1 { lib, pkgs, config, ... }:
3 options.myServices.mail.milters.sockets = lib.mkOption {
4 type = lib.types.attrsOf lib.types.path;
6 opendkim = "/run/opendkim/opendkim.sock";
7 opendmarc = "/run/opendmarc/opendmarc.sock";
8 openarc = "/run/openarc/openarc.sock";
15 config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
18 dest = "opendkim/eldiron.private";
19 user = config.services.opendkim.user;
20 group = config.services.opendkim.group;
22 text = config.myEnv.mail.dkim.eldiron.private;
25 dest = "opendkim/eldiron.txt";
26 user = config.services.opendkim.user;
27 group = config.services.opendkim.group;
30 eldiron._domainkey IN TXT ${config.myEnv.mail.dkim.eldiron.public}'';
33 dest = "opendmarc/ignore.hosts";
34 user = config.services.opendmarc.user;
35 group = config.services.opendmarc.group;
38 mxes = lib.attrsets.filterAttrs
42 builtins.concatStringsSep "\n" ([
43 config.myEnv.mail.dmarc.ignore_hosts
44 ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
47 users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
50 socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
51 domains = builtins.concatStringsSep "," (lib.flatten (map
53 (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
54 (zone.withEmail or [])
56 config.myEnv.dns.masterZones
58 keyPath = "${config.secrets.location}/opendkim";
60 configFile = pkgs.writeText "opendkim.conf" ''
65 group = config.services.postfix.group;
67 systemd.services.opendkim.serviceConfig.Slice = "mail.slice";
68 systemd.services.opendkim.preStart = lib.mkBefore ''
69 # Skip the prestart script as keys are handled in secrets
72 services.filesWatcher.opendkim = {
75 config.secrets.fullPaths."opendkim/eldiron.private"
79 users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
80 systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
81 services.opendmarc = {
83 socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
84 configFile = pkgs.writeText "opendmarc.conf" ''
87 FailureReportsBcc postmaster@immae.eu
88 FailureReportsOnNone true
89 FailureReportsSentBy postmaster@immae.eu
90 IgnoreAuthenticatedClients true
91 IgnoreHosts ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
97 group = config.services.postfix.group;
99 services.filesWatcher.opendmarc = {
102 config.secrets.fullPaths."opendmarc/ignore.hosts"
109 socket = "local:${config.myServices.mail.milters.sockets.openarc}";
110 group = config.services.postfix.group;
111 configFile = pkgs.writeText "openarc.conf" ''
112 AuthservID mail.immae.eu
114 KeyFile ${config.secrets.fullPaths."opendkim/eldiron.private"}
121 systemd.services.openarc.serviceConfig.Slice = "mail.slice";
122 systemd.services.openarc.postStart = lib.optionalString
123 (lib.strings.hasPrefix "local:" config.services.openarc.socket) ''
124 while [ ! -S ${lib.strings.removePrefix "local:" config.services.openarc.socket} ]; do
127 chmod g+w ${lib.strings.removePrefix "local:" config.services.openarc.socket}
129 services.filesWatcher.openarc = {
132 config.secrets.fullPaths."opendkim/eldiron.private"
136 systemd.services.milter_verify_from = {
137 description = "Verify from milter";
138 after = [ "network.target" ];
139 wantedBy = [ "multi-user.target" ];
142 Slice = "mail.slice";
145 ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
146 in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
147 RuntimeDirectory = "milter_verify_from";