1 { lib, pkgs, config, nodes, name, ... }:
3 config = lib.mkIf config.myServices.mailBackup.enable {
4 security.acme2.certs."mail" = config.myServices.certificates.certConfig // {
6 systemctl restart postfix.service
8 domain = config.hostEnv.fqdn;
10 zonesWithMx = builtins.filter (zone:
11 lib.attrsets.hasAttr "withEmail" zone && lib.lists.length zone.withEmail > 0
12 ) config.myEnv.dns.masterZones;
13 mxs = map (zone: "${config.myEnv.servers."${name}".mx.subdomain}.${zone.name}") zonesWithMx;
14 in builtins.listToAttrs (map (mx: lib.attrsets.nameValuePair mx null) mxs);
18 dest = "postfix/mysql_alias_maps";
19 user = config.services.postfix.user;
20 group = config.services.postfix.group;
23 # We need to specify that option to trigger ssl connection
25 user = ${config.myEnv.mail.postfix.mysql.user}
26 password = ${config.myEnv.mail.postfix.mysql.password}
27 hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
28 dbname = ${config.myEnv.mail.postfix.mysql.database}
29 query = SELECT DISTINCT 1
30 FROM forwardings_merge
32 ((regex = 1 AND '%s' REGEXP CONCAT('^',source,'$') ) OR (regex = 0 AND source = '%s'))
37 FROM forwardings_blacklisted
40 SELECT 'devnull@immae.eu'
41 FROM forwardings_blacklisted
46 dest = "postfix/mysql_mailbox_maps";
47 user = config.services.postfix.user;
48 group = config.services.postfix.group;
51 # We need to specify that option to trigger ssl connection
53 user = ${config.myEnv.mail.postfix.mysql.user}
54 password = ${config.myEnv.mail.postfix.mysql.password}
55 hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
56 dbname = ${config.myEnv.mail.postfix.mysql.database}
57 query = SELECT DISTINCT 1
61 (domain = '%d' AND user = '%u' AND regex = 0)
64 AND '%d' REGEXP CONCAT('^',domain,'$')
65 AND '%u' REGEXP CONCAT('^',user,'$')
72 dest = "postfix/ldap_ejabberd_users_immae_fr";
73 user = config.services.postfix.user;
74 group = config.services.postfix.group;
77 server_host = ldaps://${config.myEnv.jabber.ldap.host}:636
78 search_base = ${config.myEnv.jabber.ldap.base}
79 query_filter = ${config.myEnv.jabber.postfix_user_filter}
81 bind_dn = ${config.myEnv.jabber.ldap.dn}
82 bind_pw = ${config.myEnv.jabber.ldap.password}
83 result_attribute = immaeXmppUid
84 result_format = ejabberd@localhost
90 networking.firewall.allowedTCPPorts = [ 25 ];
92 nixpkgs.overlays = [ (self: super: {
93 postfix = super.postfix.override { withMySQL = true; };
95 users.users."${config.services.postfix.user}".extraGroups = [ "keys" ];
96 services.filesWatcher.postfix = {
99 config.secrets.fullPaths."postfix/mysql_alias_maps"
100 config.secrets.fullPaths."postfix/mysql_mailbox_maps"
101 config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"
107 name = n: i: "relay_${n}_${toString i}";
108 pair = n: i: m: lib.attrsets.nameValuePair (name n i) (
110 then pkgs.writeText (name n i) m.content
113 pairs = n: v: lib.imap1 (i: m: pair n i m) v.recipient_maps;
114 in lib.attrsets.filterAttrs (k: v: v != null) (
115 lib.attrsets.listToAttrs (lib.flatten (
116 lib.attrsets.mapAttrsToList pairs config.myEnv.mail.postfix.backup_domains
119 relay_restrictions = lib.attrsets.filterAttrs (k: v: v != null) (
120 lib.attrsets.mapAttrs' (n: v:
121 lib.attrsets.nameValuePair "recipient_access_${n}" (
122 if lib.attrsets.hasAttr "relay_restrictions" v
123 then pkgs.writeText "recipient_access_${n}" v.relay_restrictions
126 ) config.myEnv.mail.postfix.backup_domains
130 cfg = config.myEnv.monitoring.email_check.eldiron;
131 address = "${cfg.mail_address}@${cfg.mail_domain}";
132 in pkgs.writeText "postfix-virtual" (
133 builtins.concatStringsSep "\n" (
135 lib.attrsets.mapAttrsToList (
136 n: v: lib.optionalString v.external ''
137 script_${n}@mail.immae.eu 1
139 ) config.myEnv.mail.scripts
144 host_dummy_mailboxes = pkgs.writeText "host-virtual-mailbox"
145 (builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (n: v: "${n}@immae.eu 1") nodes));
148 recipient_maps // relay_restrictions // virtual_map // sasl_access;
150 ### postfix module overrides
151 readme_directory = "${pkgs.postfix}/share/postfix/doc";
152 smtp_tls_CAfile = lib.mkForce "";
153 smtp_tls_cert_file = lib.mkForce "";
154 smtp_tls_key_file = lib.mkForce "";
156 message_size_limit = "1073741824"; # Don't put 0 here, it's not equivalent to "unlimited"
157 mailbox_size_limit = "1073741825"; # Workaround, local delivered mails should all go through scripts
158 alias_database = "\$alias_maps";
162 backups = lib.flatten (lib.attrsets.mapAttrsToList (n: v: v.domains or []) config.myEnv.mail.postfix.backup_domains);
163 virtual_domains = config.myEnv.mail.postfix.additional_mailbox_domains
164 ++ lib.remove null (lib.flatten (map
167 then "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}"
170 (zone.withEmail or [])
172 config.myEnv.dns.masterZones
175 backups ++ virtual_domains;
176 relay_recipient_maps = let
177 backup_recipients = lib.flatten (lib.attrsets.mapAttrsToList (n: v:
178 lib.imap1 (i: m: "${m.type}:/etc/postfix/relay_${n}_${toString i}") v.recipient_maps
179 ) config.myEnv.mail.postfix.backup_domains);
180 virtual_alias_maps = [
181 "hash:/etc/postfix/virtual"
182 "mysql:${config.secrets.fullPaths."postfix/mysql_alias_maps"}"
183 "ldap:${config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"}"
185 virtual_mailbox_maps = [
186 "hash:/etc/postfix/host_dummy_mailboxes"
187 "mysql:${config.secrets.fullPaths."postfix/mysql_mailbox_maps"}"
190 backup_recipients ++ virtual_alias_maps ++ virtual_mailbox_maps;
191 smtpd_relay_restrictions = [
192 "defer_unauth_destination"
193 ] ++ lib.flatten (lib.attrsets.mapAttrsToList (n: v:
194 if lib.attrsets.hasAttr "relay_restrictions" v
195 then [ "check_recipient_access hash:/etc/postfix/recipient_access_${n}" ]
197 ) config.myEnv.mail.postfix.backup_domains);
199 ### Additional smtpd configuration
200 smtpd_tls_received_header = "yes";
201 smtpd_tls_loglevel = "1";
203 ### Email sending configuration
204 smtp_tls_security_level = "may";
205 smtp_tls_loglevel = "1";
207 ### Force ip bind for smtp
208 smtp_bind_address = config.myEnv.servers."${name}".ips.main.ip4;
209 smtp_bind_address6 = builtins.head config.myEnv.servers."${name}".ips.main.ip6;
212 "unix:${config.myServices.mail.milters.sockets.opendkim}"
213 "unix:${config.myServices.mail.milters.sockets.openarc}"
214 "unix:${config.myServices.mail.milters.sockets.opendmarc}"
219 enableSubmission = false;
220 destination = ["localhost"];
221 # This needs to reverse DNS
222 hostname = config.hostEnv.fqdn;
224 sslCert = "/var/lib/acme/mail/fullchain.pem";
225 sslKey = "/var/lib/acme/mail/key.pem";
226 recipientDelimiter = "+";