Squash changes containing private information

There were a lot of changes since the previous commit, but a lot of them
contained personnal information about users. All thos changes got
stashed into a single commit (history is kept in a different place) and
private information was moved in a separate private repository

10 files changed, 1259 insertions, 0 deletions

diff --git a/systems/eldiron/mail/default.nix b/systems/eldiron/mail/default.nix
new file mode 100644
index 0000000..4e13f6a
--- /dev/null
+++ b/systems/eldiron/mail/default.nix
@@ -0,0 +1,44 @@
+{ lib, pkgs, config, ... }:
+{
+  imports = [
+    ./postfix.nix
+    ./dovecot.nix
+    ./rspamd.nix
+    ./sympa.nix
+  ];
+
+  options.myServices.mail.enable = lib.mkEnableOption "enable Mail services";
+  config = lib.mkIf config.myServices.mail.enable {
+    myServices.mail.milters.enable = true;
+    security.acme.certs."mail" = {
+      postRun = lib.mkBefore ''
+        cp -f fullchain.pem /etc/dovecot/fullchain.pem
+        chown :dovecot2 /etc/dovecot/fullchain.pem
+        chmod a+r /etc/dovecot/fullchain.pem
+      '';
+      domain = config.hostEnv.fqdn;
+      extraDomainNames = let
+        zonesWithMx = builtins.attrNames (lib.filterAttrs (n: v: v.hasEmail) config.myServices.dns.zones);
+        mxs = map (n: "${config.hostEnv.mx.subdomain}.${n}") zonesWithMx;
+      in mxs;
+    };
+    # This is for clients that don’t support elliptic curves (e.g.
+    # printer)
+    security.acme.certs."mail-rsa" = {
+      postRun = lib.mkBefore ''
+        cp -f fullchain.pem /etc/dovecot/fullchain-rsa.pem
+        chown :dovecot2 /etc/dovecot/fullchain-rsa.pem
+        chmod a+r /etc/dovecot/fullchain-rsa.pem
+      '';
+      domain = config.hostEnv.fqdn;
+      keyType = "rsa4096";
+      extraDomainNames = let
+        zonesWithMx = builtins.attrNames (lib.filterAttrs (n: v: v.hasEmail) config.myServices.dns.zones);
+        mxs = map (n: "${config.hostEnv.mx.subdomain}.${n}") zonesWithMx;
+      in mxs;
+    };
+    systemd.slices.mail = {
+      description = "Mail slice";
+    };
+  };
+}
diff --git a/systems/eldiron/mail/dovecot.nix b/systems/eldiron/mail/dovecot.nix
new file mode 100644
index 0000000..a1282e3
--- /dev/null
+++ b/systems/eldiron/mail/dovecot.nix
@@ -0,0 +1,348 @@
+{ lib, pkgs, config, ... }:
+let
+  sieve_bin = pkgs.runCommand "sieve_bin" {
+    buildInputs = [ pkgs.makeWrapper ];
+  } ''
+    cp -a ${./sieve_bin} $out
+    chmod -R u+w $out
+    patchShebangs $out
+    for i in $out/*; do
+      wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]}
+    done
+    '';
+in
+{
+  config = lib.mkIf config.myServices.mail.enable {
+    myServices.dns.zones."immae.eu".subdomains =
+      with config.myServices.dns.helpers;
+      {
+        imap = ips servers.eldiron.ips.main;
+        pop3 = ips servers.eldiron.ips.main;
+      };
+
+    myServices.chatonsProperties.services.email = {
+      file.datetime = "2022-08-22T01:00:00";
+      service = {
+        name = "E-mail account";
+        description = "Compte e-mail avec configuration imap et smtp/pop3";
+        logo = "https://www.dovecot.org/wp-content/uploads/2021/09/favicon.ico";
+        website = "https://mail.immae.eu/";
+        status.level = "OK";
+        status.description = "OK";
+        registration."" = ["MEMBER" "CLIENT"];
+        registration.load = "OPEN";
+        install.type = "PACKAGE";
+      };
+      software = {
+        name = "Dovecot";
+        website = "https://www.dovecot.org/";
+        license.url = "https://github.com/dovecot/core/blob/main/COPYING";
+        license.name = "MIT and LGPLv2.1 Licenses";
+        version = pkgs.dovecot.version;
+        source.url = "https://github.com/dovecot/core";
+        modules = ["roundcube" "rainloop"] ++ map (a: a.pname) config.services.dovecot2.modules;
+      };
+    };
+    systemd.services.dovecot2.serviceConfig.Slice = "mail.slice";
+    secrets.keys."dovecot/ldap" = {
+      user = config.services.dovecot2.user;
+      group = config.services.dovecot2.group;
+      permissions = "0400";
+      text = ''
+        hosts = ${config.myEnv.mail.dovecot.ldap.host}
+        tls = yes
+
+        dn = ${config.myEnv.mail.dovecot.ldap.dn}
+        dnpass = ${config.myEnv.mail.dovecot.ldap.password}
+
+        auth_bind = yes
+
+        ldap_version = 3
+
+        base = ${config.myEnv.mail.dovecot.ldap.base}
+        scope = subtree
+
+        pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
+        pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
+
+        user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
+        user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
+        iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
+        iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
+        '';
+    };
+
+    users.users.vhost = {
+      group = "vhost";
+      uid = config.ids.uids.vhost;
+    };
+    users.groups.vhost.gid = config.ids.gids.vhost;
+    users.users."${config.services.dovecot2.user}".extraGroups = [ "acme" ];
+
+    nixpkgs.overlays = [
+      (self: super: {
+        dovecot = super.dovecot.override { openldap = self.openldap_libressl_cyrus; };
+      })
+    ];
+
+    # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous.......
+    services.dovecot2 = {
+      enable = true;
+      enablePAM = false;
+      enablePop3 = true;
+      enableImap = true;
+      enableLmtp = true;
+      protocols = [ "sieve" ];
+      modules = [
+        pkgs.dovecot_pigeonhole
+        pkgs.dovecot_fts_xapian
+      ];
+      mailUser = "vhost";
+      mailGroup = "vhost";
+      createMailUser = false;
+      mailboxes = {
+        Trash  = { auto = "subscribe"; specialUse = "Trash"; };
+        Junk   = { auto = "subscribe"; specialUse = "Junk"; };
+        Sent   = { auto = "subscribe"; specialUse = "Sent"; };
+        Drafts = { auto = "subscribe"; specialUse = "Drafts"; };
+      };
+      mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap";
+      sslServerCert = "/etc/dovecot/fullchain.pem";
+      sslServerKey = "/var/lib/acme/mail/key.pem";
+      sslCACert = "/etc/dovecot/fullchain.pem";
+      extraConfig = builtins.concatStringsSep "\n" [
+        # For printer which doesn’t support elliptic curve
+        ''
+          ssl_alt_cert = </etc/dovecot/fullchain-rsa.pem
+          ssl_alt_key = </var/lib/acme/mail-rsa/key.pem
+        ''
+
+        ''
+          postmaster_address = postmaster@immae.eu
+          mail_attribute_dict = file:%h/dovecot-attributes
+          imap_idle_notify_interval = 20 mins
+          namespace inbox {
+            type = private
+            separator = /
+            inbox = yes
+            list = yes
+          }
+        ''
+
+        # ACL
+        ''
+          mail_plugins = $mail_plugins acl
+          plugin {
+            acl = vfile:${pkgs.writeText "dovecot-acl" ''
+              Backup/* owner lrp
+              ''}
+            acl_globals_only = yes
+          }
+        ''
+
+        # Full text search
+        ''
+          # needs to be bigger than any mailbox size
+          default_vsz_limit = 2GB
+          mail_plugins = $mail_plugins fts fts_xapian
+          plugin {
+            plugin = fts fts_xapian
+            fts = xapian
+            fts_xapian = partial=2 full=20
+            fts_autoindex = yes
+            fts_autoindex_exclude = \Junk
+            fts_autoindex_exclude2 = \Trash
+            fts_autoindex_exclude3 = Virtual/*
+          }
+        ''
+
+        # Antispam
+        # https://docs.iredmail.org/dovecot.imapsieve.html
+        ''
+        # imap_sieve plugin added below
+
+        plugin {
+            sieve_plugins = sieve_imapsieve sieve_extprograms
+            imapsieve_url = sieve://127.0.0.1:4190
+
+            sieve_before = file:${./sieve_scripts}/backup.sieve;bindir=/var/lib/vhost/.sieve_bin
+
+            # From elsewhere to Junk folder
+            imapsieve_mailbox1_name = Junk
+            imapsieve_mailbox1_causes = COPY APPEND
+            imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin
+
+            # From Junk folder to elsewhere
+            imapsieve_mailbox2_name = *
+            imapsieve_mailbox2_from = Junk
+            imapsieve_mailbox2_causes = COPY
+            imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
+
+            # From anywhere to NoJunk folder
+            imapsieve_mailbox3_name = NoJunk
+            imapsieve_mailbox3_causes = COPY APPEND
+            imapsieve_mailbox3_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
+
+            sieve_pipe_bin_dir = ${sieve_bin}
+
+            sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
+        }
+        ''
+        # Services to listen
+        ''
+        service imap-login {
+          inet_listener imap {
+          }
+          inet_listener imaps {
+          }
+        }
+        service pop3-login {
+          inet_listener pop3 {
+          }
+          inet_listener pop3s {
+          }
+        }
+        service imap {
+        }
+        service pop3 {
+        }
+        service auth {
+          unix_listener auth-userdb {
+          }
+          unix_listener ${config.services.postfix.config.queue_directory}/private/auth {
+            mode = 0666
+          }
+        }
+        service auth-worker {
+        }
+        service dict {
+          unix_listener dict {
+          }
+        }
+        service stats {
+          unix_listener stats-reader {
+            user = vhost
+            group = vhost
+            mode = 0660
+          }
+          unix_listener stats-writer {
+            user = vhost
+            group = vhost
+            mode = 0660
+          }
+        }
+        ''
+
+        # Authentification
+        ''
+        first_valid_uid = ${toString config.ids.uids.vhost}
+        disable_plaintext_auth = yes
+        passdb {
+          driver = ldap
+          args = ${config.secrets.fullPaths."dovecot/ldap"}
+        }
+        userdb {
+          driver = ldap
+          args = ${config.secrets.fullPaths."dovecot/ldap"}
+        }
+        ''
+
+        # Zlib
+        ''
+        mail_plugins = $mail_plugins zlib
+        plugin {
+          zlib_save_level = 6
+          zlib_save = gz
+        }
+        ''
+
+        # Sieve
+        ''
+        plugin {
+          sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve
+        }
+        service managesieve-login {
+        }
+        service managesieve {
+        }
+        ''
+
+        # Virtual mailboxes
+        ''
+        mail_plugins = $mail_plugins virtual
+        namespace Virtual {
+          prefix = Virtual/
+          location = virtual:~/Virtual
+        }
+        ''
+
+        # Protocol specific configuration
+        # Needs to come last if there are mail_plugins entries
+        ''
+        protocol imap {
+          mail_plugins = $mail_plugins imap_sieve imap_acl
+        }
+        protocol lda {
+          mail_plugins = $mail_plugins sieve
+        }
+        ''
+      ];
+    };
+    networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ];
+    system.activationScripts.dovecot = {
+      deps = [ "users" ];
+      text  =''
+        install -m 0755 -o vhost -g vhost -d /var/lib/vhost
+        '';
+    };
+
+    services.cron.systemCronJobs = let
+      cron_script = pkgs.writeScriptBin "cleanup-imap-folders" ''
+        ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX "Backup/*" NOT FLAGGED BEFORE 8w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
+        ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Junk SEEN NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
+        ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Trash NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
+        '';
+      in
+      [
+        "0 2 * * * root ${cron_script}/bin/cleanup-imap-folders"
+      ];
+    security.acme.certs."mail-rsa" = {
+      postRun = ''
+        systemctl restart dovecot2.service
+      '';
+      extraDomainNames = [ "imap.immae.eu" "pop3.immae.eu" ];
+    };
+    security.acme.certs."mail" = {
+      postRun = ''
+        systemctl restart dovecot2.service
+      '';
+      extraDomainNames = [ "imap.immae.eu" "pop3.immae.eu" ];
+    };
+    myServices.monitoring.fromMasterActivatedPlugins = [ "imap" "tcp" ];
+    myServices.monitoring.fromMasterObjects.service = [
+      {
+        service_description = "imap connection works";
+        host_name = config.hostEnv.fqdn;
+        use = "external-service";
+        check_command = "check_imap_connection";
+
+        servicegroups = "webstatus-remote-services,webstatus-email";
+        _webstatus_name = "IMAP";
+        _webstatus_url = "imap.immae.eu";
+      }
+
+      {
+        service_description = "imap SSL is up to date";
+        host_name = config.hostEnv.fqdn;
+        use = "external-service";
+        check_command = ["check_tcp_ssl" "993"];
+
+        servicegroups = "webstatus-ssl";
+        _webstatus_name = "IMAP";
+        _webstatus_url = "imap.immae.eu";
+      }
+
+    ];
+  };
+}
+
diff --git a/systems/eldiron/mail/postfix.nix b/systems/eldiron/mail/postfix.nix
new file mode 100644
index 0000000..f95ee1b
--- /dev/null
+++ b/systems/eldiron/mail/postfix.nix
@@ -0,0 +1,497 @@
+{ lib, pkgs, config, options, ... }:
+let
+  getDomains = p: lib.mapAttrsToList (n: v: v.fqdn) (lib.filterAttrs (n: v: v.receive) p.emailPolicies);
+  bydomain = builtins.mapAttrs (n: getDomains) config.myServices.dns.zones;
+  receiving_domains = lib.flatten (builtins.attrValues bydomain);
+in
+{
+  options.services.postfix.submissionOptions' = options.services.postfix.submissionOptions // {
+    type = with lib.types; attrsOf (either str (listOf str));
+    apply = builtins.mapAttrs (n: v: if builtins.isList v then builtins.concatStringsSep "," v else v);
+  };
+  config = lib.mkIf config.myServices.mail.enable {
+    myServices.dns.zones."immae.eu" = with config.myServices.dns.helpers; lib.mkMerge [
+      mailMX
+      (mailCommon "immae.eu")
+      mailSend
+      {
+        # Virtual forwards and mailboxes for real users
+        emailPolicies."mail".receive = true;
+        # multi-domain generic mails:
+        #     hostmaster, cron, httpd, naemon, postmaster
+        # system virtual mailboxes:
+        #     devnull, printer, testconnect
+        emailPolicies."".receive = true;
+        subdomains.mail = lib.mkMerge [ (mailCommon "immae.eu") mailSend ];
+        subdomains.smtp = ips servers.eldiron.ips.main;
+
+        # DMARC reports
+        subdomains._dmarc.subdomains._report.subdomains = let
+          getDomains = p: lib.mapAttrsToList (n: v: v.fqdn) p.emailPolicies;
+          bydomain = builtins.mapAttrs (n: getDomains) config.myServices.dns.zones;
+          hostsWithMail = lib.flatten (builtins.attrValues bydomain);
+          nvpairs = builtins.map (e: { name = e; value = { TXT = [ "v=DMARC1;" ]; }; }) hostsWithMail;
+        in
+          builtins.listToAttrs nvpairs;
+      }
+    ];
+
+    myServices.chatonsProperties.hostings.mx-backup = {
+      file.datetime = "2022-08-22T01:00:00";
+      hosting = {
+        name = "MX Backup";
+        description = "Serveur e-mail secondaire";
+        logo = "https://www.postfix.org/favicon.ico";
+        website = "https://mail.immae.eu/";
+        status.level = "OK";
+        status.description = "OK";
+        registration.load = "OPEN";
+        install.type = "PACKAGE";
+      };
+      software = {
+        name = "Postfix";
+        website = "http://www.postfix.org/";
+        license.url = "http://postfix.mirrors.ovh.net/postfix-release/LICENSE";
+        license.name = "Eclipse Public license (EPL 2.0) and IBM Public License (IPL 1.0)";
+        version = pkgs.postfix.version;
+        source.url = "http://www.postfix.org/download.html";
+      };
+    };
+    secrets.keys = {
+      "postfix/mysql_alias_maps" = {
+        user = config.services.postfix.user;
+        group = config.services.postfix.group;
+        permissions = "0440";
+        text = ''
+          # We need to specify that option to trigger ssl connection
+          tls_ciphers = TLSv1.2
+          user = ${config.myEnv.mail.postfix.mysql.user}
+          password = ${config.myEnv.mail.postfix.mysql.password}
+          hosts = unix:${config.myEnv.mail.postfix.mysql.socket}
+          dbname = ${config.myEnv.mail.postfix.mysql.database}
+          query = SELECT DISTINCT destination
+            FROM forwardings
+            WHERE
+              ((regex = 1 AND '%s' REGEXP CONCAT('^',source,'$') ) OR (regex = 0 AND source = '%s'))
+              AND active = 1
+              AND '%s' NOT IN
+              (
+                SELECT source
+                FROM forwardings_blacklisted
+                WHERE source = '%s'
+              ) UNION
+              SELECT 'devnull@immae.eu'
+              FROM forwardings_blacklisted
+              WHERE source = '%s'
+          '';
+      };
+      "postfix/ldap_mailboxes" = {
+        user = config.services.postfix.user;
+        group = config.services.postfix.group;
+        permissions = "0440";
+        text = ''
+          server_host = ldaps://${config.myEnv.mail.dovecot.ldap.host}:636
+          search_base = ${config.myEnv.mail.dovecot.ldap.base}
+          query_filter = ${config.myEnv.mail.dovecot.ldap.postfix_mailbox_filter}
+          bind_dn = ${config.myEnv.mail.dovecot.ldap.dn}
+          bind_pw = ${config.myEnv.mail.dovecot.ldap.password}
+          result_attribute = immaePostfixAddress
+          result_format = dummy
+          version = 3
+        '';
+      };
+      "postfix/mysql_sender_login_maps" = {
+        user = config.services.postfix.user;
+        group = config.services.postfix.group;
+        permissions = "0440";
+        text = ''
+          # We need to specify that option to trigger ssl connection
+          tls_ciphers = TLSv1.2
+          user = ${config.myEnv.mail.postfix.mysql.user}
+          password = ${config.myEnv.mail.postfix.mysql.password}
+          hosts = unix:${config.myEnv.mail.postfix.mysql.socket}
+          dbname = ${config.myEnv.mail.postfix.mysql.database}
+          query = SELECT DISTINCT destination
+            FROM forwardings
+            WHERE
+              (
+                (regex = 1 AND CONCAT(SUBSTRING_INDEX('%u', '+', 1), '@%d') REGEXP CONCAT('^',source,'$') )
+              OR
+                (regex = 0 AND source = CONCAT(SUBSTRING_INDEX('%u', '+', 1), '@%d'))
+              )
+              AND active = 1
+            UNION SELECT CONCAT(SUBSTRING_INDEX('%u', '+', 1), '@%d') AS destination
+          '';
+      };
+      "postfix/mysql_sender_relays_maps" = {
+        user = config.services.postfix.user;
+        group = config.services.postfix.group;
+        permissions = "0440";
+        text = ''
+          # We need to specify that option to trigger ssl connection
+          tls_ciphers = TLSv1.2
+          user = ${config.myEnv.mail.postfix.mysql.user}
+          password = ${config.myEnv.mail.postfix.mysql.password}
+          hosts = unix:${config.myEnv.mail.postfix.mysql.socket}
+          dbname = ${config.myEnv.mail.postfix.mysql.database}
+          # INSERT INTO sender_relays
+          #   (`from`, owner, relay, login, password, regex, active)
+          # VALUES
+          #   ( 'sender@otherhost.org'
+          #   , 'me@mail.immae.eu'
+          #   , '[otherhost.org]:587'
+          #   , 'otherhostlogin'
+          #   , AES_ENCRYPT('otherhostpassword', '${config.myEnv.mail.postfix.mysql.password_encrypt}')
+          #   , '0'
+          #   , '1');
+
+          query = SELECT DISTINCT `owner`
+            FROM sender_relays
+            WHERE
+              ((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
+              AND active = 1
+          '';
+      };
+      "postfix/mysql_sender_relays_hosts" = {
+        user = config.services.postfix.user;
+        group = config.services.postfix.group;
+        permissions = "0440";
+        text = ''
+          # We need to specify that option to trigger ssl connection
+          tls_ciphers = TLSv1.2
+          user = ${config.myEnv.mail.postfix.mysql.user}
+          password = ${config.myEnv.mail.postfix.mysql.password}
+          hosts = unix:${config.myEnv.mail.postfix.mysql.socket}
+          dbname = ${config.myEnv.mail.postfix.mysql.database}
+
+          query = SELECT DISTINCT relay
+            FROM sender_relays
+            WHERE
+              ((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
+              AND active = 1
+          '';
+      };
+      "postfix/mysql_sender_relays_creds" = {
+        user = config.services.postfix.user;
+        group = config.services.postfix.group;
+        permissions = "0440";
+        text = ''
+          # We need to specify that option to trigger ssl connection
+          tls_ciphers = TLSv1.2
+          user = ${config.myEnv.mail.postfix.mysql.user}
+          password = ${config.myEnv.mail.postfix.mysql.password}
+          hosts = unix:${config.myEnv.mail.postfix.mysql.socket}
+          dbname = ${config.myEnv.mail.postfix.mysql.database}
+
+          query = SELECT DISTINCT CONCAT(`login`, ':', AES_DECRYPT(`password`, '${config.myEnv.mail.postfix.mysql.password_encrypt}'))
+            FROM sender_relays
+            WHERE
+              ((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
+              AND active = 1
+          '';
+      };
+      "postfix/ldap_ejabberd_users_immae_fr" = {
+        user = config.services.postfix.user;
+        group = config.services.postfix.group;
+        permissions = "0440";
+        text = ''
+          server_host = ldaps://${config.myEnv.jabber.ldap.host}:636
+          search_base = ${config.myEnv.jabber.ldap.base}
+          query_filter = ${config.myEnv.jabber.postfix_user_filter}
+          domain = immae.fr
+          bind_dn = ${config.myEnv.jabber.ldap.dn}
+          bind_pw = ${config.myEnv.jabber.ldap.password}
+          result_attribute = immaeXmppUid
+          result_format = ejabberd@localhost
+          version = 3
+          '';
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 25 465 587 ];
+
+    users.users.postfixscripts = {
+      group = "keys";
+      uid = config.ids.uids.postfixscripts;
+      description = "Postfix scripts user";
+    };
+    users.users."${config.services.postfix.user}".extraGroups = [ "keys" ];
+    services.filesWatcher.postfix = {
+      restart = true;
+      paths = [
+        config.secrets.fullPaths."postfix/mysql_alias_maps"
+        config.secrets.fullPaths."postfix/ldap_mailboxes"
+        config.secrets.fullPaths."postfix/mysql_sender_login_maps"
+        config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"
+      ];
+    };
+    services.postfix = {
+      extraAliases = let
+        testmail = pkgs.writeScript "testmail" ''
+          #! ${pkgs.stdenv.shell}
+          ${pkgs.coreutils}/bin/touch \
+            "/var/lib/naemon/checks/email/$(${pkgs.procmail}/bin/formail -x To: | ${pkgs.coreutils}/bin/tr -d ' <>')"
+          '';
+      in
+        ''testmail: "|${testmail}"'';
+      mapFiles = let
+        virtual_map = {
+          virtual = let
+            cfg = config.myEnv.monitoring.email_check.eldiron;
+            address = "${cfg.mail_address}@${cfg.mail_domain}";
+            aliases = config.myEnv.mail.postfix.common_aliases;
+            admins = builtins.concatStringsSep "," config.myEnv.mail.postfix.admins;
+          in pkgs.writeText "postfix-virtual" (
+            builtins.concatStringsSep "\n" (
+              [ "${address} testmail@localhost"
+              ] ++
+              map (a: "${a} ${admins}") config.myEnv.mail.postfix.other_aliases
+              ++ lib.lists.flatten (
+                map (domain:
+                  map (alias: "${alias}@${domain} ${admins}") aliases
+                ) receiving_domains
+                )
+          ));
+        };
+        sasl_access = {
+          host_sender_login = with lib.attrsets; let
+            addresses = zipAttrs (lib.flatten (mapAttrsToList
+              (n: v: (map (e: { "${e}" = "${n}@immae.eu"; }) v.emails)) config.myEnv.servers));
+            aliases = config.myEnv.mail.postfix.common_aliases;
+            joined = builtins.concatStringsSep ",";
+            admins = joined config.myEnv.mail.postfix.admins;
+          in pkgs.writeText "host-sender-login"
+            (builtins.concatStringsSep "\n" (
+              mapAttrsToList (n: v: "${n} ${joined v}") addresses
+              ++ lib.lists.flatten (
+                map (domain:
+                  map (alias: "${alias}@${domain} ${admins}") aliases
+                ) receiving_domains
+                )
+              ++ map (a: "${a} ${admins}") config.myEnv.mail.postfix.other_aliases
+          ));
+        };
+      in
+        virtual_map // sasl_access;
+      config = {
+        ### postfix module overrides
+        readme_directory = "${pkgs.postfix}/share/postfix/doc";
+        smtp_tls_CAfile = lib.mkForce "";
+        smtp_tls_cert_file = lib.mkForce "";
+        smtp_tls_key_file = lib.mkForce "";
+
+        message_size_limit = "1073741824"; # Don't put 0 here, it's not equivalent to "unlimited"
+        mailbox_size_limit = "1073741825"; # Workaround, local delivered mails should all go through scripts
+        alias_database = "\$alias_maps";
+
+        ### Aliases scripts user
+        default_privs = "postfixscripts";
+
+        ### Virtual mailboxes config
+        virtual_alias_maps = [
+          "hash:/etc/postfix/virtual"
+          "mysql:${config.secrets.fullPaths."postfix/mysql_alias_maps"}"
+          "ldap:${config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"}"
+        ];
+        virtual_mailbox_domains = receiving_domains;
+        virtual_mailbox_maps = [
+          "ldap:${config.secrets.fullPaths."postfix/ldap_mailboxes"}"
+        ];
+        dovecot_destination_recipient_limit = "1";
+        virtual_transport = "dovecot";
+
+        ### Relay domains
+        smtpd_relay_restrictions = [
+          "defer_unauth_destination"
+        ];
+
+        ### Additional smtpd configuration
+        smtpd_tls_received_header = "yes";
+        smtpd_tls_loglevel = "1";
+
+        ### Email sending configuration
+        smtp_tls_security_level = "may";
+        smtp_tls_loglevel = "1";
+
+        ### Force ip bind for smtp
+        smtp_bind_address  = builtins.head config.hostEnv.ips.main.ip4;
+        smtp_bind_address6 = builtins.head config.hostEnv.ips.main.ip6;
+
+        # Use some relays when authorized senders are not myself
+        smtp_sasl_mechanism_filter = [
+          "plain"
+          "login"
+        ]; # GSSAPI Not correctly supported by postfix
+        smtp_sasl_auth_enable = "yes";
+        smtp_sasl_password_maps = [
+          "mysql:${config.secrets.fullPaths."postfix/mysql_sender_relays_creds"}"
+        ];
+        smtp_sasl_security_options = "noanonymous";
+        smtp_sender_dependent_authentication = "yes";
+        sender_dependent_relayhost_maps = [
+          "mysql:${config.secrets.fullPaths."postfix/mysql_sender_relays_hosts"}"
+        ];
+
+        ### opendkim, opendmarc, openarc milters
+        non_smtpd_milters = [
+          "unix:${config.myServices.mail.milters.sockets.opendkim}"
+        ];
+        smtpd_milters = [
+          "unix:${config.myServices.mail.milters.sockets.opendkim}"
+          "unix:${config.myServices.mail.milters.sockets.openarc}"
+          "unix:${config.myServices.mail.milters.sockets.opendmarc}"
+        ];
+
+        smtp_use_tls = true;
+        smtpd_use_tls = true;
+        smtpd_tls_chain_files = [
+          "/var/lib/acme/mail/full.pem"
+          "/var/lib/acme/mail-rsa/full.pem"
+        ];
+
+        maximal_queue_lifetime = "6w";
+        bounce_queue_lifetime = "6w";
+      };
+      enable = true;
+      enableSmtp = true;
+      enableSubmission = true;
+      submissionOptions = config.services.postfix.submissionOptions';
+      submissionOptions' = {
+        # Don’t use "long form", only commas (cf
+        # http://www.postfix.org/master.5.html long form is not handled
+        # well by the submission function)
+        smtpd_tls_security_level = "encrypt";
+        smtpd_sasl_auth_enable = "yes";
+        smtpd_tls_auth_only = "yes";
+        smtpd_sasl_tls_security_options = "noanonymous";
+        smtpd_sasl_type = "dovecot";
+        smtpd_sasl_path = "private/auth";
+        smtpd_reject_unlisted_recipient = "no";
+        smtpd_client_restrictions = [
+          "permit_sasl_authenticated"
+          "reject"
+        ];
+        smtpd_relay_restrictions = [
+          "permit_sasl_authenticated"
+          "reject"
+        ];
+        # Refuse to send e-mails with a From that is not handled
+        smtpd_sender_restrictions = [
+          "reject_sender_login_mismatch"
+          "reject_unlisted_sender"
+          "permit_sasl_authenticated,reject"
+        ];
+        smtpd_sender_login_maps = [
+          "hash:/etc/postfix/host_sender_login"
+          "mysql:${config.secrets.fullPaths."postfix/mysql_sender_relays_maps"}"
+          "mysql:${config.secrets.fullPaths."postfix/mysql_sender_login_maps"}"
+        ];
+        smtpd_recipient_restrictions = [
+          "permit_sasl_authenticated"
+          "reject"
+        ];
+        milter_macro_daemon_name = "ORIGINATING";
+        smtpd_milters = [
+          # FIXME: put it back when opensmtpd is upgraded and able to
+          # rewrite the from header
+          #"unix:/run/milter_verify_from/verify_from.sock"
+          "unix:${config.myServices.mail.milters.sockets.opendkim}"
+        ];
+      };
+      destination = ["localhost"];
+      # This needs to reverse DNS
+      hostname = config.hostEnv.fqdn;
+      setSendmail = true;
+      recipientDelimiter = "+";
+      masterConfig = {
+        submissions = {
+          type = "inet";
+          private = false;
+          command = "smtpd";
+          args = ["-o" "smtpd_tls_wrappermode=yes" ] ++ (let
+            mkKeyVal = opt: val: [ "-o" (opt + "=" + val) ];
+          in lib.concatLists (lib.mapAttrsToList mkKeyVal config.services.postfix.submissionOptions)
+          );
+        };
+        dovecot = {
+          type = "unix";
+          privileged = true;
+          chroot = false;
+          command = "pipe";
+          args = let
+            # rspamd could be used as a milter, but then it cannot apply
+            # its checks "per user" (milter is not yet dispatched to
+            # users), so we wrap dovecot-lda inside rspamc per recipient
+            # here.
+            rspamc_dovecot = pkgs.writeScriptBin "rspamc_dovecot" ''
+              #! ${pkgs.stdenv.shell}
+              set -o pipefail
+              sender="$1"
+              original_recipient="$2"
+              user="$3"
+
+              ${pkgs.coreutils}/bin/cat - | \
+                ${pkgs.rspamd}/bin/rspamc -h ${config.myServices.mail.rspamd.sockets.worker-controller} -c bayes -d "$user" --mime | \
+                ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -f "$sender" -a "$original_recipient" -d "$user"
+              if echo ''${PIPESTATUS[@]} | ${pkgs.gnugrep}/bin/grep -qE '^[0 ]+$'; then
+                exit 0
+              else
+                # src/global/sys_exits.h to retry
+                exit 75
+              fi
+              '';
+          in [
+            "flags=ODRhu" "user=vhost:vhost"
+            "argv=${rspamc_dovecot}/bin/rspamc_dovecot \${sender} \${original_recipient} \${user}@\${nexthop}"
+          ];
+        };
+      };
+    };
+    security.acme.certs."mail" = {
+      postRun = ''
+        systemctl restart postfix.service
+        '';
+      extraDomainNames = [ "smtp.immae.eu" ];
+    };
+    security.acme.certs."mail-rsa" = {
+      postRun = ''
+        systemctl restart postfix.service
+        '';
+      extraDomainNames = [ "smtp.immae.eu" ];
+    };
+    system.activationScripts.testmail = {
+      deps = [ "users" ];
+      text = let
+        allCfg = config.myEnv.monitoring.email_check;
+        cfg = allCfg.eldiron;
+        reverseTargets = builtins.attrNames (lib.attrsets.filterAttrs (k: v: builtins.elem "eldiron" v.targets) allCfg);
+        to_email = cfg': host':
+          let sep = if lib.strings.hasInfix "+" cfg'.mail_address then "_" else "+";
+          in "${cfg'.mail_address}${sep}${host'}@${cfg'.mail_domain}";
+        mails_to_receive = builtins.concatStringsSep " " (map (to_email cfg) reverseTargets);
+      in ''
+        install -m 0555 -o postfixscripts -g keys -d /var/lib/naemon/checks/email
+        for f in ${mails_to_receive}; do
+          if [ ! -f /var/lib/naemon/checks/email/$f ]; then
+            install -m 0644 -o postfixscripts -g keys /dev/null -T /var/lib/naemon/checks/email/$f
+            touch -m -d @0 /var/lib/naemon/checks/email/$f
+          fi
+        done
+        '';
+    };
+    systemd.services.postfix.serviceConfig.Slice = "mail.slice";
+
+    myServices.monitoring.fromMasterObjects.service = [
+      {
+        service_description = "postfix SSL is up to date";
+        host_name = config.hostEnv.fqdn;
+        use = "external-service";
+        check_command = "check_smtp";
+
+        servicegroups = "webstatus-ssl";
+        _webstatus_name = "SMTP";
+        _webstatus_url = "smtp.immae.eu";
+      }
+    ];
+  };
+}
diff --git a/systems/eldiron/mail/rspamd.nix b/systems/eldiron/mail/rspamd.nix
new file mode 100644
index 0000000..a300cc5
--- /dev/null
+++ b/systems/eldiron/mail/rspamd.nix
@@ -0,0 +1,88 @@
+{ lib, pkgs, config, ... }:
+{
+  options.myServices.mail.rspamd.sockets = lib.mkOption {
+    type = lib.types.attrsOf lib.types.path;
+    default = {
+      worker-controller = "/run/rspamd/worker-controller.sock";
+    };
+    readOnly = true;
+    description = ''
+      rspamd sockets
+      '';
+  };
+  config = lib.mkIf config.myServices.mail.enable {
+    services.cron.systemCronJobs = let
+      cron_script = pkgs.runCommand "cron_script" {
+        buildInputs = [ pkgs.makeWrapper ];
+      } ''
+        mkdir -p $out
+        cp ${./scan_reported_mails} $out/scan_reported_mails
+        patchShebangs $out
+        for i in $out/*; do
+          wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils pkgs.rspamd pkgs.flock ]}
+        done
+        '';
+    in
+      [ "*/20 * * * * vhost ${cron_script}/scan_reported_mails" ];
+
+    systemd.services.rspamd.serviceConfig.Slice = "mail.slice";
+    systemd.services.rspamd.serviceConfig.SupplementaryGroups = [ "vhost" ];
+    services.rspamd = {
+      enable = true;
+      debug = false;
+      overrides = {
+        "actions.conf".text = ''
+          reject = null;
+          add_header = 6;
+          greylist = null;
+          '';
+        "milter_headers.conf".text = ''
+          extended_spam_headers = true;
+        '';
+      };
+      locals = {
+        "redis.conf".text = ''
+          servers = "${config.myEnv.mail.rspamd.redis.socket}";
+          db = "${config.myEnv.mail.rspamd.redis.db}";
+          '';
+        "classifier-bayes.conf".text = ''
+          users_enabled = true;
+          backend = "redis";
+          servers = "${config.myEnv.mail.rspamd.redis.socket}";
+          database = "${config.myEnv.mail.rspamd.redis.db}";
+          autolearn = true;
+          cache {
+            backend = "redis";
+          }
+          new_schema = true;
+          statfile {
+            BAYES_HAM {
+              spam = false;
+            }
+            BAYES_SPAM {
+              spam = true;
+            }
+          }
+          '';
+      };
+      workers = {
+        controller = {
+          extraConfig = ''
+            enable_password = "${config.myEnv.mail.rspamd.write_password_hashed}";
+            password = "${config.myEnv.mail.rspamd.read_password_hashed}";
+          '';
+          bindSockets = [ {
+            socket = config.myServices.mail.rspamd.sockets.worker-controller;
+            mode = "0660";
+            owner = config.services.rspamd.user;
+            group = "vhost";
+          } ];
+        };
+      };
+      postfix = {
+        enable = true;
+        config = {};
+      };
+    };
+  };
+}
diff --git a/systems/eldiron/mail/scan_reported_mails b/systems/eldiron/mail/scan_reported_mails
new file mode 100755
index 0000000..fe9f4d6
--- /dev/null
+++ b/systems/eldiron/mail/scan_reported_mails
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+( flock -n 9 || exit 1
+shopt -s nullglob
+for spool in /var/lib/vhost/.rspamd/*/pending; do
+  rspamd_folder=$(dirname $spool)
+  mail_user=$(basename $rspamd_folder)
+  mv $rspamd_folder/pending $rspamd_folder/processing
+
+  for mtype in ham spam; do
+    if [ -d $rspamd_folder/processing/$mtype ]; then
+      output="$(rspamc -h /run/rspamd/worker-controller.sock -c bayes -d $mail_user learn_$mtype $rspamd_folder/processing/$mtype/*)"
+      echo "[$mtype: $mail_user]" ${output} >> /var/lib/vhost/.rspamd/rspamd.log
+      mkdir -p $rspamd_folder/processed/$mtype
+      cp $rspamd_folder/processing/$mtype/* $rspamd_folder/processed/$mtype/
+    fi
+  done
+
+  rm -rf $rspamd_folder/processing
+done
+) 9>/var/lib/vhost/scan_reported_mails.lock
diff --git a/systems/eldiron/mail/sieve_bin/imapsieve_copy b/systems/eldiron/mail/sieve_bin/imapsieve_copy
new file mode 100755
index 0000000..2ca1f23
--- /dev/null
+++ b/systems/eldiron/mail/sieve_bin/imapsieve_copy
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Inspired from https://docs.iredmail.org/dovecot.imapsieve.html
+
+MSG_TYPE="$1"
+OUTPUT_DIR="/var/lib/vhost/.rspamd/${USER}/pending/${MSG_TYPE}"
+FILE="${OUTPUT_DIR}/$(date +%Y%m%d%H%M%S)-${RANDOM}${RANDOM}.eml"
+mkdir -p "${OUTPUT_DIR}"
+cat > ${FILE} < /dev/stdin
diff --git a/systems/eldiron/mail/sieve_scripts/backup.sieve b/systems/eldiron/mail/sieve_scripts/backup.sieve
new file mode 100644
index 0000000..3014c0a
--- /dev/null
+++ b/systems/eldiron/mail/sieve_scripts/backup.sieve
@@ -0,0 +1,7 @@
+# vim: filetype=sieve
+require ["copy","mailbox","fileinto","regex"];
+if header :is "X-Spam" "Yes" {
+  fileinto :create :copy "Backup/Spam";
+} else {
+  fileinto :create :copy "Backup/Ham";
+}
diff --git a/systems/eldiron/mail/sieve_scripts/report_ham.sieve b/systems/eldiron/mail/sieve_scripts/report_ham.sieve
new file mode 100644
index 0000000..f9b8481
--- /dev/null
+++ b/systems/eldiron/mail/sieve_scripts/report_ham.sieve
@@ -0,0 +1,11 @@
+require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];
+
+if environment :matches "imap.mailbox" "*" {
+    set "mailbox" "${1}";
+}
+
+if string "${mailbox}" "Trash" {
+    stop;
+}
+
+pipe :copy "imapsieve_copy" [ "ham" ];
diff --git a/systems/eldiron/mail/sieve_scripts/report_spam.sieve b/systems/eldiron/mail/sieve_scripts/report_spam.sieve
new file mode 100644
index 0000000..9a1f794
--- /dev/null
+++ b/systems/eldiron/mail/sieve_scripts/report_spam.sieve
@@ -0,0 +1,3 @@
+require ["vnd.dovecot.pipe", "copy", "imapsieve" ];
+
+pipe :copy "imapsieve_copy" [ "spam" ];
diff --git a/systems/eldiron/mail/sympa.nix b/systems/eldiron/mail/sympa.nix
new file mode 100644
index 0000000..8e801dd
--- /dev/null
+++ b/systems/eldiron/mail/sympa.nix
@@ -0,0 +1,232 @@
+{ lib, pkgs, config, ... }:
+let
+  domain = "lists.immae.eu";
+  sympaConfig = config.myEnv.mail.sympa;
+in
+{
+  config = lib.mkIf config.myServices.mail.enable {
+    myServices.dns.zones."immae.eu".emailPolicies."lists".receive = true;
+    myServices.dns.zones."immae.eu".subdomains.lists =
+      with config.myServices.dns.helpers; lib.mkMerge [
+        (ips servers.eldiron.ips.main)
+        (mailCommon "immae.eu")
+        mailSend
+      ];
+
+    myServices.chatonsProperties.services.sympa = {
+      file.datetime = "2022-08-22T00:50:00";
+      service = {
+        name = "Sympa";
+        description = "Mailing lists service";
+        website = "https://mail.immae.eu/sympa";
+        logo = "https://mail.immae.eu/static-sympa/icons/favicon_sympa.png";
+        status.level = "OK";
+        status.description = "OK";
+        registration."" = ["MEMBER" "CLIENT"];
+        registration.load = "OPEN";
+        install.type = "PACKAGE";
+      };
+      software = {
+        name = "Sympa";
+        website = "https://www.sympa.org/";
+        license.url = "https://github.com/sympa-community/sympa/blob/sympa-6.2/COPYING";
+        license.name = "GNU General Public License v2.0";
+        version = pkgs.sympa.version;
+        source.url = "https://github.com/sympa-community/sympa/";
+      };
+    };
+    myServices.databases.postgresql.authorizedHosts = {
+      backup-2 = [
+        {
+          username = "sympa";
+          database = "sympa";
+          ip4 = config.myEnv.servers.backup-2.ips.main.ip4;
+          ip6 = map (v: "${v}/128") config.myEnv.servers.backup-2.ips.main.ip6;
+        }
+      ];
+    };
+    services.websites.env.tools.vhostConfs.mail = {
+      extraConfig = lib.mkAfter [
+        ''
+          Alias /static-sympa/ /var/lib/sympa/static_content/
+          <Directory /var/lib/sympa/static_content/>
+            Require all granted
+            AllowOverride none
+          </Directory>
+          <Location /sympa>
+            SetHandler "proxy:unix:/run/sympa/wwsympa.socket|fcgi://"
+            Require all granted
+          </Location>
+          ''
+      ];
+    };
+
+    secrets.keys = {
+      "sympa/db_password" = {
+        permissions = "0400";
+        group = "sympa";
+        user = "sympa";
+        text = sympaConfig.postgresql.password;
+      };
+    }
+    // lib.mapAttrs' (n: v: lib.nameValuePair "sympa/data_sources/${n}.incl" {
+      permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
+    }) sympaConfig.data_sources
+    // lib.mapAttrs' (n: v: lib.nameValuePair "sympa/scenari/${n}" {
+      permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
+    }) sympaConfig.scenari;
+    users.users.sympa.extraGroups = [ "keys" ];
+    systemd.slices.mail-sympa = {
+      description = "Sympa slice";
+    };
+
+    systemd.services.sympa.serviceConfig.SupplementaryGroups = [ "keys" ];
+    systemd.services.sympa-archive.serviceConfig.SupplementaryGroups = [ "keys" ];
+    systemd.services.sympa-bounce.serviceConfig.SupplementaryGroups = [ "keys" ];
+    systemd.services.sympa-bulk.serviceConfig.SupplementaryGroups = [ "keys" ];
+    systemd.services.sympa-task.serviceConfig.SupplementaryGroups = [ "keys" ];
+
+    systemd.services.sympa.serviceConfig.Slice = "mail-sympa.slice";
+    systemd.services.sympa-archive.serviceConfig.Slice = "mail-sympa.slice";
+    systemd.services.sympa-bounce.serviceConfig.Slice = "mail-sympa.slice";
+    systemd.services.sympa-bulk.serviceConfig.Slice = "mail-sympa.slice";
+    systemd.services.sympa-task.serviceConfig.Slice = "mail-sympa.slice";
+
+    # https://github.com/NixOS/nixpkgs/pull/84202
+    systemd.services.sympa.serviceConfig.ProtectKernelModules = lib.mkForce false;
+    systemd.services.sympa-archive.serviceConfig.ProtectKernelModules = lib.mkForce false;
+    systemd.services.sympa-bounce.serviceConfig.ProtectKernelModules = lib.mkForce false;
+    systemd.services.sympa-bulk.serviceConfig.ProtectKernelModules = lib.mkForce false;
+    systemd.services.sympa-task.serviceConfig.ProtectKernelModules = lib.mkForce false;
+    systemd.services.sympa.serviceConfig.ProtectKernelTunables = lib.mkForce false;
+    systemd.services.sympa-archive.serviceConfig.ProtectKernelTunables = lib.mkForce false;
+    systemd.services.sympa-bounce.serviceConfig.ProtectKernelTunables = lib.mkForce false;
+    systemd.services.sympa-bulk.serviceConfig.ProtectKernelTunables = lib.mkForce false;
+    systemd.services.sympa-task.serviceConfig.ProtectKernelTunables = lib.mkForce false;
+
+    systemd.services.wwsympa = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "sympa.service" ];
+      serviceConfig = {
+        Slice = "mail-sympa.slice";
+        Type = "forking";
+        PIDFile = "/run/sympa/wwsympa.pid";
+        Restart = "always";
+        ExecStart = ''${pkgs.spawn_fcgi}/bin/spawn-fcgi \
+          -u sympa \
+          -g sympa \
+          -U wwwrun \
+          -M 0600 \
+          -F 2 \
+          -P /run/sympa/wwsympa.pid \
+          -s /run/sympa/wwsympa.socket \
+          -- ${pkgs.sympa}/lib/sympa/cgi/wwsympa.fcgi
+        '';
+        StateDirectory = "sympa";
+        ProtectHome = true;
+        ProtectSystem = "full";
+        ProtectControlGroups = true;
+      };
+    };
+
+    services.postfix = {
+      mapFiles = {
+        # Update relay list when changing one of those
+        sympa_virtual = pkgs.writeText "virtual.sympa" ''
+          sympa-request@${domain} postmaster@immae.eu
+          sympa-owner@${domain}   postmaster@immae.eu
+        '';
+        sympa_transport = pkgs.writeText "transport.sympa" ''
+          ${domain}                        error:User unknown in recipient table
+          sympa@${domain}                  sympa:sympa@${domain}
+          listmaster@${domain}             sympa:listmaster@${domain}
+          bounce@${domain}                 sympabounce:sympa@${domain}
+          abuse-feedback-report@${domain}  sympabounce:sympa@${domain}
+        '';
+      };
+      config = {
+        transport_maps = lib.mkAfter [
+          "hash:/etc/postfix/sympa_transport"
+          "hash:/var/lib/sympa/sympa_transport"
+        ];
+        virtual_alias_maps = lib.mkAfter [
+          "hash:/etc/postfix/sympa_virtual"
+        ];
+        virtual_mailbox_maps = lib.mkAfter [
+          "hash:/etc/postfix/sympa_transport"
+          "hash:/var/lib/sympa/sympa_transport"
+          "hash:/etc/postfix/sympa_virtual"
+        ];
+      };
+      masterConfig = {
+        sympa = {
+          type = "unix";
+          privileged = true;
+          chroot = false;
+          command = "pipe";
+          args = [
+            "flags=hqRu"
+            "user=sympa"
+            "argv=${pkgs.sympa}/libexec/queue"
+            "\${nexthop}"
+          ];
+        };
+        sympabounce = {
+          type = "unix";
+          privileged = true;
+          chroot = false;
+          command = "pipe";
+          args = [
+            "flags=hqRu"
+            "user=sympa"
+            "argv=${pkgs.sympa}/libexec/bouncequeue"
+            "\${nexthop}"
+          ];
+        };
+      };
+    };
+    services.sympa = {
+      enable = true;
+      listMasters = sympaConfig.listmasters;
+      mainDomain = domain;
+      domains = {
+        "${domain}" = {
+          webHost = "mail.immae.eu";
+          webLocation = "/sympa";
+        };
+      };
+
+      database = {
+        type = "PostgreSQL";
+        user = sympaConfig.postgresql.user;
+        host = sympaConfig.postgresql.socket;
+        name = sympaConfig.postgresql.database;
+        passwordFile = config.secrets.fullPaths."sympa/db_password";
+        createLocally = false;
+      };
+      settings = {
+        sendmail = "/run/wrappers/bin/sendmail";
+        log_smtp = "on";
+        sendmail_aliases = "/var/lib/sympa/sympa_transport";
+        aliases_program = "${pkgs.postfix}/bin/postmap";
+        create_list = "listmaster";
+      };
+      settingsFile = {
+        "virtual.sympa".enable = false;
+        "transport.sympa".enable = false;
+      } // lib.mapAttrs' (n: v: lib.nameValuePair
+        "etc/${domain}/data_sources/${n}.incl"
+        { source = config.secrets.fullPaths."sympa/data_sources/${n}.incl"; }) sympaConfig.data_sources
+        // lib.mapAttrs' (n: v: lib.nameValuePair
+        "etc/${domain}/scenari/${n}"
+        { source = config.secrets.fullPaths."sympa/scenari/${n}"; }) sympaConfig.scenari;
+      web = {
+        server = "none";
+      };
+
+      mta = {
+        type = "none";
+      };
+    };
+  };
+}