Add backup module

[perso/Immae/Config/Nix.git] / modules / private / mail / postfix.nix

diff --git a/modules/private/mail/postfix.nix b/modules/private/mail/postfix.nix
index ee4ac35159e09da2b057f168fc9a862514d97e88..edfd19652e88f46606e8b807221d70617ff44048 100644 (file)
--- a/modules/private/mail/postfix.nix
+++ b/modules/private/mail/postfix.nix
@@ -1,5 +1,8 @@
 { lib, pkgs, config, myconfig,  ... }:
 {
+  config.services.backup.profiles.mail.excludeFile = ''
+    + /var/lib/postfix
+    '';
   config.secrets.keys = [
     {
       dest = "postfix/mysql_alias_maps";
@@ -73,6 +76,7 @@
           WHERE
             ((regex = 1 AND '%s' REGEXP CONCAT('^',source,'$') ) OR (regex = 0 AND source = '%s'))
             AND active = 1
+          UNION SELECT '%s' AS destination
         '';
     }
   ];
@@ -93,19 +97,30 @@
   };
   config.services.postfix = {
     mapFiles = let
-      name = n: i: "relay_${n}_${toString i}";
-      pair = n: i: m: lib.attrsets.nameValuePair (name n i) (
-        if m.type == "hash"
-        then pkgs.writeText (name n i) m.content
-        else null
-      );
-      pairs = n: v: lib.imap1 (i: m: pair n i m) v.recipient_maps;
-    in
-      lib.attrsets.filterAttrs (k: v: v != null) (
+      recipient_maps = let
+        name = n: i: "relay_${n}_${toString i}";
+        pair = n: i: m: lib.attrsets.nameValuePair (name n i) (
+          if m.type == "hash"
+          then pkgs.writeText (name n i) m.content
+          else null
+        );
+        pairs = n: v: lib.imap1 (i: m: pair n i m) v.recipient_maps;
+      in lib.attrsets.filterAttrs (k: v: v != null) (
         lib.attrsets.listToAttrs (lib.flatten (
           lib.attrsets.mapAttrsToList pairs myconfig.env.mail.postfix.backup_domains
         ))
       );
+      relay_restrictions = lib.attrsets.filterAttrs (k: v: v != null) (
+        lib.attrsets.mapAttrs' (n: v:
+          lib.attrsets.nameValuePair "recipient_access_${n}" (
+            if lib.attrsets.hasAttr "relay_restrictions" v
+            then pkgs.writeText "recipient_access_${n}" v.relay_restrictions
+            else null
+          )
+        ) myconfig.env.mail.postfix.backup_domains
+      );
+    in
+      recipient_maps // relay_restrictions;
     config = {
       ### postfix module overrides
       readme_directory = "${pkgs.postfix}/share/postfix/doc";
@@ -138,6 +153,15 @@
       relay_recipient_maps = lib.flatten (lib.attrsets.mapAttrsToList (n: v:
         lib.imap1 (i: m: "${m.type}:/etc/postfix/relay_${n}_${toString i}") v.recipient_maps
       ) myconfig.env.mail.postfix.backup_domains);
+      smtpd_relay_restrictions = [
+        "permit_mynetworks"
+        "permit_sasl_authenticated"
+        "defer_unauth_destination"
+      ] ++ lib.flatten (lib.attrsets.mapAttrsToList (n: v:
+        if lib.attrsets.hasAttr "relay_restrictions" v
+        then [ "check_recipient_access hash:/etc/postfix/recipient_access_${n}" ]
+        else []
+      ) myconfig.env.mail.postfix.backup_domains);
 
       ### Additional smtpd configuration
       smtpd_tls_received_header = "yes";