hinterland/hearth
2
2
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: ente: smpt increase security level

Browse Source
This commit is contained in:
yukkop
2026-06-06 15:34:47 +00:00
parent e04b7e11da
commit 2856ca1d98
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/module/hectic/service/mailserver.nix
+12 -2
View File
@@ -56,8 +56,18 @@ in {
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
}; };
# NOTE(yukkop): avoid Gmail rejection due to missing IPv6 PTR records services.postfix.settings.main = {
services.postfix.settings.main.inet_protocols = lib.mkDefault "ipv4"; # NOTE(yukkop): avoid Gmail rejection due to missing IPv6 PTR records.
inet_protocols = lib.mkDefault "ipv4";
# NOTE(yukkop): nixos-mailserver enables DANE by default. Some large MXes
# currently fail certificate verification under this policy, which leaves
# otherwise valid transactional mail deferred in the queue. Keep STARTTLS
# opportunistic for outbound delivery rather than blocking mail entirely.
smtp_tls_security_level = lib.mkForce "may";
smtp_dns_support_level = lib.mkForce "enabled";
smtp_tls_policy_maps = lib.mkForce "";
};
security.acme.acceptTerms = true; security.acme.acceptTerms = true;
security.acme.defaults.email = "security@" + cfg.domain; security.acme.defaults.email = "security@" + cfg.domain;