flakes/private/opendmarc/flake.nix

   1 {
   2   inputs.opendmarc = {
   3     path = "../../opendmarc";
   4     type = "path";
   5   };
   6   inputs.nixpkgs.url = "github:NixOS/nixpkgs";
   7
   8   description = "Private configuration for opendmarc";
   9   outputs = { self, nixpkgs, opendmarc }:
  10     let
  11       cfg = name': { config, lib, pkgs, name, ... }: lib.mkIf (name == name') {
  12         users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
  13         systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
  14         services.opendmarc = {
  15           enable = true;
  16           socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
  17           configFile = pkgs.writeText "opendmarc.conf" ''
  18             AuthservID                  HOSTNAME
  19             FailureReports              false
  20             FailureReportsBcc           postmaster@immae.eu
  21             FailureReportsOnNone        true
  22             FailureReportsSentBy        postmaster@immae.eu
  23             IgnoreAuthenticatedClients  true
  24             IgnoreHosts                 ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
  25             SoftwareHeader              true
  26             SPFIgnoreResults            true
  27             SPFSelfValidate             true
  28             UMask                       002
  29             '';
  30           group = config.services.postfix.group;
  31         };
  32         services.filesWatcher.opendmarc = {
  33           restart = true;
  34           paths = [
  35             config.secrets.fullPaths."opendmarc/ignore.hosts"
  36           ];
  37         };
  38         secrets.keys = [
  39           {
  40             dest = "opendmarc/ignore.hosts";
  41             user = config.services.opendmarc.user;
  42             group = config.services.opendmarc.group;
  43             permissions = "0400";
  44             text = let
  45               mxes = lib.attrsets.filterAttrs
  46                 (n: v: v.mx.enable)
  47                 config.myEnv.servers;
  48               in
  49                 builtins.concatStringsSep "\n" ([
  50                   config.myEnv.mail.dmarc.ignore_hosts
  51                 ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
  52           }
  53         ];
  54       };
  55     in
  56       opendmarc.outputs //
  57       { nixosModules = opendmarc.nixosModules or {} // nixpkgs.lib.genAttrs ["eldiron" "backup-2"] cfg; };
  58 }
  59