NixMailTemplate

Mail-on-NixOS template (postfix + dovecot + roundcube + opendkim + nginx). Emits config matching the host.mail.* option shape from nixos/modules/services/mail.nix.

public sealed class NixMailTemplate : NixHostTemplate

1. Properties

1.1. AuthorizedKeys

Authorized SSH public keys (one per line).

public IReadOnlyList<string> AuthorizedKeys { get; set; }

1.2. CustomerDomain

Customer mail domain (e.g. "test01.laufentaler.free"). Required.

public string CustomerDomain { get; set; }

1.3. DiskDevice

Install-target block device (e.g. /dev/sda, /dev/vda).

public string DiskDevice { get; set; }

1.4. DnsLanIp

LAN IP of the dns VM used as resolver for outbound MX lookups. Empty ⇒ 1.1.1.1 fallback only.

public string DnsLanIp { get; set; }

1.5. Gateway

Default gateway for static IPv4. Auto-derived from StaticIPv4 (.1) when null.

public string Gateway { get; set; }

1.6. Hostname

Target hostname.

public MachineName Hostname { get; set; }

1.7. Mailboxes

Per-user mailboxes. One entry per real employee; the nix module emits postfix virtual aliases (${name}@${domain} -> ${name}) and a dovecot passwd-file with the inlined password. Empty list = no users; module still applies, postfix virtual + dovecot passdb are empty.

public List<NixMailMailbox> Mailboxes { get; set; }

1.8. Nameservers

DNS servers used with static IPv4. Default falls back to gateway.

public IReadOnlyList<string> Nameservers { get; set; }

1.9. Password

Initial password applied to root + admin user (users.users.<name>.initialPassword). Defaults to the central NETSetup admin password so SSH key auth and console login both work with the same value across Windows/Nix/PMG provisioning.

public string Password { get; set; }

1.10. PmgLanIp

LAN IP of the PMG LXC for source-restricted port-26 acceptance. Empty ⇒ default 10.0.0.0/24.

public string PmgLanIp { get; set; }

1.11. RecommendedCpuCores

Recommended runtime vCPU count. Default 2 (mail/dns/generic). Nextcloud overrides to 4 because php-fpm + nix-install closure builds saturate fewer cores.

public virtual uint RecommendedCpuCores { get; }

1.12. RecommendedDiskGib

Recommended VM disk size in GiB. Nextcloud needs ~256 (closure build space); dns/mail/pmg fit comfortably in 32. Default 32; concrete templates override.

public virtual int RecommendedDiskGib { get; }

1.13. RecommendedMemoryGib

Recommended runtime RAM in GiB. Default 8. Nextcloud and IPFS keep the same value explicitly (php-fpm / the ipfs daemon need the headroom at runtime as well).

public virtual int RecommendedMemoryGib { get; }

1.14. RecommendedSwapMib

Steady-state swapfile size in MiB written to /var/swapfile. Default 8192 (8 GiB). Tight RAM (Mail/Dns at 2 GiB) makes runtime OOM likely under load — swap is slow but keeps services alive. Nextcloud overrides to 16 GiB given larger working set.

public virtual int RecommendedSwapMib { get; }

1.15. Relay

Optional smarthost relay. Null ⇒ postfix does direct MX lookup.

public MailRelayOptions Relay { get; set; }

1.16. StaticIPv4

Static IPv4 to assign to the primary NIC (e.g. "192.168.1.183"). Null/empty → DHCP.

public string StaticIPv4 { get; set; }

1.17. StaticIPv4Prefix

Static IPv4 prefix length when StaticIPv4 is set. Default /24.

public int StaticIPv4Prefix { get; set; }

1.18. TimeZone

IANA time zone.

public string TimeZone { get; set; }

1.19. TrustedNetworks

Extra CIDRs appended to postfix mynetworks (in addition to the built-in 127.0.0.0/8
[::1]/128 + PmgLanIp CIDR). The PMG LXC /32 must be here when 25/tcp arrives via the DNS-VM Traefik passthrough so PMG’s submission to mail VM :25 is accepted without authentication. Order preserved; values inserted verbatim into the nix list.

public IReadOnlyList<string> TrustedNetworks { get; set; }

1.20. UserName

Default admin user.

public string UserName { get; set; }

2. Methods

2.1. GenerateDefaultNix()

Host default.nix content. Concrete per template.

public override string GenerateDefaultNix()

Returns: string

2.2. GenerateFlakeNix()

flake.nix for this host.

public virtual string GenerateFlakeNix()

Returns: string

2.3. GenerateHardwareNix()

hardware.nix for this host.

public virtual string GenerateHardwareNix()

Returns: string

2.4. GenerateStaticNetworkBlock()

Returns the network nix snippet — ALWAYS emits host.system.network.dhcp.enable so individual templates must NOT repeat it (NixOS module eval treats duplicate attribute definitions within the same {} body as an "already defined" error, even when one is mkDefault and the other mkForce — priority modifiers only resolve cross-module conflicts, not intra-set duplicates). Emits the static-IPv4 block additionally when StaticIPv4 is set.

protected string GenerateStaticNetworkBlock()

Returns: string

2.5. GetRequiredSecrets(NETSetupConfig)

Extra sops secrets this template requires in the per-VM secrets.yaml (beyond the always-emitted luks password). Base returns none; concrete templates (e.g. NixIpfsTemplate) override to contribute nested/multiline entries.

public virtual IReadOnlyList<NixSecretEntry> GetRequiredSecrets(NETSetupConfig config)

Table 1. Parameters
Name	Type	Description
config	NETSetupConfig

Returns: IReadOnlyList<NixSecretEntry>