···
+
{ config, options, pkgs, lib, ... }:
cfg = config.services.rspamd;
+
opts = options.services.rspamd;
+
bindSocketOpts = {options, config, ... }: {
+
example = "localhost:11333";
+
Socket for this worker to listen on in a format acceptable by rspamd.
+
description = "Mode to set on unix socket";
+
default = "${cfg.user}";
+
description = "Owner to set on unix socket";
+
default = "${cfg.group}";
+
description = "Group to set on unix socket";
+
optionalString options.${option}.isDefined " ${option}=${config.${option}}";
+
if (!(hasPrefix "/" config.socket)) then "${config.socket}"
+
else "${config.socket}${maybeOption "mode"}${maybeOption "owner"}${maybeOption "group"}";
+
workerOpts = { name, ... }: {
+
type = types.nullOr types.bool;
+
description = "Whether to run the rspamd worker.";
+
type = types.nullOr types.str;
+
description = "Name of the worker";
+
type = types.nullOr (types.enum [
+
"normal" "controller" "fuzzy_storage" "proxy" "lua"
+
description = "The type of this worker";
+
bindSockets = mkOption {
+
type = types.listOf (types.either types.str (types.submodule bindSocketOpts));
+
List of sockets to listen, in format acceptable by rspamd
+
socket = "/run/rspamd.sock";
+
apply = value: map (each: if (isString each)
+
then if (isUnixSocket each)
+
then {socket = each; owner = cfg.user; group = cfg.group; mode = "0644"; rawEntry = "${each}";}
+
else {socket = each; rawEntry = "${each}";}
+
type = types.nullOr types.int;
+
Number of worker instances to run
+
type = types.listOf types.str;
+
List of files to include in configuration
+
extraConfig = mkOption {
+
description = "Additional entries to put verbatim into worker section of rspamd config file.";
+
config = mkIf (name == "normal" || name == "controller" || name == "fuzzy") {
+
includes = mkDefault [ "$CONFDIR/worker-${name}.inc" ];
+
bindSockets = mkDefault (if name == "normal"
+
socket = "/run/rspamd/rspamd.sock";
+
else if name == "controller"
+
then [ "localhost:11334" ]
+
indexOf = default: start: list: e:
+
else if (head list) == e then start
+
else (indexOf default (start + (length (listenStreams (head list).socket))) (tail list) e);
+
systemdSocket = indexOf (abort "Socket not found") 0 allSockets;
+
isUnixSocket = socket: hasPrefix "/" (if (isString socket) then socket else socket.socket);
+
isPort = hasPrefix "*:";
+
isIPv4Socket = hasPrefix "*v4:";
+
isIPv6Socket = hasPrefix "*v6:";
+
isLocalHost = hasPrefix "localhost:";
+
listenStreams = socket:
+
if (isLocalHost socket) then
+
let port = (removePrefix "localhost:" socket);
+
in [ "127.0.0.1:${port}" ] ++ (if config.networking.enableIPv6 then ["[::1]:${port}"] else [])
+
else if (isIPv6Socket socket) then [removePrefix "*v6:" socket]
+
else if (isPort socket) then [removePrefix "*:" socket]
+
else if (isIPv4Socket socket) then
+
throw "error: IPv4 only socket not supported in rspamd with socket activation"
+
else if (length (splitString " " socket)) != 1 then
+
throw "error: string options not supported in rspamd with socket activation"
+
mkBindSockets = enabled: socks: concatStringsSep "\n " (flatten (map (each:
+
if cfg.socketActivation && enabled != false then
+
let systemd = (systemdSocket each);
+
in (imap (idx: e: "bind_socket = \"systemd:${toString (systemd + idx - 1)}\";") (listenStreams each.socket))
+
else "bind_socket = \"${each.rawEntry}\";") socks));
+
rspamdConfFile = pkgs.writeText "rspamd.conf"
.include "$CONFDIR/common.conf"
···
.include "$CONFDIR/logging.inc"
+
${concatStringsSep "\n" (mapAttrsToList (name: value: ''
+
worker ${optionalString (value.name != "normal" && value.name != "controller") "${value.name}"} {
+
type = "${value.type}";
+
${optionalString (value.enable != null)
+
"enabled = ${if value.enable != false then "yes" else "no"};"}
+
${mkBindSockets value.enable value.bindSockets}
+
${optionalString (value.count != null) "count = ${toString value.count};"}
+
${concatStringsSep "\n " (map (each: ".include \"${each}\"") value.includes)}
+
allMappedSockets = flatten (mapAttrsToList (name: value:
+
if value.enable != false
+
then imap (idx: each: {
+
allSockets = map (e: e.value) allMappedSockets;
+
allSocketNames = map (each: "rspamd-${each.name}-${toString each.index}.socket") allMappedSockets;
···
enable = mkEnableOption "Whether to run the rspamd daemon.";
description = "Whether to run the rspamd daemon in debug mode.";
+
socketActivation = mkOption {
+
Enable systemd socket activation for rspamd.
+
type = with types; attrsOf (submodule workerOpts);
+
Attribute set of workers to start.
+
example = literalExample ''
+
includes = [ "$CONFDIR/worker-normal.inc" ];
+
socket = "/run/rspamd/rspamd.sock";
+
group = "${cfg.group}";
+
includes = [ "$CONFDIR/worker-controller.inc" ];
+
bindSockets = [ "[::1]:11334" ];
···
config = mkIf cfg.enable {
+
services.rspamd.socketActivation = mkDefault (!opts.bindSocket.isDefined && !opts.bindUISocket.isDefined);
+
assertion = !cfg.socketActivation || !(opts.bindSocket.isDefined || opts.bindUISocket.isDefined);
+
message = "Can't use socketActivation for rspamd when using renamed bind socket options";
# Allow users to run 'rspamc' and 'rspamadm'.
environment.systemPackages = [ pkgs.rspamd ];
···
gid = config.ids.gids.rspamd;
+
environment.etc."rspamd.conf".source = rspamdConfFile;
systemd.services.rspamd = {
description = "Rspamd Service";
+
wantedBy = mkIf (!cfg.socketActivation) [ "multi-user.target" ];
+
after = [ "network.target" ] ++
+
(if cfg.socketActivation then allSocketNames else []);
+
requires = mkIf cfg.socketActivation allSocketNames;
ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} --user=${cfg.user} --group=${cfg.group} --pid=/run/rspamd.pid -c ${rspamdConfFile} -f";
RuntimeDirectory = "rspamd";
+
Sockets = mkIf cfg.socketActivation (concatStringsSep " " allSocketNames);
···
${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} /var/lib/rspamd
+
systemd.sockets = mkIf cfg.socketActivation
+
(listToAttrs (map (each: {
+
name = "rspamd-${each.name}-${toString each.index}";
+
description = "Rspamd socket ${toString each.index} for worker ${each.name}";
+
wantedBy = [ "sockets.target" ];
+
listenStreams = (listenStreams each.value.socket);
+
BindIPv6Only = mkIf (isIPv6Socket each.value.socket) "ipv6-only";
+
Service = "rspamd.service";
+
SocketUser = mkIf (isUnixSocket each.value.socket) each.value.owner;
+
SocketGroup = mkIf (isUnixSocket each.value.socket) each.value.group;
+
SocketMode = mkIf (isUnixSocket each.value.socket) each.value.mode;
+
(mkRenamedOptionModule [ "services" "rspamd" "bindSocket" ] [ "services" "rspamd" "workers" "normal" "bindSockets" ])
+
(mkRenamedOptionModule [ "services" "rspamd" "bindUISocket" ] [ "services" "rspamd" "workers" "controller" "bindSockets" ])
pyrox.dev