argh whatever

modules/mail/default.nix

@@ -2,45 +2,28 @@
   inherit (config) conf;
   inherit (lib) mkIf;
 in mkIf conf.mail.enable {
-  services.nginx.streamConfig = ''
+  services.nginx = {
-    # Proxy SMTP
+    virtualHosts."chpu.eu" = {
-    server {
+      serverName = "chpu.eu";
-      server_name chpu.eu mail.chpu.eu;
+      serverAliases = [
-      listen 25 proxy_protocol;
+        "webadmin.chpu.eu"
-      proxy_pass 127.0.0.1:10025;
+        "autoconfig.chpu.eu"
-      proxy_protocol on;
+        "autodiscover.chpu.eu"
-    }
+      ];
-
+      forceSSL = true;
-    # Proxy IMAPS
+      useACMEHost = "chpu.eu";
-    server {
+      locations = {
-      server_name chpu.eu mail.chpu.eu;
+        "/" = {
-      listen 993 proxy_protocol;
+          proxyPass = "http://localhost:9090";
-      proxy_pass 127.0.0.1:10993;
+        };
-      proxy_protocol on;
+      };
-    }
+    };
-
+  };
-    # Proxy SMTPS
-    server {
-      server_name chpu.eu mail.chpu.eu;
-      listen 465 proxy_protocol;
-      proxy_pass 127.0.0.1:10465;
-      proxy_protocol on;
-    }
-
-    # Proxy HTTPS
-    server {
-      server_name chpu.eu mail.chpu.eu;
-      listen 443 proxy_protocol;
-      proxy_pass 127.0.0.1:10443;
-      proxy_protocol on;
-    }
-  '';
 
   users.users."stalwart-mail".extraGroups = [ "nginx" ];
 
   services.stalwart-mail = {
     enable = true;
-    openFirewall = true;
     settings = {
       config.local-keys = [
         "certificate.default.cert"
@@ -53,27 +36,22 @@ in mkIf conf.mail.enable {
           enable = true;
           implicit = true;
         };
-        proxy.trusted-networks = [
-          "127.0.0.0/8"
-          "::1"
-          "10.0.0.0/8"
-        ];
         listener = {
           submissions = {
             protocol = "smtp";
-            bind = "127.0.0.1:10465";
+            bind = "[::]:465";
           };
           smtp = {
             protocol = "smtp";
-            bind = "127.0.0.1:10025";
+            bind = "[::]:25";
           };
           imaps = {
             protocol = "imap";
-            bind = "127.0.0.1:10993";
+            bind = "[::]:993";
           };
           management = {
             protocol = "http";
-            bind = [ "127.0.0.1:10443" ];
+            bind = "127.0.0.1:9090";
           };
         };
       };