From bd90edf157959760bddc38e8cd96c6e67eed347b Mon Sep 17 00:00:00 2001
From: encode42 <me@encode42.dev>
Date: Sat, 1 Nov 2025 02:09:50 -0400
Subject: [PATCH] Create MTA-STS snippet, split autoconfig into own module

---
 hosts/index/config/groupware/maddy.nix | 12 +--------
 packages/server/groupware/maddy.nix    | 26 +++++++++++++++++---
 packages/server/groupware/mta-sts.nix  | 34 ++++++++++++++++++++++++++
 3 files changed, 58 insertions(+), 14 deletions(-)
 create mode 100644 packages/server/groupware/mta-sts.nix

diff --git a/hosts/index/config/groupware/maddy.nix b/hosts/index/config/groupware/maddy.nix
index d1f4f51..7bb7051 100644
--- a/hosts/index/config/groupware/maddy.nix
+++ b/hosts/index/config/groupware/maddy.nix
@@ -7,23 +7,13 @@ let
     inherit domain;
 
     email = "postmaster@${domain}";
-  };
-
-  autoconfigModule = import (flakeRoot + /packages/server/groupware/autoconfig.nix) {
-    inherit domain;
 
-    hosts = [
-      {
-        name = "autoconfig.${domain}";
-        ssl = "cloudflare";
-      }
-    ];
+    ssl = "cloudflare";
   };
 in
 {
   imports = [
     maddyModule
-    autoconfigModule
   ];
 
   services.maddy = {
diff --git a/packages/server/groupware/maddy.nix b/packages/server/groupware/maddy.nix
index c34edf3..5d036e3 100644
--- a/packages/server/groupware/maddy.nix
+++ b/packages/server/groupware/maddy.nix
@@ -1,14 +1,34 @@
-{ domain, email }:
-
-{ config, ... }:
+{
+  domain,
+  email,
+  ssl,
+}:
 
 let
   subdomain = "mx.${domain}";
+
+  tlsModule = import ./mta-sts.nix {
+    inherit domain ssl;
+  };
+
+  autoconfigModule = import ./autoconfig.nix {
+    inherit domain;
+
+    hosts = [
+      {
+        name = "autoconfig.${domain}";
+        ssl = "cloudflare";
+      }
+    ];
+  };
 in
 {
   imports = [
     ../databases/postgresql.nix
     ./rspamd.nix
+
+    tlsModule
+    autoconfigModule
   ];
 
   services.postgresql = {
diff --git a/packages/server/groupware/mta-sts.nix b/packages/server/groupware/mta-sts.nix
new file mode 100644
index 0000000..7e692a5
--- /dev/null
+++ b/packages/server/groupware/mta-sts.nix
@@ -0,0 +1,34 @@
+{ domain, ssl }:
+
+{ pkgs, flakeLib, ... }:
+
+let
+  tlsDomain = "mta-sts.${domain}";
+in
+{
+  services.caddy.virtualHosts =
+    flakeLib.mkProxies
+      [
+        {
+          name = tlsDomain;
+
+          inherit ssl;
+        }
+      ]
+      ''
+        file_server
+
+        root * ${
+          pkgs.runCommand "testdir" { } ''
+            mkdir -p "$out/.well-known"
+
+            echo "
+              version: STSv1
+              mode: enforce
+              max_age: 604800
+              mx: ${tlsDomain}
+            " > "$out/.well-known/mta-sts.txt"
+          ''
+        }
+      '';
+}
-- 
2.54.0