From 22b4bd78a10b49272cfd345d379703cae4ab5d3d Mon Sep 17 00:00:00 2001 From: =?utf8?q?Isma=C3=ABl=20Bouya?= Date: Thu, 7 May 2020 10:40:43 +0200 Subject: [PATCH] Use ldap instead of mysql to fetch mailboxes --- modules/private/environment.nix | 1 + modules/private/mail/postfix.nix | 36 +++++++--------------- modules/private/mail/relay.nix | 53 +++++++++++++++----------------- modules/private/mail/sympa.nix | 1 + 4 files changed, 38 insertions(+), 53 deletions(-) diff --git a/modules/private/environment.nix b/modules/private/environment.nix index 7555fe6..5d74ab5 100644 --- a/modules/private/environment.nix +++ b/modules/private/environment.nix @@ -650,6 +650,7 @@ in user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; }; iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; }; iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; }; + postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; }; }; }; }; diff --git a/modules/private/mail/postfix.nix b/modules/private/mail/postfix.nix index 46d45c1..0c95df5 100644 --- a/modules/private/mail/postfix.nix +++ b/modules/private/mail/postfix.nix @@ -34,30 +34,19 @@ ''; } { - dest = "postfix/mysql_mailbox_maps"; + dest = "postfix/ldap_mailboxes"; user = config.services.postfix.user; group = config.services.postfix.group; permissions = "0440"; text = '' - # We need to specify that option to trigger ssl connection - tls_ciphers = TLSv1.2 - user = ${config.myEnv.mail.postfix.mysql.user} - password = ${config.myEnv.mail.postfix.mysql.password} - hosts = unix:${config.myEnv.mail.postfix.mysql.socket} - dbname = ${config.myEnv.mail.postfix.mysql.database} - result_format = /%d/%u - query = SELECT DISTINCT '%s' - FROM mailboxes - WHERE active = 1 - AND ( - (domain = '%d' AND user = '%u' AND regex = 0) - OR ( - regex = 1 - AND '%d' REGEXP CONCAT('^',domain,'$') - AND '%u' REGEXP CONCAT('^',user,'$') - ) - ) - LIMIT 1 + server_host = ldaps://${config.myEnv.mail.dovecot.ldap.host}:636 + search_base = ${config.myEnv.mail.dovecot.ldap.base} + query_filter = ${config.myEnv.mail.dovecot.ldap.postfix_mailbox_filter} + bind_dn = ${config.myEnv.mail.dovecot.ldap.dn} + bind_pw = ${config.myEnv.mail.dovecot.ldap.password} + result_attribute = immaePostfixAddress + result_format = dummy + version = 3 ''; } { @@ -180,7 +169,7 @@ restart = true; paths = [ config.secrets.fullPaths."postfix/mysql_alias_maps" - config.secrets.fullPaths."postfix/mysql_mailbox_maps" + config.secrets.fullPaths."postfix/ldap_mailboxes" config.secrets.fullPaths."postfix/mysql_sender_login_maps" config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr" ]; @@ -274,8 +263,6 @@ joined = builtins.concatStringsSep ","; in pkgs.writeText "host-sender-login" (builtins.concatStringsSep "\n" (mapAttrsToList (n: v: "${n} ${joined v}") addresses)); - host_dummy_mailboxes = pkgs.writeText "host-virtual-mailbox" - (builtins.concatStringsSep "\n" (["immae-eu@immae.eu dummy"] ++ lib.attrsets.mapAttrsToList (n: v: "${n}@immae.eu dummy") nodes)); }; in recipient_maps // relay_restrictions // virtual_map // sasl_access; @@ -308,8 +295,7 @@ config.myEnv.dns.masterZones )); virtual_mailbox_maps = [ - "hash:/etc/postfix/host_dummy_mailboxes" - "mysql:${config.secrets.fullPaths."postfix/mysql_mailbox_maps"}" + "ldap:${config.secrets.fullPaths."postfix/ldap_mailboxes"}" ]; dovecot_destination_recipient_limit = "1"; virtual_transport = "dovecot"; diff --git a/modules/private/mail/relay.nix b/modules/private/mail/relay.nix index 52288fc..651452c 100644 --- a/modules/private/mail/relay.nix +++ b/modules/private/mail/relay.nix @@ -43,29 +43,19 @@ ''; } { - dest = "postfix/mysql_mailbox_maps"; + dest = "postfix/ldap_mailboxes"; user = config.services.postfix.user; group = config.services.postfix.group; permissions = "0440"; text = '' - # We need to specify that option to trigger ssl connection - tls_ciphers = TLSv1.2 - user = ${config.myEnv.mail.postfix.mysql.user} - password = ${config.myEnv.mail.postfix.mysql.password} - hosts = ${config.myEnv.mail.postfix.mysql.remoteHost} - dbname = ${config.myEnv.mail.postfix.mysql.database} - query = SELECT DISTINCT 1 - FROM mailboxes - WHERE active = 1 - AND ( - (domain = '%d' AND user = '%u' AND regex = 0) - OR ( - regex = 1 - AND '%d' REGEXP CONCAT('^',domain,'$') - AND '%u' REGEXP CONCAT('^',user,'$') - ) - ) - LIMIT 1 + server_host = ldaps://${config.myEnv.mail.dovecot.ldap.host}:636 + search_base = ${config.myEnv.mail.dovecot.ldap.base} + query_filter = ${config.myEnv.mail.dovecot.ldap.postfix_mailbox_filter} + bind_dn = ${config.myEnv.mail.dovecot.ldap.dn} + bind_pw = ${config.myEnv.mail.dovecot.ldap.password} + result_attribute = immaePostfixAddress + result_format = dummy + version = 3 ''; } { @@ -78,7 +68,19 @@ user = ${config.myEnv.mail.sympa.postgresql.user} password = ${config.myEnv.mail.sympa.postgresql.password} dbname = ${config.myEnv.mail.sympa.postgresql.database} - query = SELECT DISTINCT CONCAT(name_list, '@', robot_list) FROM list_table + query = SELECT DISTINCT 1 FROM list_table WHERE '%s' IN ( + CONCAT(name_list, '@', robot_list), + CONCAT(name_list, '-request@', robot_list), + CONCAT(name_list, '-editor@', robot_list), + CONCAT(name_list, '-unsubscribe@', robot_list), + CONCAT(name_list, '-owner@', robot_list), + CONCAT('sympa-request@', robot_list), + CONCAT('sympa-owner@', robot_list), + CONCAT('sympa@', robot_list), + CONCAT('listmaster@', robot_list), + CONCAT('bounce@', robot_list), + CONCAT('abuse-feedback-report@', robot_list) + ) ''; } { @@ -107,9 +109,9 @@ restart = true; paths = [ config.secrets.fullPaths."postfix/mysql_alias_maps" - config.secrets.fullPaths."postfix/mysql_mailbox_maps" config.secrets.fullPaths."postfix/sympa_mailbox_maps" config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr" + config.secrets.fullPaths."postfix/ldap_mailboxes" ]; }; services.postfix = { @@ -151,12 +153,8 @@ ) ); }; - sasl_access = { - host_dummy_mailboxes = pkgs.writeText "host-virtual-mailbox" - (builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (n: v: "${n}@immae.eu 1") nodes)); - }; in - recipient_maps // relay_restrictions // virtual_map // sasl_access; + recipient_maps // relay_restrictions // virtual_map; config = { ### postfix module overrides readme_directory = "${pkgs.postfix}/share/postfix/doc"; @@ -194,8 +192,7 @@ "ldap:${config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"}" ]; virtual_mailbox_maps = [ - "hash:/etc/postfix/host_dummy_mailboxes" - "mysql:${config.secrets.fullPaths."postfix/mysql_mailbox_maps"}" + "ldap:${config.secrets.fullPaths."postfix/ldap_mailboxes"}" "pgsql:${config.secrets.fullPaths."postfix/sympa_mailbox_maps"}" ]; in diff --git a/modules/private/mail/sympa.nix b/modules/private/mail/sympa.nix index 1a696d0..9bd5a57 100644 --- a/modules/private/mail/sympa.nix +++ b/modules/private/mail/sympa.nix @@ -94,6 +94,7 @@ in services.postfix = { mapFiles = { + # Update relay list when changing one of those sympa_virtual = pkgs.writeText "virtual.sympa" '' sympa-request@${domain} postmaster@immae.eu sympa-owner@${domain} postmaster@immae.eu -- 2.41.0