X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fmail%2Fpostfix.nix;h=7e06c452c9ca2f6e87e2832cb78ede804cfc8a56;hb=6596ce997908aab8daaae635229e5031c83fd57c;hp=054b93effc5665f76ab072032aa055093cf4abfb;hpb=4c4652aabf2cb3ac8b40f2856eca07a1df9c27e0;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/mail/postfix.nix b/modules/private/mail/postfix.nix
index 054b93e..7e06c45 100644
--- a/modules/private/mail/postfix.nix
+++ b/modules/private/mail/postfix.nix
@@ -1,9 +1,39 @@
 { lib, pkgs, config, nodes, ... }:
+let all_domains = config.myEnv.mail.postfix.additional_mailbox_domains
+      ++ lib.remove null (lib.flatten (map
+      (zone: map
+        (e: if e.receive
+        then "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}"
+        else null
+        )
+        (zone.withEmail or [])
+      )
+      config.myEnv.dns.masterZones
+    ));
+in
 {
   config = lib.mkIf config.myServices.mail.enable {
-    services.duplyBackup.profiles.mail.excludeFile = ''
-      + /var/lib/postfix
-      '';
+    myServices.chatonsProperties.hostings.mx-backup = {
+      file.datetime = "2022-08-22T01:00:00";
+      hosting = {
+        name = "MX Backup";
+        description = "Serveur e-mail secondaire";
+        logo = "https://www.postfix.org/favicon.ico";
+        website = "https://mail.immae.eu/";
+        status.level = "OK";
+        status.description = "OK";
+        registration.load = "OPEN";
+        install.type = "PACKAGE";
+      };
+      software = {
+        name = "Postfix";
+        website = "http://www.postfix.org/";
+        license.url = "http://postfix.mirrors.ovh.net/postfix-release/LICENSE";
+        license.name = "Eclipse Public license (EPL 2.0) and IBM Public License (IPL 1.0)";
+        version = pkgs.postfix.version;
+        source.url = "http://www.postfix.org/download.html";
+      };
+    };
     secrets.keys = {
       "postfix/mysql_alias_maps" = {
         user = config.services.postfix.user;
@@ -212,7 +242,12 @@
           fi
           '';
         scripts = lib.attrsets.mapAttrs (n: v:
-          toScript n (pkgs.callPackage (builtins.fetchGit { url = v.src.url; ref = "master"; rev = v.src.rev; }) { scriptEnv = config.secrets.fullPaths."postfix/scripts/${n}-env"; })
+          toScript n (
+            (builtins.getFlake "git+${v.src.url}?rev=${v.src.rev}"
+              #(builtins.fetchGit { url = v.src.url; ref = "master"; rev = v.src.rev; })
+            ).outputs.envToScript.x86_64-linux
+            config.secrets.fullPaths."postfix/scripts/${n}-env"
+          )
         ) config.myEnv.mail.scripts // {
           testmail = pkgs.writeScript "testmail" ''
             #! ${pkgs.stdenv.shell}
@@ -248,24 +283,42 @@
           virtual = let
             cfg = config.myEnv.monitoring.email_check.eldiron;
             address = "${cfg.mail_address}@${cfg.mail_domain}";
+            aliases = config.myEnv.mail.postfix.common_aliases;
+            admins = builtins.concatStringsSep "," config.myEnv.mail.postfix.admins;
           in pkgs.writeText "postfix-virtual" (
             builtins.concatStringsSep "\n" (
-              ["${address} testmail@localhost"] ++
+              [ "${address} testmail@localhost"
+              ] ++
+              map (a: "${a} ${admins}") config.myEnv.mail.postfix.other_aliases ++
               lib.attrsets.mapAttrsToList (
                 n: v: lib.optionalString v.external ''
                   script_${n}@mail.immae.eu ${n}@localhost, scripts@mail.immae.eu
                 ''
               ) config.myEnv.mail.scripts
-            )
-          );
+              ++ lib.lists.flatten (
+                map (domain:
+                  map (alias: "${alias}@${domain} ${admins}") aliases
+                ) all_domains
+                )
+          ));
         };
         sasl_access = {
           host_sender_login = with lib.attrsets; let
             addresses = zipAttrs (lib.flatten (mapAttrsToList
               (n: v: (map (e: { "${e}" = "${n}@immae.eu"; }) v.emails)) config.myEnv.servers));
+            aliases = config.myEnv.mail.postfix.common_aliases;
             joined = builtins.concatStringsSep ",";
+            admins = joined config.myEnv.mail.postfix.admins;
           in pkgs.writeText "host-sender-login"
-            (builtins.concatStringsSep "\n" (mapAttrsToList (n: v: "${n} ${joined v}") addresses));
+            (builtins.concatStringsSep "\n" (
+              mapAttrsToList (n: v: "${n} ${joined v}") addresses
+              ++ lib.lists.flatten (
+                map (domain:
+                  map (alias: "${alias}@${domain} ${admins}") aliases
+                ) all_domains
+                )
+              ++ map (a: "${a} ${admins}") config.myEnv.mail.postfix.other_aliases
+          ));
         };
       in
         recipient_maps // relay_restrictions // virtual_map // sasl_access;
@@ -289,17 +342,7 @@
           "mysql:${config.secrets.fullPaths."postfix/mysql_alias_maps"}"
           "ldap:${config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"}"
         ];
-        virtual_mailbox_domains = config.myEnv.mail.postfix.additional_mailbox_domains
-        ++ lib.remove null (lib.flatten (map
-            (zone: map
-              (e: if e.receive
-              then "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}"
-              else null
-              )
-              (zone.withEmail or [])
-            )
-            config.myEnv.dns.masterZones
-          ));
+        virtual_mailbox_domains = all_domains;
         virtual_mailbox_maps = [
           "ldap:${config.secrets.fullPaths."postfix/ldap_mailboxes"}"
         ];
@@ -328,7 +371,7 @@
         smtp_tls_loglevel = "1";
 
         ### Force ip bind for smtp
-        smtp_bind_address  = config.hostEnv.ips.main.ip4;
+        smtp_bind_address  = builtins.head config.hostEnv.ips.main.ip4;
         smtp_bind_address6 = builtins.head config.hostEnv.ips.main.ip6;
 
         # Use some relays when authorized senders are not myself
@@ -418,13 +461,20 @@
             # here.
             rspamc_dovecot = pkgs.writeScriptBin "rspamc_dovecot" ''
               #! ${pkgs.stdenv.shell}
+              set -o pipefail
               sender="$1"
               original_recipient="$2"
               user="$3"
 
               ${pkgs.coreutils}/bin/cat - | \
-                (${pkgs.rspamd}/bin/rspamc -h ${config.myServices.mail.rspamd.sockets.worker-controller} -c bayes -d "$user" --mime || true) | \
+                ${pkgs.rspamd}/bin/rspamc -h ${config.myServices.mail.rspamd.sockets.worker-controller} -c bayes -d "$user" --mime | \
                 ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -f "$sender" -a "$original_recipient" -d "$user"
+              if echo ''${PIPESTATUS[@]} | ${pkgs.gnugrep}/bin/grep -qE '^[0 ]+$'; then
+                exit 0
+              else
+                # src/global/sys_exits.h to retry
+                exit 75
+              fi
               '';
           in [
             "flags=ODRhu" "user=vhost:vhost"
@@ -437,17 +487,13 @@
       postRun = ''
         systemctl restart postfix.service
         '';
-      extraDomains = {
-        "smtp.immae.eu" = null;
-      };
+      extraDomainNames = [ "smtp.immae.eu" ];
     };
     security.acme.certs."mail-rsa" = {
       postRun = ''
         systemctl restart postfix.service
         '';
-      extraDomains = {
-        "smtp.immae.eu" = null;
-      };
+      extraDomainNames = [ "smtp.immae.eu" ];
     };
     system.activationScripts.testmail = {
       deps = [ "users" ];