···
rspamdCfg = config.services.rspamd;
8
+
postfixCfg = config.services.postfix;
cfg = config.services.rmilter;
10
-
inetSockets = map (sock: let s = stringSplit ":" sock; in "inet:${last s}:${head s}") cfg.bindInetSockets;
11
-
unixSockets = map (sock: "unix:${sock}") cfg.bindUnixSockets;
11
+
inetSocket = addr: port: "inet:[${toString port}@${addr}]";
12
+
unixSocket = sock: "unix:${sock}";
13
-
allSockets = unixSockets ++ inetSockets;
14
+
systemdSocket = if cfg.bindSocket.type == "unix" then cfg.bindSocket.path
15
+
else "${cfg.bindSocket.address}:${toString cfg.bindSocket.port}";
16
+
rmilterSocket = if cfg.bindSocket.type == "unix" then unixSocket cfg.bindSocket.path
17
+
else inetSocket cfg.bindSocket.address cfg.bindSocket.port;
16
-
pidfile = /run/rmilter/rmilter.pid;
17
-
bind_socket = ${if cfg.socketActivation then "fd:3" else concatStringsSep ", " allSockets};
20
+
pidfile = /run/rmilter/rmilter.pid;
21
+
bind_socket = ${if cfg.socketActivation then "fd:3" else rmilterSocket};
'' + (with cfg.rspamd; if enable then ''
22
-
servers = ${concatStringsSep ", " servers};
23
-
connect_timeout = 1s;
24
-
results_timeout = 20s;
28
-
reject_message = "${rejectMessage}";
29
-
${optionalString (length whitelist != 0) "whitelist = ${concatStringsSep ", " whitelist};"}
25
+
servers = ${concatStringsSep ", " servers};
26
+
connect_timeout = 1s;
27
+
results_timeout = 20s;
31
+
reject_message = "${rejectMessage}";
32
+
${optionalString (length whitelist != 0) "whitelist = ${concatStringsSep ", " whitelist};"}
31
-
# rspamd_metric - metric for using with rspamd
32
-
# Default: "default"
33
-
rspamd_metric = "default";
36
-
'' else "") + cfg.extraConfig;
34
+
# rspamd_metric - metric for using with rspamd
35
+
# Default: "default"
36
+
rspamd_metric = "default";
39
+
'' else "") + cfg.extraConfig;
rmilterConfigFile = pkgs.writeText "rmilter.conf" rmilterConf;
···
default = cfg.rspamd.enable;
description = "Whether to run the rmilter daemon.";
description = "Whether to run the rmilter daemon in debug mode.";
···
76
-
bindUnixSockets = mkOption {
77
-
type = types.listOf types.str;
78
-
default = ["/run/rmilter/rmilter.sock"];
81
+
bindSocket.type = mkOption {
82
+
type = types.enum [ "unix" "inet" ];
80
-
Unix domain sockets to listen for MTA requests.
85
+
What kind of socket rmilter should listen on. Either "unix"
86
+
for an Unix domain socket or "inet" for a TCP socket.
83
-
[ "/run/rmilter.sock"]
90
+
bindSocket.path = mkOption {
92
+
default = "/run/rmilter/rmilter.sock";
94
+
Path to Unix domain socket to listen on.
87
-
bindInetSockets = mkOption {
88
-
type = types.listOf types.str;
98
+
bindSocket.address = mkOption {
101
+
example = "0.0.0.0";
91
-
Inet addresses to listen (in format accepted by systemd.socket)
103
+
Inet address to listen on.
107
+
bindSocket.port = mkOption {
111
+
Inet port to listen on.
···
Enable systemd socket activation for rmilter.
103
-
(disabling socket activation not recommended
104
-
when unix socket used, and follow to wrong
105
-
permissions on unix domain socket.)
121
+
Disabling socket activation is not recommended when a Unix
122
+
domain socket is used and could lead to incorrect
default = rspamdCfg.enable;
description = "Whether to use rspamd to filter mails";
···
description = "Addon to postfix configuration";
160
-
smtpd_milters = ${head allSockets}
161
-
# or for TCP socket
162
-
# # smtpd_milters = inet:localhost:9900
163
-
milter_protocol = 6
164
-
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
165
-
# skip mail without checks if milter will die
166
-
milter_default_action = accept
179
+
smtpd_milters = ${rmilterSocket}
180
+
milter_protocol = 6
181
+
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
···
178
-
config = mkIf cfg.enable {
180
-
users.extraUsers = singleton {
182
-
description = "rspamd daemon";
183
-
uid = config.ids.uids.rmilter;
197
+
users.extraUsers = singleton {
199
+
description = "rmilter daemon";
200
+
uid = config.ids.uids.rmilter;
204
+
users.extraGroups = singleton {
206
+
gid = config.ids.gids.rmilter;
187
-
users.extraGroups = singleton {
189
-
gid = config.ids.gids.rmilter;
209
+
systemd.services.rmilter = {
210
+
description = "Rmilter Service";
192
-
systemd.services.rmilter = {
193
-
description = "Rmilter Service";
212
+
wantedBy = [ "multi-user.target" ];
213
+
after = [ "network.target" ];
195
-
wantedBy = [ "multi-user.target" ];
196
-
after = [ "network.target" ];
216
+
ExecStart = "${pkgs.rmilter}/bin/rmilter ${optionalString cfg.debug "-d"} -n -c ${rmilterConfigFile}";
217
+
ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
220
+
PermissionsStartOnly = true;
221
+
Restart = "always";
222
+
RuntimeDirectory = "rmilter";
223
+
RuntimeDirectoryMode = "0750";
199
-
ExecStart = "${pkgs.rmilter}/bin/rmilter ${optionalString cfg.debug "-d"} -n -c ${rmilterConfigFile}";
200
-
ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
203
-
PermissionsStartOnly = true;
204
-
Restart = "always";
205
-
RuntimeDirectory = "rmilter";
206
-
RuntimeDirectoryMode = "0755";
211
-
systemd.sockets.rmilter = mkIf cfg.socketActivation {
212
-
description = "Rmilter service socket";
213
-
wantedBy = [ "sockets.target" ];
215
-
ListenStream = cfg.bindUnixSockets ++ cfg.bindInetSockets;
216
-
SocketUser = cfg.user;
217
-
SocketGroup = cfg.group;
218
-
SocketMode = "0666";
228
+
systemd.sockets.rmilter = mkIf cfg.socketActivation {
229
+
description = "Rmilter service socket";
230
+
wantedBy = [ "sockets.target" ];
232
+
ListenStream = systemdSocket;
233
+
SocketUser = cfg.user;
234
+
SocketGroup = cfg.group;
235
+
SocketMode = "0660";
222
-
services.postfix.extraConfig = optionalString cfg.postfix.enable cfg.postfix.configFragment;
223
-
users.users.postfix.extraGroups = [ cfg.group ];
240
+
(mkIf (cfg.enable && cfg.rspamd.enable && rspamdCfg.enable) {
241
+
users.extraUsers.${cfg.user}.extraGroups = [ rspamdCfg.group ];
244
+
(mkIf (cfg.enable && cfg.postfix.enable) {
245
+
services.postfix.extraConfig = cfg.postfix.configFragment;
246
+
users.extraUsers.${postfixCfg.user}.extraGroups = [ cfg.group ];
pyrox.dev