Add relay restrictions per domain

[perso/Immae/Config/Nix.git] / modules / private / mail / postfix.nix

diff --git a/modules/private/mail/postfix.nix b/modules/private/mail/postfix.nix
index dfe6129af9ef847db361a819a69ec8b96f833388..2dccc41fedbcd9041b893808dee2c430d65d027a 100644 (file)
--- a/modules/private/mail/postfix.nix
+++ b/modules/private/mail/postfix.nix
@@ -77,7 +77,7 @@
     }
   ];
 
-  config.networking.firewall.allowedTCPPorts = [ 25 587 ];
+  config.networking.firewall.allowedTCPPorts = [ 25 465 587 ];
 
   config.nixpkgs.overlays = [ (self: super: {
     postfix = super.postfix.override { withMySQL = true; };
@@ -93,19 +93,30 @@
   };
   config.services.postfix = {
     mapFiles = let
-      name = n: i: "relay_${n}_${toString i}";
-      pair = n: i: m: lib.attrsets.nameValuePair (name n i) (
-        if m.type == "hash"
-        then pkgs.writeText (name n i) m.content
-        else null
-      );
-      pairs = n: v: lib.imap1 (i: m: pair n i m) v.recipient_maps;
-    in
-      lib.attrsets.filterAttrs (k: v: v != null) (
+      recipient_maps = let
+        name = n: i: "relay_${n}_${toString i}";
+        pair = n: i: m: lib.attrsets.nameValuePair (name n i) (
+          if m.type == "hash"
+          then pkgs.writeText (name n i) m.content
+          else null
+        );
+        pairs = n: v: lib.imap1 (i: m: pair n i m) v.recipient_maps;
+      in lib.attrsets.filterAttrs (k: v: v != null) (
         lib.attrsets.listToAttrs (lib.flatten (
           lib.attrsets.mapAttrsToList pairs myconfig.env.mail.postfix.backup_domains
         ))
       );
+      relay_restrictions = lib.attrsets.filterAttrs (k: v: v != null) (
+        lib.attrsets.mapAttrs' (n: v:
+          lib.attrsets.nameValuePair "recipient_access_${n}" (
+            if lib.attrsets.hasAttr "relay_restrictions" v
+            then pkgs.writeText "recipient_access_${n}" v.relay_restrictions
+            else null
+          )
+        ) myconfig.env.mail.postfix.backup_domains
+      );
+    in
+      recipient_maps // relay_restrictions;
     config = {
       ### postfix module overrides
       readme_directory = "${pkgs.postfix}/share/postfix/doc";
@@ -138,6 +149,15 @@
       relay_recipient_maps = lib.flatten (lib.attrsets.mapAttrsToList (n: v:
         lib.imap1 (i: m: "${m.type}:/etc/postfix/relay_${n}_${toString i}") v.recipient_maps
       ) myconfig.env.mail.postfix.backup_domains);
+      smtpd_relay_restrictions = [
+        "permit_mynetworks"
+        "permit_sasl_authenticated"
+        "defer_unauth_destination"
+      ] ++ lib.flatten (lib.attrsets.mapAttrsToList (n: v:
+        if lib.attrsets.hasAttr "relay_restrictions" v
+        then [ "check_recipient_access hash:/etc/postfix/recipient_access_${n}" ]
+        else []
+      ) myconfig.env.mail.postfix.backup_domains);
 
       ### Additional smtpd configuration
       smtpd_tls_received_header = "yes";
@@ -205,6 +225,15 @@
     sslKey = "/var/lib/acme/mail/key.pem";
     recipientDelimiter = "+";
     masterConfig = {
+      submissions = {
+        type = "inet";
+        private = false;
+        command = "smtpd";
+        args = ["-o" "smtpd_tls_wrappermode=yes" ] ++ (let
+          mkKeyVal = opt: val: [ "-o" (opt + "=" + val) ];
+        in lib.concatLists (lib.mapAttrsToList mkKeyVal config.services.postfix.submissionOptions)
+        );
+      };
       dovecot = {
         type = "unix";
         privileged = true;