modules/private/mail/milters.nix

   1 { lib, pkgs, config, name, ... }:
   2 {
   3   imports =
   4        builtins.attrValues (import ../../../lib/flake-compat.nix ../../../flakes/openarc).nixosModules
   5     ++ builtins.attrValues (import ../../../lib/flake-compat.nix ../../../flakes/opendmarc).nixosModules;
   6
   7   options.myServices.mail.milters.sockets = lib.mkOption {
   8     type = lib.types.attrsOf lib.types.path;
   9     default = {
  10       opendkim = "/run/opendkim/opendkim.sock";
  11       opendmarc = "/run/opendmarc/opendmarc.sock";
  12       openarc = "/run/openarc/openarc.sock";
  13     };
  14     readOnly = true;
  15     description = ''
  16       milters sockets
  17       '';
  18   };
  19   config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
  20     secrets.keys = [
  21       {
  22         dest = "opendkim/eldiron.private";
  23         user = config.services.opendkim.user;
  24         group = config.services.opendkim.group;
  25         permissions = "0400";
  26         text = config.myEnv.mail.dkim.eldiron.private;
  27       }
  28       {
  29         dest = "opendkim/eldiron.txt";
  30         user = config.services.opendkim.user;
  31         group = config.services.opendkim.group;
  32         permissions = "0444";
  33         text = ''
  34           eldiron._domainkey    IN      TXT     ${config.myEnv.mail.dkim.eldiron.public}'';
  35       }
  36     ];
  37     users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
  38     services.opendkim = {
  39       enable = true;
  40       socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
  41       domains = builtins.concatStringsSep "," (lib.flatten (map
  42         (zone: map
  43           (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
  44           (zone.withEmail or [])
  45         )
  46         config.myEnv.dns.masterZones
  47       ));
  48       keyPath = "${config.secrets.location}/opendkim";
  49       selector = "eldiron";
  50       configFile = pkgs.writeText "opendkim.conf" ''
  51         SubDomains        yes
  52         UMask             002
  53         AlwaysAddARHeader yes
  54         '';
  55       group = config.services.postfix.group;
  56     };
  57     systemd.services.opendkim.serviceConfig.Slice = "mail.slice";
  58     systemd.services.opendkim.preStart = lib.mkBefore ''
  59       # Skip the prestart script as keys are handled in secrets
  60       exit 0
  61       '';
  62     services.filesWatcher.opendkim = {
  63       restart = true;
  64       paths = [
  65         config.secrets.fullPaths."opendkim/eldiron.private"
  66       ];
  67     };
  68
  69     systemd.services.milter_verify_from = {
  70       description  = "Verify from milter";
  71       after = [ "network.target" ];
  72       wantedBy = [ "multi-user.target" ];
  73
  74       serviceConfig = {
  75         Slice = "mail.slice";
  76         User = "postfix";
  77         Group = "postfix";
  78         ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
  79           in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
  80         RuntimeDirectory = "milter_verify_from";
  81       };
  82     };
  83   };
  84 }