1 { lib, pkgs, config, nodes, name, ... }:
3 config = lib.mkIf config.myServices.mailBackup.enable {
4 security.acme.certs."mail" = config.myServices.certificates.certConfig // {
6 systemctl restart postfix.service
8 domain = config.hostEnv.fqdn;
10 zonesWithMx = builtins.filter (zone:
11 lib.attrsets.hasAttr "withEmail" zone && lib.lists.length zone.withEmail > 0
12 ) config.myEnv.dns.masterZones;
13 mxs = map (zone: "${config.myEnv.servers."${name}".mx.subdomain}.${zone.name}") zonesWithMx;
14 in builtins.listToAttrs (map (mx: lib.attrsets.nameValuePair mx null) mxs);
18 dest = "postfix/mysql_alias_maps";
19 user = config.services.postfix.user;
20 group = config.services.postfix.group;
23 # We need to specify that option to trigger ssl connection
25 user = ${config.myEnv.mail.postfix.mysql.user}
26 password = ${config.myEnv.mail.postfix.mysql.password}
27 hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
28 dbname = ${config.myEnv.mail.postfix.mysql.database}
29 query = SELECT DISTINCT 1
32 ((regex = 1 AND '%s' REGEXP CONCAT('^',source,'$') ) OR (regex = 0 AND source = '%s'))
37 FROM forwardings_blacklisted
40 SELECT 'devnull@immae.eu'
41 FROM forwardings_blacklisted
46 dest = "postfix/mysql_mailbox_maps";
47 user = config.services.postfix.user;
48 group = config.services.postfix.group;
51 # We need to specify that option to trigger ssl connection
53 user = ${config.myEnv.mail.postfix.mysql.user}
54 password = ${config.myEnv.mail.postfix.mysql.password}
55 hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
56 dbname = ${config.myEnv.mail.postfix.mysql.database}
57 query = SELECT DISTINCT 1
61 (domain = '%d' AND user = '%u' AND regex = 0)
64 AND '%d' REGEXP CONCAT('^',domain,'$')
65 AND '%u' REGEXP CONCAT('^',user,'$')
72 dest = "postfix/ldap_ejabberd_users_immae_fr";
73 user = config.services.postfix.user;
74 group = config.services.postfix.group;
77 server_host = ldaps://${config.myEnv.jabber.ldap.host}:636
78 search_base = ${config.myEnv.jabber.ldap.base}
79 query_filter = ${config.myEnv.jabber.postfix_user_filter}
81 bind_dn = ${config.myEnv.jabber.ldap.dn}
82 bind_pw = ${config.myEnv.jabber.ldap.password}
83 result_attribute = immaeXmppUid
84 result_format = ejabberd@localhost
90 networking.firewall.allowedTCPPorts = [ 25 ];
92 users.users."${config.services.postfix.user}".extraGroups = [ "keys" ];
93 services.filesWatcher.postfix = {
96 config.secrets.fullPaths."postfix/mysql_alias_maps"
97 config.secrets.fullPaths."postfix/mysql_mailbox_maps"
98 config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"
104 name = n: i: "relay_${n}_${toString i}";
105 pair = n: i: m: lib.attrsets.nameValuePair (name n i) (
107 then pkgs.writeText (name n i) m.content
110 pairs = n: v: lib.imap1 (i: m: pair n i m) v.recipient_maps;
111 in lib.attrsets.filterAttrs (k: v: v != null) (
112 lib.attrsets.listToAttrs (lib.flatten (
113 lib.attrsets.mapAttrsToList pairs config.myEnv.mail.postfix.backup_domains
116 relay_restrictions = lib.attrsets.filterAttrs (k: v: v != null) (
117 lib.attrsets.mapAttrs' (n: v:
118 lib.attrsets.nameValuePair "recipient_access_${n}" (
119 if lib.attrsets.hasAttr "relay_restrictions" v
120 then pkgs.writeText "recipient_access_${n}" v.relay_restrictions
123 ) config.myEnv.mail.postfix.backup_domains
127 cfg = config.myEnv.monitoring.email_check.eldiron;
128 address = "${cfg.mail_address}@${cfg.mail_domain}";
129 in pkgs.writeText "postfix-virtual" (
130 builtins.concatStringsSep "\n" (
132 lib.attrsets.mapAttrsToList (
133 n: v: lib.optionalString v.external ''
134 script_${n}@mail.immae.eu 1
136 ) config.myEnv.mail.scripts
141 host_dummy_mailboxes = pkgs.writeText "host-virtual-mailbox"
142 (builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (n: v: "${n}@immae.eu 1") nodes));
145 recipient_maps // relay_restrictions // virtual_map // sasl_access;
147 ### postfix module overrides
148 readme_directory = "${pkgs.postfix}/share/postfix/doc";
149 smtp_tls_CAfile = lib.mkForce "";
150 smtp_tls_cert_file = lib.mkForce "";
151 smtp_tls_key_file = lib.mkForce "";
153 message_size_limit = "1073741824"; # Don't put 0 here, it's not equivalent to "unlimited"
154 mailbox_size_limit = "1073741825"; # Workaround, local delivered mails should all go through scripts
155 alias_database = "\$alias_maps";
159 backups = lib.flatten (lib.attrsets.mapAttrsToList (n: v: v.domains or []) config.myEnv.mail.postfix.backup_domains);
160 virtual_domains = config.myEnv.mail.postfix.additional_mailbox_domains
161 ++ lib.remove null (lib.flatten (map
164 then "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}"
167 (zone.withEmail or [])
169 config.myEnv.dns.masterZones
172 backups ++ virtual_domains;
173 relay_recipient_maps = let
174 backup_recipients = lib.flatten (lib.attrsets.mapAttrsToList (n: v:
175 lib.imap1 (i: m: "${m.type}:/etc/postfix/relay_${n}_${toString i}") v.recipient_maps
176 ) config.myEnv.mail.postfix.backup_domains);
177 virtual_alias_maps = [
178 "hash:/etc/postfix/virtual"
179 "mysql:${config.secrets.fullPaths."postfix/mysql_alias_maps"}"
180 "ldap:${config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"}"
182 virtual_mailbox_maps = [
183 "hash:/etc/postfix/host_dummy_mailboxes"
184 "mysql:${config.secrets.fullPaths."postfix/mysql_mailbox_maps"}"
187 backup_recipients ++ virtual_alias_maps ++ virtual_mailbox_maps;
188 smtpd_relay_restrictions = [
189 "defer_unauth_destination"
190 ] ++ lib.flatten (lib.attrsets.mapAttrsToList (n: v:
191 if lib.attrsets.hasAttr "relay_restrictions" v
192 then [ "check_recipient_access hash:/etc/postfix/recipient_access_${n}" ]
194 ) config.myEnv.mail.postfix.backup_domains);
196 ### Additional smtpd configuration
197 smtpd_tls_received_header = "yes";
198 smtpd_tls_loglevel = "1";
200 ### Email sending configuration
201 smtp_tls_security_level = "may";
202 smtp_tls_loglevel = "1";
204 ### Force ip bind for smtp
205 smtp_bind_address = config.myEnv.servers."${name}".ips.main.ip4;
206 smtp_bind_address6 = builtins.head config.myEnv.servers."${name}".ips.main.ip6;
209 "unix:${config.myServices.mail.milters.sockets.opendkim}"
210 "unix:${config.myServices.mail.milters.sockets.openarc}"
211 "unix:${config.myServices.mail.milters.sockets.opendmarc}"
216 enableSubmission = false;
217 destination = ["localhost"];
218 # This needs to reverse DNS
219 hostname = config.hostEnv.fqdn;
221 sslCert = "/var/lib/acme/mail/fullchain.pem";
222 sslKey = "/var/lib/acme/mail/key.pem";
223 recipientDelimiter = "+";