1 { lib, pkgs, config, name, ... }:
4 builtins.attrValues (import ../../../lib/flake-compat.nix ../../../flakes/private/openarc).nixosModules
5 ++ builtins.attrValues (import ../../../lib/flake-compat.nix ../../../flakes/private/opendmarc).nixosModules;
7 options.myServices.mail.milters.sockets = lib.mkOption {
8 type = lib.types.attrsOf lib.types.path;
10 opendkim = "/run/opendkim/opendkim.sock";
11 opendmarc = config.services.opendmarc.socket;
12 openarc = config.services.openarc.socket;
19 config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
24 user = config.services.opendkim.user;
25 group = config.services.opendkim.group;
29 dest = "opendkim/eldiron.private";
30 user = config.services.opendkim.user;
31 group = config.services.opendkim.group;
33 text = config.myEnv.mail.dkim.eldiron.private;
36 dest = "opendkim/eldiron.txt";
37 user = config.services.opendkim.user;
38 group = config.services.opendkim.group;
41 eldiron._domainkey IN TXT ${config.myEnv.mail.dkim.eldiron.public}'';
44 users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
47 socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
48 domains = builtins.concatStringsSep "," (lib.flatten (map
50 (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
51 (zone.withEmail or [])
53 config.myEnv.dns.masterZones
55 keyPath = config.secrets.fullPaths."opendkim";
57 configFile = pkgs.writeText "opendkim.conf" ''
62 group = config.services.postfix.group;
64 systemd.services.opendkim.serviceConfig.Slice = "mail.slice";
65 systemd.services.opendkim.preStart = lib.mkBefore ''
66 # Skip the prestart script as keys are handled in secrets
69 services.filesWatcher.opendkim = {
72 config.secrets.fullPaths."opendkim/eldiron.private"
76 systemd.services.milter_verify_from = {
77 description = "Verify from milter";
78 after = [ "network.target" ];
79 wantedBy = [ "multi-user.target" ];
85 ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
86 in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
87 RuntimeDirectory = "milter_verify_from";