modules/private/mail/milters.nix

   1 { lib, pkgs, config, ... }:
   2 {
   3   options.myServices.mail.milters.sockets = lib.mkOption {
   4     type = lib.types.attrsOf lib.types.path;
   5     default = {
   6       opendkim = "/run/opendkim/opendkim.sock";
   7       opendmarc = "/run/opendmarc/opendmarc.sock";
   8       openarc = "/run/openarc/openarc.sock";
   9     };
  10     readOnly = true;
  11     description = ''
  12       milters sockets
  13       '';
  14   };
  15   config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
  16     secrets.keys = [
  17       {
  18         dest = "opendkim/eldiron.private";
  19         user = config.services.opendkim.user;
  20         group = config.services.opendkim.group;
  21         permissions = "0400";
  22         text = config.myEnv.mail.dkim.eldiron.private;
  23       }
  24       {
  25         dest = "opendkim/eldiron.txt";
  26         user = config.services.opendkim.user;
  27         group = config.services.opendkim.group;
  28         permissions = "0444";
  29         text = ''
  30           eldiron._domainkey    IN      TXT     ${config.myEnv.mail.dkim.eldiron.public}'';
  31       }
  32       {
  33         dest = "opendmarc/ignore.hosts";
  34         user = config.services.opendmarc.user;
  35         group = config.services.opendmarc.group;
  36         permissions = "0400";
  37         text = let
  38           mxes = lib.attrsets.filterAttrs
  39             (n: v: v.mx.enable)
  40             config.myEnv.servers;
  41           in
  42             builtins.concatStringsSep "\n" ([
  43               config.myEnv.mail.dmarc.ignore_hosts
  44             ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
  45       }
  46     ];
  47     users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
  48     services.opendkim = {
  49       enable = true;
  50       socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
  51       domains = builtins.concatStringsSep "," (lib.flatten (map
  52         (zone: map
  53           (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
  54           (zone.withEmail or [])
  55         )
  56         config.myEnv.dns.masterZones
  57       ));
  58       keyPath = "${config.secrets.location}/opendkim";
  59       selector = "eldiron";
  60       configFile = pkgs.writeText "opendkim.conf" ''
  61         SubDomains        yes
  62         UMask             002
  63         AlwaysAddARHeader yes
  64         '';
  65       group = config.services.postfix.group;
  66     };
  67     systemd.services.opendkim.serviceConfig.Slice = "mail.slice";
  68     systemd.services.opendkim.preStart = lib.mkBefore ''
  69       # Skip the prestart script as keys are handled in secrets
  70       exit 0
  71       '';
  72     services.filesWatcher.opendkim = {
  73       restart = true;
  74       paths = [
  75         config.secrets.fullPaths."opendkim/eldiron.private"
  76       ];
  77     };
  78
  79     users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
  80     systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
  81     services.opendmarc = {
  82       enable = true;
  83       socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
  84       configFile = pkgs.writeText "opendmarc.conf" ''
  85         AuthservID                  HOSTNAME
  86         FailureReports              false
  87         FailureReportsBcc           postmaster@immae.eu
  88         FailureReportsOnNone        true
  89         FailureReportsSentBy        postmaster@immae.eu
  90         IgnoreAuthenticatedClients  true
  91         IgnoreHosts                 ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
  92         SoftwareHeader              true
  93         SPFIgnoreResults            true
  94         SPFSelfValidate             true
  95         UMask                       002
  96         '';
  97       group = config.services.postfix.group;
  98     };
  99     services.filesWatcher.opendmarc = {
 100       restart = true;
 101       paths = [
 102         config.secrets.fullPaths."opendmarc/ignore.hosts"
 103       ];
 104     };
 105
 106     services.openarc = {
 107       enable = true;
 108       user = "opendkim";
 109       socket = "local:${config.myServices.mail.milters.sockets.openarc}";
 110       group = config.services.postfix.group;
 111       configFile = pkgs.writeText "openarc.conf" ''
 112         AuthservID              mail.immae.eu
 113         Domain                  mail.immae.eu
 114         KeyFile                 ${config.secrets.fullPaths."opendkim/eldiron.private"}
 115         Mode                    sv
 116         Selector                eldiron
 117         SoftwareHeader          yes
 118         Syslog                  Yes
 119         '';
 120     };
 121     systemd.services.openarc.serviceConfig.Slice = "mail.slice";
 122     systemd.services.openarc.postStart = lib.optionalString
 123           (lib.strings.hasPrefix "local:" config.services.openarc.socket) ''
 124       while [ ! -S ${lib.strings.removePrefix "local:" config.services.openarc.socket} ]; do
 125         sleep 0.5
 126       done
 127       chmod g+w ${lib.strings.removePrefix "local:" config.services.openarc.socket}
 128       '';
 129     services.filesWatcher.openarc = {
 130       restart = true;
 131       paths = [
 132         config.secrets.fullPaths."opendkim/eldiron.private"
 133       ];
 134     };
 135
 136     systemd.services.milter_verify_from = {
 137       description  = "Verify from milter";
 138       after = [ "network.target" ];
 139       wantedBy = [ "multi-user.target" ];
 140
 141       serviceConfig = {
 142         Slice = "mail.slice";
 143         User = "postfix";
 144         Group = "postfix";
 145         ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
 146           in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
 147         RuntimeDirectory = "milter_verify_from";
 148       };
 149     };
 150   };
 151 }