1 { lib, pkgs, config, myconfig, ... }:
3 options.myServices.mail.milters.sockets = lib.mkOption {
4 type = lib.types.attrsOf lib.types.path;
6 opendkim = "/run/opendkim/opendkim.sock";
7 opendmarc = "/run/opendmarc/opendmarc.sock";
8 openarc = "/run/openarc/openarc.sock";
15 config.secrets.keys = [
17 dest = "opendkim/eldiron.private";
18 user = config.services.opendkim.user;
19 group = config.services.opendkim.group;
21 text = myconfig.env.mail.dkim.eldiron.private;
24 dest = "opendkim/eldiron.txt";
25 user = config.services.opendkim.user;
26 group = config.services.opendkim.group;
29 eldiron._domainkey IN TXT ${myconfig.env.mail.dkim.eldiron.public}'';
32 dest = "opendmarc/ignore.hosts";
33 user = config.services.opendmarc.user;
34 group = config.services.opendmarc.group;
36 text = myconfig.env.mail.dmarc.ignore_hosts;
39 config.users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
40 config.services.opendkim = {
42 socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
43 domains = builtins.concatStringsSep "," (lib.flatten (map
45 (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
46 (zone.withEmail or [])
48 myconfig.env.dns.masterZones
50 keyPath = "${config.secrets.location}/opendkim";
52 configFile = pkgs.writeText "opendkim.conf" ''
56 group = config.services.postfix.group;
58 config.systemd.services.opendkim.preStart = lib.mkBefore ''
59 # Skip the prestart script as keys are handled in secrets
62 config.services.filesWatcher.opendkim = {
65 config.secrets.fullPaths."opendkim/eldiron.private"
69 config.users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
70 config.services.opendmarc = {
72 socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
73 configFile = pkgs.writeText "opendmarc.conf" ''
76 FailureReportsBcc postmaster@localhost.immae.eu
77 FailureReportsOnNone true
78 FailureReportsSentBy postmaster@immae.eu
79 IgnoreAuthenticatedClients true
80 IgnoreHosts ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
83 TrustedAuthservIDs HOSTNAME, immae.eu, nef2.ens.fr
86 group = config.services.postfix.group;
88 config.services.filesWatcher.opendmarc = {
91 config.secrets.fullPaths."opendmarc/ignore.hosts"
95 config.services.openarc = {
98 socket = "local:${config.myServices.mail.milters.sockets.openarc}";
99 group = config.services.postfix.group;
100 configFile = pkgs.writeText "openarc.conf" ''
101 AuthservID mail.immae.eu
103 KeyFile ${config.secrets.fullPaths."opendkim/eldiron.private"}
110 config.systemd.services.openarc.postStart = lib.optionalString
111 (lib.strings.hasPrefix "local:" config.services.openarc.socket) ''
112 while [ ! -S ${lib.strings.removePrefix "local:" config.services.openarc.socket} ]; do
115 chmod g+w ${lib.strings.removePrefix "local:" config.services.openarc.socket}
117 config.services.filesWatcher.openarc = {
120 config.secrets.fullPaths."opendkim/eldiron.private"