Add support for storing emails in mailboxes accessible via IMAP
This is a prerequisite for setting up Freescout. Note: this means we need to think about backups for umbriel, which is tracked in https://github.com/NixOS/infra/issues/700.
Jeremy Fleischman committed
Jun 3, 2025 at 13:32 UTC
76934986035adeadde5fcb66781d44ff41b7956a
3 files changed
+26
-14
non-critical-infra/modules/mailserver/mailing-lists-options.nix
+13
-10
@@ -14,10 +14,12 @@ let
14
15
listsWithSecretPlaceholders = lib.mapAttrs' (name: mailingList: {
16
name = name;
17
- value = map (
18
- member:
19
- if builtins.isString member then member else config.sops.placeholder.${fileToSecretId member}
20
- ) mailingList.forwardTo;
17
+ value =
18
+ (lib.optional (mailingList.loginAccount != null && mailingList.loginAccount.storeEmail) name)
19
+ ++ map (
20
+ member:
21
+ if builtins.isString member then member else config.sops.placeholder.${fileToSecretId member}
22
+ ) mailingList.forwardTo;
23
}) config.mailing-lists;
24
25
secretAddressFiles = lib.pipe config.mailing-lists [
@@ -56,6 +58,13 @@ in
58
Must be a path to encrypted file generated with `nix run .#encrypt-email login`
59
'';
60
};
61
+ storeEmail = lib.mkOption {
62
+ type = types.bool;
63
+ description = ''
64
+ Whether to store emails sent to this mailing list in a
65
+ mailbox accessible via IMAP.
66
+ '';
67
+ };
68
};
69
}
70
);
@@ -72,12 +81,6 @@ in
81
};
82
83
config = {
75
- # Disable IMAP. We don't need it, as we don't store email on this server, we
76
- # only forward emails.
77
- mailserver.enableImap = false;
78
- mailserver.enableImapSsl = false;
79
- services.dovecot2.enableImap = false;
80
-
84
mailserver.loginAccounts = lib.pipe config.mailing-lists [
85
(lib.filterAttrs (_name: mailingList: mailingList.loginAccount != null))
86
(lib.mapAttrs (
non-critical-infra/modules/mailserver/mailing-lists.nix
+9
-3
@@ -4,7 +4,7 @@
4
# If you wish to hide your email address, you can encrypt it with SOPS. Just
5
# run `nix run .#encrypt-email address -- --help` and follow the instructions.
6
#
7
- # If you wish to set up a login account for sending email, you must generate
7
+ # If you wish to set up a login account for sending/storing email, you must generate
8
# an encrypted password. Run `nix run .#encrypt-email login -- --help` and
9
# follow the instructions.
10
mailing-lists = {
@@ -66,7 +66,10 @@
66
forwardTo = [
67
../../secrets/mweinelt-email-address.umbriel # https://github.com/mweinelt
68
];
69
- loginAccount.encryptedHashedPassword = ../../secrets/hexa-email-login.umbriel;
69
+ loginAccount = {
70
+ encryptedHashedPassword = ../../secrets/hexa-email-login.umbriel;
71
+ storeEmail = false;
72
+ };
73
};
74
75
"hostmaster@nixos.org" = {
@@ -116,7 +119,10 @@
119
../../secrets/erethon-email-address.umbriel # https://github.com/erethon
120
../../secrets/imincik-email-address.umbriel # https://github.com/imincik
121
];
119
- loginAccount.encryptedHashedPassword = ../../secrets/ngi-nixos-org-email-login.umbriel;
122
+ loginAccount = {
123
+ encryptedHashedPassword = ../../secrets/ngi-nixos-org-email-login.umbriel;
124
+ storeEmail = false;
125
+ };
126
};
127
128
"nixcon@nixos.org" = {
non-critical-infra/packages/encrypt-email/encrypt-email.py
+4
-1
@@ -145,7 +145,10 @@ def login(address_id: str, force: bool) -> None:
145
forwardTo = [
146
# Add emails here
147
];
148
- loginAccount.encryptedHashedPassword = ../../secrets/{address_id}-email-login.umbriel;
148
+ loginAccount = {{
149
+ encryptedHashedPassword = ../../secrets/{address_id}-email-login.umbriel;
150
+ storeEmail = false; # Set to `true` if you want to store email in a mailbox accessible via IMAP.
151
+ }};
152
}};
153
"""
154
)