modules/private/mail/relay.nix

   1 { lib, pkgs, config, nodes, name, ... }:
   2 {
   3   config = lib.mkIf config.myServices.mailBackup.enable {
   4     security.acme.certs."mail" = config.myServices.certificates.certConfig // {
   5       postRun = ''
   6         systemctl restart postfix.service
   7         '';
   8       domain = config.hostEnv.fqdn;
   9       extraDomains = let
  10         zonesWithMx = builtins.filter (zone:
  11           lib.attrsets.hasAttr "withEmail" zone && lib.lists.length zone.withEmail > 0
  12         ) config.myEnv.dns.masterZones;
  13         mxs = map (zone: "${config.myEnv.servers."${name}".mx.subdomain}.${zone.name}") zonesWithMx;
  14       in builtins.listToAttrs (map (mx: lib.attrsets.nameValuePair mx null) mxs);
  15     };
  16     secrets.keys = [
  17       {
  18         dest = "postfix/mysql_alias_maps";
  19         user = config.services.postfix.user;
  20         group = config.services.postfix.group;
  21         permissions = "0440";
  22         text = ''
  23           # We need to specify that option to trigger ssl connection
  24           tls_ciphers = TLSv1.2
  25           user = ${config.myEnv.mail.postfix.mysql.user}
  26           password = ${config.myEnv.mail.postfix.mysql.password}
  27           hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
  28           dbname = ${config.myEnv.mail.postfix.mysql.database}
  29           query = SELECT DISTINCT 1
  30             FROM forwardings_merge
  31             WHERE
  32               ((regex = 1 AND '%s' REGEXP CONCAT('^',source,'$') ) OR (regex = 0 AND source = '%s'))
  33               AND active = 1
  34               AND '%s' NOT IN
  35               (
  36                 SELECT source
  37                 FROM forwardings_blacklisted
  38                 WHERE source = '%s'
  39               ) UNION
  40               SELECT 'devnull@immae.eu'
  41               FROM forwardings_blacklisted
  42               WHERE source = '%s'
  43           '';
  44       }
  45       {
  46         dest = "postfix/mysql_mailbox_maps";
  47         user = config.services.postfix.user;
  48         group = config.services.postfix.group;
  49         permissions = "0440";
  50         text = ''
  51           # We need to specify that option to trigger ssl connection
  52           tls_ciphers = TLSv1.2
  53           user = ${config.myEnv.mail.postfix.mysql.user}
  54           password = ${config.myEnv.mail.postfix.mysql.password}
  55           hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
  56           dbname = ${config.myEnv.mail.postfix.mysql.database}
  57           query = SELECT DISTINCT 1
  58             FROM mailboxes
  59             WHERE active = 1
  60             AND (
  61               (domain = '%d' AND user = '%u' AND regex = 0)
  62               OR (
  63                 regex = 1
  64                 AND '%d' REGEXP CONCAT('^',domain,'$')
  65                 AND '%u' REGEXP CONCAT('^',user,'$')
  66               )
  67             )
  68             LIMIT 1
  69         '';
  70       }
  71       {
  72         dest = "postfix/ldap_ejabberd_users_immae_fr";
  73         user = config.services.postfix.user;
  74         group = config.services.postfix.group;
  75         permissions = "0440";
  76         text = ''
  77           server_host = ldaps://${config.myEnv.jabber.ldap.host}:636
  78           search_base = ${config.myEnv.jabber.ldap.base}
  79           query_filter = ${config.myEnv.jabber.postfix_user_filter}
  80           domain = immae.fr
  81           bind_dn = ${config.myEnv.jabber.ldap.dn}
  82           bind_pw = ${config.myEnv.jabber.ldap.password}
  83           result_attribute = immaeXmppUid
  84           result_format = ejabberd@localhost
  85           version = 3
  86           '';
  87       }
  88     ];
  89
  90     networking.firewall.allowedTCPPorts = [ 25 ];
  91
  92     users.users."${config.services.postfix.user}".extraGroups = [ "keys" ];
  93     services.filesWatcher.postfix = {
  94       restart = true;
  95       paths = [
  96         config.secrets.fullPaths."postfix/mysql_alias_maps"
  97         config.secrets.fullPaths."postfix/mysql_mailbox_maps"
  98         config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"
  99       ];
 100     };
 101     services.postfix = {
 102       mapFiles = let
 103         recipient_maps = let
 104           name = n: i: "relay_${n}_${toString i}";
 105           pair = n: i: m: lib.attrsets.nameValuePair (name n i) (
 106             if m.type == "hash"
 107             then pkgs.writeText (name n i) m.content
 108             else null
 109           );
 110           pairs = n: v: lib.imap1 (i: m: pair n i m) v.recipient_maps;
 111         in lib.attrsets.filterAttrs (k: v: v != null) (
 112           lib.attrsets.listToAttrs (lib.flatten (
 113             lib.attrsets.mapAttrsToList pairs config.myEnv.mail.postfix.backup_domains
 114           ))
 115         );
 116         relay_restrictions = lib.attrsets.filterAttrs (k: v: v != null) (
 117           lib.attrsets.mapAttrs' (n: v:
 118             lib.attrsets.nameValuePair "recipient_access_${n}" (
 119               if lib.attrsets.hasAttr "relay_restrictions" v
 120               then pkgs.writeText "recipient_access_${n}" v.relay_restrictions
 121               else null
 122             )
 123           ) config.myEnv.mail.postfix.backup_domains
 124         );
 125         virtual_map = {
 126           virtual = let
 127             cfg = config.myEnv.monitoring.email_check.eldiron;
 128             address = "${cfg.mail_address}@${cfg.mail_domain}";
 129           in pkgs.writeText "postfix-virtual" (
 130             builtins.concatStringsSep "\n" (
 131               ["${address} 1"] ++
 132               lib.attrsets.mapAttrsToList (
 133                 n: v: lib.optionalString v.external ''
 134                   script_${n}@mail.immae.eu 1
 135                 ''
 136               ) config.myEnv.mail.scripts
 137             )
 138           );
 139         };
 140         sasl_access = {
 141           host_dummy_mailboxes = pkgs.writeText "host-virtual-mailbox"
 142             (builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (n: v: "${n}@immae.eu  1") nodes));
 143         };
 144       in
 145         recipient_maps // relay_restrictions // virtual_map // sasl_access;
 146       config = {
 147         ### postfix module overrides
 148         readme_directory = "${pkgs.postfix}/share/postfix/doc";
 149         smtp_tls_CAfile = lib.mkForce "";
 150         smtp_tls_cert_file = lib.mkForce "";
 151         smtp_tls_key_file = lib.mkForce "";
 152
 153         message_size_limit = "1073741824"; # Don't put 0 here, it's not equivalent to "unlimited"
 154         mailbox_size_limit = "1073741825"; # Workaround, local delivered mails should all go through scripts
 155         alias_database = "\$alias_maps";
 156
 157         ### Relay domains
 158         relay_domains = let
 159           backups = lib.flatten (lib.attrsets.mapAttrsToList (n: v: v.domains or []) config.myEnv.mail.postfix.backup_domains);
 160           virtual_domains = config.myEnv.mail.postfix.additional_mailbox_domains
 161             ++ lib.remove null (lib.flatten (map
 162                 (zone: map
 163                   (e: if e.receive
 164                   then "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}"
 165                   else null
 166                   )
 167                   (zone.withEmail or [])
 168                 )
 169                 config.myEnv.dns.masterZones
 170               ));
 171         in
 172           backups ++ virtual_domains;
 173         relay_recipient_maps = let
 174           backup_recipients = lib.flatten (lib.attrsets.mapAttrsToList (n: v:
 175             lib.imap1 (i: m: "${m.type}:/etc/postfix/relay_${n}_${toString i}") v.recipient_maps
 176           ) config.myEnv.mail.postfix.backup_domains);
 177           virtual_alias_maps = [
 178             "hash:/etc/postfix/virtual"
 179             "mysql:${config.secrets.fullPaths."postfix/mysql_alias_maps"}"
 180             "ldap:${config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"}"
 181           ];
 182           virtual_mailbox_maps = [
 183             "hash:/etc/postfix/host_dummy_mailboxes"
 184             "mysql:${config.secrets.fullPaths."postfix/mysql_mailbox_maps"}"
 185           ];
 186         in
 187           backup_recipients ++ virtual_alias_maps ++ virtual_mailbox_maps;
 188         smtpd_relay_restrictions = [
 189           "defer_unauth_destination"
 190         ] ++ lib.flatten (lib.attrsets.mapAttrsToList (n: v:
 191           if lib.attrsets.hasAttr "relay_restrictions" v
 192           then [ "check_recipient_access hash:/etc/postfix/recipient_access_${n}" ]
 193           else []
 194         ) config.myEnv.mail.postfix.backup_domains);
 195
 196         ### Additional smtpd configuration
 197         smtpd_tls_received_header = "yes";
 198         smtpd_tls_loglevel = "1";
 199
 200         ### Email sending configuration
 201         smtp_tls_security_level = "may";
 202         smtp_tls_loglevel = "1";
 203
 204         ### Force ip bind for smtp
 205         smtp_bind_address  = config.myEnv.servers."${name}".ips.main.ip4;
 206         smtp_bind_address6 = builtins.head config.myEnv.servers."${name}".ips.main.ip6;
 207
 208         smtpd_milters = [
 209           "unix:${config.myServices.mail.milters.sockets.opendkim}"
 210           "unix:${config.myServices.mail.milters.sockets.openarc}"
 211           "unix:${config.myServices.mail.milters.sockets.opendmarc}"
 212         ];
 213       };
 214       enable = true;
 215       enableSmtp = true;
 216       enableSubmission = false;
 217       destination = ["localhost"];
 218       # This needs to reverse DNS
 219       hostname = config.hostEnv.fqdn;
 220       setSendmail = false;
 221       sslCert = "/var/lib/acme/mail/fullchain.pem";
 222       sslKey = "/var/lib/acme/mail/key.pem";
 223       recipientDelimiter = "+";
 224     };
 225   };
 226 }
 227