flakes/private/opendmarc/flake.nix

   1 {
   2   inputs.opendmarc = {
   3     path = "../../opendmarc";
   4     type = "path";
   5   };
   6   inputs.files-watcher = {
   7     path = "../../files-watcher";
   8     type = "path";
   9   };
  10   inputs.my-lib = {
  11     path = "../../lib";
  12     type = "path";
  13   };
  14   inputs.nix-lib.url = "github:NixOS/nixpkgs";
  15
  16   description = "Private configuration for opendmarc";
  17   outputs = { self, nix-lib, opendmarc, my-lib, files-watcher }:
  18     let
  19       cfg = name': { config, lib, pkgs, name, ... }: {
  20         imports = [
  21           (my-lib.lib.withNarKey files-watcher "nixosModule")
  22           (my-lib.lib.withNarKey opendmarc "nixosModule")
  23           #FIXME:
  24           #(my-lib.lib.withNarKey secrets "nixosModule")
  25         ];
  26         config = lib.mkIf (name == name') {
  27           users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
  28           systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
  29           services.opendmarc = {
  30             enable = true;
  31             socket = "/run/opendmarc/opendmarc.sock";
  32             configFile = pkgs.writeText "opendmarc.conf" ''
  33               AuthservID                  HOSTNAME
  34               FailureReports              false
  35               FailureReportsBcc           postmaster@immae.eu
  36               FailureReportsOnNone        true
  37               FailureReportsSentBy        postmaster@immae.eu
  38               IgnoreAuthenticatedClients  true
  39               IgnoreHosts                 ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
  40               SoftwareHeader              true
  41               SPFIgnoreResults            true
  42               SPFSelfValidate             true
  43               UMask                       002
  44               '';
  45             group = config.services.postfix.group;
  46           };
  47           services.filesWatcher.opendmarc = {
  48             restart = true;
  49             paths = [
  50               config.secrets.fullPaths."opendmarc/ignore.hosts"
  51             ];
  52           };
  53           secrets.keys = [
  54             {
  55               dest = "opendmarc/ignore.hosts";
  56               user = config.services.opendmarc.user;
  57               group = config.services.opendmarc.group;
  58               permissions = "0400";
  59               text = let
  60                 mxes = lib.attrsets.filterAttrs
  61                   (n: v: v.mx.enable)
  62                   config.myEnv.servers;
  63                 in
  64                   builtins.concatStringsSep "\n" ([
  65                     config.myEnv.mail.dmarc.ignore_hosts
  66                   ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
  67             }
  68           ];
  69         };
  70       };
  71     in
  72       opendmarc.outputs //
  73       { nixosModules = opendmarc.nixosModules or {} // nix-lib.lib.genAttrs ["eldiron" "backup-2"] cfg; };
  74 }
  75