pyrox.dev
1{ config, pkgs, lib, ... }:
2let
3 cfg = config.services.schleuder;
4 settingsFormat = pkgs.formats.yaml { };
5 postfixMap = entries: lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value: "${name} ${value}") entries);
6 writePostfixMap = name: entries: pkgs.writeText name (postfixMap entries);
7 configScript = pkgs.writeScript "schleuder-cfg" ''
8 #!${pkgs.runtimeShell}
9 set -exuo pipefail
10 umask 0077
11 ${pkgs.yq}/bin/yq \
12 --slurpfile overrides <(${pkgs.yq}/bin/yq . <${lib.escapeShellArg cfg.extraSettingsFile}) \
13 < ${settingsFormat.generate "schleuder.yml" cfg.settings} \
14 '. * $overrides[0]' \
15 > /etc/schleuder/schleuder.yml
16 chown schleuder: /etc/schleuder/schleuder.yml
17 '';
18in
19{
20 options.services.schleuder = {
21 enable = lib.mkEnableOption (lib.mdDoc "Schleuder secure remailer");
22 enablePostfix = lib.mkEnableOption (lib.mdDoc "automatic postfix integration") // { default = true; };
23 lists = lib.mkOption {
24 description = lib.mdDoc ''
25 List of list addresses that should be handled by Schleuder.
26
27 Note that this is only handled by the postfix integration, and
28 the setup of the lists, their members and their keys has to be
29 performed separately via schleuder's API, using a tool such as
30 schleuder-cli.
31 '';
32 type = lib.types.listOf lib.types.str;
33 default = [ ];
34 example = [ "widget-team@example.com" "security@example.com" ];
35 };
36 /* maybe one day....
37 domains = lib.mkOption {
38 description = "Domains for which all mail should be handled by Schleuder.";
39 type = lib.types.listOf lib.types.str;
40 default = [];
41 example = ["securelists.example.com"];
42 };
43 */
44 settings = lib.mkOption {
45 description = lib.mdDoc ''
46 Settings for schleuder.yml.
47
48 Check the [example configuration](https://0xacab.org/schleuder/schleuder/blob/master/etc/schleuder.yml) for possible values.
49 '';
50 type = lib.types.submodule {
51 freeformType = settingsFormat.type;
52 options.keyserver = lib.mkOption {
53 type = lib.types.str;
54 description = lib.mdDoc ''
55 Key server from which to fetch and update keys.
56
57 Note that NixOS uses a different default from upstream, since the upstream default sks-keyservers.net is deprecated.
58 '';
59 default = "keys.openpgp.org";
60 };
61 };
62 default = { };
63 };
64 extraSettingsFile = lib.mkOption {
65 description = lib.mdDoc "YAML file to merge into the schleuder config at runtime. This can be used for secrets such as API keys.";
66 type = lib.types.nullOr lib.types.path;
67 default = null;
68 };
69 listDefaults = lib.mkOption {
70 description = lib.mdDoc ''
71 Default settings for lists (list-defaults.yml).
72
73 Check the [example configuration](https://0xacab.org/schleuder/schleuder/-/blob/master/etc/list-defaults.yml) for possible values.
74 '';
75 type = settingsFormat.type;
76 default = { };
77 };
78 };
79 config = lib.mkIf cfg.enable {
80 assertions = [
81 {
82 assertion = !(cfg.settings.api ? valid_api_keys);
83 message = ''
84 services.schleuder.settings.api.valid_api_keys is set. Defining API keys via NixOS config results in them being copied to the world-readable Nix store. Please use the extraSettingsFile option to store API keys in a non-public location.
85 '';
86 }
87 {
88 assertion = !(lib.any (db: db ? password) (lib.attrValues cfg.settings.database or {}));
89 message = ''
90 A password is defined for at least one database in services.schleuder.settings.database. Defining passwords via NixOS config results in them being copied to the world-readable Nix store. Please use the extraSettingsFile option to store database passwords in a non-public location.
91 '';
92 }
93 ];
94 users.users.schleuder.isSystemUser = true;
95 users.users.schleuder.group = "schleuder";
96 users.groups.schleuder = {};
97 environment.systemPackages = [
98 pkgs.schleuder-cli
99 ];
100 services.postfix = lib.mkIf cfg.enablePostfix {
101 extraMasterConf = ''
102 schleuder unix - n n - - pipe
103 flags=DRhu user=schleuder argv=/${pkgs.schleuder}/bin/schleuder work ''${recipient}
104 '';
105 transport = lib.mkIf (cfg.lists != [ ]) (postfixMap (lib.genAttrs cfg.lists (_: "schleuder:")));
106 extraConfig = ''
107 schleuder_destination_recipient_limit = 1
108 '';
109 # review: does this make sense?
110 localRecipients = lib.mkIf (cfg.lists != [ ]) cfg.lists;
111 };
112 systemd.services = let commonServiceConfig = {
113 # We would have liked to use DynamicUser, but since the default
114 # database is SQLite and lives in StateDirectory, and that same
115 # database needs to be readable from the postfix service, this
116 # isn't trivial to do.
117 User = "schleuder";
118 StateDirectory = "schleuder";
119 StateDirectoryMode = "0700";
120 }; in
121 {
122 schleuder-init = {
123 serviceConfig = commonServiceConfig // {
124 ExecStartPre = lib.mkIf (cfg.extraSettingsFile != null) [
125 "+${configScript}"
126 ];
127 ExecStart = [ "${pkgs.schleuder}/bin/schleuder install" ];
128 Type = "oneshot";
129 };
130 };
131 schleuder-api-daemon = {
132 after = [ "local-fs.target" "network.target" "schleuder-init.service" ];
133 wantedBy = [ "multi-user.target" ];
134 requires = [ "schleuder-init.service" ];
135 serviceConfig = commonServiceConfig // {
136 ExecStart = [ "${pkgs.schleuder}/bin/schleuder-api-daemon" ];
137 };
138 };
139 schleuder-weekly-key-maintenance = {
140 after = [ "local-fs.target" "network.target" ];
141 startAt = "weekly";
142 serviceConfig = commonServiceConfig // {
143 ExecStart = [
144 "${pkgs.schleuder}/bin/schleuder refresh_keys"
145 "${pkgs.schleuder}/bin/schleuder check_keys"
146 ];
147 };
148 };
149 };
150
151 environment.etc."schleuder/schleuder.yml" = lib.mkIf (cfg.extraSettingsFile == null) {
152 source = settingsFormat.generate "schleuder.yml" cfg.settings;
153 };
154 environment.etc."schleuder/list-defaults.yml".source = settingsFormat.generate "list-defaults.yml" cfg.listDefaults;
155
156 services.schleuder = {
157 #lists_dir = "/var/lib/schleuder.lists";
158 settings.filters_dir = lib.mkDefault "/var/lib/schleuder/filters";
159 settings.keyword_handlers_dir = lib.mkDefault "/var/lib/schleuder/keyword_handlers";
160 };
161 };
162}