From dfa130e828fc1612621802c83618685a5b6dfe92 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 22 May 2024 12:23:36 +0200
Subject: [PATCH 1/2] nixos/stalwart-mail: use upstream systemd unit

---
 nixos/modules/services/mail/stalwart-mail.nix | 103 +++++++++---------
 1 file changed, 50 insertions(+), 53 deletions(-)

diff --git a/nixos/modules/services/mail/stalwart-mail.nix b/nixos/modules/services/mail/stalwart-mail.nix
index 477660e454b8..6a0725f32808 100644
--- a/nixos/modules/services/mail/stalwart-mail.nix
+++ b/nixos/modules/services/mail/stalwart-mail.nix
@@ -76,63 +76,60 @@ in {
       };
     };
 
-    systemd.services.stalwart-mail = {
-      wantedBy = [ "multi-user.target" ];
-      after = [ "local-fs.target" "network.target" ];
+    systemd = {
+      packages = [ cfg.package ];
+      services.stalwart-mail = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "local-fs.target" "network.target" ];
+        preStart = if useLegacyStorage then ''
+          mkdir -p ${dataDir}/{queue,reports,data/blobs}
+        '' else ''
+          mkdir -p ${dataDir}/{queue,reports,db}
+        '';
+        serviceConfig = {
+          ExecStart = [
+            ""
+            "${cfg.package}/bin/stalwart-mail --config=${configFile}"
+          ];
 
-      preStart = if useLegacyStorage then ''
-        mkdir -p ${dataDir}/{queue,reports,data/blobs}
-      '' else ''
-        mkdir -p ${dataDir}/{queue,reports,db}
-      '';
+          StandardOutput = "journal";
+          StandardError = "journal";
 
-      serviceConfig = {
-        ExecStart =
-          "${cfg.package}/bin/stalwart-mail --config=${configFile}";
+          StateDirectory = "stalwart-mail";
 
-        # Base from template resources/systemd/stalwart-mail.service
-        Type = "simple";
-        LimitNOFILE = 65536;
-        KillMode = "process";
-        KillSignal = "SIGINT";
-        Restart = "on-failure";
-        RestartSec = 5;
-        StandardOutput = "journal";
-        StandardError = "journal";
-        SyslogIdentifier = "stalwart-mail";
+          # Bind standard privileged ports
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
 
-        User = "stalwart-mail";
-        Group = "stalwart-mail";
-        StateDirectory = "stalwart-mail";
-
-        # Bind standard privileged ports
-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-
-        # Hardening
-        DeviceAllow = [ "" ];
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        PrivateDevices = true;
-        PrivateUsers = false;  # incompatible with CAP_NET_BIND_SERVICE
-        ProcSubset = "pid";
-        PrivateTmp = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [ "@system-service" "~@privileged" ];
-        UMask = "0077";
+          # Hardening
+          DeviceAllow = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          PrivateDevices = true;
+          PrivateUsers = false;  # incompatible with CAP_NET_BIND_SERVICE
+          ProcSubset = "pid";
+          PrivateTmp = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "@system-service" "~@privileged" ];
+          UMask = "0077";
+        };
+        unitConfig.ConditionPathExists = [
+          ""
+          "${configFile}"
+        ];
       };
     };
 

From 336232debdc95311595c1ce56ef8690dcd334eda Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 22 May 2024 12:30:53 +0200
Subject: [PATCH 2/2] stalwart-mail: package upstream systemd unit

---
 nixos/modules/services/mail/stalwart-mail.nix | 2 ++
 pkgs/by-name/st/stalwart-mail/package.nix     | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/nixos/modules/services/mail/stalwart-mail.nix b/nixos/modules/services/mail/stalwart-mail.nix
index 6a0725f32808..ed3c5389354c 100644
--- a/nixos/modules/services/mail/stalwart-mail.nix
+++ b/nixos/modules/services/mail/stalwart-mail.nix
@@ -81,11 +81,13 @@ in {
       services.stalwart-mail = {
         wantedBy = [ "multi-user.target" ];
         after = [ "local-fs.target" "network.target" ];
+
         preStart = if useLegacyStorage then ''
           mkdir -p ${dataDir}/{queue,reports,data/blobs}
         '' else ''
           mkdir -p ${dataDir}/{queue,reports,db}
         '';
+
         serviceConfig = {
           ExecStart = [
             ""
diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 68e0d97bebb5..5ef0a24af0be 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -62,6 +62,13 @@ rustPlatform.buildRustPackage {
     ROCKSDB_LIB_DIR = "${rocksdb}/lib";
   };
 
+  postInstall = ''
+    mkdir -p $out/lib/systemd/system
+
+    substitute resources/systemd/stalwart-mail.service $out/lib/systemd/system/stalwart-mail.service \
+      --replace "__PATH__" "$out"
+  '';
+
   # Tests require reading to /etc/resolv.conf
   doCheck = false;