql" for PostgreSQL.
+        #       type = "postgresql";
+
+        #       # The hostname or IP address of the PostgreSQL server.
+        #       host = "localhost";
+
+        #       # Port PostgreSQL runs on. Defaults to 5432.
+        #       port = "5432";
+
+        #       # Name of the database to connect to.
+        #       # TODO: add this to PostgreSQL.
+        #       database = "stalwart";
+
+        #       # The username used for authentication with the PostgreSQL server.
+        #       # TODO: add this to PostgreSQL.
+        #       user = "stalwart";
+
+        #       password = "";
+
+        #       # Enable TLS
+        #       tls.enable = true;
+        #     };
+        #   };
+      };
+    };
+    services.nginx = {
+      enable = true;
+      virtualHosts."mail.${domain}" = {
+        addSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:${toString 8080}";
+        };
+      };
+    };
+  };
+}