flakes/private/opendmarc/flake.nix

   1 {
   2   inputs.opendmarc = {
   3     url = "path:../../opendmarc";
   4   };
   5   inputs.secrets = {
   6     url = "path:../../secrets";
   7   };
   8   inputs.files-watcher = {
   9     url = "path:../../files-watcher";
  10   };
  11   inputs.my-lib = {
  12     url = "path:../../lib";
  13   };
  14   inputs.nix-lib.url = "github:NixOS/nixpkgs";
  15
  16   description = "Private configuration for opendmarc";
  17   outputs = { self, nix-lib, opendmarc, my-lib, files-watcher, secrets }:
  18     let
  19       cfg = name': { config, lib, pkgs, name, ... }: {
  20         imports = [
  21           (my-lib.lib.withNarKey files-watcher "nixosModule")
  22           (my-lib.lib.withNarKey opendmarc "nixosModule")
  23           (my-lib.lib.withNarKey secrets "nixosModule")
  24         ];
  25         config = lib.mkIf (name == name') {
  26           users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
  27           systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
  28           services.opendmarc = {
  29             enable = true;
  30             socket = "/run/opendmarc/opendmarc.sock";
  31             configFile = pkgs.writeText "opendmarc.conf" ''
  32               AuthservID                  HOSTNAME
  33               FailureReports              false
  34               FailureReportsBcc           postmaster@immae.eu
  35               FailureReportsOnNone        true
  36               FailureReportsSentBy        postmaster@immae.eu
  37               IgnoreAuthenticatedClients  true
  38               IgnoreHosts                 ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
  39               SoftwareHeader              true
  40               SPFIgnoreResults            true
  41               SPFSelfValidate             true
  42               UMask                       002
  43               '';
  44             group = config.services.postfix.group;
  45           };
  46           services.filesWatcher.opendmarc = {
  47             restart = true;
  48             paths = [
  49               config.secrets.fullPaths."opendmarc/ignore.hosts"
  50             ];
  51           };
  52           secrets.keys = {
  53             "opendmarc/ignore.hosts" = {
  54               user = config.services.opendmarc.user;
  55               group = config.services.opendmarc.group;
  56               permissions = "0400";
  57               text = let
  58                 mxes = lib.attrsets.filterAttrs
  59                   (n: v: v.mx.enable)
  60                   config.myEnv.servers;
  61                 in
  62                   builtins.concatStringsSep "\n" ([
  63                     config.myEnv.mail.dmarc.ignore_hosts
  64                   ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
  65             };
  66           };
  67         };
  68       };
  69     in
  70       opendmarc.outputs //
  71       { nixosModules = opendmarc.nixosModules or {} // nix-lib.lib.genAttrs ["eldiron" "backup-2"] cfg; };
  72 }
  73