From 2856ca1d98f4ba07f889d22ad5cd4bb75800b540 Mon Sep 17 00:00:00 2001 From: yukkop Date: Sat, 6 Jun 2026 15:34:47 +0000 Subject: [PATCH] feat: `ente`: smpt increase security level --- nixos/module/hectic/service/mailserver.nix | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/nixos/module/hectic/service/mailserver.nix b/nixos/module/hectic/service/mailserver.nix index 280a2987..18c64618 100644 --- a/nixos/module/hectic/service/mailserver.nix +++ b/nixos/module/hectic/service/mailserver.nix @@ -56,8 +56,18 @@ in { certificateScheme = "acme-nginx"; }; - # NOTE(yukkop): avoid Gmail rejection due to missing IPv6 PTR records - services.postfix.settings.main.inet_protocols = lib.mkDefault "ipv4"; + services.postfix.settings.main = { + # NOTE(yukkop): avoid Gmail rejection due to missing IPv6 PTR records. + inet_protocols = lib.mkDefault "ipv4"; + + # NOTE(yukkop): nixos-mailserver enables DANE by default. Some large MXes + # currently fail certificate verification under this policy, which leaves + # otherwise valid transactional mail deferred in the queue. Keep STARTTLS + # opportunistic for outbound delivery rather than blocking mail entirely. + smtp_tls_security_level = lib.mkForce "may"; + smtp_dns_support_level = lib.mkForce "enabled"; + smtp_tls_policy_maps = lib.mkForce ""; + }; security.acme.acceptTerms = true; security.acme.defaults.email = "security@" + cfg.domain;