Squash changes containing private information

There were a lot of changes since the previous commit, but a lot of them
contained personnal information about users. All thos changes got
stashed into a single commit (history is kept in a different place) and
private information was moved in a separate private repository

3 files changed, 162 insertions, 0 deletions

diff --git a/flakes/private/mail-relay/filter-rewrite-from.py b/flakes/private/mail-relay/filter-rewrite-from.py
new file mode 100755
index 0000000..aad9c69
--- /dev/null
+++ b/flakes/private/mail-relay/filter-rewrite-from.py
@@ -0,0 +1,68 @@
+#! /usr/bin/env python3
+import sys
+
+sys.stdin.reconfigure(encoding='utf-8')
+sys.stdout.reconfigure(encoding='utf-8')
+stdin = sys.stdin
+stdout = sys.stdout
+
+mailaddr = sys.argv[1]
+inheader = {}
+
+# Change to actual file for logging
+logfile = open("/dev/null", "a")
+
+def log(l, i):
+    logfile.write("{} {}\n".format(i, l))
+    logfile.flush()
+
+def send(l):
+    log(l, ">")
+    stdout.write("{}\n".format(l))
+    stdout.flush()
+
+def token_and_sid(version, sid, token):
+    if version < "0.5":
+        return "{}|{}".format(token, sid)
+    else:
+        return "{}|{}".format(sid, token)
+
+log("started", "l")
+while True:
+    line = stdin.readline().strip()
+    log(line, "<")
+    if not line:
+        log("finished", "l")
+        break
+    splitted = line.split("|")
+    if line == "config|ready":
+        log("in config ready", "l")
+        send("register|filter|smtp-in|mail-from")
+        send("register|filter|smtp-in|data-line")
+        send("register|ready")
+    if splitted[0] != "filter":
+        continue
+    if len(splitted) < 7:
+        send("invalid filter command: expected >6 fields!")
+        sys.exit(1)
+    version = splitted[1]
+    action = splitted[4]
+    sid = splitted[5]
+    token = splitted[6]
+    token_sid = token_and_sid(version, sid, token)
+    rest = "|".join(splitted[7:])
+    if action == "mail-from":
+        inheader[sid] = True
+        send("filter-result|{}|rewrite|<{}>".format(token_sid, mailaddr))
+        continue
+    if action == "data-line":
+        if rest == "" and inheader.get(sid, False):
+            inheader[sid] = False
+        if rest == "." and not inheader.get(sid):
+            del(inheader[sid])
+        if inheader.get(sid, False) and rest.upper().startswith("FROM:"):
+            send("filter-dataline|{}|From: {}".format(token_sid, mailaddr))
+        else:
+            send("filter-dataline|{}|{}".format(token_sid, rest))
+        continue
+    send("filter-result|{}|proceed".format(token_sid))
diff --git a/flakes/private/mail-relay/flake.lock b/flakes/private/mail-relay/flake.lock
new file mode 100644
index 0000000..bbb2011
--- /dev/null
+++ b/flakes/private/mail-relay/flake.lock
@@ -0,0 +1,36 @@
+{
+  "nodes": {
+    "environment": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-rMKbM7fHqWQbI7y59BsPG8KwoDj2jyrvN2niPWB24uE=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "root": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      }
+    },
+    "secrets": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flakes/private/mail-relay/flake.nix b/flakes/private/mail-relay/flake.nix
new file mode 100644
index 0000000..639bd06
--- /dev/null
+++ b/flakes/private/mail-relay/flake.nix
@@ -0,0 +1,58 @@
+{
+  inputs.environment.url = "path:../environment";
+  inputs.secrets.url = "path:../../secrets";
+
+  outputs = { self, environment, secrets }: {
+    nixosModule = self.nixosModules.mail-relay;
+    nixosModules.mail-relay = { lib, pkgs, config, name, ... }:
+      {
+        imports = [
+          environment.nixosModule
+          secrets.nixosModule
+        ];
+        options.myServices.mailRelay.enable = lib.mkEnableOption "enable Mail relay services";
+        config = lib.mkIf config.myServices.mailRelay.enable {
+          secrets.keys."opensmtpd/creds" = {
+            user = "smtpd";
+            group = "smtpd";
+            permissions = "0400";
+            text = ''
+              eldiron    ${name}:${config.hostEnv.ldap.password}
+              '';
+          };
+          users.users.smtpd.extraGroups = [ "keys" ];
+          services.opensmtpd = {
+            enable = true;
+            serverConfiguration = let
+              filter-rewrite-from = pkgs.runCommand "filter-rewrite-from.py" {
+                buildInputs = [ pkgs.python38 ];
+              } ''
+                cp ${./filter-rewrite-from.py} $out
+                patchShebangs $out
+              '';
+            in ''
+              table creds \
+                "${config.secrets.fullPaths."opensmtpd/creds"}"
+              # FIXME: filtering requires 6.6, uncomment following lines when
+              # upgrading
+              # filter "fixfrom" \
+              #   proc-exec "${filter-rewrite-from} ${name}@immae.eu"
+              # listen on socket filter "fixfrom"
+              action "relay-rewrite-from" relay \
+                helo ${config.hostEnv.fqdn} \
+                host smtp+tls://eldiron@eldiron.immae.eu:587 \
+                auth <creds> \
+                mail-from ${name}@immae.eu
+              action "relay" relay \
+                helo ${config.hostEnv.fqdn} \
+                host smtp+tls://eldiron@eldiron.immae.eu:587 \
+                auth <creds>
+              match for any !mail-from "@immae.eu" action "relay-rewrite-from"
+              match for any mail-from "@immae.eu" action "relay"
+              '';
+          };
+          environment.systemPackages = [ config.services.opensmtpd.package ];
+        };
+      };
+  };
+}