flakes/private/opendmarc/flake.nix

   1 {
   2   inputs.opendmarc = {
   3     path = "../../opendmarc";
   4     type = "path";
   5   };
   6   inputs.nix-lib.url = "github:NixOS/nixpkgs";
   7
   8   # Necessary for dependencies
   9   inputs.nixpkgs.follows = "opendmarc/nixpkgs";
  10
  11   description = "Private configuration for opendmarc";
  12   outputs = { self, nix-lib, opendmarc, nixpkgs }:
  13     let
  14       cfg = name': { config, lib, pkgs, name, ... }: lib.mkIf (name == name') {
  15         users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
  16         systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
  17         services.opendmarc = {
  18           enable = true;
  19           socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
  20           configFile = pkgs.writeText "opendmarc.conf" ''
  21             AuthservID                  HOSTNAME
  22             FailureReports              false
  23             FailureReportsBcc           postmaster@immae.eu
  24             FailureReportsOnNone        true
  25             FailureReportsSentBy        postmaster@immae.eu
  26             IgnoreAuthenticatedClients  true
  27             IgnoreHosts                 ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
  28             SoftwareHeader              true
  29             SPFIgnoreResults            true
  30             SPFSelfValidate             true
  31             UMask                       002
  32             '';
  33           group = config.services.postfix.group;
  34         };
  35         services.filesWatcher.opendmarc = {
  36           restart = true;
  37           paths = [
  38             config.secrets.fullPaths."opendmarc/ignore.hosts"
  39           ];
  40         };
  41         secrets.keys = [
  42           {
  43             dest = "opendmarc/ignore.hosts";
  44             user = config.services.opendmarc.user;
  45             group = config.services.opendmarc.group;
  46             permissions = "0400";
  47             text = let
  48               mxes = lib.attrsets.filterAttrs
  49                 (n: v: v.mx.enable)
  50                 config.myEnv.servers;
  51               in
  52                 builtins.concatStringsSep "\n" ([
  53                   config.myEnv.mail.dmarc.ignore_hosts
  54                 ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
  55           }
  56         ];
  57       };
  58     in
  59       opendmarc.outputs //
  60       { nixosModules = opendmarc.nixosModules or {} // nix-lib.lib.genAttrs ["eldiron" "backup-2"] cfg; };
  61 }
  62