nixos/gitea/mailer: fix using sendmail

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -92,6 +92,8 @@
 
 - `services.dnscrypt-proxy2` gains a `package` option to specify dnscrypt-proxy package to use.
 
+- `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
+
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 

nixos/modules/services/misc/gitea.nix

@@ -366,6 +366,15 @@ in
         description = "Path to a file containing the SMTP password.";
       };
 
+      mailerUseSendmail = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Use the operating system's sendmail command instead of SMTP.
+          Note: some sandbox settings will be disabled.
+        '';
+      };
+
       metricsTokenFile = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -652,9 +661,15 @@ in
           })
         ]);
 
-        mailer = mkIf (cfg.mailerPasswordFile != null) {
-          PASSWD = "#mailerpass#";
-        };
+        mailer = mkMerge [
+          (mkIf (cfg.mailerPasswordFile != null) {
+            PASSWD = "#mailerpass#";
+          })
+          (mkIf cfg.mailerUseSendmail {
+            PROTOCOL = "sendmail";
+            SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
+          })
+        ];
 
         metrics = mkIf (cfg.metricsTokenFile != null) {
           TOKEN = "#metricstoken#";
@@ -867,18 +882,18 @@ in
           cfg.repositoryRoot
           cfg.stateDir
           cfg.lfs.contentDir
-        ];
+        ] ++ optional cfg.mailerUseSendmail "/var/lib/postfix/queue/maildrop";
         UMask = "0027";
         # Capabilities
         CapabilityBoundingSet = "";
         # Security
-        NoNewPrivileges = true;
+        NoNewPrivileges = optional (!cfg.mailerUseSendmail) true;
         # Sandboxing
         ProtectSystem = "strict";
         ProtectHome = true;
         PrivateTmp = true;
         PrivateDevices = true;
-        PrivateUsers = true;
+        PrivateUsers = optional (!cfg.mailerUseSendmail) true;
         ProtectHostname = true;
         ProtectClock = true;
         ProtectKernelTunables = true;
@@ -889,7 +904,7 @@ in
           "AF_UNIX"
           "AF_INET"
           "AF_INET6"
-        ];
+        ] ++ optional cfg.mailerUseSendmail "AF_NETLINK";
         RestrictNamespaces = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
@@ -900,9 +915,9 @@ in
         # System Call Filtering
         SystemCallArchitectures = "native";
         SystemCallFilter = [
-          "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"
+          "~@cpu-emulation @debug @keyring @mount @obsolete @setuid"
           "setrlimit"
-        ];
+        ] ++ optional (!cfg.mailerUseSendmail) "~@privileged";
       };
 
       environment = {
@@ -978,6 +993,7 @@ in
       timerConfig.OnCalendar = cfg.dump.interval;
     };
   };
+
   meta.maintainers = with lib.maintainers; [
     ma27
     techknowlogick