X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fmail%2Fpostfix.nix;h=de5e59d71d41b7d91016057102642f69d7d9b7f7;hb=da30ae4ffdd153a1eb32fb86f9ca9a65aa19e4e2;hp=46d45c188cbc549f1199897fcc5d670147923ed2;hpb=418a4ed7da43fab53c18f99237bc296e37f47d2c;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/mail/postfix.nix b/modules/private/mail/postfix.nix
index 46d45c1..de5e59d 100644
--- a/modules/private/mail/postfix.nix
+++ b/modules/private/mail/postfix.nix
@@ -34,30 +34,19 @@
           '';
       }
       {
-        dest = "postfix/mysql_mailbox_maps";
+        dest = "postfix/ldap_mailboxes";
         user = config.services.postfix.user;
         group = config.services.postfix.group;
         permissions = "0440";
         text = ''
-          # We need to specify that option to trigger ssl connection
-          tls_ciphers = TLSv1.2
-          user = ${config.myEnv.mail.postfix.mysql.user}
-          password = ${config.myEnv.mail.postfix.mysql.password}
-          hosts = unix:${config.myEnv.mail.postfix.mysql.socket}
-          dbname = ${config.myEnv.mail.postfix.mysql.database}
-          result_format = /%d/%u
-          query = SELECT DISTINCT '%s'
-            FROM mailboxes
-            WHERE active = 1
-            AND (
-              (domain = '%d' AND user = '%u' AND regex = 0)
-              OR (
-                regex = 1
-                AND '%d' REGEXP CONCAT('^',domain,'$')
-                AND '%u' REGEXP CONCAT('^',user,'$')
-              )
-            )
-            LIMIT 1
+          server_host = ldaps://${config.myEnv.mail.dovecot.ldap.host}:636
+          search_base = ${config.myEnv.mail.dovecot.ldap.base}
+          query_filter = ${config.myEnv.mail.dovecot.ldap.postfix_mailbox_filter}
+          bind_dn = ${config.myEnv.mail.dovecot.ldap.dn}
+          bind_pw = ${config.myEnv.mail.dovecot.ldap.password}
+          result_attribute = immaePostfixAddress
+          result_format = dummy
+          version = 3
         '';
       }
       {
@@ -171,16 +160,27 @@
           version = 3
           '';
       }
-    ];
+    ] ++ (lib.mapAttrsToList (name: v: {
+      dest = "postfix/scripts/${name}-env";
+      user = "postfixscripts";
+      group = "root";
+      permissions = "0400";
+      text = builtins.toJSON v.env;
+    }) config.myEnv.mail.scripts);
 
     networking.firewall.allowedTCPPorts = [ 25 465 587 ];
 
+    users.users.postfixscripts = {
+      group = "keys";
+      uid = config.ids.uids.postfixscripts;
+      description = "Postfix scripts user";
+    };
     users.users."${config.services.postfix.user}".extraGroups = [ "keys" ];
     services.filesWatcher.postfix = {
       restart = true;
       paths = [
         config.secrets.fullPaths."postfix/mysql_alias_maps"
-        config.secrets.fullPaths."postfix/mysql_mailbox_maps"
+        config.secrets.fullPaths."postfix/ldap_mailboxes"
         config.secrets.fullPaths."postfix/mysql_sender_login_maps"
         config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"
       ];
@@ -220,7 +220,7 @@
           fi
           '';
         scripts = lib.attrsets.mapAttrs (n: v:
-          toScript n (pkgs.callPackage (builtins.fetchGit { url = v.src.url; ref = "master"; rev = v.src.rev; }) { scriptEnv = v.env; })
+          toScript n (pkgs.callPackage (builtins.fetchGit { url = v.src.url; ref = "master"; rev = v.src.rev; }) { scriptEnv = config.secrets.fullPaths."postfix/scripts/${n}-env"; })
         ) config.myEnv.mail.scripts // {
           testmail = pkgs.writeScript "testmail" ''
             #! ${pkgs.stdenv.shell}
@@ -274,8 +274,6 @@
             joined = builtins.concatStringsSep ",";
           in pkgs.writeText "host-sender-login"
             (builtins.concatStringsSep "\n" (mapAttrsToList (n: v: "${n} ${joined v}") addresses));
-          host_dummy_mailboxes = pkgs.writeText "host-virtual-mailbox"
-            (builtins.concatStringsSep "\n" (["immae-eu@immae.eu dummy"] ++ lib.attrsets.mapAttrsToList (n: v: "${n}@immae.eu  dummy") nodes));
         };
       in
         recipient_maps // relay_restrictions // virtual_map // sasl_access;
@@ -290,6 +288,9 @@
         mailbox_size_limit = "1073741825"; # Workaround, local delivered mails should all go through scripts
         alias_database = "\$alias_maps";
 
+        ### Aliases scripts user
+        default_privs = "postfixscripts";
+
         ### Virtual mailboxes config
         virtual_alias_maps = [
           "hash:/etc/postfix/virtual"
@@ -308,8 +309,7 @@
             config.myEnv.dns.masterZones
           ));
         virtual_mailbox_maps = [
-          "hash:/etc/postfix/host_dummy_mailboxes"
-          "mysql:${config.secrets.fullPaths."postfix/mysql_mailbox_maps"}"
+          "ldap:${config.secrets.fullPaths."postfix/ldap_mailboxes"}"
         ];
         dovecot_destination_recipient_limit = "1";
         virtual_transport = "dovecot";
@@ -435,7 +435,7 @@
                 ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -f "$sender" -a "$original_recipient" -d "$user"
               '';
           in [
-            "flags=DRhu" "user=vhost:vhost"
+            "flags=ODRhu" "user=vhost:vhost"
             "argv=${rspamc_dovecot}/bin/rspamc_dovecot \${sender} \${original_recipient} \${user}@\${nexthop}"
           ];
         };
@@ -468,14 +468,15 @@
           in "${cfg'.mail_address}${sep}${host'}@${cfg'.mail_domain}";
         mails_to_receive = builtins.concatStringsSep " " (map (to_email cfg) reverseTargets);
       in ''
-        install -m 0555 -o nobody -g nogroup -d /var/lib/naemon/checks/email
+        install -m 0555 -o postfixscripts -g keys -d /var/lib/naemon/checks/email
         for f in ${mails_to_receive}; do
           if [ ! -f /var/lib/naemon/checks/email/$f ]; then
-            install -m 0644 -o nobody -g nogroup /dev/null -T /var/lib/naemon/checks/email/$f
+            install -m 0644 -o postfixscripts -g keys /dev/null -T /var/lib/naemon/checks/email/$f
             touch -m -d @0 /var/lib/naemon/checks/email/$f
           fi
         done
         '';
     };
+    systemd.services.postfix.serviceConfig.Slice = "mail.slice";
   };
 }