-{ lib, pkgs, config, myconfig, ... }:
+{ lib, pkgs, config, ... }:
{
options.myServices.mail.milters.sockets = lib.mkOption {
type = lib.types.attrsOf lib.types.path;
milters sockets
'';
};
- config.secrets.keys = [
- {
- dest = "opendkim/eldiron.private";
- user = config.services.opendkim.user;
- group = config.services.opendkim.group;
- permissions = "0400";
- text = myconfig.env.mail.dkim.eldiron.private;
- }
- {
- dest = "opendkim/eldiron.txt";
- user = config.services.opendkim.user;
- group = config.services.opendkim.group;
- permissions = "0444";
- text = ''
- eldiron._domainkey IN TXT ${myconfig.env.mail.dkim.eldiron.public}'';
- }
- {
- dest = "opendmarc/ignore.hosts";
- user = config.services.opendmarc.user;
- group = config.services.opendmarc.group;
- permissions = "0400";
- text = myconfig.env.mail.dmarc.ignore_hosts;
- }
- ];
- config.users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
- config.services.opendkim = {
- enable = true;
- socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
- domains = builtins.concatStringsSep "," (lib.flatten (map
- (zone: map
- (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
- (zone.withEmail or [])
- )
- myconfig.env.dns.masterZones
- ));
- keyPath = "${config.secrets.location}/opendkim";
- selector = "eldiron";
- configFile = pkgs.writeText "opendkim.conf" ''
- SubDomains yes
- UMask 002
- '';
- group = config.services.postfix.group;
- };
- config.systemd.services.opendkim.preStart = lib.mkBefore ''
- # Skip the prestart script as keys are handled in secrets
- exit 0
- '';
- config.services.filesWatcher.opendkim = {
- restart = true;
- paths = [
- config.secrets.fullPaths."opendkim/eldiron.private"
+ config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
+ secrets.keys = [
+ {
+ dest = "opendkim/eldiron.private";
+ user = config.services.opendkim.user;
+ group = config.services.opendkim.group;
+ permissions = "0400";
+ text = config.myEnv.mail.dkim.eldiron.private;
+ }
+ {
+ dest = "opendkim/eldiron.txt";
+ user = config.services.opendkim.user;
+ group = config.services.opendkim.group;
+ permissions = "0444";
+ text = ''
+ eldiron._domainkey IN TXT ${config.myEnv.mail.dkim.eldiron.public}'';
+ }
+ {
+ dest = "opendmarc/ignore.hosts";
+ user = config.services.opendmarc.user;
+ group = config.services.opendmarc.group;
+ permissions = "0400";
+ text = let
+ mxes = lib.attrsets.filterAttrs
+ (n: v: v.mx.enable)
+ config.myEnv.servers;
+ in
+ builtins.concatStringsSep "\n" ([
+ config.myEnv.mail.dmarc.ignore_hosts
+ ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
+ }
];
- };
-
- config.users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
- config.services.opendmarc = {
- enable = true;
- socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
- configFile = pkgs.writeText "opendmarc.conf" ''
- AuthservID HOSTNAME
- FailureReports false
- FailureReportsBcc postmaster@localhost.immae.eu
- FailureReportsOnNone true
- FailureReportsSentBy postmaster@immae.eu
- IgnoreAuthenticatedClients true
- IgnoreHosts ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
- SoftwareHeader true
- SPFSelfValidate true
- TrustedAuthservIDs HOSTNAME, immae.eu, nef2.ens.fr
- UMask 002
+ users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
+ services.opendkim = {
+ enable = true;
+ socket = "local:${config.myServices.mail.milters.sockets.opendkim}";
+ domains = builtins.concatStringsSep "," (lib.flatten (map
+ (zone: map
+ (e: "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}")
+ (zone.withEmail or [])
+ )
+ config.myEnv.dns.masterZones
+ ));
+ keyPath = "${config.secrets.location}/opendkim";
+ selector = "eldiron";
+ configFile = pkgs.writeText "opendkim.conf" ''
+ SubDomains yes
+ UMask 002
+ AlwaysAddARHeader yes
+ '';
+ group = config.services.postfix.group;
+ };
+ systemd.services.opendkim.preStart = lib.mkBefore ''
+ # Skip the prestart script as keys are handled in secrets
+ exit 0
'';
- group = config.services.postfix.group;
- };
- config.services.filesWatcher.opendmarc = {
- restart = true;
- paths = [
- config.secrets.fullPaths."opendmarc/ignore.hosts"
- ];
- };
+ services.filesWatcher.opendkim = {
+ restart = true;
+ paths = [
+ config.secrets.fullPaths."opendkim/eldiron.private"
+ ];
+ };
- config.services.openarc = {
- enable = true;
- user = "opendkim";
- socket = "local:${config.myServices.mail.milters.sockets.openarc}";
- group = config.services.postfix.group;
- configFile = pkgs.writeText "openarc.conf" ''
- AuthservID mail.immae.eu
- Domain mail.immae.eu
- KeyFile ${config.secrets.fullPaths."opendkim/eldiron.private"}
- Mode sv
- Selector eldiron
- SoftwareHeader yes
- Syslog Yes
+ users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
+ services.opendmarc = {
+ enable = true;
+ socket = "local:${config.myServices.mail.milters.sockets.opendmarc}";
+ configFile = pkgs.writeText "opendmarc.conf" ''
+ AuthservID HOSTNAME
+ FailureReports false
+ FailureReportsBcc postmaster@immae.eu
+ FailureReportsOnNone true
+ FailureReportsSentBy postmaster@immae.eu
+ IgnoreAuthenticatedClients true
+ IgnoreHosts ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
+ SoftwareHeader true
+ SPFIgnoreResults true
+ SPFSelfValidate true
+ UMask 002
+ '';
+ group = config.services.postfix.group;
+ };
+ services.filesWatcher.opendmarc = {
+ restart = true;
+ paths = [
+ config.secrets.fullPaths."opendmarc/ignore.hosts"
+ ];
+ };
+
+ services.openarc = {
+ enable = true;
+ user = "opendkim";
+ socket = "local:${config.myServices.mail.milters.sockets.openarc}";
+ group = config.services.postfix.group;
+ configFile = pkgs.writeText "openarc.conf" ''
+ AuthservID mail.immae.eu
+ Domain mail.immae.eu
+ KeyFile ${config.secrets.fullPaths."opendkim/eldiron.private"}
+ Mode sv
+ Selector eldiron
+ SoftwareHeader yes
+ Syslog Yes
+ '';
+ };
+ systemd.services.openarc.postStart = lib.optionalString
+ (lib.strings.hasPrefix "local:" config.services.openarc.socket) ''
+ while [ ! -S ${lib.strings.removePrefix "local:" config.services.openarc.socket} ]; do
+ sleep 0.5
+ done
+ chmod g+w ${lib.strings.removePrefix "local:" config.services.openarc.socket}
'';
- };
- config.systemd.services.openarc.postStart = lib.optionalString
- (lib.strings.hasPrefix "local:" config.services.openarc.socket) ''
- while [ ! -S ${lib.strings.removePrefix "local:" config.services.openarc.socket} ]; do
- sleep 0.5
- done
- chmod g+w ${lib.strings.removePrefix "local:" config.services.openarc.socket}
- '';
- config.services.filesWatcher.openarc = {
- restart = true;
- paths = [
- config.secrets.fullPaths."opendkim/eldiron.private"
- ];
+ services.filesWatcher.openarc = {
+ restart = true;
+ paths = [
+ config.secrets.fullPaths."opendkim/eldiron.private"
+ ];
+ };
+
+ systemd.services.milter_verify_from = {
+ description = "Verify from milter";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+
+ serviceConfig = {
+ User = "postfix";
+ Group = "postfix";
+ ExecStart = let python = pkgs.python3.withPackages (p: [ p.pymilter ]);
+ in "${python}/bin/python ${./verify_from.py} -s /run/milter_verify_from/verify_from.sock";
+ RuntimeDirectory = "milter_verify_from";
+ };
+ };
};
}
projects / perso / Immae / Config / Nix.git / blobdiff