1 { lib, pkgs, config, name, ... }:
4 builtins.attrValues (import ../../../lib/flake-compat.nix ../../../flakes/openarc).nixosModules;
6 options.myServices.mail.milters.sockets = lib.mkOption {
7 type = lib.types.attrsOf lib.types.path;
9 opendkim = "/run/opendkim/opendkim.sock";
10 opendmarc = "/run/opendmarc/opendmarc.sock";
11 openarc = "/run/openarc/openarc.sock";
18 config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
21 dest = "opendkim/eldiron.private";
22 user = config.services.opendkim.user;
23 group = config.services.opendkim.group;
25 text = config.myEnv.mail.dkim.eldiron.private;
28 dest = "opendkim/eldiron.txt";
29 user = config.services.opendkim.user;
30 group = config.services.opendkim.group;
33 eldiron._domainkey IN TXT ${config.myEnv.mail.dkim.eldiron.public}'';
36 dest = "opendmarc/ignore.hosts";
37 user = config.services.opendmarc.user;
38 group = config.services.opendmarc.group;
41 mxes = lib.attrsets.filterAttrs
45 builtins.concatStringsSep "\n" ([
46 config.myEnv.mail.dmarc.ignore_hosts
47 ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
50 users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
53 socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
54 domains = builtins.concatStringsSep "," (lib.flatten (map
56 (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
57 (zone.withEmail or [])
59 config.myEnv.dns.masterZones
61 keyPath = "${config.secrets.location}/opendkim";
63 configFile = pkgs.writeText "opendkim.conf" ''
68 group = config.services.postfix.group;
70 systemd.services.opendkim.serviceConfig.Slice = "mail.slice";
71 systemd.services.opendkim.preStart = lib.mkBefore ''
72 # Skip the prestart script as keys are handled in secrets
75 services.filesWatcher.opendkim = {
78 config.secrets.fullPaths."opendkim/eldiron.private"
82 users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
83 systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
84 services.opendmarc = {
86 socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
87 configFile = pkgs.writeText "opendmarc.conf" ''
90 FailureReportsBcc postmaster@immae.eu
91 FailureReportsOnNone true
92 FailureReportsSentBy postmaster@immae.eu
93 IgnoreAuthenticatedClients true
94 IgnoreHosts ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
100 group = config.services.postfix.group;
102 services.filesWatcher.opendmarc = {
105 config.secrets.fullPaths."opendmarc/ignore.hosts"
109 systemd.services.milter_verify_from = {
110 description = "Verify from milter";
111 after = [ "network.target" ];
112 wantedBy = [ "multi-user.target" ];
115 Slice = "mail.slice";
118 ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
119 in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
120 RuntimeDirectory = "milter_verify_from";