nixos/stalwart-mail: use upstream systemd unit

nixos/modules/services/mail/stalwart-mail.nix

@@ -76,63 +76,60 @@ in {
       };
     };
 
-    systemd.services.stalwart-mail = {
+    systemd = {
-      wantedBy = [ "multi-user.target" ];
+      packages = [ cfg.package ];
-      after = [ "local-fs.target" "network.target" ];
+      services.stalwart-mail = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "local-fs.target" "network.target" ];
+        preStart = if useLegacyStorage then ''
+          mkdir -p ${dataDir}/{queue,reports,data/blobs}
+        '' else ''
+          mkdir -p ${dataDir}/{queue,reports,db}
+        '';
+        serviceConfig = {
+          ExecStart = [
+            ""
+            "${cfg.package}/bin/stalwart-mail --config=${configFile}"
+          ];
 
-      preStart = if useLegacyStorage then ''
+          StandardOutput = "journal";
-        mkdir -p ${dataDir}/{queue,reports,data/blobs}
+          StandardError = "journal";
-      '' else ''
-        mkdir -p ${dataDir}/{queue,reports,db}
-      '';
 
-      serviceConfig = {
+          StateDirectory = "stalwart-mail";
-        ExecStart =
-          "${cfg.package}/bin/stalwart-mail --config=${configFile}";
 
-        # Base from template resources/systemd/stalwart-mail.service
+          # Bind standard privileged ports
-        Type = "simple";
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        LimitNOFILE = 65536;
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-        KillMode = "process";
-        KillSignal = "SIGINT";
-        Restart = "on-failure";
-        RestartSec = 5;
-        StandardOutput = "journal";
-        StandardError = "journal";
-        SyslogIdentifier = "stalwart-mail";
 
-        User = "stalwart-mail";
+          # Hardening
-        Group = "stalwart-mail";
+          DeviceAllow = [ "" ];
-        StateDirectory = "stalwart-mail";
+          LockPersonality = true;
-
+          MemoryDenyWriteExecute = true;
-        # Bind standard privileged ports
+          PrivateDevices = true;
-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          PrivateUsers = false;  # incompatible with CAP_NET_BIND_SERVICE
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+          ProcSubset = "pid";
-
+          PrivateTmp = true;
-        # Hardening
+          ProtectClock = true;
-        DeviceAllow = [ "" ];
+          ProtectControlGroups = true;
-        LockPersonality = true;
+          ProtectHome = true;
-        MemoryDenyWriteExecute = true;
+          ProtectHostname = true;
-        PrivateDevices = true;
+          ProtectKernelLogs = true;
-        PrivateUsers = false;  # incompatible with CAP_NET_BIND_SERVICE
+          ProtectKernelModules = true;
-        ProcSubset = "pid";
+          ProtectKernelTunables = true;
-        PrivateTmp = true;
+          ProtectProc = "invisible";
-        ProtectClock = true;
+          ProtectSystem = "strict";
-        ProtectControlGroups = true;
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-        ProtectHome = true;
+          RestrictNamespaces = true;
-        ProtectHostname = true;
+          RestrictRealtime = true;
-        ProtectKernelLogs = true;
+          RestrictSUIDSGID = true;
-        ProtectKernelModules = true;
+          SystemCallArchitectures = "native";
-        ProtectKernelTunables = true;
+          SystemCallFilter = [ "@system-service" "~@privileged" ];
-        ProtectProc = "invisible";
+          UMask = "0077";
-        ProtectSystem = "strict";
+        };
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        unitConfig.ConditionPathExists = [
-        RestrictNamespaces = true;
+          ""
-        RestrictRealtime = true;
+          "${configFile}"
-        RestrictSUIDSGID = true;
+        ];
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [ "@system-service" "~@privileged" ];
-        UMask = "0077";
       };
     };