X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fmail%2Fmilters.nix;h=96c280066f44b966c55beee99fc7c12d2f961047;hb=74a10960d8659eaffa8224cee31fcf217c69609f;hp=123af4ab650b554730fa2fe5b0cc6c0e8aea7a29;hpb=8415083eb6acc343dfa404dbbc12fa0171a48a20;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/mail/milters.nix b/modules/private/mail/milters.nix
index 123af4a..96c2800 100644
--- a/modules/private/mail/milters.nix
+++ b/modules/private/mail/milters.nix
@@ -1,5 +1,8 @@
-{ lib, pkgs, config, myconfig,  ... }:
+{ lib, pkgs, config, name, ... }:
 {
+  imports =
+    builtins.attrValues (import ../../../lib/flake-compat.nix ../../../flakes/openarc).nixosModules;
+
   options.myServices.mail.milters.sockets = lib.mkOption {
     type = lib.types.attrsOf lib.types.path;
     default = {
@@ -12,14 +15,14 @@
       milters sockets
       '';
   };
-  config = lib.mkIf config.myServices.mail.enable {
+  config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
     secrets.keys = [
       {
         dest = "opendkim/eldiron.private";
         user = config.services.opendkim.user;
         group = config.services.opendkim.group;
         permissions = "0400";
-        text = myconfig.env.mail.dkim.eldiron.private;
+        text = config.myEnv.mail.dkim.eldiron.private;
       }
       {
         dest = "opendkim/eldiron.txt";
@@ -27,14 +30,21 @@
         group = config.services.opendkim.group;
         permissions = "0444";
         text = ''
-          eldiron._domainkey	IN	TXT	${myconfig.env.mail.dkim.eldiron.public}'';
+          eldiron._domainkey	IN	TXT	${config.myEnv.mail.dkim.eldiron.public}'';
       }
       {
         dest = "opendmarc/ignore.hosts";
         user = config.services.opendmarc.user;
         group = config.services.opendmarc.group;
         permissions = "0400";
-        text = myconfig.env.mail.dmarc.ignore_hosts;
+        text = let
+          mxes = lib.attrsets.filterAttrs
+            (n: v: v.mx.enable)
+            config.myEnv.servers;
+          in
+            builtins.concatStringsSep "\n" ([
+              config.myEnv.mail.dmarc.ignore_hosts
+            ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
       }
     ];
     users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
@@ -46,16 +56,18 @@
           (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
           (zone.withEmail or [])
         )
-        myconfig.env.dns.masterZones
+        config.myEnv.dns.masterZones
       ));
       keyPath = "${config.secrets.location}/opendkim";
       selector = "eldiron";
       configFile = pkgs.writeText "opendkim.conf" ''
-        SubDomains     yes
-        UMask          002
+        SubDomains        yes
+        UMask             002
+        AlwaysAddARHeader yes
         '';
       group = config.services.postfix.group;
     };
+    systemd.services.opendkim.serviceConfig.Slice = "mail.slice";
     systemd.services.opendkim.preStart = lib.mkBefore ''
       # Skip the prestart script as keys are handled in secrets
       exit 0
@@ -68,20 +80,21 @@
     };
 
     users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
+    systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
     services.opendmarc = {
       enable = true;
       socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
       configFile = pkgs.writeText "opendmarc.conf" ''
         AuthservID                  HOSTNAME
         FailureReports              false
-        FailureReportsBcc           postmaster@localhost.immae.eu
+        FailureReportsBcc           postmaster@immae.eu
         FailureReportsOnNone        true
         FailureReportsSentBy        postmaster@immae.eu
         IgnoreAuthenticatedClients  true
         IgnoreHosts                 ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
         SoftwareHeader              true
+        SPFIgnoreResults            true
         SPFSelfValidate             true
-        TrustedAuthservIDs          HOSTNAME, immae.eu, nef2.ens.fr
         UMask                       002
         '';
       group = config.services.postfix.group;
@@ -93,33 +106,19 @@
       ];
     };
 
-    services.openarc = {
-      enable = true;
-      user = "opendkim";
-      socket = "local:${config.myServices.mail.milters.sockets.openarc}";
-      group = config.services.postfix.group;
-      configFile = pkgs.writeText "openarc.conf" ''
-        AuthservID              mail.immae.eu
-        Domain                  mail.immae.eu
-        KeyFile                 ${config.secrets.fullPaths."opendkim/eldiron.private"}
-        Mode                    sv
-        Selector                eldiron
-        SoftwareHeader          yes
-        Syslog                  Yes
-        '';
-    };
-    systemd.services.openarc.postStart = lib.optionalString
-          (lib.strings.hasPrefix "local:" config.services.openarc.socket) ''
-      while [ ! -S ${lib.strings.removePrefix "local:" config.services.openarc.socket} ]; do
-        sleep 0.5
-      done
-      chmod g+w ${lib.strings.removePrefix "local:" config.services.openarc.socket}
-      '';
-    services.filesWatcher.openarc = {
-      restart = true;
-      paths = [
-        config.secrets.fullPaths."opendkim/eldiron.private"
-      ];
+    systemd.services.milter_verify_from = {
+      description  = "Verify from milter";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Slice = "mail.slice";
+        User = "postfix";
+        Group = "postfix";
+        ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
+          in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
+        RuntimeDirectory = "milter_verify_from";
+      };
     };
   };
 }