Maddy

`services.maddy.config`

Server configuration, see https://maddy.email for more information. The default configuration of this module will setup minimal Maddy instance for mail transfer without TLS encryption.

::: {.note} This should not be used in a production environment. :::

Type: null or strings concatenated with "\n"

Default

`#!nix '' # Minimal configuration with TLS disabled, adapted from upstream example # configuration here https://github.com/foxcpp/maddy/blob/master/maddy.conf # Do not use this in production!

auth.pass_table local_authdb { table sql_table { driver sqlite3 dsn credentials.db table_name passwords } }

storage.imapsql local_mailboxes { driver sqlite3 dsn imapsql.db }

table.chain local_rewrites { optional_step regexp "(.+)+(.+)@(.+)" "$1@$3" optional_step static { entry postmaster postmaster@$(primary_domain) } optional_step file /etc/maddy/aliases }

msgpipeline local_routing { destination postmaster $(local_domains) { modify { replace_rcpt &local_rewrites } deliver_to &local_mailboxes } default_destination { reject 550 5.1.1 "User doesn't exist" } }

smtp tcp://0.0.0.0:25 { limits { all rate 20 1s all concurrency 10 } dmarc yes check { require_mx_record dkim spf } source $(local_domains) { reject 501 5.1.8 "Use Submission for outgoing SMTP" } default_source { destination postmaster $(local_domains) { deliver_to &local_routing } default_destination { reject 550 5.1.1 "User doesn't exist" } } }

submission tcp://0.0.0.0:587 { limits { all rate 50 1s } auth &local_authdb source $(local_domains) { check { authorize_sender { prepare_email &local_rewrites user_to_email identity } } destination postmaster $(local_domains) { deliver_to &local_routing } default_destination { modify { dkim $(primary_domain) $(local_domains) default } deliver_to &remote_queue } } default_source { reject 501 5.1.8 "Non-local sender domain" } }

target.remote outbound_delivery { limits { destination rate 20 1s destination concurrency 10 } mx_auth { dane mtasts { cache fs fs_dir mtasts_cache/ } local_policy { min_tls_level encrypted min_mx_level none } } }

target.queue remote_queue { target &outbound_delivery autogenerated_msg_domain $(primary_domain) bounce { destination postmaster $(local_domains) { deliver_to &local_routing } default_destination { reject 550 5.0.0 "Refusing to send DSNs to non-local addresses" } } }

imap tcp://0.0.0.0:143 { auth &local_authdb storage &local_mailboxes } ''`

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.enable`

Whether to enable Maddy, a free an open source mail server. Type: boolean

Default

false

Example

true

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.ensureAccounts`

List of IMAP accounts which get automatically created. Note that for a complete setup, user credentials for these accounts are required and can be created using the ensureCredentials option. This option does not delete accounts which are not (anymore) listed.

Type: list of string

Default

[ ]

Example

["user1@localhost""user2@localhost"]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.ensureCredentials`

List of user accounts which get automatically created if they don't exist yet. Note that for a complete setup, corresponding mail boxes have to get created using the ensureAccounts option. This option does not delete accounts which are not (anymore) listed.

Type: attribute set of (submodule)

Default

{ }

Example

{"user1@localhost" = {passwordFile = /secrets/user1-localhost;};"user2@localhost" = {passwordFile = /secrets/user2-localhost;};}

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.ensureCredentials.<name>.passwordFile`

Specifies the path to a file containing the clear text password for the user.

Type: path

Default

null

Example

"/path/to/file"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.group`

Group account under which maddy runs.

::: {.note} If left as the default value this group will automatically be created on system activation, otherwise the sysadmin is responsible for ensuring the group exists before the maddy service starts. :::

Type: string

Default

"maddy"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.hostname`

Hostname to use. It should be FQDN.

Type: string

Default

"localhost"

Example

"example.com"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.localDomains`

Define list of allowed domains.

Type: list of string

Default

["$(primary_domain)"]

Example

["$(primary_domain)""example.com""other.example.com"]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.openFirewall`

Open the configured incoming and outgoing mail server ports.

Type: boolean

Default

false

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.primaryDomain`

Primary MX domain to use. It should be FQDN.

Type: string

Default

"localhost"

Example

"mail.example.com"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.secrets`

A list of files containing the various secrets. Should be in the format expected by systemd's EnvironmentFile directory. Secrets can be referenced in the format {env:VAR}.

Type: list of path

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.tls.certificates`

A list of attribute sets containing paths to TLS certificates and keys. Maddy will use SNI if multiple pairs are selected.

Type: list of (submodule)

Default

[ ]

Example

[{keyPath = "/etc/ssl/mx1.example.org.key";certPath = "/etc/ssl/mx1.example.org.crt";}]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.tls.certificates.*.certPath`

Path to the certificate used for TLS.

Type: path

Example

"/etc/ssl/mx1.example.org.crt"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.tls.certificates.*.keyPath`

Path to the private key used for TLS.

Type: path

Example

"/etc/ssl/mx1.example.org.key"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.tls.extraConfig`

Arguments for the specified certificate loader.

In case the tls loader is set, the defaults are considered secure and there is no need to change anything in most cases. For available options see upstream manual.

For ACME configuration, see following page.

Type: null or strings concatenated with "\n"

Default

""

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.tls.loader`

TLS certificates are obtained by modules called "certificate loaders".

The file loader module reads certificates from files specified by the certificates option.

Alternatively the acme module can be used to automatically obtain certificates using the ACME protocol.

Module configuration is done via the tls.extraConfig option.

Secrets such as API keys or passwords should not be supplied in plaintext. Instead the secrets option can be used to read secrets at runtime as environment variables. Secrets can be referenced with {env:VAR}.

Type: null or one of "off", "file", "acme"

Default

"off"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix

`services.maddy.user`

User account under which maddy runs.

::: {.note} If left as the default value this user will automatically be created on system activation, otherwise the sysadmin is responsible for ensuring the user exists before the maddy service starts. :::

Type: string

Default

"maddy"

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/mail/maddy.nix