- config.secrets.keys = [
- {
- dest = "opendkim/eldiron.private";
- user = config.services.opendkim.user;
- group = config.services.opendkim.group;
- permissions = "0400";
- text = myconfig.env.mail.dkim.eldiron.private;
- }
- {
- dest = "opendkim/eldiron.txt";
- user = config.services.opendkim.user;
- group = config.services.opendkim.group;
- permissions = "0444";
- text = ''
- eldiron._domainkey IN TXT ${myconfig.env.mail.dkim.eldiron.public}'';
- }
- {
- dest = "opendmarc/ignore.hosts";
- user = config.services.opendmarc.user;
- group = config.services.opendmarc.group;
- permissions = "0400";
- text = myconfig.env.mail.dmarc.ignore_hosts;
- }
- ];
- config.users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
- config.services.opendkim = {
- enable = true;
- socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
- domains = builtins.concatStringsSep "," (lib.flatten (map
- (zone: map
- (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
- (zone.withEmail or [])
- )
- myconfig.env.dns.masterZones
- ));
- keyPath = "${config.secrets.location}/opendkim";
- selector = "eldiron";
- configFile = pkgs.writeText "opendkim.conf" ''
- SubDomains yes
- UMask 002
+ config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
+ secrets.keys = {
+ "opendkim" = {
+ isDir = true;
+ user = config.services.opendkim.user;
+ group = config.services.opendkim.group;
+ permissions = "0550";
+ };
+ "opendkim/eldiron.private" = {
+ user = config.services.opendkim.user;
+ group = config.services.opendkim.group;
+ permissions = "0400";
+ text = config.myEnv.mail.dkim.eldiron.private;
+ };
+ "opendkim/eldiron.txt" = {
+ user = config.services.opendkim.user;
+ group = config.services.opendkim.group;
+ permissions = "0444";
+ text = ''
+ eldiron._domainkey IN TXT ${config.myEnv.mail.dkim.eldiron.public}'';
+ };
+ };
+ users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
+ services.opendkim = {
+ enable = true;
+ socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
+ domains = builtins.concatStringsSep "," (lib.flatten (map
+ (zone: map
+ (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
+ (zone.withEmail or [])
+ )
+ config.myEnv.dns.masterZones
+ ));
+ keyPath = config.secrets.fullPaths."opendkim";
+ selector = "eldiron";
+ configFile = pkgs.writeText "opendkim.conf" ''
+ SubDomains yes
+ UMask 002
+ AlwaysAddARHeader yes
+ '';
+ group = config.services.postfix.group;
+ };
+ systemd.services.opendkim.serviceConfig.Slice = "mail.slice";
+ systemd.services.opendkim.preStart = lib.mkBefore ''
+ # Skip the prestart script as keys are handled in secrets
+ exit 0