3 path = "../../opendmarc";
7 path = "../../secrets";
10 inputs.files-watcher = {
11 path = "../../files-watcher";
18 inputs.nix-lib.url = "github:NixOS/nixpkgs";
20 description = "Private configuration for opendmarc";
21 outputs = { self, nix-lib, opendmarc, my-lib, files-watcher, secrets }:
23 cfg = name': { config, lib, pkgs, name, ... }: {
25 (my-lib.lib.withNarKey files-watcher "nixosModule")
26 (my-lib.lib.withNarKey opendmarc "nixosModule")
27 (my-lib.lib.withNarKey secrets "nixosModule")
29 config = lib.mkIf (name == name') {
30 users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
31 systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
32 services.opendmarc = {
34 socket = "/run/opendmarc/opendmarc.sock";
35 configFile = pkgs.writeText "opendmarc.conf" ''
38 FailureReportsBcc postmaster@immae.eu
39 FailureReportsOnNone true
40 FailureReportsSentBy postmaster@immae.eu
41 IgnoreAuthenticatedClients true
42 IgnoreHosts ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
48 group = config.services.postfix.group;
50 services.filesWatcher.opendmarc = {
53 config.secrets.fullPaths."opendmarc/ignore.hosts"
57 "opendmarc/ignore.hosts" = {
58 user = config.services.opendmarc.user;
59 group = config.services.opendmarc.group;
62 mxes = lib.attrsets.filterAttrs
66 builtins.concatStringsSep "\n" ([
67 config.myEnv.mail.dmarc.ignore_hosts
68 ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
75 { nixosModules = opendmarc.nixosModules or {} // nix-lib.lib.genAttrs ["eldiron" "backup-2"] cfg; };