{ lib, pkgs, config, nodes, name, ... }:
{
config = lib.mkIf config.myServices.mailBackup.enable {
- security.acme2.certs."mail" = config.myServices.certificates.certConfig // {
+ security.acme.certs."mail" = config.myServices.certificates.certConfig // {
postRun = ''
systemctl restart postfix.service
'';
mxs = map (zone: "${config.myEnv.servers."${name}".mx.subdomain}.${zone.name}") zonesWithMx;
in builtins.listToAttrs (map (mx: lib.attrsets.nameValuePair mx null) mxs);
};
- secrets.keys = [
- {
- dest = "postfix/mysql_alias_maps";
+ secrets.keys = {
+ "postfix/mysql_alias_maps" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
dbname = ${config.myEnv.mail.postfix.mysql.database}
query = SELECT DISTINCT 1
- FROM forwardings_merge
+ FROM forwardings
WHERE
((regex = 1 AND '%s' REGEXP CONCAT('^',source,'$') ) OR (regex = 0 AND source = '%s'))
AND active = 1
FROM forwardings_blacklisted
WHERE source = '%s'
'';
- }
- {
- dest = "postfix/mysql_mailbox_maps";
+ };
+ "postfix/ldap_mailboxes" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
text = ''
- # We need to specify that option to trigger ssl connection
- tls_ciphers = TLSv1.2
- user = ${config.myEnv.mail.postfix.mysql.user}
- password = ${config.myEnv.mail.postfix.mysql.password}
- hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
- dbname = ${config.myEnv.mail.postfix.mysql.database}
- query = SELECT DISTINCT 1
- FROM mailboxes
- WHERE active = 1
- AND (
- (domain = '%d' AND user = '%u' AND regex = 0)
- OR (
- regex = 1
- AND '%d' REGEXP CONCAT('^',domain,'$')
- AND '%u' REGEXP CONCAT('^',user,'$')
- )
+ server_host = ldaps://${config.myEnv.mail.dovecot.ldap.host}:636
+ search_base = ${config.myEnv.mail.dovecot.ldap.base}
+ query_filter = ${config.myEnv.mail.dovecot.ldap.postfix_mailbox_filter}
+ bind_dn = ${config.myEnv.mail.dovecot.ldap.dn}
+ bind_pw = ${config.myEnv.mail.dovecot.ldap.password}
+ result_attribute = immaePostfixAddress
+ result_format = dummy
+ version = 3
+ '';
+ };
+ "postfix/sympa_mailbox_maps" = {
+ user = config.services.postfix.user;
+ group = config.services.postfix.group;
+ permissions = "0440";
+ text = ''
+ hosts = ${config.myEnv.mail.sympa.postgresql.host}
+ user = ${config.myEnv.mail.sympa.postgresql.user}
+ password = ${config.myEnv.mail.sympa.postgresql.password}
+ dbname = ${config.myEnv.mail.sympa.postgresql.database}
+ query = SELECT DISTINCT 1 FROM list_table WHERE '%s' IN (
+ CONCAT(name_list, '@', robot_list),
+ CONCAT(name_list, '-request@', robot_list),
+ CONCAT(name_list, '-editor@', robot_list),
+ CONCAT(name_list, '-unsubscribe@', robot_list),
+ CONCAT(name_list, '-owner@', robot_list),
+ CONCAT('sympa-request@', robot_list),
+ CONCAT('sympa-owner@', robot_list),
+ CONCAT('sympa@', robot_list),
+ CONCAT('listmaster@', robot_list),
+ CONCAT('bounce@', robot_list),
+ CONCAT('abuse-feedback-report@', robot_list)
)
- LIMIT 1
'';
- }
- {
- dest = "postfix/ldap_ejabberd_users_immae_fr";
+ };
+ "postfix/ldap_ejabberd_users_immae_fr" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
result_format = ejabberd@localhost
version = 3
'';
- }
- ];
+ };
+ };
networking.firewall.allowedTCPPorts = [ 25 ];
- nixpkgs.overlays = [ (self: super: {
- postfix = super.postfix.override { withMySQL = true; };
- }) ];
users.users."${config.services.postfix.user}".extraGroups = [ "keys" ];
services.filesWatcher.postfix = {
restart = true;
paths = [
config.secrets.fullPaths."postfix/mysql_alias_maps"
- config.secrets.fullPaths."postfix/mysql_mailbox_maps"
+ config.secrets.fullPaths."postfix/sympa_mailbox_maps"
config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"
+ config.secrets.fullPaths."postfix/ldap_mailboxes"
];
};
services.postfix = {
)
);
};
- sasl_access = {
- host_dummy_mailboxes = pkgs.writeText "host-virtual-mailbox"
- (builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (n: v: "${n}@immae.eu 1") nodes));
- };
in
- recipient_maps // relay_restrictions // virtual_map // sasl_access;
+ recipient_maps // relay_restrictions // virtual_map;
config = {
### postfix module overrides
readme_directory = "${pkgs.postfix}/share/postfix/doc";
relay_domains = let
backups = lib.flatten (lib.attrsets.mapAttrsToList (n: v: v.domains or []) config.myEnv.mail.postfix.backup_domains);
virtual_domains = config.myEnv.mail.postfix.additional_mailbox_domains
- ++ lib.remove "localhost.immae.eu" (lib.remove null (lib.flatten (map
+ ++ lib.remove null (lib.flatten (map
(zone: map
(e: if e.receive
then "${e.domain}${lib.optionalString (e.domain != "") "."}${zone.name}"
(zone.withEmail or [])
)
config.myEnv.dns.masterZones
- )));
+ ));
in
backups ++ virtual_domains;
relay_recipient_maps = let
"ldap:${config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"}"
];
virtual_mailbox_maps = [
- "hash:/etc/postfix/host_dummy_mailboxes"
- "mysql:${config.secrets.fullPaths."postfix/mysql_mailbox_maps"}"
+ "ldap:${config.secrets.fullPaths."postfix/ldap_mailboxes"}"
+ "pgsql:${config.secrets.fullPaths."postfix/sympa_mailbox_maps"}"
];
in
backup_recipients ++ virtual_alias_maps ++ virtual_mailbox_maps;
enable = true;
enableSmtp = true;
enableSubmission = false;
- # FIXME: Mail adressed to localhost.immae.eu will still have mx-1 as
- # prioritized MX, which provokes "mail for localhost.immae.eu loops
- # back to myself" errors. This transport entry forces to push
- # e-mails to its right destination.
- transport = ''
- localhost.immae.eu smtp:[immae.eu]:25
- '';
destination = ["localhost"];
# This needs to reverse DNS
hostname = config.hostEnv.fqdn;
projects / perso / Immae / Config / Nix.git / blobdiff