From 615fa25cfcc1264a96506f48a3e60743845ccf22 Mon Sep 17 00:00:00 2001
From: Kopatz <7265381+Kropatz@users.noreply.github.com>
Date: Thu, 9 Oct 2025 10:56:08 +0200
Subject: [PATCH] ssl on dovecot

---
 systems/amd-server-vm/mail.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/systems/amd-server-vm/mail.nix b/systems/amd-server-vm/mail.nix
index db8b5d1..b398f46 100644
--- a/systems/amd-server-vm/mail.nix
+++ b/systems/amd-server-vm/mail.nix
@@ -153,10 +153,18 @@ in
       }
       mail_location = maildir:/data/vmail/${email-domain}/%n
 
-      ssl = no
-      disable_plaintext_auth = no
+      #ssl = no
+      #disable_plaintext_auth = no
       auth_mechanisms = plain
 
+      #https://doc.dovecot.org/2.3/configuration_manual/dovecot_ssl_configuration/#dovecot-ssl-configuration
+      disable_plaintext_auth = yes
+      ssl = required
+      ssl_key = </var/lib/acme/${email-domain}/key.pem 
+      ssl_cert = </var/lib/acme/${email-domain}/cert.pem
+      ssl_prefer_server_ciphers = yes
+      ssl_cipher_list = HIGH
+
       service auth {
         unix_listener /var/lib/postfix/queue/private/auth {
           group = postfix