modules/private/mail/opensmtpd.nix

   1 { lib, pkgs, config, name, ... }:
   2 {
   3   config = lib.mkIf config.myServices.mailRelay.enable {
   4     secrets.keys."opensmtpd/creds" = {
   5       user = "smtpd";
   6       group = "smtpd";
   7       permissions = "0400";
   8       text = ''
   9         eldiron    ${name}:${config.hostEnv.ldap.password}
  10         '';
  11     };
  12     users.users.smtpd.extraGroups = [ "keys" ];
  13     services.opensmtpd = {
  14       enable = true;
  15       serverConfiguration = let
  16         filter-rewrite-from = pkgs.runCommand "filter-rewrite-from.py" {
  17           buildInputs = [ pkgs.python3 ];
  18         } ''
  19           cp ${./filter-rewrite-from.py} $out
  20           patchShebangs $out
  21         '';
  22       in ''
  23         table creds \
  24           "${config.secrets.fullPaths."opensmtpd/creds"}"
  25         # FIXME: filtering requires 6.6, uncomment following lines when
  26         # upgrading
  27         # filter "fixfrom" \
  28         #   proc-exec "${filter-rewrite-from} ${name}@immae.eu"
  29         # listen on socket filter "fixfrom"
  30         action "relay-rewrite-from" relay \
  31           helo ${config.hostEnv.fqdn} \
  32           host smtp+tls://eldiron@eldiron.immae.eu:587 \
  33           auth <creds> \
  34           mail-from ${name}@immae.eu
  35         action "relay" relay \
  36           helo ${config.hostEnv.fqdn} \
  37           host smtp+tls://eldiron@eldiron.immae.eu:587 \
  38           auth <creds>
  39         match for any !mail-from "@immae.eu" action "relay-rewrite-from"
  40         match for any mail-from "@immae.eu" action "relay"
  41         '';
  42     };
  43     environment.systemPackages = [ config.services.opensmtpd.package ];
  44     services.mail.sendmailSetuidWrapper = {
  45       program = "sendmail";
  46       source = "${config.services.opensmtpd.package}/bin/smtpctl";
  47       setuid = false;
  48       setgid = false;
  49     };
  50     security.wrappers.mailq = {
  51       program = "mailq";
  52       source = "${config.services.opensmtpd.package}/bin/smtpctl";
  53       setuid = false;
  54       setgid = false;
  55     };
  56   };
  57 }