modules/private/mail/milters.nix

   1 { lib, pkgs, config, ... }:
   2 {
   3   options.myServices.mail.milters.sockets = lib.mkOption {
   4     type = lib.types.attrsOf lib.types.path;
   5     default = {
   6       opendkim = "/run/opendkim/opendkim.sock";
   7       opendmarc = "/run/opendmarc/opendmarc.sock";
   8       openarc = "/run/openarc/openarc.sock";
   9     };
  10     readOnly = true;
  11     description = ''
  12       milters sockets
  13       '';
  14   };
  15   config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
  16     secrets.keys = [
  17       {
  18         dest = "opendkim/eldiron.private";
  19         user = config.services.opendkim.user;
  20         group = config.services.opendkim.group;
  21         permissions = "0400";
  22         text = config.myEnv.mail.dkim.eldiron.private;
  23       }
  24       {
  25         dest = "opendkim/eldiron.txt";
  26         user = config.services.opendkim.user;
  27         group = config.services.opendkim.group;
  28         permissions = "0444";
  29         text = ''
  30           eldiron._domainkey    IN      TXT     ${config.myEnv.mail.dkim.eldiron.public}'';
  31       }
  32       {
  33         dest = "opendmarc/ignore.hosts";
  34         user = config.services.opendmarc.user;
  35         group = config.services.opendmarc.group;
  36         permissions = "0400";
  37         text = let
  38           mxes = lib.attrsets.filterAttrs
  39             (n: v: v.mx.enable)
  40             config.myEnv.servers;
  41           in
  42             builtins.concatStringsSep "\n" ([
  43               config.myEnv.mail.dmarc.ignore_hosts
  44             ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
  45       }
  46     ];
  47     users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
  48     services.opendkim = {
  49       enable = true;
  50       socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
  51       domains = builtins.concatStringsSep "," (lib.flatten (map
  52         (zone: map
  53           (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
  54           (zone.withEmail or [])
  55         )
  56         config.myEnv.dns.masterZones
  57       ));
  58       keyPath = "${config.secrets.location}/opendkim";
  59       selector = "eldiron";
  60       configFile = pkgs.writeText "opendkim.conf" ''
  61         SubDomains        yes
  62         UMask             002
  63         AlwaysAddARHeader yes
  64         '';
  65       group = config.services.postfix.group;
  66     };
  67     systemd.services.opendkim.preStart = lib.mkBefore ''
  68       # Skip the prestart script as keys are handled in secrets
  69       exit 0
  70       '';
  71     services.filesWatcher.opendkim = {
  72       restart = true;
  73       paths = [
  74         config.secrets.fullPaths."opendkim/eldiron.private"
  75       ];
  76     };
  77
  78     users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
  79     services.opendmarc = {
  80       enable = true;
  81       socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
  82       configFile = pkgs.writeText "opendmarc.conf" ''
  83         AuthservID                  HOSTNAME
  84         FailureReports              false
  85         FailureReportsBcc           postmaster@immae.eu
  86         FailureReportsOnNone        true
  87         FailureReportsSentBy        postmaster@immae.eu
  88         IgnoreAuthenticatedClients  true
  89         IgnoreHosts                 ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
  90         SoftwareHeader              true
  91         SPFIgnoreResults            true
  92         SPFSelfValidate             true
  93         UMask                       002
  94         '';
  95       group = config.services.postfix.group;
  96     };
  97     services.filesWatcher.opendmarc = {
  98       restart = true;
  99       paths = [
 100         config.secrets.fullPaths."opendmarc/ignore.hosts"
 101       ];
 102     };
 103
 104     services.openarc = {
 105       enable = true;
 106       user = "opendkim";
 107       socket = "local:${config.myServices.mail.milters.sockets.openarc}";
 108       group = config.services.postfix.group;
 109       configFile = pkgs.writeText "openarc.conf" ''
 110         AuthservID              mail.immae.eu
 111         Domain                  mail.immae.eu
 112         KeyFile                 ${config.secrets.fullPaths."opendkim/eldiron.private"}
 113         Mode                    sv
 114         Selector                eldiron
 115         SoftwareHeader          yes
 116         Syslog                  Yes
 117         '';
 118     };
 119     systemd.services.openarc.postStart = lib.optionalString
 120           (lib.strings.hasPrefix "local:" config.services.openarc.socket) ''
 121       while [ ! -S ${lib.strings.removePrefix "local:" config.services.openarc.socket} ]; do
 122         sleep 0.5
 123       done
 124       chmod g+w ${lib.strings.removePrefix "local:" config.services.openarc.socket}
 125       '';
 126     services.filesWatcher.openarc = {
 127       restart = true;
 128       paths = [
 129         config.secrets.fullPaths."opendkim/eldiron.private"
 130       ];
 131     };
 132
 133     systemd.services.milter_verify_from = {
 134       description  = "Verify from milter";
 135       after = [ "network.target" ];
 136       wantedBy = [ "multi-user.target" ];
 137
 138       serviceConfig = {
 139         User = "postfix";
 140         Group = "postfix";
 141         ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
 142           in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
 143         RuntimeDirectory = "milter_verify_from";
 144       };
 145     };
 146   };
 147 }