Add milter to verify from

[perso/Immae/Config/Nix.git] / modules / private / mail / milters.nix

diff --git a/modules/private/mail/milters.nix b/modules/private/mail/milters.nix
index 6b033e86102c4b684c115cf11cf31e220c0c3949..5de03cf12dcb04152579f01ffa5e7a4c7823fbe5 100644 (file)
--- a/modules/private/mail/milters.nix
+++ b/modules/private/mail/milters.nix
@@ -12,7 +12,7 @@
       milters sockets
       '';
   };
-  config = lib.mkIf config.myServices.mail.enable {
+  config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
     secrets.keys = [
       {
         dest = "opendkim/eldiron.private";
@@ -34,7 +34,14 @@
         user = config.services.opendmarc.user;
         group = config.services.opendmarc.group;
         permissions = "0400";
-        text = config.myEnv.mail.dmarc.ignore_hosts;
+        text = let
+          mxes = lib.attrsets.filterAttrs
+            (n: v: v.mx.enable)
+            config.myEnv.servers;
+          in
+            builtins.concatStringsSep "\n" ([
+              config.myEnv.mail.dmarc.ignore_hosts
+            ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
       }
     ];
     users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
@@ -51,8 +58,9 @@
       keyPath = "${config.secrets.location}/opendkim";
       selector = "eldiron";
       configFile = pkgs.writeText "opendkim.conf" ''
-        SubDomains     yes
-        UMask          002
+        SubDomains        yes
+        UMask             002
+        AlwaysAddARHeader yes
         '';
       group = config.services.postfix.group;
     };
@@ -74,14 +82,14 @@
       configFile = pkgs.writeText "opendmarc.conf" ''
         AuthservID                  HOSTNAME
         FailureReports              false
-        FailureReportsBcc           postmaster@localhost.immae.eu
+        FailureReportsBcc           postmaster@immae.eu
         FailureReportsOnNone        true
         FailureReportsSentBy        postmaster@immae.eu
         IgnoreAuthenticatedClients  true
         IgnoreHosts                 ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
         SoftwareHeader              true
+        SPFIgnoreResults            true
         SPFSelfValidate             true
-        TrustedAuthservIDs          HOSTNAME, immae.eu, nef2.ens.fr
         UMask                       002
         '';
       group = config.services.postfix.group;
@@ -121,5 +129,19 @@
         config.secrets.fullPaths."opendkim/eldiron.private"
       ];
     };
+
+    systemd.services.milter_verify_from = {
+      description  = "Verify from milter";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        User = "postfix";
+        Group = "postfix";
+        ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
+          in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
+        RuntimeDirectory = "milter_verify_from";
+      };
+    };
   };
 }