pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.services.opendkim;
8
9 defaultSock = "local:/run/opendkim/opendkim.sock";
10
11 args = [ "-f" "-l"
12 "-p" cfg.socket
13 "-d" cfg.domains
14 "-k" cfg.keyFile
15 "-s" cfg.selector
16 ] ++ optionals (cfg.configFile != null) [ "-x" cfg.configFile ];
17
18in {
19
20 ###### interface
21
22 options = {
23
24 services.opendkim = {
25
26 enable = mkOption {
27 type = types.bool;
28 default = false;
29 description = "Whether to enable the OpenDKIM sender authentication system.";
30 };
31
32 socket = mkOption {
33 type = types.str;
34 default = defaultSock;
35 description = "Socket which is used for communication with OpenDKIM.";
36 };
37
38 user = mkOption {
39 type = types.str;
40 default = "opendkim";
41 description = "User for the daemon.";
42 };
43
44 group = mkOption {
45 type = types.str;
46 default = "opendkim";
47 description = "Group for the daemon.";
48 };
49
50 domains = mkOption {
51 type = types.str;
52 description = "Local domains set; messages from them are signed, not verified.";
53 };
54
55 keyFile = mkOption {
56 type = types.path;
57 description = "Secret key file used for signing messages.";
58 };
59
60 selector = mkOption {
61 type = types.str;
62 description = "Selector to use when signing.";
63 };
64
65 configFile = mkOption {
66 type = types.nullOr types.path;
67 default = null;
68 description = "Additional opendkim configuration.";
69 };
70
71 };
72
73 };
74
75
76 ###### implementation
77
78 config = mkIf cfg.enable {
79
80 services.opendkim.domains = mkDefault "csl:${config.networking.hostName}";
81
82 users.extraUsers = optionalAttrs (cfg.user == "opendkim") (singleton
83 { name = "opendkim";
84 group = cfg.group;
85 uid = config.ids.uids.opendkim;
86 });
87
88 users.extraGroups = optionalAttrs (cfg.group == "opendkim") (singleton
89 { name = "opendkim";
90 gid = config.ids.gids.opendkim;
91 });
92
93 environment.systemPackages = [ pkgs.opendkim ];
94
95 systemd.services.opendkim = {
96 description = "OpenDKIM signing and verification daemon";
97 after = [ "network.target" ];
98 wantedBy = [ "multi-user.target" ];
99
100 serviceConfig = {
101 ExecStart = "${pkgs.opendkim}/bin/opendkim ${concatMapStringsSep " " escapeShellArg args}";
102 User = cfg.user;
103 Group = cfg.group;
104 RuntimeDirectory = optional (cfg.socket == defaultSock) "opendkim";
105 };
106 };
107
108 };
109}