commit 41b2b90ec99bb88a0cee8e12b28d47a7194bb065 · ryan.freumh.org/eilean-nix

+27

flake.lock

···

       1
       1
       +
       {

     

       2
       2
       +
         "nodes": {

     

       3
       3
       +
           "nixpkgs": {

     

       4
       4
       +
             "locked": {

     

       5
       5
       +
               "lastModified": 1667231093,

     

       6
       6
       +
               "narHash": "sha256-RERXruzBEBuf0c7OfZeX1hxEKB+PTCUNxWeB6C1jd8Y=",

     

       7
       7
       +
               "owner": "nixos",

     

       8
       8
       +
               "repo": "nixpkgs",

     

       9
       9
       +
               "rev": "d40fea9aeb8840fea0d377baa4b38e39b9582458",

     

       10
       10
       +
               "type": "github"

     

       11
       11
       +
             },

     

       12
       12
       +
             "original": {

     

       13
       13
       +
               "owner": "nixos",

     

       14
       14
       +
               "ref": "nixos-unstable",

     

       15
       15
       +
               "repo": "nixpkgs",

     

       16
       16
       +
               "type": "github"

     

       17
       17
       +
             }

     

       18
       18
       +
           },

     

       19
       19
       +
           "root": {

     

       20
       20
       +
             "inputs": {

     

       21
       21
       +
               "nixpkgs": "nixpkgs"

     

       22
       22
       +
             }

     

       23
       23
       +
           }

     

       24
       24
       +
         },

     

       25
       25
       +
         "root": "root",

     

       26
       26
       +
         "version": 7

     

       27
       27
       +
       }

+11

flake.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         inputs = {

     

       3
       3
       +
           nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

     

       4
       4
       +
         };

     

       5
       5
       +
       

     

       6
       6
       +
         outputs = { self, nixpkgs, ... }@inputs: {

     

       7
       7
       +
           nixosModules.default = {

     

       8
       8
       +
             imports = [ ./modules/default.nix ];

     

       9
       9
       +
           };

     

       10
       10
       +
         };

     

       11
       11
       +
       }

+14

modules/default.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         imports = [

     

       3
       3
       +
           ./dns/default.nix

     

       4
       4
       +
           ./mailserver/default.nix

     

       5
       5
       +
           ./hosting/default.nix

     

       6
       6
       +
           ./hosting/mastodon.nix

     

       7
       7
       +
           ./hosting/mailserver.nix

     

       8
       8
       +
           ./hosting/gitea.nix

     

       9
       9
       +
           ./hosting/dns.nix

     

       10
       10
       +
           ./hosting/matrix.nix

     

       11
       11
       +
           ./wireguard/server.nix

     

       12
       12
       +
           ./wireguard/default.nix

     

       13
       13
       +
         ];

     

       14
       14
       +
       }

+17

modules/dns/bind.nix

···

       1
       1
       +
       { pkgs, config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       let cfg = config.dns; in {

     

       4
       4
       +
         services.bind = lib.mkIf (cfg.enable && cfg.server == "bind") {

     

       5
       5
       +
           enable = true;

     

       6
       6
       +
           # recursive resolver

     

       7
       7
       +
           # cacheNetworks = [ "0.0.0.0/0" ];

     

       8
       8
       +
           zones."${config.networking.domain}" = {

     

       9
       9
       +
             master = true;

     

       10
       10
       +
             file = import ./zonefile.nix { inherit pkgs config lib; };

     

       11
       11
       +
             # axfr zone transfer

     

       12
       12
       +
             slaves = [

     

       13
       13
       +
               "127.0.0.1"

     

       14
       14
       +
             ];

     

       15
       15
       +
           };

     

       16
       16
       +
         };

     

       17
       17
       +
       }

+75

modules/dns/default.nix

···

       1
       1
       +
       { pkgs, config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       with lib;

     

       4
       4
       +
       

     

       5
       5
       +
       {

     

       6
       6
       +
         imports = [ ./bind.nix ];

     

       7
       7
       +
       

     

       8
       8
       +
         options.dns = {

     

       9
       9
       +
           enable = lib.mkEnableOption "DNS server";

     

       10
       10
       +
           server = mkOption {

     

       11
       11
       +
             type = types.enum [ "bind" ];

     

       12
       12
       +
             default = "bind";

     

       13
       13
       +
           };

     

       14
       14
       +
           domain = mkOption {

     

       15
       15
       +
             type = types.str;

     

       16
       16
       +
             default = config.networking.domain;

     

       17
       17
       +
           };

     

       18
       18
       +
           ttl = mkOption {

     

       19
       19
       +
             type = types.int;

     

       20
       20
       +
             default = 3600; # 1hr

     

       21
       21
       +
           };

     

       22
       22
       +
           soa = {

     

       23
       23
       +
             ns = mkOption {

     

       24
       24
       +
               type = types.str;

     

       25
       25
       +
               default = "ns1";

     

       26
       26
       +
             };

     

       27
       27
       +
             email = mkOption {

     

       28
       28
       +
               type = types.str;

     

       29
       29
       +
               default = "dns";

     

       30
       30
       +
             };

     

       31
       31
       +
             # TODO auto increment

     

       32
       32
       +
             serial = mkOption {

     

       33
       33
       +
               type = types.int;

     

       34
       34
       +
             };

     

       35
       35
       +
             refresh = mkOption {

     

       36
       36
       +
               type = types.int;

     

       37
       37
       +
               default = 3600; # 1hr

     

       38
       38
       +
             };

     

       39
       39
       +
             retry = mkOption {

     

       40
       40
       +
               type = types.int;

     

       41
       41
       +
               default = 15; # 15m

     

       42
       42
       +
             };

     

       43
       43
       +
             expire = mkOption {

     

       44
       44
       +
               type = types.int;

     

       45
       45
       +
               default = 1814400; # 21d

     

       46
       46
       +
             };

     

       47
       47
       +
             negativeCacheTtl = mkOption {

     

       48
       48
       +
               type = types.int;

     

       49
       49
       +
               default = 3600; # 1hr

     

       50
       50
       +
             };

     

       51
       51
       +
           };

     

       52
       52
       +
           records =

     

       53
       53
       +
             let recordOpts = {

     

       54
       54
       +
               options = {

     

       55
       55
       +
                 name = mkOption {

     

       56
       56
       +
                   type = types.str;

     

       57
       57
       +
                 };

     

       58
       58
       +
                 ttl = mkOption {

     

       59
       59
       +
                   type = with types; nullOr int;

     

       60
       60
       +
                   default = null;

     

       61
       61
       +
                 };

     

       62
       62
       +
                 type = mkOption {

     

       63
       63
       +
                   type = types.str;

     

       64
       64
       +
                 };

     

       65
       65
       +
                 data = mkOption {

     

       66
       66
       +
                   type = types.str;

     

       67
       67
       +
                 };

     

       68
       68
       +
               };

     

       69
       69
       +
             };

     

       70
       70
       +
             in mkOption {

     

       71
       71
       +
               type = with types; listOf (submodule recordOpts);

     

       72
       72
       +
               default = [ ];

     

       73
       73
       +
             };

     

       74
       74
       +
         };

     

       75
       75
       +
       }

+20

modules/dns/zonefile.nix

···

       1
       1
       +
       { pkgs, config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       let cfg = config.dns; in pkgs.writeTextFile {

     

       4
       4
       +
         name = "zonefile";

     

       5
       5
       +
         text = ''

     

       6
       6
       +
           $ORIGIN ${cfg.domain}.

     

       7
       7
       +
           $TTL ${builtins.toString cfg.ttl}

     

       8
       8
       +
           @ IN SOA ${cfg.soa.ns} ${cfg.soa.email} (

     

       9
       9
       +
             ${builtins.toString cfg.soa.serial}

     

       10
       10
       +
             ${builtins.toString cfg.soa.refresh}

     

       11
       11
       +
             ${builtins.toString cfg.soa.retry}

     

       12
       12
       +
             ${builtins.toString cfg.soa.expire}

     

       13
       13
       +
             ${builtins.toString cfg.soa.negativeCacheTtl}

     

       14
       14
       +
           )

     

       15
       15
       +
           ${

     

       16
       16
       +
             lib.strings.concatStringsSep "\n"

     

       17
       17
       +
               (builtins.map (rr: "${rr.name} IN ${builtins.toString rr.ttl} ${rr.type} ${rr.data}") cfg.records)

     

       18
       18
       +
           }

     

       19
       19
       +
         '';

     

       20
       20
       +
       }

+15

modules/hosting/default.nix

···

       1
       1
       +
       { lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       {

     

       4
       4
       +
         options = {

     

       5
       5
       +
           hosting.username = lib.mkOption {

     

       6
       6
       +
             type = lib.types.str;

     

       7
       7
       +
           };

     

       8
       8
       +
           hosting.serverIpv4 = lib.mkOption {

     

       9
       9
       +
             type = lib.types.str;

     

       10
       10
       +
           };

     

       11
       11
       +
           hosting.serverIpv6 = lib.mkOption {

     

       12
       12
       +
             type = lib.types.str;

     

       13
       13
       +
           };

     

       14
       14
       +
         };

     

       15
       15
       +
       }

+58

modules/hosting/dns.nix

···

       1
       1
       +
       { config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       let cfg = config.hosting; in

     

       4
       4
       +
       {

     

       5
       5
       +
         options.hosting.dns = lib.mkEnableOption "dns";

     

       6
       6
       +
         

     

       7
       7
       +
         config.dns = lib.mkIf cfg.dns {

     

       8
       8
       +
           enable = true;

     

       9
       9
       +
           soa.serial = 2018011623;

     

       10
       10
       +
           records = builtins.concatMap (ns: [

     

       11
       11
       +
             {

     

       12
       12
       +
               name = "@";

     

       13
       13
       +
               type = "NS";

     

       14
       14
       +
               data = ns;

     

       15
       15
       +
             }

     

       16
       16
       +
             {

     

       17
       17
       +
               name = ns;

     

       18
       18
       +
               type = "A";

     

       19
       19
       +
               data = config.hosting.serverIpv4;

     

       20
       20
       +
             }

     

       21
       21
       +
           ]) [ "ns1" "ns2" ] ++

     

       22
       22
       +
           [

     

       23
       23
       +
             {

     

       24
       24
       +
               name = "www";

     

       25
       25
       +
               type = "CNAME";

     

       26
       26
       +
               data = "@";

     

       27
       27
       +
             }

     

       28
       28
       +
       

     

       29
       29
       +
             {

     

       30
       30
       +
               name = "@";

     

       31
       31
       +
               type = "A";

     

       32
       32
       +
               data = config.hosting.serverIpv4;

     

       33
       33
       +
             }

     

       34
       34
       +
             {

     

       35
       35
       +
               name = "@";

     

       36
       36
       +
               type = "AAAA";

     

       37
       37
       +
               data = config.hosting.serverIpv6;

     

       38
       38
       +
             }

     

       39
       39
       +
       

     

       40
       40
       +
             {

     

       41
       41
       +
               name = "vps";

     

       42
       42
       +
               type = "A";

     

       43
       43
       +
               data = config.hosting.serverIpv4;

     

       44
       44
       +
             }

     

       45
       45
       +
             {

     

       46
       46
       +
               name = "vps";

     

       47
       47
       +
               type = "AAAA";

     

       48
       48
       +
               data = config.hosting.serverIpv6;

     

       49
       49
       +
             }

     

       50
       50
       +
             

     

       51
       51
       +
             {

     

       52
       52
       +
               name = "@";

     

       53
       53
       +
               type = "LOC";

     

       54
       54
       +
               data = "52 12 40.4 N 0 5 31.9 E 22m 10m 10m 10m";

     

       55
       55
       +
             }

     

       56
       56
       +
           ];

     

       57
       57
       +
         };

     

       58
       58
       +
       }

+88

modules/hosting/gitea.nix

···

       1
       1
       +
       { pkgs, config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       let

     

       4
       4
       +
         cfg = config.hosting;

     

       5
       5
       +
         domain = config.networking.domain;

     

       6
       6
       +
       in {

     

       7
       7
       +
         options.hosting.gitea = lib.mkEnableOption "gitea";

     

       8
       8
       +
       

     

       9
       9
       +
         config = lib.mkIf cfg.gitea {

     

       10
       10
       +
           services.nginx = {

     

       11
       11
       +
             recommendedProxySettings = true;

     

       12
       12
       +
             virtualHosts."git.${domain}" = {

     

       13
       13
       +
               enableACME = true;

     

       14
       14
       +
               forceSSL = true;

     

       15
       15
       +
               locations."/" = {

     

       16
       16
       +
                 proxyPass = "http://localhost:${builtins.toString config.services.gitea.httpPort}/";

     

       17
       17
       +
               };

     

       18
       18
       +
             };

     

       19
       19
       +
           };

     

       20
       20
       +
       

     

       21
       21
       +
           users.users.git = {

     

       22
       22
       +
             description = "Git Service";

     

       23
       23
       +
             home = config.services.gitea.stateDir;

     

       24
       24
       +
             useDefaultShell = true;

     

       25
       25
       +
             group = "gitea";

     

       26
       26
       +
             isSystemUser = true;

     

       27
       27
       +
           };

     

       28
       28
       +
       

     

       29
       29
       +
           services.gitea = {

     

       30
       30
       +
             enable = true;

     

       31
       31
       +
             user = "git";

     

       32
       32
       +
             appName = "git | ${domain}";

     

       33
       33
       +
             domain = "git.${domain}";

     

       34
       34
       +
             rootUrl = "https://git.${domain}/";

     

       35
       35
       +
             mailerPasswordFile = "${config.custom.secretsDir}/email-pswd-unhashed";

     

       36
       36
       +
             settings = {

     

       37
       37
       +
               mailer = {

     

       38
       38
       +
                 ENABLED = true;

     

       39
       39
       +
                 FROM = "git@${domain}";

     

       40
       40
       +
                 MAILER_TYPE = "smtp";

     

       41
       41
       +
                 HOST = "mail.${domain}:465";

     

       42
       42
       +
                 USER = "misc@${domain}";

     

       43
       43
       +
                 IS_TLS_ENABLED = true;

     

       44
       44
       +
               };

     

       45
       45
       +
               repository.DEFAULT_BRANCH = "main";

     

       46
       46
       +
               service.DISABLE_REGISTRATION = true;

     

       47
       47
       +
             };

     

       48
       48
       +
             database = {

     

       49
       49
       +
               type = "postgres";

     

       50
       50
       +
               passwordFile = "${config.custom.secretsDir}/gitea-db";

     

       51
       51
       +
               user = "git";

     

       52
       52
       +
               name = "git";

     

       53
       53
       +
               #createDatabase = true;

     

       54
       54
       +
               #socket = "/run/postgresql";

     

       55
       55
       +
             };

     

       56
       56
       +
             #httpPort = 3000;

     

       57
       57
       +
             #stateDir = "/var/lib/gitea";

     

       58
       58
       +
           };

     

       59
       59
       +
       

     

       60
       60
       +
           # https://github.com/NixOS/nixpkgs/issues/103446

     

       61
       61
       +
           systemd.services.gitea.serviceConfig = {

     

       62
       62
       +
             ReadWritePaths = [ "/var/lib/postfix/queue/maildrop" ];

     

       63
       63
       +
             NoNewPrivileges = lib.mkForce false;

     

       64
       64
       +
             PrivateDevices = lib.mkForce false;

     

       65
       65
       +
             PrivateUsers = lib.mkForce false;

     

       66
       66
       +
             ProtectHostname = lib.mkForce false;

     

       67
       67
       +
             ProtectClock = lib.mkForce false;

     

       68
       68
       +
             ProtectKernelTunables = lib.mkForce false;

     

       69
       69
       +
             ProtectKernelModules = lib.mkForce false;

     

       70
       70
       +
             ProtectKernelLogs = lib.mkForce false;

     

       71
       71
       +
             RestrictAddressFamilies = lib.mkForce [ ];

     

       72
       72
       +
             LockPersonality = lib.mkForce false;

     

       73
       73
       +
             MemoryDenyWriteExecute = lib.mkForce false;

     

       74
       74
       +
             RestrictRealtime = lib.mkForce false;

     

       75
       75
       +
             RestrictSUIDSGID = lib.mkForce false;

     

       76
       76
       +
             SystemCallArchitectures = lib.mkForce "";

     

       77
       77
       +
             SystemCallFilter = lib.mkForce [];

     

       78
       78
       +
           };

     

       79
       79
       +
       

     

       80
       80
       +
           dns.records = [

     

       81
       81
       +
             {

     

       82
       82
       +
               name = "git";

     

       83
       83
       +
               type = "CNAME";

     

       84
       84
       +
               data = "vps";

     

       85
       85
       +
             }

     

       86
       86
       +
           ];

     

       87
       87
       +
         };

     

       88
       88
       +
       }

+81

modules/hosting/mailserver.nix

···

       1
       1
       +
       { config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       let

     

       4
       4
       +
         cfg = config.hosting;

     

       5
       5
       +
         domain = config.networking.domain;

     

       6
       6
       +
       in {

     

       7
       7
       +
         options.hosting.mailserver = lib.mkEnableOption "mailserver";

     

       8
       8
       +
       

     

       9
       9
       +
         config = lib.mkIf cfg.mailserver {

     

       10
       10
       +
           mailserver = {

     

       11
       11
       +
             enable = true;

     

       12
       12
       +
             fqdn = "mail.${domain}";

     

       13
       13
       +
             domains = [ "${domain}" ];

     

       14
       14
       +
       

     

       15
       15
       +
             # A list of all login accounts. To create the password hashes, use

     

       16
       16
       +
             # nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2

     

       17
       17
       +
             loginAccounts = {

     

       18
       18
       +
                 "${config.hosting.username}@${domain}" = {

     

       19
       19
       +
                     hashedPasswordFile = "${config.custom.secretsDir}/email-pswd";

     

       20
       20
       +
                     aliases = [

     

       21
       21
       +
                       "dns@${domain}"

     

       22
       22
       +
                       "postmaster@${domain}"

     

       23
       23
       +
                     ];

     

       24
       24
       +
                 };

     

       25
       25
       +
                 "misc@${domain}" = {

     

       26
       26
       +
                     hashedPasswordFile = "${config.custom.secretsDir}/email-pswd";

     

       27
       27
       +
                     aliases = [

     

       28
       28
       +
                       "git@${domain}"

     

       29
       29
       +
                       "mastodon@${domain}"

     

       30
       30
       +
                     ];

     

       31
       31
       +
                     catchAll = [ "${domain}" ];

     

       32
       32
       +
                 };

     

       33
       33
       +
             };

     

       34
       34
       +
       

     

       35
       35
       +
             # Use Let's Encrypt certificates. Note that this needs to set up a stripped

     

       36
       36
       +
             # down nginx and opens port 80.

     

       37
       37
       +
             certificateScheme = 3;

     

       38
       38
       +
       

     

       39
       39
       +
             localDnsResolver = false;

     

       40
       40
       +
           };

     

       41
       41
       +
       

     

       42
       42
       +
           services.nginx.virtualHosts."${config.mailserver.fqdn}".extraConfig = ''

     

       43
       43
       +
             return 301 $scheme://${domain}$request_uri;

     

       44
       44
       +
           '';

     

       45
       45
       +
       

     

       46
       46
       +
           dns.records = [

     

       47
       47
       +
             {

     

       48
       48
       +
               name = "mail";

     

       49
       49
       +
               type = "A";

     

       50
       50
       +
               data = config.hosting.serverIpv4;

     

       51
       51
       +
             }

     

       52
       52
       +
             {

     

       53
       53
       +
               name = "mail";

     

       54
       54
       +
               type = "AAAA";

     

       55
       55
       +
               data = config.hosting.serverIpv6;

     

       56
       56
       +
             }

     

       57
       57
       +
             {

     

       58
       58
       +
               name = "@";

     

       59
       59
       +
               type = "MX";

     

       60
       60
       +
               data = "10 mail";

     

       61
       61
       +
             }

     

       62
       62
       +
             {

     

       63
       63
       +
               name = "@";

     

       64
       64
       +
               type = "TXT";

     

       65
       65
       +
               data = "\"v=spf1 a:mail.${config.networking.domain} -all\"";

     

       66
       66
       +
             }

     

       67
       67
       +
             {

     

       68
       68
       +
               name = "mail._domainkey";

     

       69
       69
       +
               ttl = 10800;

     

       70
       70
       +
               type = "TXT";

     

       71
       71
       +
               data = "\"v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6YmYYvoFF7VqtGcozpVQa78aaGgZdvc5ZIHqzmkKdCBEyDF2FRbCEK4s2AlC8hhc8O4mSSe3S4AzEhlRgHXbU22GBaUZ3s2WHS8JJwZvWeTjsbXQwjN/U7xpkqXPHLH9IVfOJbHlp4HQmCAXw4NaypgkkxIGK0jaZHm2j6/1izQIDAQAB\"";

     

       72
       72
       +
             }

     

       73
       73
       +
             {

     

       74
       74
       +
               name = "_dmarc";

     

       75
       75
       +
               ttl = 10800;

     

       76
       76
       +
               type = "TXT";

     

       77
       77
       +
               data = "\"v=DMARC1; p=none\"";

     

       78
       78
       +
             }

     

       79
       79
       +
           ];

     

       80
       80
       +
         };

     

       81
       81
       +
       }

+79

modules/hosting/mastodon.nix

···

       1
       1
       +
       { pkgs, config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       let

     

       4
       4
       +
         cfg = config.hosting;

     

       5
       5
       +
         domain = config.networking.domain;

     

       6
       6
       +
       in {

     

       7
       7
       +
         options.hosting.mastodon = lib.mkEnableOption "mastodon";

     

       8
       8
       +
       

     

       9
       9
       +
         config = lib.mkIf cfg.mastodon {

     

       10
       10
       +
           services.mastodon = {

     

       11
       11
       +
             enable = true;

     

       12
       12
       +
             enableUnixSocket = false;

     

       13
       13
       +
             webProcesses = 1;

     

       14
       14
       +
             webThreads = 3;

     

       15
       15
       +
             sidekiqThreads = 5;

     

       16
       16
       +
             smtp = {

     

       17
       17
       +
               #createLocally = false;

     

       18
       18
       +
               user = "misc@${domain}";

     

       19
       19
       +
               port = 465;

     

       20
       20
       +
               host = "mail.${domain}";

     

       21
       21
       +
               authenticate = true;

     

       22
       22
       +
               passwordFile = "${config.custom.secretsDir}/email-pswd-unhashed";

     

       23
       23
       +
               fromAddress = "mastodon@${domain}";

     

       24
       24
       +
             };

     

       25
       25
       +
             extraConfig = {

     

       26
       26
       +
               # override localDomain

     

       27
       27
       +
               LOCAL_DOMAIN = "${domain}";

     

       28
       28
       +
               WEB_DOMAIN = "mastodon.${domain}";

     

       29
       29
       +
       

     

       30
       30
       +
               # https://peterbabic.dev/blog/setting-up-smtp-in-mastodon/

     

       31
       31
       +
               SMTP_SSL="true";

     

       32
       32
       +
               SMTP_ENABLE_STARTTLS="false";

     

       33
       33
       +
               SMTP_OPENSSL_VERIFY_MODE="none";

     

       34
       34
       +
             };

     

       35
       35
       +
           };

     

       36
       36
       +
       

     

       37
       37
       +
           users.groups.${config.services.mastodon.group}.members = [ config.services.nginx.user ];

     

       38
       38
       +
       

     

       39
       39
       +
           services.nginx = {

     

       40
       40
       +
             enable = true;

     

       41
       41
       +
             recommendedProxySettings = true;

     

       42
       42
       +
             virtualHosts = {

     

       43
       43
       +
               # relies on root domain being set up

     

       44
       44
       +
               "${domain}".locations."/.well-known/host-meta".extraConfig = ''

     

       45
       45
       +
                 return 301 https://mastodon.${domain}$request_uri;

     

       46
       46
       +
               '';

     

       47
       47
       +
               "mastodon.${domain}" = {

     

       48
       48
       +
                 root = "${config.services.mastodon.package}/public/";

     

       49
       49
       +
                 forceSSL = true;

     

       50
       50
       +
                 enableACME = true;

     

       51
       51
       +
       

     

       52
       52
       +
                 locations."/system/".alias = "/var/lib/mastodon/public-system/";

     

       53
       53
       +
       

     

       54
       54
       +
                 locations."/" = {

     

       55
       55
       +
                   tryFiles = "$uri @proxy";

     

       56
       56
       +
                 };

     

       57
       57
       +
       

     

       58
       58
       +
                 locations."@proxy" = {

     

       59
       59
       +
                   proxyPass = "http://127.0.0.1:${builtins.toString config.services.mastodon.webPort}";

     

       60
       60
       +
                   proxyWebsockets = true;

     

       61
       61
       +
                 };

     

       62
       62
       +
       

     

       63
       63
       +
                 locations."/api/v1/streaming/" = {

     

       64
       64
       +
                   proxyPass = "http://127.0.0.1:${builtins.toString config.services.mastodon.streamingPort}/";

     

       65
       65
       +
                   proxyWebsockets = true;

     

       66
       66
       +
                 };

     

       67
       67
       +
               };

     

       68
       68
       +
             };

     

       69
       69
       +
           };

     

       70
       70
       +
       

     

       71
       71
       +
           dns.records = [

     

       72
       72
       +
             {

     

       73
       73
       +
               name = "mastodon";

     

       74
       74
       +
               type = "CNAME";

     

       75
       75
       +
               data = "vps";

     

       76
       76
       +
             }

     

       77
       77
       +
           ];

     

       78
       78
       +
         };

     

       79
       79
       +
       }

+112

modules/hosting/matrix.nix

···

       1
       1
       +
       { config, pkgs, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       let cfg = config.hosting; in

     

       4
       4
       +
       {

     

       5
       5
       +
         options.hosting.matrix = lib.mkEnableOption "matrix";

     

       6
       6
       +
       

     

       7
       7
       +
         config = lib.mkIf cfg.matrix {

     

       8
       8
       +
           services.postgresql.enable = true;

     

       9
       9
       +
           services.postgresql.package = pkgs.postgresql_13;

     

       10
       10
       +
           services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''

     

       11
       11
       +
             CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';

     

       12
       12
       +
             CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"

     

       13
       13
       +
               TEMPLATE template0

     

       14
       14
       +
               LC_COLLATE = "C"

     

       15
       15
       +
               LC_CTYPE = "C";

     

       16
       16
       +
           '';

     

       17
       17
       +
       

     

       18
       18
       +
           services.nginx = {

     

       19
       19
       +
             enable = true;

     

       20
       20
       +
             # only recommendedProxySettings and recommendedGzipSettings are strictly required,

     

       21
       21
       +
             # but the rest make sense as well

     

       22
       22
       +
             recommendedTlsSettings = true;

     

       23
       23
       +
             recommendedOptimisation = true;

     

       24
       24
       +
             recommendedGzipSettings = true;

     

       25
       25
       +
             recommendedProxySettings = true;

     

       26
       26
       +
       

     

       27
       27
       +
             virtualHosts = {

     

       28
       28
       +
               # This host section can be placed on a different host than the rest,

     

       29
       29
       +
               # i.e. to delegate from the host being accessible as ${config.networking.domain}

     

       30
       30
       +
               # to another host actually running the Matrix homeserver.

     

       31
       31
       +
               "${config.networking.domain}" = {

     

       32
       32
       +
                 enableACME = true;

     

       33
       33
       +
                 forceSSL = true;

     

       34
       34
       +
       

     

       35
       35
       +
                 locations."= /.well-known/matrix/server".extraConfig =

     

       36
       36
       +
                   let

     

       37
       37
       +
                     # use 443 instead of the default 8448 port to unite

     

       38
       38
       +
                     # the client-server and server-server port for simplicity

     

       39
       39
       +
                     server = { "m.server" = "matrix.${config.networking.domain}:443"; };

     

       40
       40
       +
                   in ''

     

       41
       41
       +
                     add_header Content-Type application/json;

     

       42
       42
       +
                     return 200 '${builtins.toJSON server}';

     

       43
       43
       +
                   '';

     

       44
       44
       +
                 locations."= /.well-known/matrix/client".extraConfig =

     

       45
       45
       +
                   let

     

       46
       46
       +
                     client = {

     

       47
       47
       +
                       "m.homeserver" =  { "base_url" = "https://matrix.${config.networking.domain}"; };

     

       48
       48
       +
                       "m.identity_server" =  { "base_url" = "https://vector.im"; };

     

       49
       49
       +
                     };

     

       50
       50
       +
                   # ACAO required to allow element-web on any URL to request this json file

     

       51
       51
       +
                   in ''

     

       52
       52
       +
                     add_header Content-Type application/json;

     

       53
       53
       +
                     add_header Access-Control-Allow-Origin *;

     

       54
       54
       +
                     return 200 '${builtins.toJSON client}';

     

       55
       55
       +
                   '';

     

       56
       56
       +
               };

     

       57
       57
       +
       

     

       58
       58
       +
               # Reverse proxy for Matrix client-server and server-server communication

     

       59
       59
       +
               "matrix.${config.networking.domain}" = {

     

       60
       60
       +
                 enableACME = true;

     

       61
       61
       +
                 forceSSL = true;

     

       62
       62
       +
       

     

       63
       63
       +
                 # Or do a redirect instead of the 404, or whatever is appropriate for you.

     

       64
       64
       +
                 # But do not put a Matrix Web client here! See the Element web section below.

     

       65
       65
       +
                 locations."/".extraConfig = ''

     

       66
       66
       +
                   return 404;

     

       67
       67
       +
                 '';

     

       68
       68
       +
       

     

       69
       69
       +
                 # forward all Matrix API calls to the synapse Matrix homeserver

     

       70
       70
       +
                 locations."/_matrix" = {

     

       71
       71
       +
                   proxyPass = "http://127.0.0.1:8008"; # without a trailing /

     

       72
       72
       +
                   #proxyPassReverse = "http://127.0.0.1:8008"; # without a trailing /

     

       73
       73
       +
                 };

     

       74
       74
       +
               };

     

       75
       75
       +
             };

     

       76
       76
       +
           };

     

       77
       77
       +
       

     

       78
       78
       +
           services.matrix-synapse = {

     

       79
       79
       +
             enable = true;

     

       80
       80
       +
             settings = {

     

       81
       81
       +
               server_name = config.networking.domain;

     

       82
       82
       +
               enable_registration = true;

     

       83
       83
       +
               registration_requires_token = true;

     

       84
       84
       +
               auto_join_rooms = [ "#freumh:freumh.org" ];

     

       85
       85
       +
               registration_shared_secret_path = "${config.custom.secretsDir}/matrix-shared-secret";

     

       86
       86
       +
               listeners = [

     

       87
       87
       +
                 {

     

       88
       88
       +
                   port = 8008;

     

       89
       89
       +
                   bind_addresses = [ "::1" "127.0.0.1" ];

     

       90
       90
       +
                   type = "http";

     

       91
       91
       +
                   tls = false;

     

       92
       92
       +
                   x_forwarded = true;

     

       93
       93
       +
                   resources = [

     

       94
       94
       +
                     {

     

       95
       95
       +
                       names = [ "client" "federation" ];

     

       96
       96
       +
                       compress = false;

     

       97
       97
       +
                     }

     

       98
       98
       +
                   ];

     

       99
       99
       +
                 }

     

       100
       100
       +
               ];

     

       101
       101
       +
             };

     

       102
       102
       +
           };

     

       103
       103
       +
       

     

       104
       104
       +
           dns.records = [

     

       105
       105
       +
             {

     

       106
       106
       +
               name = "matrix";

     

       107
       107
       +
               type = "CNAME";

     

       108
       108
       +
               data = "vps";

     

       109
       109
       +
             }

     

       110
       110
       +
           ];

     

       111
       111
       +
         };

     

       112
       112
       +
       }

+78

modules/mailserver/borgbackup.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver.borgbackup;

     

       21
       21
       +
       

     

       22
       22
       +
         methodFragment = lib.optional (cfg.compression.method != null) cfg.compression.method;

     

       23
       23
       +
         autoFragment =

     

       24
       24
       +
           if cfg.compression.auto && cfg.compression.method == null

     

       25
       25
       +
           then throw "compression.method must be set when using auto."

     

       26
       26
       +
           else lib.optional cfg.compression.auto "auto";

     

       27
       27
       +
         levelFragment =

     

       28
       28
       +
           if cfg.compression.level != null && cfg.compression.method == null

     

       29
       29
       +
           then throw "compression.method must be set when using compression.level."

     

       30
       30
       +
           else lib.optional (cfg.compression.level != null) (toString cfg.compression.level);

     

       31
       31
       +
         compressionFragment = lib.concatStringsSep "," (lib.flatten [autoFragment methodFragment levelFragment]);

     

       32
       32
       +
         compression = lib.optionalString (compressionFragment != "") "--compression ${compressionFragment}";

     

       33
       33
       +
       

     

       34
       34
       +
         encryptionFragment = cfg.encryption.method;

     

       35
       35
       +
         passphraseFile = lib.escapeShellArg cfg.encryption.passphraseFile;

     

       36
       36
       +
         passphraseFragment = lib.optionalString (cfg.encryption.method != "none")

     

       37
       37
       +
                                (if cfg.encryption.passphraseFile != null then ''env BORG_PASSPHRASE="$(cat ${passphraseFile})"''

     

       38
       38
       +
                                 else throw "passphraseFile must be set when using encryption.");

     

       39
       39
       +
       

     

       40
       40
       +
         locations = lib.escapeShellArgs cfg.locations;

     

       41
       41
       +
         name = lib.escapeShellArg cfg.name;

     

       42
       42
       +
       

     

       43
       43
       +
         repoLocation = lib.escapeShellArg cfg.repoLocation;

     

       44
       44
       +
       

     

       45
       45
       +
         extraInitArgs = lib.escapeShellArgs cfg.extraArgumentsForInit;

     

       46
       46
       +
         extraCreateArgs = lib.escapeShellArgs cfg.extraArgumentsForCreate;

     

       47
       47
       +
       

     

       48
       48
       +
         cmdPreexec = lib.optionalString (cfg.cmdPreexec != null) cfg.cmdPreexec;

     

       49
       49
       +
         cmdPostexec = lib.optionalString (cfg.cmdPostexec != null) cfg.cmdPostexec;

     

       50
       50
       +
       

     

       51
       51
       +
         borgScript = ''

     

       52
       52
       +
           export BORG_REPO=${repoLocation}

     

       53
       53
       +
           ${cmdPreexec}

     

       54
       54
       +
           ${passphraseFragment} ${pkgs.borgbackup}/bin/borg init ${extraInitArgs} --encryption ${encryptionFragment} || true

     

       55
       55
       +
           ${passphraseFragment} ${pkgs.borgbackup}/bin/borg create ${extraCreateArgs} ${compression} ::${name} ${locations}

     

       56
       56
       +
           ${cmdPostexec}

     

       57
       57
       +
         '';

     

       58
       58
       +
       in {

     

       59
       59
       +
         config = lib.mkIf (config.mailserver.enable && cfg.enable) {

     

       60
       60
       +
           environment.systemPackages = with pkgs; [

     

       61
       61
       +
             borgbackup

     

       62
       62
       +
           ];

     

       63
       63
       +
       

     

       64
       64
       +
           systemd.services.borgbackup = {

     

       65
       65
       +
             description = "borgbackup";

     

       66
       66
       +
             unitConfig.Documentation = "man:borgbackup";

     

       67
       67
       +
             script = borgScript;

     

       68
       68
       +
             serviceConfig = {

     

       69
       69
       +
               User = cfg.user;

     

       70
       70
       +
               Group = cfg.group;

     

       71
       71
       +
               CPUSchedulingPolicy = "idle";

     

       72
       72
       +
               IOSchedulingClass = "idle";

     

       73
       73
       +
               ProtectSystem = "full";

     

       74
       74
       +
             };

     

       75
       75
       +
             startAt = cfg.startAt;

     

       76
       76
       +
           };

     

       77
       77
       +
         };

     

       78
       78
       +
       }

+30

modules/mailserver/clamav.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, options, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver;

     

       21
       21
       +
       in

     

       22
       22
       +
       {

     

       23
       23
       +
         config = lib.mkIf (cfg.enable && cfg.virusScanning) {

     

       24
       24
       +
           services.clamav.daemon = {

     

       25
       25
       +
             enable = true;

     

       26
       26
       +
             settings.PhishingScanURLs = "no";

     

       27
       27
       +
           };

     

       28
       28
       +
           services.clamav.updater.enable = true;

     

       29
       29
       +
         };

     

       30
       30
       +
       }

+48

modules/mailserver/common.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver;

     

       21
       21
       +
       in

     

       22
       22
       +
       {

     

       23
       23
       +
         # cert :: PATH

     

       24
       24
       +
         certificatePath = if cfg.certificateScheme == 1

     

       25
       25
       +
                    then cfg.certificateFile

     

       26
       26
       +
                    else if cfg.certificateScheme == 2

     

       27
       27
       +
                         then "${cfg.certificateDirectory}/cert-${cfg.fqdn}.pem"

     

       28
       28
       +
                         else if cfg.certificateScheme == 3

     

       29
       29
       +
                              then "${config.security.acme.certs.${cfg.fqdn}.directory}/fullchain.pem"

     

       30
       30
       +
                              else throw "Error: Certificate Scheme must be in { 1, 2, 3 }";

     

       31
       31
       +
       

     

       32
       32
       +
         # key :: PATH

     

       33
       33
       +
         keyPath = if cfg.certificateScheme == 1

     

       34
       34
       +
               then cfg.keyFile

     

       35
       35
       +
               else if cfg.certificateScheme == 2

     

       36
       36
       +
                    then "${cfg.certificateDirectory}/key-${cfg.fqdn}.pem"

     

       37
       37
       +
                     else if cfg.certificateScheme == 3

     

       38
       38
       +
                          then "${config.security.acme.certs.${cfg.fqdn}.directory}/key.pem"

     

       39
       39
       +
                          else throw "Error: Certificate Scheme must be in { 1, 2, 3 }";

     

       40
       40
       +
       

     

       41
       41
       +
         passwordFiles = let

     

       42
       42
       +
           mkHashFile = name: hash: pkgs.writeText "${builtins.hashString "sha256" name}-password-hash" hash;

     

       43
       43
       +
         in

     

       44
       44
       +
           lib.mapAttrs (name: value:

     

       45
       45
       +
           if value.hashedPasswordFile == null then

     

       46
       46
       +
             builtins.toString (mkHashFile name value.hashedPassword)

     

       47
       47
       +
           else value.hashedPasswordFile) cfg.loginAccounts;

     

       48
       48
       +
       }

modules/mailserver/debug.nix

···

       1
       1
       +
       { config, lib, ... }:

     

       2
       2
       +
       {

     

       3
       3
       +
         mailserver.policydSPFExtraConfig = lib.mkIf config.mailserver.debug "debugLevel = 4";

     

       4
       4
       +
       }

+1043

modules/mailserver/default.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, lib, pkgs, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       with lib;

     

       20
       20
       +
       

     

       21
       21
       +
       let

     

       22
       22
       +
         cfg = config.mailserver;

     

       23
       23
       +
       in

     

       24
       24
       +
       {

     

       25
       25
       +
         options.mailserver = {

     

       26
       26
       +
           enable = lib.mkEnableOption "nixos-mailserver";

     

       27
       27
       +
       

     

       28
       28
       +
           openFirewall = mkOption {

     

       29
       29
       +
             type = types.bool;

     

       30
       30
       +
             default = true;

     

       31
       31
       +
             description = "Automatically open ports in the firewall.";

     

       32
       32
       +
           };

     

       33
       33
       +
       

     

       34
       34
       +
           fqdn = mkOption {

     

       35
       35
       +
             type = types.str;

     

       36
       36
       +
             example = "mx.example.com";

     

       37
       37
       +
             description = "The fully qualified domain name of the mail server.";

     

       38
       38
       +
           };

     

       39
       39
       +
       

     

       40
       40
       +
           domains = mkOption {

     

       41
       41
       +
             type = types.listOf types.str;

     

       42
       42
       +
             example = [ "example.com" ];

     

       43
       43
       +
             default = [];

     

       44
       44
       +
             description = "The domains that this mail server serves.";

     

       45
       45
       +
           };

     

       46
       46
       +
       

     

       47
       47
       +
           certificateDomains = mkOption {

     

       48
       48
       +
             type = types.listOf types.str;

     

       49
       49
       +
             example = [ "imap.example.com" "pop3.example.com" ];

     

       50
       50
       +
             default = [];

     

       51
       51
       +
             description = "Secondary domains and subdomains for which it is necessary to generate a certificate.";

     

       52
       52
       +
           };

     

       53
       53
       +
       

     

       54
       54
       +
           messageSizeLimit = mkOption {

     

       55
       55
       +
             type = types.int;

     

       56
       56
       +
             example = 52428800;

     

       57
       57
       +
             default = 20971520;

     

       58
       58
       +
             description = "Message size limit enforced by Postfix.";

     

       59
       59
       +
           };

     

       60
       60
       +
       

     

       61
       61
       +
           loginAccounts = mkOption {

     

       62
       62
       +
             type = types.attrsOf (types.submodule ({ name, ... }: {

     

       63
       63
       +
               options = {

     

       64
       64
       +
                 name = mkOption {

     

       65
       65
       +
                   type = types.str;

     

       66
       66
       +
                   example = "user1@example.com";

     

       67
       67
       +
                   description = "Username";

     

       68
       68
       +
                 };

     

       69
       69
       +
       

     

       70
       70
       +
                 hashedPassword = mkOption {

     

       71
       71
       +
                   type = with types; nullOr str;

     

       72
       72
       +
                   default = null;

     

       73
       73
       +
                   example = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";

     

       74
       74
       +
                   description = ''

     

       75
       75
       +
                     The user's hashed password. Use `htpasswd` as follows

     

       76
       76
       +
       

     

       77
       77
       +
                     ```

     

       78
       78
       +
                     nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2

     

       79
       79
       +
                     ```

     

       80
       80
       +
       

     

       81
       81
       +
                     Warning: this is stored in plaintext in the Nix store!

     

       82
       82
       +
                     Use `hashedPasswordFile` instead.

     

       83
       83
       +
                   '';

     

       84
       84
       +
                 };

     

       85
       85
       +
       

     

       86
       86
       +
                 hashedPasswordFile = mkOption {

     

       87
       87
       +
                   type = with types; nullOr path;

     

       88
       88
       +
                   default = null;

     

       89
       89
       +
                   example = "/run/keys/user1-passwordhash";

     

       90
       90
       +
                   description = ''

     

       91
       91
       +
                     A file containing the user's hashed password. Use `htpasswd` as follows

     

       92
       92
       +
       

     

       93
       93
       +
                     ```

     

       94
       94
       +
                     nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2

     

       95
       95
       +
                     ```

     

       96
       96
       +
                   '';

     

       97
       97
       +
                 };

     

       98
       98
       +
       

     

       99
       99
       +
                 aliases = mkOption {

     

       100
       100
       +
                   type = with types; listOf types.str;

     

       101
       101
       +
                   example = ["abuse@example.com" "postmaster@example.com"];

     

       102
       102
       +
                   default = [];

     

       103
       103
       +
                   description = ''

     

       104
       104
       +
                     A list of aliases of this login account.

     

       105
       105
       +
                     Note: Use list entries like "@example.com" to create a catchAll

     

       106
       106
       +
                     that allows sending from all email addresses in these domain.

     

       107
       107
       +
                   '';

     

       108
       108
       +
                 };

     

       109
       109
       +
       

     

       110
       110
       +
                 catchAll = mkOption {

     

       111
       111
       +
                   type = with types; listOf (enum cfg.domains);

     

       112
       112
       +
                   example = ["example.com" "example2.com"];

     

       113
       113
       +
                   default = [];

     

       114
       114
       +
                   description = ''

     

       115
       115
       +
                     For which domains should this account act as a catch all?

     

       116
       116
       +
                     Note: Does not allow sending from all addresses of these domains.

     

       117
       117
       +
                   '';

     

       118
       118
       +
                 };

     

       119
       119
       +
       

     

       120
       120
       +
                 quota = mkOption {

     

       121
       121
       +
                   type = with types; nullOr types.str;

     

       122
       122
       +
                   default = null;

     

       123
       123
       +
                   example = "2G";

     

       124
       124
       +
                   description = ''

     

       125
       125
       +
                     Per user quota rules. Accepted sizes are `xx k/M/G/T` with the

     

       126
       126
       +
                     obvious meaning. Leave blank for the standard quota `100G`.

     

       127
       127
       +
                   '';

     

       128
       128
       +
                 };

     

       129
       129
       +
       

     

       130
       130
       +
                 sieveScript = mkOption {

     

       131
       131
       +
                   type = with types; nullOr lines;

     

       132
       132
       +
                   default = null;

     

       133
       133
       +
                   example = ''

     

       134
       134
       +
                     require ["fileinto", "mailbox"];

     

       135
       135
       +
       

     

       136
       136
       +
                     if address :is "from" "gitlab@mg.gitlab.com" {

     

       137
       137
       +
                       fileinto :create "GitLab";

     

       138
       138
       +
                       stop;

     

       139
       139
       +
                     }

     

       140
       140
       +
       

     

       141
       141
       +
                     # This must be the last rule, it will check if list-id is set, and

     

       142
       142
       +
                     # file the message into the Lists folder for further investigation

     

       143
       143
       +
                     elsif header :matches "list-id" "<?*>" {

     

       144
       144
       +
                       fileinto :create "Lists";

     

       145
       145
       +
                       stop;

     

       146
       146
       +
                     }

     

       147
       147
       +
                   '';

     

       148
       148
       +
                   description = ''

     

       149
       149
       +
                     Per-user sieve script.

     

       150
       150
       +
                   '';

     

       151
       151
       +
                 };

     

       152
       152
       +
       

     

       153
       153
       +
                 sendOnly = mkOption {

     

       154
       154
       +
                   type = types.bool;

     

       155
       155
       +
                   default = false;

     

       156
       156
       +
                   description = ''

     

       157
       157
       +
                     Specifies if the account should be a send-only account.

     

       158
       158
       +
                     Emails sent to send-only accounts will be rejected from

     

       159
       159
       +
                     unauthorized senders with the sendOnlyRejectMessage

     

       160
       160
       +
                     stating the reason.

     

       161
       161
       +
                   '';

     

       162
       162
       +
                 };

     

       163
       163
       +
       

     

       164
       164
       +
                 sendOnlyRejectMessage = mkOption {

     

       165
       165
       +
                   type = types.str;

     

       166
       166
       +
                   default = "This account cannot receive emails.";

     

       167
       167
       +
                   description = ''

     

       168
       168
       +
                     The message that will be returned to the sender when an email is

     

       169
       169
       +
                     sent to a send-only account. Only used if the account is marked

     

       170
       170
       +
                     as send-only.

     

       171
       171
       +
                   '';

     

       172
       172
       +
                 };

     

       173
       173
       +
               };

     

       174
       174
       +
       

     

       175
       175
       +
               config.name = mkDefault name;

     

       176
       176
       +
             }));

     

       177
       177
       +
             example = {

     

       178
       178
       +
               user1 = {

     

       179
       179
       +
                 hashedPassword = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";

     

       180
       180
       +
               };

     

       181
       181
       +
               user2 = {

     

       182
       182
       +
                 hashedPassword = "$6$oE0ZNv2n7Vk9gOf$9xcZWCCLGdMflIfuA0vR1Q1Xblw6RZqPrP94mEit2/81/7AKj2bqUai5yPyWE.QYPyv6wLMHZvjw3Rlg7yTCD/";

     

       183
       183
       +
               };

     

       184
       184
       +
             };

     

       185
       185
       +
             description = ''

     

       186
       186
       +
               The login account of the domain. Every account is mapped to a unix user,

     

       187
       187
       +
               e.g. `user1@example.com`. To generate the passwords use `htpasswd` as

     

       188
       188
       +
               follows

     

       189
       189
       +
       

     

       190
       190
       +
               ```

     

       191
       191
       +
               nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2

     

       192
       192
       +
               ```

     

       193
       193
       +
             '';

     

       194
       194
       +
             default = {};

     

       195
       195
       +
           };

     

       196
       196
       +
       

     

       197
       197
       +
           indexDir = mkOption {

     

       198
       198
       +
             type = types.nullOr types.str;

     

       199
       199
       +
             default = null;

     

       200
       200
       +
             description = ''

     

       201
       201
       +
               Folder to store search indices. If null, indices are stored

     

       202
       202
       +
               along with email, which could not necessarily be desirable,

     

       203
       203
       +
               especially when the fullTextSearch option is enable since

     

       204
       204
       +
               indices it creates are voluminous and do not need to be backed

     

       205
       205
       +
               up.

     

       206
       206
       +
       

     

       207
       207
       +
               Be careful when changing this option value since all indices

     

       208
       208
       +
               would be recreated at the new location (and clients would need

     

       209
       209
       +
               to resynchronize).

     

       210
       210
       +
       

     

       211
       211
       +
               Note the some variables can be used in the file path. See

     

       212
       212
       +
               https://doc.dovecot.org/configuration_manual/mail_location/#variables

     

       213
       213
       +
               for details.

     

       214
       214
       +
             '';

     

       215
       215
       +
             example = "/var/lib/dovecot/indices";

     

       216
       216
       +
           };

     

       217
       217
       +
       

     

       218
       218
       +
           fullTextSearch = {

     

       219
       219
       +
             enable = lib.mkEnableOption "Full text search indexing with xapian. This has significant performance and disk space cost.";

     

       220
       220
       +
             autoIndex = mkOption {

     

       221
       221
       +
               type = types.bool;

     

       222
       222
       +
               default = true;

     

       223
       223
       +
               description = "Enable automatic indexing of messages as they are received or modified.";

     

       224
       224
       +
             };

     

       225
       225
       +
             autoIndexExclude = mkOption {

     

       226
       226
       +
               type = types.listOf types.str;

     

       227
       227
       +
               default = [ ];

     

       228
       228
       +
               example = [ "\\Trash" "SomeFolder" "Other/*" ];

     

       229
       229
       +
               description = ''

     

       230
       230
       +
                 Mailboxes to exclude from automatic indexing.

     

       231
       231
       +
               '';

     

       232
       232
       +
             };

     

       233
       233
       +
       

     

       234
       234
       +
             indexAttachments = mkOption {

     

       235
       235
       +
               type = types.bool;

     

       236
       236
       +
               default = false;

     

       237
       237
       +
               description = "Also index text-only attachements. Binary attachements are never indexed.";

     

       238
       238
       +
             };

     

       239
       239
       +
       

     

       240
       240
       +
             enforced = mkOption {

     

       241
       241
       +
               type = types.enum [ "yes" "no" "body" ];

     

       242
       242
       +
               default = "no";

     

       243
       243
       +
               description = ''

     

       244
       244
       +
                 Fail searches when no index is available. If set to

     

       245
       245
       +
                 <literal>body</literal>, then only body searches (as opposed to

     

       246
       246
       +
                 header) are affected. If set to <literal>no</literal>, searches may

     

       247
       247
       +
                 fall back to a very slow brute force search.

     

       248
       248
       +
               '';

     

       249
       249
       +
             };

     

       250
       250
       +
       

     

       251
       251
       +
             minSize = mkOption {

     

       252
       252
       +
               type = types.int;

     

       253
       253
       +
               default = 2;

     

       254
       254
       +
               description = "Size of the smallest n-gram to index.";

     

       255
       255
       +
             };

     

       256
       256
       +
             maxSize = mkOption {

     

       257
       257
       +
               type = types.int;

     

       258
       258
       +
               default = 20;

     

       259
       259
       +
               description = "Size of the largest n-gram to index.";

     

       260
       260
       +
             };

     

       261
       261
       +
             memoryLimit = mkOption {

     

       262
       262
       +
               type = types.nullOr types.int;

     

       263
       263
       +
               default = null;

     

       264
       264
       +
               example = 2000;

     

       265
       265
       +
               description = "Memory limit for the indexer process, in MiB. If null, leaves the default (which is rather low), and if 0, no limit.";

     

       266
       266
       +
             };

     

       267
       267
       +
       

     

       268
       268
       +
             maintenance = {

     

       269
       269
       +
               enable = mkOption {

     

       270
       270
       +
                 type = types.bool;

     

       271
       271
       +
                 default = true;

     

       272
       272
       +
                 description = "Regularly optmize indices, as recommended by upstream.";

     

       273
       273
       +
               };

     

       274
       274
       +
       

     

       275
       275
       +
               onCalendar = mkOption {

     

       276
       276
       +
                 type = types.str;

     

       277
       277
       +
                 default = "daily";

     

       278
       278
       +
                 description = "When to run the maintenance job. See systemd.time(7) for more information about the format.";

     

       279
       279
       +
               };

     

       280
       280
       +
       

     

       281
       281
       +
               randomizedDelaySec = mkOption {

     

       282
       282
       +
                 type = types.int;

     

       283
       283
       +
                 default = 1000;

     

       284
       284
       +
                 description = "Run the maintenance job not exactly at the time specified with <literal>onCalendar</literal>, but plus or minus this many seconds.";

     

       285
       285
       +
               };

     

       286
       286
       +
             };

     

       287
       287
       +
           };

     

       288
       288
       +
       

     

       289
       289
       +
           lmtpSaveToDetailMailbox = mkOption {

     

       290
       290
       +
             type = types.enum ["yes" "no"];

     

       291
       291
       +
             default = "yes";

     

       292
       292
       +
             description = ''

     

       293
       293
       +
               If an email address is delimited by a "+", should it be filed into a

     

       294
       294
       +
               mailbox matching the string after the "+"?  For example,

     

       295
       295
       +
               user1+test@example.com would be filed into the mailbox "test".

     

       296
       296
       +
             '';

     

       297
       297
       +
           };

     

       298
       298
       +
       

     

       299
       299
       +
           extraVirtualAliases = mkOption {

     

       300
       300
       +
             type = let

     

       301
       301
       +
               loginAccount = mkOptionType {

     

       302
       302
       +
                 name = "Login Account";

     

       303
       303
       +
                 check = (account: builtins.elem account (builtins.attrNames cfg.loginAccounts));

     

       304
       304
       +
               };

     

       305
       305
       +
             in with types; attrsOf (either loginAccount (nonEmptyListOf loginAccount));

     

       306
       306
       +
             example = {

     

       307
       307
       +
               "info@example.com" = "user1@example.com";

     

       308
       308
       +
               "postmaster@example.com" = "user1@example.com";

     

       309
       309
       +
               "abuse@example.com" = "user1@example.com";

     

       310
       310
       +
               "multi@example.com" = [ "user1@example.com" "user2@example.com" ];

     

       311
       311
       +
             };

     

       312
       312
       +
             description = ''

     

       313
       313
       +
               Virtual Aliases. A virtual alias `"info@example.com" = "user1@example.com"` means that

     

       314
       314
       +
               all mail to `info@example.com` is forwarded to `user1@example.com`. Note

     

       315
       315
       +
               that it is expected that `postmaster@example.com` and `abuse@example.com` is

     

       316
       316
       +
               forwarded to some valid email address. (Alternatively you can create login

     

       317
       317
       +
               accounts for `postmaster` and (or) `abuse`). Furthermore, it also allows

     

       318
       318
       +
               the user `user1@example.com` to send emails as `info@example.com`.

     

       319
       319
       +
               It's also possible to create an alias for multiple accounts. In this

     

       320
       320
       +
               example all mails for `multi@example.com` will be forwarded to both

     

       321
       321
       +
               `user1@example.com` and `user2@example.com`.

     

       322
       322
       +
             '';

     

       323
       323
       +
             default = {};

     

       324
       324
       +
           };

     

       325
       325
       +
       

     

       326
       326
       +
           forwards = mkOption {

     

       327
       327
       +
             type = with types; attrsOf (either (listOf str) str);

     

       328
       328
       +
             example = {

     

       329
       329
       +
               "user@example.com" = "user@elsewhere.com";

     

       330
       330
       +
             };

     

       331
       331
       +
             description = ''

     

       332
       332
       +
               To forward mails to an external address. For instance,

     

       333
       333
       +
               the value {`"user@example.com" = "user@elsewhere.com";}`

     

       334
       334
       +
               means that mails to `user@example.com` are forwarded to

     

       335
       335
       +
               `user@elsewhere.com`. The difference with the

     

       336
       336
       +
               `extraVirtualAliases` option is that `user@elsewhere.com`

     

       337
       337
       +
               can't send mail as `user@example.com`. Also, this option

     

       338
       338
       +
               allows to forward mails to external addresses.

     

       339
       339
       +
             '';

     

       340
       340
       +
             default = {};

     

       341
       341
       +
           };

     

       342
       342
       +
       

     

       343
       343
       +
           rejectSender = mkOption {

     

       344
       344
       +
             type = types.listOf types.str;

     

       345
       345
       +
             example = [ "@example.com" "spammer@example.net" ];

     

       346
       346
       +
             description = ''

     

       347
       347
       +
               Reject emails from these addresses from unauthorized senders.

     

       348
       348
       +
               Use if a spammer is using the same domain or the same sender over and over.

     

       349
       349
       +
             '';

     

       350
       350
       +
             default = [];

     

       351
       351
       +
           };

     

       352
       352
       +
       

     

       353
       353
       +
           rejectRecipients = mkOption {

     

       354
       354
       +
             type = types.listOf types.str;

     

       355
       355
       +
             example = [ "sales@example.com" "info@example.com" ];

     

       356
       356
       +
             description = ''

     

       357
       357
       +
               Reject emails addressed to these local addresses from unauthorized senders.

     

       358
       358
       +
               Use if a spammer has found email addresses in a catchall domain but you do

     

       359
       359
       +
               not want to disable the catchall.

     

       360
       360
       +
             '';

     

       361
       361
       +
             default = [];

     

       362
       362
       +
           };

     

       363
       363
       +
       

     

       364
       364
       +
           vmailUID = mkOption {

     

       365
       365
       +
             type = types.int;

     

       366
       366
       +
             default = 5000;

     

       367
       367
       +
             description = ''

     

       368
       368
       +
               The unix UID of the virtual mail user.  Be mindful that if this is

     

       369
       369
       +
               changed, you will need to manually adjust the permissions of

     

       370
       370
       +
               mailDirectory.

     

       371
       371
       +
             '';

     

       372
       372
       +
           };

     

       373
       373
       +
       

     

       374
       374
       +
           vmailUserName = mkOption {

     

       375
       375
       +
             type = types.str;

     

       376
       376
       +
             default = "virtualMail";

     

       377
       377
       +
             description = ''

     

       378
       378
       +
               The user name and group name of the user that owns the directory where all

     

       379
       379
       +
               the mail is stored.

     

       380
       380
       +
             '';

     

       381
       381
       +
           };

     

       382
       382
       +
       

     

       383
       383
       +
           vmailGroupName = mkOption {

     

       384
       384
       +
             type = types.str;

     

       385
       385
       +
             default = "virtualMail";

     

       386
       386
       +
             description = ''

     

       387
       387
       +
               The user name and group name of the user that owns the directory where all

     

       388
       388
       +
               the mail is stored.

     

       389
       389
       +
             '';

     

       390
       390
       +
           };

     

       391
       391
       +
       

     

       392
       392
       +
           mailDirectory = mkOption {

     

       393
       393
       +
             type = types.path;

     

       394
       394
       +
             default = "/var/vmail";

     

       395
       395
       +
             description = ''

     

       396
       396
       +
               Where to store the mail.

     

       397
       397
       +
             '';

     

       398
       398
       +
           };

     

       399
       399
       +
       

     

       400
       400
       +
           useFsLayout = mkOption {

     

       401
       401
       +
             type = types.bool;

     

       402
       402
       +
             default = false;

     

       403
       403
       +
             description = ''

     

       404
       404
       +
               Sets whether dovecot should organize mail in subdirectories:

     

       405
       405
       +
       

     

       406
       406
       +
               - /var/vmail/example.com/user/.folder.subfolder/ (default layout)

     

       407
       407
       +
               - /var/vmail/example.com/user/folder/subfolder/  (FS layout)

     

       408
       408
       +
       

     

       409
       409
       +
               See https://wiki2.dovecot.org/MailboxFormat/Maildir for details.

     

       410
       410
       +
             '';

     

       411
       411
       +
           };

     

       412
       412
       +
       

     

       413
       413
       +
           hierarchySeparator = mkOption {

     

       414
       414
       +
             type = types.str;

     

       415
       415
       +
             default = ".";

     

       416
       416
       +
             description = ''

     

       417
       417
       +
               The hierarchy separator for mailboxes used by dovecot for the namespace 'inbox'.

     

       418
       418
       +
               Dovecot defaults to "." but recommends "/".

     

       419
       419
       +
               This affects how mailboxes appear to mail clients and sieve scripts.

     

       420
       420
       +
               For instance when using "." then in a sieve script "example.com" would refer to the mailbox "com" in the parent mailbox "example".

     

       421
       421
       +
               This does not determine the way your mails are stored on disk.

     

       422
       422
       +
               See https://wiki.dovecot.org/Namespaces for details.

     

       423
       423
       +
             '';

     

       424
       424
       +
           };

     

       425
       425
       +
       

     

       426
       426
       +
           mailboxes = mkOption {

     

       427
       427
       +
             description = ''

     

       428
       428
       +
               The mailboxes for dovecot.

     

       429
       429
       +
               Depending on the mail client used it might be necessary to change some mailbox's name.

     

       430
       430
       +
             '';

     

       431
       431
       +
             default = {

     

       432
       432
       +
               Trash = {

     

       433
       433
       +
                 auto = "no";

     

       434
       434
       +
                 specialUse = "Trash";

     

       435
       435
       +
               };

     

       436
       436
       +
               Junk = {

     

       437
       437
       +
                 auto = "subscribe";

     

       438
       438
       +
                 specialUse = "Junk";

     

       439
       439
       +
               };

     

       440
       440
       +
               Drafts = {

     

       441
       441
       +
                 auto = "subscribe";

     

       442
       442
       +
                 specialUse = "Drafts";

     

       443
       443
       +
               };

     

       444
       444
       +
               Sent = {

     

       445
       445
       +
                 auto = "subscribe";

     

       446
       446
       +
                 specialUse = "Sent";

     

       447
       447
       +
               };

     

       448
       448
       +
             };

     

       449
       449
       +
           };

     

       450
       450
       +
       

     

       451
       451
       +
           certificateScheme = mkOption {

     

       452
       452
       +
             type = types.enum [ 1 2 3 ];

     

       453
       453
       +
             default = 2;

     

       454
       454
       +
             description = ''

     

       455
       455
       +
               Certificate Files. There are three options for these.

     

       456
       456
       +
       

     

       457
       457
       +
               1) You specify locations and manually copy certificates there.

     

       458
       458
       +
               2) You let the server create new (self signed) certificates on the fly.

     

       459
       459
       +
               3) You let the server create a certificate via `Let's Encrypt`. Note that

     

       460
       460
       +
                  this implies that a stripped down webserver has to be started. This also

     

       461
       461
       +
                  implies that the FQDN must be set as an `A` record to point to the IP of

     

       462
       462
       +
                  the server. In particular port 80 on the server will be opened. For details

     

       463
       463
       +
                  on how to set up the domain records, see the guide in the readme.

     

       464
       464
       +
             '';

     

       465
       465
       +
           };

     

       466
       466
       +
       

     

       467
       467
       +
           certificateFile = mkOption {

     

       468
       468
       +
             type = types.path;

     

       469
       469
       +
             example = "/root/mail-server.crt";

     

       470
       470
       +
             description = ''

     

       471
       471
       +
               Scheme 1)

     

       472
       472
       +
               Location of the certificate

     

       473
       473
       +
             '';

     

       474
       474
       +
           };

     

       475
       475
       +
       

     

       476
       476
       +
           keyFile = mkOption {

     

       477
       477
       +
             type = types.path;

     

       478
       478
       +
             example = "/root/mail-server.key";

     

       479
       479
       +
             description = ''

     

       480
       480
       +
               Scheme 1)

     

       481
       481
       +
               Location of the key file

     

       482
       482
       +
             '';

     

       483
       483
       +
           };

     

       484
       484
       +
       

     

       485
       485
       +
           certificateDirectory = mkOption {

     

       486
       486
       +
             type = types.path;

     

       487
       487
       +
             default = "/var/certs";

     

       488
       488
       +
             description = ''

     

       489
       489
       +
               Scheme 2)

     

       490
       490
       +
               This is the folder where the certificate will be created. The name is

     

       491
       491
       +
               hardcoded to "cert-DOMAIN.pem" and "key-DOMAIN.pem" and the

     

       492
       492
       +
               certificate is valid for 10 years.

     

       493
       493
       +
             '';

     

       494
       494
       +
           };

     

       495
       495
       +
       

     

       496
       496
       +
           enableImap = mkOption {

     

       497
       497
       +
             type = types.bool;

     

       498
       498
       +
             default = true;

     

       499
       499
       +
             description = ''

     

       500
       500
       +
               Whether to enable IMAP with STARTTLS on port 143.

     

       501
       501
       +
             '';

     

       502
       502
       +
           };

     

       503
       503
       +
       

     

       504
       504
       +
           enableImapSsl = mkOption {

     

       505
       505
       +
             type = types.bool;

     

       506
       506
       +
             default = true;

     

       507
       507
       +
             description = ''

     

       508
       508
       +
               Whether to enable IMAP with TLS in wrapper-mode on port 993.

     

       509
       509
       +
             '';

     

       510
       510
       +
           };

     

       511
       511
       +
       

     

       512
       512
       +
           enableSubmission = mkOption {

     

       513
       513
       +
             type = types.bool;

     

       514
       514
       +
             default = true;

     

       515
       515
       +
             description = ''

     

       516
       516
       +
               Whether to enable SMTP with STARTTLS on port 587.

     

       517
       517
       +
             '';

     

       518
       518
       +
           };

     

       519
       519
       +
       

     

       520
       520
       +
           enableSubmissionSsl = mkOption {

     

       521
       521
       +
             type = types.bool;

     

       522
       522
       +
             default = true;

     

       523
       523
       +
             description = ''

     

       524
       524
       +
               Whether to enable SMTP with TLS in wrapper-mode on port 465.

     

       525
       525
       +
             '';

     

       526
       526
       +
           };

     

       527
       527
       +
       

     

       528
       528
       +
           enablePop3 = mkOption {

     

       529
       529
       +
             type = types.bool;

     

       530
       530
       +
             default = false;

     

       531
       531
       +
             description = ''

     

       532
       532
       +
               Whether to enable POP3 with STARTTLS on port on port 110.

     

       533
       533
       +
             '';

     

       534
       534
       +
           };

     

       535
       535
       +
       

     

       536
       536
       +
           enablePop3Ssl = mkOption {

     

       537
       537
       +
             type = types.bool;

     

       538
       538
       +
             default = false;

     

       539
       539
       +
             description = ''

     

       540
       540
       +
               Whether to enable POP3 with TLS in wrapper-mode on port 995.

     

       541
       541
       +
             '';

     

       542
       542
       +
           };

     

       543
       543
       +
       

     

       544
       544
       +
           enableManageSieve = mkOption {

     

       545
       545
       +
             type = types.bool;

     

       546
       546
       +
             default = false;

     

       547
       547
       +
             description = ''

     

       548
       548
       +
               Whether to enable ManageSieve, setting this option to true will open

     

       549
       549
       +
               port 4190 in the firewall.

     

       550
       550
       +
       

     

       551
       551
       +
               The ManageSieve protocol allows users to manage their Sieve scripts on

     

       552
       552
       +
               a remote server with a supported client, including Thunderbird.

     

       553
       553
       +
             '';

     

       554
       554
       +
           };

     

       555
       555
       +
       

     

       556
       556
       +
           sieveDirectory = mkOption {

     

       557
       557
       +
             type = types.path;

     

       558
       558
       +
             default = "/var/sieve";

     

       559
       559
       +
             description = ''

     

       560
       560
       +
               Where to store the sieve scripts.

     

       561
       561
       +
             '';

     

       562
       562
       +
           };

     

       563
       563
       +
       

     

       564
       564
       +
           virusScanning = mkOption {

     

       565
       565
       +
             type = types.bool;

     

       566
       566
       +
             default = false;

     

       567
       567
       +
             description = ''

     

       568
       568
       +
               Whether to activate virus scanning. Note that virus scanning is _very_

     

       569
       569
       +
               expensive memory wise.

     

       570
       570
       +
             '';

     

       571
       571
       +
           };

     

       572
       572
       +
       

     

       573
       573
       +
           dkimSigning = mkOption {

     

       574
       574
       +
             type = types.bool;

     

       575
       575
       +
             default = true;

     

       576
       576
       +
             description = ''

     

       577
       577
       +
               Whether to activate dkim signing.

     

       578
       578
       +
             '';

     

       579
       579
       +
           };

     

       580
       580
       +
       

     

       581
       581
       +
           dkimSelector = mkOption {

     

       582
       582
       +
             type = types.str;

     

       583
       583
       +
             default = "mail";

     

       584
       584
       +
             description = ''

     

       585
       585
       +
       

     

       586
       586
       +
             '';

     

       587
       587
       +
           };

     

       588
       588
       +
       

     

       589
       589
       +
           dkimKeyDirectory = mkOption {

     

       590
       590
       +
             type = types.path;

     

       591
       591
       +
             default = "/var/dkim";

     

       592
       592
       +
             description = ''

     

       593
       593
       +
       

     

       594
       594
       +
             '';

     

       595
       595
       +
           };

     

       596
       596
       +
       

     

       597
       597
       +
           dkimKeyBits = mkOption {

     

       598
       598
       +
               type = types.int;

     

       599
       599
       +
               default = 1024;

     

       600
       600
       +
               description = ''

     

       601
       601
       +
                   How many bits in generated DKIM keys. RFC6376 advises minimum 1024-bit keys.

     

       602
       602
       +
       

     

       603
       603
       +
                   If you have already deployed a key with a different number of bits than specified

     

       604
       604
       +
                   here, then you should use a different selector (dkimSelector). In order to get

     

       605
       605
       +
                   this package to generate a key with the new number of bits, you will either have to

     

       606
       606
       +
                   change the selector or delete the old key file.

     

       607
       607
       +
               '';

     

       608
       608
       +
           };

     

       609
       609
       +
       

     

       610
       610
       +
           dkimHeaderCanonicalization = mkOption {

     

       611
       611
       +
               type = types.enum ["relaxed" "simple"];

     

       612
       612
       +
               default = "relaxed";

     

       613
       613
       +
               description = ''

     

       614
       614
       +
                 DKIM canonicalization algorithm for message headers.

     

       615
       615
       +
       

     

       616
       616
       +
                 See https://datatracker.ietf.org/doc/html/rfc6376/#section-3.4 for details.

     

       617
       617
       +
               '';

     

       618
       618
       +
           };

     

       619
       619
       +
       

     

       620
       620
       +
           dkimBodyCanonicalization = mkOption {

     

       621
       621
       +
               type = types.enum ["relaxed" "simple"];

     

       622
       622
       +
               default = "relaxed";

     

       623
       623
       +
               description = ''

     

       624
       624
       +
                 DKIM canonicalization algorithm for message bodies.

     

       625
       625
       +
       

     

       626
       626
       +
                 See https://datatracker.ietf.org/doc/html/rfc6376/#section-3.4 for details.

     

       627
       627
       +
               '';

     

       628
       628
       +
           };

     

       629
       629
       +
       

     

       630
       630
       +
           debug = mkOption {

     

       631
       631
       +
             type = types.bool;

     

       632
       632
       +
             default = false;

     

       633
       633
       +
             description = ''

     

       634
       634
       +
               Whether to enable verbose logging for mailserver related services. This

     

       635
       635
       +
               intended be used for development purposes only, you probably don't want

     

       636
       636
       +
               to enable this unless you're hacking on nixos-mailserver.

     

       637
       637
       +
             '';

     

       638
       638
       +
           };

     

       639
       639
       +
       

     

       640
       640
       +
           maxConnectionsPerUser = mkOption {

     

       641
       641
       +
             type = types.int;

     

       642
       642
       +
             default = 100;

     

       643
       643
       +
             description = ''

     

       644
       644
       +
               Maximum number of IMAP/POP3 connections allowed for a user from each IP address.

     

       645
       645
       +
               E.g. a value of 50 allows for 50 IMAP and 50 POP3 connections at the same

     

       646
       646
       +
               time for a single user.

     

       647
       647
       +
             '';

     

       648
       648
       +
           };

     

       649
       649
       +
       

     

       650
       650
       +
           localDnsResolver = mkOption {

     

       651
       651
       +
             type = types.bool;

     

       652
       652
       +
             default = true;

     

       653
       653
       +
             description = ''

     

       654
       654
       +
               Runs a local DNS resolver (kresd) as recommended when running rspamd. This prevents your log file from filling up with rspamd_monitored_dns_mon entries.

     

       655
       655
       +
             '';

     

       656
       656
       +
           };

     

       657
       657
       +
       

     

       658
       658
       +
           recipientDelimiter = mkOption {

     

       659
       659
       +
             type = types.str;

     

       660
       660
       +
             default = "+";

     

       661
       661
       +
             description = ''

     

       662
       662
       +
               Configure the recipient delimiter.

     

       663
       663
       +
             '';

     

       664
       664
       +
           };

     

       665
       665
       +
       

     

       666
       666
       +
           redis = {

     

       667
       667
       +
             address = mkOption {

     

       668
       668
       +
               type = types.str;

     

       669
       669
       +
               # read the default from nixos' redis module

     

       670
       670
       +
               default = let

     

       671
       671
       +
                 cf = config.services.redis.servers.rspamd.bind;

     

       672
       672
       +
                 cfdefault = if cf == null then "127.0.0.1" else cf;

     

       673
       673
       +
                 ips = lib.strings.splitString " " cfdefault;

     

       674
       674
       +
                 ip = lib.lists.head (ips ++ [ "127.0.0.1" ]);

     

       675
       675
       +
                 isIpv6 = ip: lib.lists.elem ":" (lib.stringToCharacters ip);

     

       676
       676
       +
               in

     

       677
       677
       +
               if (ip == "0.0.0.0" || ip == "::")

     

       678
       678
       +
               then "127.0.0.1"

     

       679
       679
       +
               else if isIpv6 ip then "[${ip}]" else ip;

     

       680
       680
       +
               defaultText = lib.literalDocBook "computed from <option>config.services.redis.servers.rspamd.bind</option>";

     

       681
       681
       +
               description = ''

     

       682
       682
       +
                 Address that rspamd should use to contact redis.

     

       683
       683
       +
               '';

     

       684
       684
       +
             };

     

       685
       685
       +
       

     

       686
       686
       +
             port = mkOption {

     

       687
       687
       +
               type = types.port;

     

       688
       688
       +
               default = config.services.redis.servers.rspamd.port;

     

       689
       689
       +
               defaultText = lib.literalExpression "config.services.redis.servers.rspamd.port";

     

       690
       690
       +
               description = ''

     

       691
       691
       +
                 Port that rspamd should use to contact redis.

     

       692
       692
       +
               '';

     

       693
       693
       +
             };

     

       694
       694
       +
       

     

       695
       695
       +
             password = mkOption {

     

       696
       696
       +
               type = types.nullOr types.str;

     

       697
       697
       +
               default = config.services.redis.servers.rspamd.requirePass;

     

       698
       698
       +
               defaultText = lib.literalExpression "config.services.redis.servers.rspamd.requirePass";

     

       699
       699
       +
               description = ''

     

       700
       700
       +
                 Password that rspamd should use to contact redis, or null if not required.

     

       701
       701
       +
               '';

     

       702
       702
       +
             };

     

       703
       703
       +
           };

     

       704
       704
       +
       

     

       705
       705
       +
           rewriteMessageId = mkOption {

     

       706
       706
       +
             type = types.bool;

     

       707
       707
       +
             default = false;

     

       708
       708
       +
             description = ''

     

       709
       709
       +
               Rewrites the Message-ID's hostname-part of outgoing emails to the FQDN.

     

       710
       710
       +
               Please be aware that this may cause problems with some mail clients

     

       711
       711
       +
               relying on the original Message-ID.

     

       712
       712
       +
             '';

     

       713
       713
       +
           };

     

       714
       714
       +
       

     

       715
       715
       +
           sendingFqdn = mkOption {

     

       716
       716
       +
             type = types.str;

     

       717
       717
       +
             default = cfg.fqdn;

     

       718
       718
       +
             defaultText = "config.mailserver.fqdn";

     

       719
       719
       +
             example = "myserver.example.com";

     

       720
       720
       +
             description = ''

     

       721
       721
       +
               The fully qualified domain name of the mail server used to

     

       722
       722
       +
               identify with remote servers.

     

       723
       723
       +
       

     

       724
       724
       +
               If this server's IP serves purposes other than a mail server,

     

       725
       725
       +
               it may be desirable for the server to have a name other than

     

       726
       726
       +
               that to which the user will connect.  For example, the user

     

       727
       727
       +
               might connect to mx.example.com, but the server's IP has

     

       728
       728
       +
               reverse DNS that resolves to myserver.example.com; in this

     

       729
       729
       +
               scenario, some mail servers may reject or penalize the

     

       730
       730
       +
               message.

     

       731
       731
       +
       

     

       732
       732
       +
               This setting allows the server to identify as

     

       733
       733
       +
               myserver.example.com when forwarding mail, independently of

     

       734
       734
       +
               `fqdn` (which, for SSL reasons, should generally be the name

     

       735
       735
       +
               to which the user connects).

     

       736
       736
       +
       

     

       737
       737
       +
               Set this to the name to which the sending IP's reverse DNS

     

       738
       738
       +
               resolves.

     

       739
       739
       +
             '';

     

       740
       740
       +
           };

     

       741
       741
       +
       

     

       742
       742
       +
           policydSPFExtraConfig = mkOption {

     

       743
       743
       +
             type = types.lines;

     

       744
       744
       +
             default = "";

     

       745
       745
       +
             example = ''

     

       746
       746
       +
               skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1

     

       747
       747
       +
             '';

     

       748
       748
       +
             description = ''

     

       749
       749
       +
               Extra configuration options for policyd-spf. This can be use to among

     

       750
       750
       +
               other things skip spf checking for some IP addresses.

     

       751
       751
       +
             '';

     

       752
       752
       +
           };

     

       753
       753
       +
       

     

       754
       754
       +
           monitoring = {

     

       755
       755
       +
             enable = lib.mkEnableOption "monitoring via monit";

     

       756
       756
       +
       

     

       757
       757
       +
             alertAddress = mkOption {

     

       758
       758
       +
               type = types.str;

     

       759
       759
       +
               description = ''

     

       760
       760
       +
                 The email address to send alerts to.

     

       761
       761
       +
               '';

     

       762
       762
       +
             };

     

       763
       763
       +
       

     

       764
       764
       +
             config = mkOption {

     

       765
       765
       +
               type = types.str;

     

       766
       766
       +
               default = ''

     

       767
       767
       +
                 set daemon 120 with start delay 60

     

       768
       768
       +
                 set mailserver

     

       769
       769
       +
                     localhost

     

       770
       770
       +
       

     

       771
       771
       +
                 set httpd port 2812 and use address localhost

     

       772
       772
       +
                     allow localhost

     

       773
       773
       +
                     allow admin:obwjoawijerfoijsiwfj29jf2f2jd

     

       774
       774
       +
       

     

       775
       775
       +
                 check filesystem root with path /

     

       776
       776
       +
                       if space usage > 80% then alert

     

       777
       777
       +
                       if inode usage > 80% then alert

     

       778
       778
       +
       

     

       779
       779
       +
                 check system $HOST

     

       780
       780
       +
                       if cpu usage > 95% for 10 cycles then alert

     

       781
       781
       +
                       if memory usage > 75% for 5 cycles then alert

     

       782
       782
       +
                       if swap usage > 20% for 10 cycles then alert

     

       783
       783
       +
                       if loadavg (1min) > 90 for 15 cycles then alert

     

       784
       784
       +
                       if loadavg (5min) > 80 for 10 cycles then alert

     

       785
       785
       +
                       if loadavg (15min) > 70 for 8 cycles then alert

     

       786
       786
       +
       

     

       787
       787
       +
                 check process sshd with pidfile /var/run/sshd.pid

     

       788
       788
       +
                       start program  "${pkgs.systemd}/bin/systemctl start sshd"

     

       789
       789
       +
                       stop program  "${pkgs.systemd}/bin/systemctl stop sshd"

     

       790
       790
       +
                       if failed port 22 protocol ssh for 2 cycles then restart

     

       791
       791
       +
       

     

       792
       792
       +
                 check process postfix with pidfile /var/lib/postfix/queue/pid/master.pid

     

       793
       793
       +
                       start program = "${pkgs.systemd}/bin/systemctl start postfix"

     

       794
       794
       +
                       stop program = "${pkgs.systemd}/bin/systemctl stop postfix"

     

       795
       795
       +
                       if failed port 25 protocol smtp for 5 cycles then restart

     

       796
       796
       +
       

     

       797
       797
       +
                 check process dovecot with pidfile /var/run/dovecot2/master.pid

     

       798
       798
       +
                       start program = "${pkgs.systemd}/bin/systemctl start dovecot2"

     

       799
       799
       +
                       stop program = "${pkgs.systemd}/bin/systemctl stop dovecot2"

     

       800
       800
       +
                       if failed host ${cfg.fqdn} port 993 type tcpssl sslauto protocol imap for 5 cycles then restart

     

       801
       801
       +
       

     

       802
       802
       +
                 check process rspamd with matching "rspamd: main process"

     

       803
       803
       +
                       start program = "${pkgs.systemd}/bin/systemctl start rspamd"

     

       804
       804
       +
                       stop program = "${pkgs.systemd}/bin/systemctl stop rspamd"

     

       805
       805
       +
               '';

     

       806
       806
       +
               defaultText = lib.literalDocBook "see source";

     

       807
       807
       +
               description = ''

     

       808
       808
       +
                 The configuration used for monitoring via monit.

     

       809
       809
       +
                 Use a mail address that you actively check and set it via 'set alert ...'.

     

       810
       810
       +
               '';

     

       811
       811
       +
             };

     

       812
       812
       +
           };

     

       813
       813
       +
       

     

       814
       814
       +
           borgbackup = {

     

       815
       815
       +
             enable = lib.mkEnableOption "backup via borgbackup";

     

       816
       816
       +
       

     

       817
       817
       +
             repoLocation = mkOption {

     

       818
       818
       +
               type = types.str;

     

       819
       819
       +
               default = "/var/borgbackup";

     

       820
       820
       +
               description = ''

     

       821
       821
       +
                 The location where borg saves the backups.

     

       822
       822
       +
                 This can be a local path or a remote location such as user@host:/path/to/repo.

     

       823
       823
       +
                 It is exported and thus available as an environment variable to cmdPreexec and cmdPostexec.

     

       824
       824
       +
               '';

     

       825
       825
       +
             };

     

       826
       826
       +
       

     

       827
       827
       +
             startAt = mkOption {

     

       828
       828
       +
               type = types.str;

     

       829
       829
       +
               default = "hourly";

     

       830
       830
       +
               description = "When or how often the backup should run. Must be in the format described in systemd.time 7.";

     

       831
       831
       +
             };

     

       832
       832
       +
       

     

       833
       833
       +
             user = mkOption {

     

       834
       834
       +
               type = types.str;

     

       835
       835
       +
               default = "virtualMail";

     

       836
       836
       +
               description = "The user borg and its launch script is run as.";

     

       837
       837
       +
             };

     

       838
       838
       +
       

     

       839
       839
       +
             group = mkOption {

     

       840
       840
       +
               type = types.str;

     

       841
       841
       +
               default = "virtualMail";

     

       842
       842
       +
               description = "The group borg and its launch script is run as.";

     

       843
       843
       +
             };

     

       844
       844
       +
       

     

       845
       845
       +
             compression = {

     

       846
       846
       +
               method = mkOption {

     

       847
       847
       +
                 type = types.nullOr (types.enum ["none" "lz4" "zstd" "zlib" "lzma"]);

     

       848
       848
       +
                 default = null;

     

       849
       849
       +
                 description = "Leaving this unset allows borg to choose. The default for borg 1.1.4 is lz4.";

     

       850
       850
       +
               };

     

       851
       851
       +
       

     

       852
       852
       +
               level = mkOption {

     

       853
       853
       +
                 type = types.nullOr types.int;

     

       854
       854
       +
                 default = null;

     

       855
       855
       +
                 description = ''

     

       856
       856
       +
                   Denotes the level of compression used by borg.

     

       857
       857
       +
                   Most methods accept levels from 0 to 9 but zstd which accepts values from 1 to 22.

     

       858
       858
       +
                   If null the decision is left up to borg.

     

       859
       859
       +
                 '';

     

       860
       860
       +
               };

     

       861
       861
       +
       

     

       862
       862
       +
               auto = mkOption {

     

       863
       863
       +
                 type = types.bool;

     

       864
       864
       +
                 default = false;

     

       865
       865
       +
                 description = "Leaves it to borg to determine whether an individual file should be compressed.";

     

       866
       866
       +
               };

     

       867
       867
       +
             };

     

       868
       868
       +
       

     

       869
       869
       +
             encryption = {

     

       870
       870
       +
               method = mkOption {

     

       871
       871
       +
                 type = types.enum [

     

       872
       872
       +
                   "none"

     

       873
       873
       +
                   "authenticated"

     

       874
       874
       +
                   "authenticated-blake2"

     

       875
       875
       +
                   "repokey"

     

       876
       876
       +
                   "keyfile"

     

       877
       877
       +
                   "repokey-blake2"

     

       878
       878
       +
                   "keyfile-blake2"

     

       879
       879
       +
                 ];

     

       880
       880
       +
                 default = "none";

     

       881
       881
       +
                 description = ''

     

       882
       882
       +
                   The backup can be encrypted by choosing any other value than 'none'.

     

       883
       883
       +
                   When using encryption the password / passphrase must be provided in passphraseFile.

     

       884
       884
       +
                 '';

     

       885
       885
       +
               };

     

       886
       886
       +
       

     

       887
       887
       +
               passphraseFile = mkOption {

     

       888
       888
       +
                 type = types.nullOr types.path;

     

       889
       889
       +
                 default = null;

     

       890
       890
       +
                 description = "Path to a file containing the encryption password or passphrase.";

     

       891
       891
       +
               };

     

       892
       892
       +
             };

     

       893
       893
       +
       

     

       894
       894
       +
             name = mkOption {

     

       895
       895
       +
               type = types.str;

     

       896
       896
       +
               default = "{hostname}-{user}-{now}";

     

       897
       897
       +
               description = ''

     

       898
       898
       +
                 The name of the individual backups as used by borg.

     

       899
       899
       +
                 Certain placeholders will be replaced by borg.

     

       900
       900
       +
               '';

     

       901
       901
       +
             };

     

       902
       902
       +
       

     

       903
       903
       +
             locations = mkOption {

     

       904
       904
       +
               type = types.listOf types.path;

     

       905
       905
       +
               default = [cfg.mailDirectory];

     

       906
       906
       +
               description = "The locations that are to be backed up by borg.";

     

       907
       907
       +
             };

     

       908
       908
       +
       

     

       909
       909
       +
             extraArgumentsForInit = mkOption {

     

       910
       910
       +
               type = types.listOf types.str;

     

       911
       911
       +
               default = ["--critical"];

     

       912
       912
       +
               description = "Additional arguments to add to the borg init command line.";

     

       913
       913
       +
             };

     

       914
       914
       +
       

     

       915
       915
       +
             extraArgumentsForCreate = mkOption {

     

       916
       916
       +
               type = types.listOf types.str;

     

       917
       917
       +
               default = [ ];

     

       918
       918
       +
               description = "Additional arguments to add to the borg create command line e.g. '--stats'.";

     

       919
       919
       +
             };

     

       920
       920
       +
       

     

       921
       921
       +
             cmdPreexec = mkOption {

     

       922
       922
       +
               type = types.nullOr types.str;

     

       923
       923
       +
               default = null;

     

       924
       924
       +
               description = ''

     

       925
       925
       +
                 The command to be executed before each backup operation.

     

       926
       926
       +
                 This is called prior to borg init in the same script that runs borg init and create and cmdPostexec.

     

       927
       927
       +
                 Example:

     

       928
       928
       +
                   export BORG_RSH="ssh -i /path/to/private/key"

     

       929
       929
       +
               '';

     

       930
       930
       +
             };

     

       931
       931
       +
       

     

       932
       932
       +
             cmdPostexec = mkOption {

     

       933
       933
       +
               type = types.nullOr types.str;

     

       934
       934
       +
               default = null;

     

       935
       935
       +
               description = ''

     

       936
       936
       +
                 The command to be executed after each backup operation.

     

       937
       937
       +
                 This is called after borg create completed successfully and in the same script that runs

     

       938
       938
       +
                 cmdPreexec, borg init and create.

     

       939
       939
       +
               '';

     

       940
       940
       +
             };

     

       941
       941
       +
       

     

       942
       942
       +
           };

     

       943
       943
       +
       

     

       944
       944
       +
           rebootAfterKernelUpgrade = {

     

       945
       945
       +
             enable = mkOption {

     

       946
       946
       +
               type = types.bool;

     

       947
       947
       +
               default = false;

     

       948
       948
       +
               example = true;

     

       949
       949
       +
               description = ''

     

       950
       950
       +
                 Whether to enable automatic reboot after kernel upgrades.

     

       951
       951
       +
                 This is to be used in conjunction with system.autoUpgrade.enable = true"

     

       952
       952
       +
               '';

     

       953
       953
       +
             };

     

       954
       954
       +
             method = mkOption {

     

       955
       955
       +
               type = types.enum [ "reboot" "systemctl kexec" ];

     

       956
       956
       +
               default = "reboot";

     

       957
       957
       +
               description = ''

     

       958
       958
       +
                 Whether to issue a full "reboot" or just a "systemctl kexec"-only reboot.

     

       959
       959
       +
                 It is recommended to use the default value because the quicker kexec reboot has a number of problems.

     

       960
       960
       +
                 Also if your server is running in a virtual machine the regular reboot will already be very quick.

     

       961
       961
       +
               '';

     

       962
       962
       +
             };

     

       963
       963
       +
           };

     

       964
       964
       +
       

     

       965
       965
       +
           backup = {

     

       966
       966
       +
             enable = lib.mkEnableOption "backup via rsnapshot";

     

       967
       967
       +
       

     

       968
       968
       +
             snapshotRoot = mkOption {

     

       969
       969
       +
               type = types.path;

     

       970
       970
       +
               default = "/var/rsnapshot";

     

       971
       971
       +
               description = ''

     

       972
       972
       +
                 The directory where rsnapshot stores the backup.

     

       973
       973
       +
               '';

     

       974
       974
       +
             };

     

       975
       975
       +
       

     

       976
       976
       +
             cmdPreexec = mkOption {

     

       977
       977
       +
               type = types.nullOr types.str;

     

       978
       978
       +
               default = null;

     

       979
       979
       +
               description = ''

     

       980
       980
       +
                 The command to be executed before each backup operation. This is wrapped in a shell script to be called by rsnapshot.

     

       981
       981
       +
               '';

     

       982
       982
       +
             };

     

       983
       983
       +
       

     

       984
       984
       +
             cmdPostexec = mkOption {

     

       985
       985
       +
               type = types.nullOr types.str;

     

       986
       986
       +
               default = null;

     

       987
       987
       +
               description = "The command to be executed after each backup operation. This is wrapped in a shell script to be called by rsnapshot.";

     

       988
       988
       +
             };

     

       989
       989
       +
       

     

       990
       990
       +
             retain = {

     

       991
       991
       +
               hourly = mkOption {

     

       992
       992
       +
                 type = types.int;

     

       993
       993
       +
                 default = 24;

     

       994
       994
       +
                 description = "How many hourly snapshots are retained.";

     

       995
       995
       +
               };

     

       996
       996
       +
               daily = mkOption {

     

       997
       997
       +
                 type = types.int;

     

       998
       998
       +
                 default = 7;

     

       999
       999
       +
                 description = "How many daily snapshots are retained.";

     

       1000
       1000
       +
               };

     

       1001
       1001
       +
               weekly = mkOption {

     

       1002
       1002
       +
                 type = types.int;

     

       1003
       1003
       +
                 default = 54;

     

       1004
       1004
       +
                 description = "How many weekly snapshots are retained.";

     

       1005
       1005
       +
               };

     

       1006
       1006
       +
             };

     

       1007
       1007
       +
       

     

       1008
       1008
       +
             cronIntervals = mkOption {

     

       1009
       1009
       +
               type = types.attrsOf types.str;

     

       1010
       1010
       +
               default = {

     

       1011
       1011
       +
                          # minute, hour, day-in-month, month, weekday (0 = sunday)

     

       1012
       1012
       +
                 hourly = " 0  *  *  *  *"; # Every full hour

     

       1013
       1013
       +
                 daily  = "30  3  *  *  *"; # Every day at 3:30

     

       1014
       1014
       +
                 weekly = " 0  5  *  *  0"; # Every sunday at 5:00 AM

     

       1015
       1015
       +
               };

     

       1016
       1016
       +
               description = ''

     

       1017
       1017
       +
                 Periodicity at which intervals should be run by cron.

     

       1018
       1018
       +
                 Note that the intervals also have to exist in configuration

     

       1019
       1019
       +
                 as retain options.

     

       1020
       1020
       +
               '';

     

       1021
       1021
       +
             };

     

       1022
       1022
       +
           };

     

       1023
       1023
       +
         };

     

       1024
       1024
       +
       

     

       1025
       1025
       +
         imports = [

     

       1026
       1026
       +
           ./borgbackup.nix

     

       1027
       1027
       +
           ./debug.nix

     

       1028
       1028
       +
           ./rsnapshot.nix

     

       1029
       1029
       +
           ./clamav.nix

     

       1030
       1030
       +
           ./monit.nix

     

       1031
       1031
       +
           ./users.nix

     

       1032
       1032
       +
           ./environment.nix

     

       1033
       1033
       +
           ./networking.nix

     

       1034
       1034
       +
           ./systemd.nix

     

       1035
       1035
       +
           ./dovecot.nix

     

       1036
       1036
       +
           ./opendkim.nix

     

       1037
       1037
       +
           ./postfix.nix

     

       1038
       1038
       +
           ./rspamd.nix

     

       1039
       1039
       +
           ./nginx.nix

     

       1040
       1040
       +
           ./kresd.nix

     

       1041
       1041
       +
           ./post-upgrade-check.nix

     

       1042
       1042
       +
         ];

     

       1043
       1043
       +
       }

+324

modules/mailserver/dovecot.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       with (import ./common.nix { inherit config pkgs lib; });

     

       20
       20
       +
       

     

       21
       21
       +
       let

     

       22
       22
       +
         cfg = config.mailserver;

     

       23
       23
       +
       

     

       24
       24
       +
         passwdDir = "/run/dovecot2";

     

       25
       25
       +
         passwdFile = "${passwdDir}/passwd";

     

       26
       26
       +
       

     

       27
       27
       +
         bool2int = x: if x then "1" else "0";

     

       28
       28
       +
       

     

       29
       29
       +
         maildirLayoutAppendix = lib.optionalString cfg.useFsLayout ":LAYOUT=fs";

     

       30
       30
       +
       

     

       31
       31
       +
         # maildir in format "/${domain}/${user}"

     

       32
       32
       +
         dovecotMaildir =

     

       33
       33
       +
           "maildir:${cfg.mailDirectory}/%d/%n${maildirLayoutAppendix}"

     

       34
       34
       +
           + (lib.optionalString (cfg.indexDir != null)

     

       35
       35
       +
              ":INDEX=${cfg.indexDir}/%d/%n"

     

       36
       36
       +
             );

     

       37
       37
       +
       

     

       38
       38
       +
         postfixCfg = config.services.postfix;

     

       39
       39
       +
         dovecot2Cfg = config.services.dovecot2;

     

       40
       40
       +
       

     

       41
       41
       +
         stateDir = "/var/lib/dovecot";

     

       42
       42
       +
       

     

       43
       43
       +
         pipeBin = pkgs.stdenv.mkDerivation {

     

       44
       44
       +
           name = "pipe_bin";

     

       45
       45
       +
           src = ./dovecot/pipe_bin;

     

       46
       46
       +
           buildInputs = with pkgs; [ makeWrapper coreutils bash rspamd ];

     

       47
       47
       +
           buildCommand = ''

     

       48
       48
       +
             mkdir -p $out/pipe/bin

     

       49
       49
       +
             cp $src/* $out/pipe/bin/

     

       50
       50
       +
             chmod a+x $out/pipe/bin/*

     

       51
       51
       +
             patchShebangs $out/pipe/bin

     

       52
       52
       +
       

     

       53
       53
       +
             for file in $out/pipe/bin/*; do

     

       54
       54
       +
               wrapProgram $file \

     

       55
       55
       +
                 --set PATH "${pkgs.coreutils}/bin:${pkgs.rspamd}/bin"

     

       56
       56
       +
             done

     

       57
       57
       +
           '';

     

       58
       58
       +
         };

     

       59
       59
       +
       

     

       60
       60
       +
         genPasswdScript = pkgs.writeScript "generate-password-file" ''

     

       61
       61
       +
           #!${pkgs.stdenv.shell}

     

       62
       62
       +
       

     

       63
       63
       +
           set -euo pipefail

     

       64
       64
       +
       

     

       65
       65
       +
           if (! test -d "${passwdDir}"); then

     

       66
       66
       +
             mkdir "${passwdDir}"

     

       67
       67
       +
             chmod 755 "${passwdDir}"

     

       68
       68
       +
           fi

     

       69
       69
       +
       

     

       70
       70
       +
           for f in ${builtins.toString (lib.mapAttrsToList (name: value: passwordFiles."${name}") cfg.loginAccounts)}; do

     

       71
       71
       +
             if [ ! -f "$f" ]; then

     

       72
       72
       +
               echo "Expected password hash file $f does not exist!"

     

       73
       73
       +
               exit 1

     

       74
       74
       +
             fi

     

       75
       75
       +
           done

     

       76
       76
       +
       

     

       77
       77
       +
           cat <<EOF > ${passwdFile}

     

       78
       78
       +
           ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:

     

       79
       79
       +
             "${name}:${"$(head -n 1 ${passwordFiles."${name}"})"}:${builtins.toString cfg.vmailUID}:${builtins.toString cfg.vmailUID}::${cfg.mailDirectory}:/run/current-system/sw/bin/nologin:"

     

       80
       80
       +
               + (if lib.isString value.quota

     

       81
       81
       +
                     then "userdb_quota_rule=*:storage=${value.quota}"

     

       82
       82
       +
                     else "")

     

       83
       83
       +
           ) cfg.loginAccounts)}

     

       84
       84
       +
           EOF

     

       85
       85
       +
       

     

       86
       86
       +
           chmod 600 ${passwdFile}

     

       87
       87
       +
         '';

     

       88
       88
       +
       

     

       89
       89
       +
         junkMailboxes = builtins.attrNames (lib.filterAttrs (n: v: v ? "specialUse" && v.specialUse == "Junk") cfg.mailboxes);

     

       90
       90
       +
         junkMailboxNumber = builtins.length junkMailboxes;

     

       91
       91
       +
         # The assertion garantees there is exactly one Junk mailbox.

     

       92
       92
       +
         junkMailboxName = if junkMailboxNumber == 1 then builtins.elemAt junkMailboxes 0 else "";

     

       93
       93
       +
       

     

       94
       94
       +
       in

     

       95
       95
       +
       {

     

       96
       96
       +
         config = with cfg; lib.mkIf enable {

     

       97
       97
       +
           assertions = [

     

       98
       98
       +
             {

     

       99
       99
       +
               assertion = junkMailboxNumber == 1;

     

       100
       100
       +
               message = "nixos-mailserver requires exactly one dovecot mailbox with the 'special use' flag set to 'Junk' (${builtins.toString junkMailboxNumber} have been found)";

     

       101
       101
       +
             }

     

       102
       102
       +
           ];

     

       103
       103
       +
       

     

       104
       104
       +
           services.dovecot2 = {

     

       105
       105
       +
             enable = true;

     

       106
       106
       +
             enableImap = enableImap || enableImapSsl;

     

       107
       107
       +
             enablePop3 = enablePop3 || enablePop3Ssl;

     

       108
       108
       +
             enablePAM = false;

     

       109
       109
       +
             enableQuota = true;

     

       110
       110
       +
             mailGroup = vmailGroupName;

     

       111
       111
       +
             mailUser = vmailUserName;

     

       112
       112
       +
             mailLocation = dovecotMaildir;

     

       113
       113
       +
             sslServerCert = certificatePath;

     

       114
       114
       +
             sslServerKey = keyPath;

     

       115
       115
       +
             enableLmtp = true;

     

       116
       116
       +
             modules = [ pkgs.dovecot_pigeonhole ] ++ (lib.optional cfg.fullTextSearch.enable pkgs.dovecot_fts_xapian );

     

       117
       117
       +
             mailPlugins.globally.enable = lib.optionals cfg.fullTextSearch.enable [ "fts" "fts_xapian" ];

     

       118
       118
       +
             protocols = lib.optional cfg.enableManageSieve "sieve";

     

       119
       119
       +
       

     

       120
       120
       +
             sieveScripts = {

     

       121
       121
       +
               after = builtins.toFile "spam.sieve" ''

     

       122
       122
       +
                 require "fileinto";

     

       123
       123
       +
       

     

       124
       124
       +
                 if header :is "X-Spam" "Yes" {

     

       125
       125
       +
                     fileinto "${junkMailboxName}";

     

       126
       126
       +
                     stop;

     

       127
       127
       +
                 }

     

       128
       128
       +
               '';

     

       129
       129
       +
             };

     

       130
       130
       +
       

     

       131
       131
       +
             mailboxes = cfg.mailboxes;

     

       132
       132
       +
       

     

       133
       133
       +
             extraConfig = ''

     

       134
       134
       +
               #Extra Config

     

       135
       135
       +
               ${lib.optionalString debug ''

     

       136
       136
       +
                 mail_debug = yes

     

       137
       137
       +
                 auth_debug = yes

     

       138
       138
       +
                 verbose_ssl = yes

     

       139
       139
       +
               ''}

     

       140
       140
       +
       

     

       141
       141
       +
               ${lib.optionalString (cfg.enableImap || cfg.enableImapSsl) ''

     

       142
       142
       +
                 service imap-login {

     

       143
       143
       +
                   inet_listener imap {

     

       144
       144
       +
                     ${if cfg.enableImap then ''

     

       145
       145
       +
                       port = 143

     

       146
       146
       +
                     '' else ''

     

       147
       147
       +
                       # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html

     

       148
       148
       +
                       port = 0

     

       149
       149
       +
                     ''}

     

       150
       150
       +
                   }

     

       151
       151
       +
                   inet_listener imaps {

     

       152
       152
       +
                     ${if cfg.enableImapSsl then ''

     

       153
       153
       +
                       port = 993

     

       154
       154
       +
                       ssl = yes

     

       155
       155
       +
                     '' else ''

     

       156
       156
       +
                       # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html

     

       157
       157
       +
                       port = 0

     

       158
       158
       +
                     ''}

     

       159
       159
       +
                   }

     

       160
       160
       +
                 }

     

       161
       161
       +
               ''}

     

       162
       162
       +
               ${lib.optionalString (cfg.enablePop3 || cfg.enablePop3Ssl) ''

     

       163
       163
       +
                 service pop3-login {

     

       164
       164
       +
                   inet_listener pop3 {

     

       165
       165
       +
                     ${if cfg.enablePop3 then ''

     

       166
       166
       +
                       port = 110

     

       167
       167
       +
                     '' else ''

     

       168
       168
       +
                       # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html

     

       169
       169
       +
                       port = 0

     

       170
       170
       +
                     ''}

     

       171
       171
       +
                   }

     

       172
       172
       +
                   inet_listener pop3s {

     

       173
       173
       +
                     ${if cfg.enablePop3Ssl then ''

     

       174
       174
       +
                       port = 995

     

       175
       175
       +
                       ssl = yes

     

       176
       176
       +
                     '' else ''

     

       177
       177
       +
                       # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html

     

       178
       178
       +
                       port = 0

     

       179
       179
       +
                     ''}

     

       180
       180
       +
                   }

     

       181
       181
       +
                 }

     

       182
       182
       +
               ''}

     

       183
       183
       +
       

     

       184
       184
       +
               protocol imap {

     

       185
       185
       +
                 mail_max_userip_connections = ${toString cfg.maxConnectionsPerUser}

     

       186
       186
       +
                 mail_plugins = $mail_plugins imap_sieve

     

       187
       187
       +
               }

     

       188
       188
       +
       

     

       189
       189
       +
               protocol pop3 {

     

       190
       190
       +
                 mail_max_userip_connections = ${toString cfg.maxConnectionsPerUser}

     

       191
       191
       +
               }

     

       192
       192
       +
       

     

       193
       193
       +
               mail_access_groups = ${vmailGroupName}

     

       194
       194
       +
               ssl = required

     

       195
       195
       +
               ssl_min_protocol = TLSv1.2

     

       196
       196
       +
               ssl_prefer_server_ciphers = yes

     

       197
       197
       +
       

     

       198
       198
       +
               service lmtp {

     

       199
       199
       +
                 unix_listener dovecot-lmtp {

     

       200
       200
       +
                   group = ${postfixCfg.group}

     

       201
       201
       +
                   mode = 0600

     

       202
       202
       +
                   user = ${postfixCfg.user}

     

       203
       203
       +
                 }

     

       204
       204
       +
               }

     

       205
       205
       +
       

     

       206
       206
       +
               recipient_delimiter = ${cfg.recipientDelimiter}

     

       207
       207
       +
               lmtp_save_to_detail_mailbox = ${cfg.lmtpSaveToDetailMailbox}

     

       208
       208
       +
       

     

       209
       209
       +
               protocol lmtp {

     

       210
       210
       +
                 mail_plugins = $mail_plugins sieve

     

       211
       211
       +
               }

     

       212
       212
       +
       

     

       213
       213
       +
               passdb {

     

       214
       214
       +
                 driver = passwd-file

     

       215
       215
       +
                 args = ${passwdFile}

     

       216
       216
       +
               }

     

       217
       217
       +
       

     

       218
       218
       +
               userdb {

     

       219
       219
       +
                 driver = passwd-file

     

       220
       220
       +
                 args = ${passwdFile}

     

       221
       221
       +
               }

     

       222
       222
       +
       

     

       223
       223
       +
               service auth {

     

       224
       224
       +
                 unix_listener auth {

     

       225
       225
       +
                   mode = 0660

     

       226
       226
       +
                   user = ${postfixCfg.user}

     

       227
       227
       +
                   group = ${postfixCfg.group}

     

       228
       228
       +
                 }

     

       229
       229
       +
               }

     

       230
       230
       +
       

     

       231
       231
       +
               auth_mechanisms = plain login

     

       232
       232
       +
       

     

       233
       233
       +
               namespace inbox {

     

       234
       234
       +
                 separator = ${cfg.hierarchySeparator}

     

       235
       235
       +
                 inbox = yes

     

       236
       236
       +
               }

     

       237
       237
       +
       

     

       238
       238
       +
               plugin {

     

       239
       239
       +
                 sieve_plugins = sieve_imapsieve sieve_extprograms

     

       240
       240
       +
                 sieve = file:${cfg.sieveDirectory}/%u/scripts;active=${cfg.sieveDirectory}/%u/active.sieve

     

       241
       241
       +
                 sieve_default = file:${cfg.sieveDirectory}/%u/default.sieve

     

       242
       242
       +
                 sieve_default_name = default

     

       243
       243
       +
       

     

       244
       244
       +
                 # From elsewhere to Spam folder

     

       245
       245
       +
                 imapsieve_mailbox1_name = ${junkMailboxName}

     

       246
       246
       +
                 imapsieve_mailbox1_causes = COPY

     

       247
       247
       +
                 imapsieve_mailbox1_before = file:${stateDir}/imap_sieve/report-spam.sieve

     

       248
       248
       +
       

     

       249
       249
       +
                 # From Spam folder to elsewhere

     

       250
       250
       +
                 imapsieve_mailbox2_name = *

     

       251
       251
       +
                 imapsieve_mailbox2_from = ${junkMailboxName}

     

       252
       252
       +
                 imapsieve_mailbox2_causes = COPY

     

       253
       253
       +
                 imapsieve_mailbox2_before = file:${stateDir}/imap_sieve/report-ham.sieve

     

       254
       254
       +
       

     

       255
       255
       +
                 sieve_pipe_bin_dir = ${pipeBin}/pipe/bin

     

       256
       256
       +
       

     

       257
       257
       +
                 sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment

     

       258
       258
       +
               }

     

       259
       259
       +
       

     

       260
       260
       +
               ${lib.optionalString cfg.fullTextSearch.enable ''

     

       261
       261
       +
               plugin {

     

       262
       262
       +
                 plugin = fts fts_xapian

     

       263
       263
       +
                 fts = xapian

     

       264
       264
       +
                 fts_xapian = partial=${toString cfg.fullTextSearch.minSize} full=${toString cfg.fullTextSearch.maxSize} attachments=${bool2int cfg.fullTextSearch.indexAttachments} verbose=${bool2int cfg.debug}

     

       265
       265
       +
       

     

       266
       266
       +
                 fts_autoindex = ${if cfg.fullTextSearch.autoIndex then "yes" else "no"}

     

       267
       267
       +
       

     

       268
       268
       +
                 ${lib.strings.concatImapStringsSep "\n" (n: x: "fts_autoindex_exclude${if n==1 then "" else toString n} = ${x}") cfg.fullTextSearch.autoIndexExclude}

     

       269
       269
       +
       

     

       270
       270
       +
                 fts_enforced = ${cfg.fullTextSearch.enforced}

     

       271
       271
       +
               }

     

       272
       272
       +
       

     

       273
       273
       +
               ${lib.optionalString (cfg.fullTextSearch.memoryLimit != null) ''

     

       274
       274
       +
               service indexer-worker {

     

       275
       275
       +
                 vsz_limit = ${toString (cfg.fullTextSearch.memoryLimit*1024*1024)}

     

       276
       276
       +
               }

     

       277
       277
       +
               ''}

     

       278
       278
       +
               ''}

     

       279
       279
       +
       

     

       280
       280
       +
               lda_mailbox_autosubscribe = yes

     

       281
       281
       +
               lda_mailbox_autocreate = yes

     

       282
       282
       +
             '';

     

       283
       283
       +
           };

     

       284
       284
       +
       

     

       285
       285
       +
           systemd.services.dovecot2 = {

     

       286
       286
       +
             preStart = ''

     

       287
       287
       +
               ${genPasswdScript}

     

       288
       288
       +
               rm -rf '${stateDir}/imap_sieve'

     

       289
       289
       +
               mkdir '${stateDir}/imap_sieve'

     

       290
       290
       +
               cp -p "${./dovecot/imap_sieve}"/*.sieve '${stateDir}/imap_sieve/'

     

       291
       291
       +
               for k in "${stateDir}/imap_sieve"/*.sieve ; do

     

       292
       292
       +
                 ${pkgs.dovecot_pigeonhole}/bin/sievec "$k"

     

       293
       293
       +
               done

     

       294
       294
       +
               chown -R '${dovecot2Cfg.mailUser}:${dovecot2Cfg.mailGroup}' '${stateDir}/imap_sieve'

     

       295
       295
       +
             '';

     

       296
       296
       +
           };

     

       297
       297
       +
       

     

       298
       298
       +
           systemd.services.postfix.restartTriggers = [ genPasswdScript ];

     

       299
       299
       +
       

     

       300
       300
       +
           systemd.services.dovecot-fts-xapian-optimize = lib.mkIf (cfg.fullTextSearch.enable && cfg.fullTextSearch.maintenance.enable) {

     

       301
       301
       +
             description = "Optimize dovecot indices for fts_xapian";

     

       302
       302
       +
             requisite = [ "dovecot2.service" ];

     

       303
       303
       +
             after = [ "dovecot2.service" ];

     

       304
       304
       +
             startAt = cfg.fullTextSearch.maintenance.onCalendar;

     

       305
       305
       +
             serviceConfig = {

     

       306
       306
       +
               Type = "oneshot";

     

       307
       307
       +
               ExecStart = "${pkgs.dovecot}/bin/doveadm fts optimize -A";

     

       308
       308
       +
               PrivateDevices = true;

     

       309
       309
       +
               PrivateNetwork = true;

     

       310
       310
       +
               ProtectKernelTunables = true;

     

       311
       311
       +
               ProtectKernelModules = true;

     

       312
       312
       +
               ProtectControlGroups = true;

     

       313
       313
       +
               ProtectHome = true;

     

       314
       314
       +
               ProtectSystem = true;

     

       315
       315
       +
               PrivateTmp = true;

     

       316
       316
       +
             };

     

       317
       317
       +
           };

     

       318
       318
       +
           systemd.timers.dovecot-fts-xapian-optimize = lib.mkIf (cfg.fullTextSearch.enable && cfg.fullTextSearch.maintenance.enable && cfg.fullTextSearch.maintenance.randomizedDelaySec != 0) {

     

       319
       319
       +
             timerConfig = {

     

       320
       320
       +
               RandomizedDelaySec = cfg.fullTextSearch.maintenance.randomizedDelaySec;

     

       321
       321
       +
             };

     

       322
       322
       +
           };

     

       323
       323
       +
         };

     

       324
       324
       +
       }

+15

modules/mailserver/dovecot/imap_sieve/report-ham.sieve

···

       1
       1
       +
       require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];

     

       2
       2
       +
       

     

       3
       3
       +
       if environment :matches "imap.mailbox" "*" {

     

       4
       4
       +
         set "mailbox" "${1}";

     

       5
       5
       +
       }

     

       6
       6
       +
       

     

       7
       7
       +
       if string "${mailbox}" "Trash" {

     

       8
       8
       +
         stop;

     

       9
       9
       +
       }

     

       10
       10
       +
       

     

       11
       11
       +
       if environment :matches "imap.user" "*" {

     

       12
       12
       +
         set "username" "${1}";

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       pipe :copy "sa-learn-ham.sh" [ "${username}" ];

modules/mailserver/dovecot/imap_sieve/report-spam.sieve

···

       1
       1
       +
       require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];

     

       2
       2
       +
       

     

       3
       3
       +
       if environment :matches "imap.user" "*" {

     

       4
       4
       +
         set "username" "${1}";

     

       5
       5
       +
       }

     

       6
       6
       +
       

     

       7
       7
       +
       pipe :copy "sa-learn-spam.sh" [ "${username}" ];

modules/mailserver/dovecot/pipe_bin/sa-learn-ham.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       set -o errexit

     

       3
       3
       +
       exec rspamc -h /run/rspamd/worker-controller.sock learn_ham

modules/mailserver/dovecot/pipe_bin/sa-learn-spam.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       set -o errexit

     

       3
       3
       +
       exec rspamc -h /run/rspamd/worker-controller.sock learn_spam

+28

modules/mailserver/environment.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver;

     

       21
       21
       +
       in

     

       22
       22
       +
       {

     

       23
       23
       +
         config = with cfg; lib.mkIf enable {

     

       24
       24
       +
           environment.systemPackages = with pkgs; [

     

       25
       25
       +
             dovecot opendkim openssh postfix rspamd

     

       26
       26
       +
           ] ++ (if certificateScheme == 2 then [ openssl ] else []);

     

       27
       27
       +
         };

     

       28
       28
       +
       }

+27

modules/mailserver/kresd.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2017  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver;

     

       21
       21
       +
       in

     

       22
       22
       +
       {

     

       23
       23
       +
         config = lib.mkIf (cfg.enable && cfg.localDnsResolver) {

     

       24
       24
       +
           services.kresd.enable = true;

     

       25
       25
       +
         };

     

       26
       26
       +
       }

     

       27
       27
       +

+32

modules/mailserver/monit.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver;

     

       21
       21
       +
       in

     

       22
       22
       +
       {

     

       23
       23
       +
         config = lib.mkIf (cfg.enable && cfg.monitoring.enable) {

     

       24
       24
       +
           services.monit = {

     

       25
       25
       +
             enable = true;

     

       26
       26
       +
             config = ''

     

       27
       27
       +
               set alert ${cfg.monitoring.alertAddress}

     

       28
       28
       +
               ${cfg.monitoring.config}

     

       29
       29
       +
             '';

     

       30
       30
       +
           };

     

       31
       31
       +
         };

     

       32
       32
       +
       }

+37

modules/mailserver/networking.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver;

     

       21
       21
       +
       in

     

       22
       22
       +
       {

     

       23
       23
       +
         config = with cfg; lib.mkIf (enable && openFirewall) {

     

       24
       24
       +
       

     

       25
       25
       +
           networking.firewall = {

     

       26
       26
       +
             allowedTCPPorts = [ 25 ]

     

       27
       27
       +
               ++ lib.optional enableSubmission 587

     

       28
       28
       +
               ++ lib.optional enableSubmissionSsl 465

     

       29
       29
       +
               ++ lib.optional enableImap 143

     

       30
       30
       +
               ++ lib.optional enableImapSsl 993

     

       31
       31
       +
               ++ lib.optional enablePop3 110

     

       32
       32
       +
               ++ lib.optional enablePop3Ssl 995

     

       33
       33
       +
               ++ lib.optional enableManageSieve 4190

     

       34
       34
       +
               ++ lib.optional (certificateScheme == 3) 80;

     

       35
       35
       +
           };

     

       36
       36
       +
         };

     

       37
       37
       +
       }

+44

modules/mailserver/nginx.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       

     

       18
       18
       +
       { config, pkgs, lib, ... }:

     

       19
       19
       +
       

     

       20
       20
       +
       with (import ./common.nix { inherit config; });

     

       21
       21
       +
       

     

       22
       22
       +
       let

     

       23
       23
       +
         cfg = config.mailserver;

     

       24
       24
       +
         acmeRoot = "/var/lib/acme/acme-challenge";

     

       25
       25
       +
       in

     

       26
       26
       +
       {

     

       27
       27
       +
         config = lib.mkIf (cfg.enable && cfg.certificateScheme == 3) {

     

       28
       28
       +
           services.nginx = {

     

       29
       29
       +
             enable = true;

     

       30
       30
       +
             virtualHosts."${cfg.fqdn}" = {

     

       31
       31
       +
               serverName = cfg.fqdn;

     

       32
       32
       +
               serverAliases = cfg.certificateDomains;

     

       33
       33
       +
               forceSSL = true;

     

       34
       34
       +
               enableACME = true;

     

       35
       35
       +
               acmeRoot = acmeRoot;

     

       36
       36
       +
             };

     

       37
       37
       +
           };

     

       38
       38
       +
       

     

       39
       39
       +
           security.acme.certs."${cfg.fqdn}".reloadServices = [

     

       40
       40
       +
             "postfix.service"

     

       41
       41
       +
             "dovecot2.service"

     

       42
       42
       +
           ];

     

       43
       43
       +
         };

     

       44
       44
       +
       }

+88

modules/mailserver/opendkim.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2017  Brian Olsen

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       { config, lib, pkgs, ... }:

     

       17
       17
       +
       

     

       18
       18
       +
       with lib;

     

       19
       19
       +
       

     

       20
       20
       +
       let

     

       21
       21
       +
         cfg = config.mailserver;

     

       22
       22
       +
       

     

       23
       23
       +
         dkimUser = config.services.opendkim.user;

     

       24
       24
       +
         dkimGroup = config.services.opendkim.group;

     

       25
       25
       +
       

     

       26
       26
       +
         createDomainDkimCert = dom:

     

       27
       27
       +
           let

     

       28
       28
       +
             dkim_key = "${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.key";

     

       29
       29
       +
             dkim_txt = "${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.txt";

     

       30
       30
       +
           in

     

       31
       31
       +
               ''

     

       32
       32
       +
                 if [ ! -f "${dkim_key}" ]

     

       33
       33
       +
                 then

     

       34
       34
       +
                     ${pkgs.opendkim}/bin/opendkim-genkey -s "${cfg.dkimSelector}" \

     

       35
       35
       +
                                                          -d "${dom}" \

     

       36
       36
       +
                                                          --bits="${toString cfg.dkimKeyBits}" \

     

       37
       37
       +
                                                          --directory="${cfg.dkimKeyDirectory}"

     

       38
       38
       +
                     mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.private" "${dkim_key}"

     

       39
       39
       +
                     mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.txt" "${dkim_txt}"

     

       40
       40
       +
                     echo "Generated key for domain ${dom} selector ${cfg.dkimSelector}"

     

       41
       41
       +
                 fi

     

       42
       42
       +
               '';

     

       43
       43
       +
         createAllCerts = lib.concatStringsSep "\n" (map createDomainDkimCert cfg.domains);

     

       44
       44
       +
       

     

       45
       45
       +
         keyTable = pkgs.writeText "opendkim-KeyTable"

     

       46
       46
       +
           (lib.concatStringsSep "\n" (lib.flip map cfg.domains

     

       47
       47
       +
             (dom: "${dom} ${dom}:${cfg.dkimSelector}:${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.key")));

     

       48
       48
       +
         signingTable = pkgs.writeText "opendkim-SigningTable"

     

       49
       49
       +
           (lib.concatStringsSep "\n" (lib.flip map cfg.domains (dom: "${dom} ${dom}")));

     

       50
       50
       +
       

     

       51
       51
       +
         dkim = config.services.opendkim;

     

       52
       52
       +
         args = [ "-f" "-l" ] ++ lib.optionals (dkim.configFile != null) [ "-x" dkim.configFile ];

     

       53
       53
       +
       in

     

       54
       54
       +
       {

     

       55
       55
       +
           config = mkIf (cfg.dkimSigning && cfg.enable) {

     

       56
       56
       +
             services.opendkim = {

     

       57
       57
       +
               enable = true;

     

       58
       58
       +
               selector = cfg.dkimSelector;

     

       59
       59
       +
               keyPath = cfg.dkimKeyDirectory;

     

       60
       60
       +
               domains = "csl:${builtins.concatStringsSep "," cfg.domains}";

     

       61
       61
       +
               configFile = pkgs.writeText "opendkim.conf" (''

     

       62
       62
       +
                 Canonicalization ${cfg.dkimHeaderCanonicalization}/${cfg.dkimBodyCanonicalization}

     

       63
       63
       +
                 UMask 0002

     

       64
       64
       +
                 Socket ${dkim.socket}

     

       65
       65
       +
                 KeyTable file:${keyTable}

     

       66
       66
       +
                 SigningTable file:${signingTable}

     

       67
       67
       +
               '' + (lib.optionalString cfg.debug ''

     

       68
       68
       +
                 Syslog yes

     

       69
       69
       +
                 SyslogSuccess yes

     

       70
       70
       +
                 LogWhy yes

     

       71
       71
       +
               ''));

     

       72
       72
       +
             };

     

       73
       73
       +
       

     

       74
       74
       +
             users.users = optionalAttrs (config.services.postfix.user == "postfix") {

     

       75
       75
       +
               postfix.extraGroups = [ "${dkimGroup}" ];

     

       76
       76
       +
             };

     

       77
       77
       +
             systemd.services.opendkim = {

     

       78
       78
       +
               preStart = lib.mkForce createAllCerts;

     

       79
       79
       +
               serviceConfig = {

     

       80
       80
       +
                 ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";

     

       81
       81
       +
                 PermissionsStartOnly = lib.mkForce false;

     

       82
       82
       +
               };

     

       83
       83
       +
             };

     

       84
       84
       +
             systemd.tmpfiles.rules = [

     

       85
       85
       +
               "d '${cfg.dkimKeyDirectory}' - ${dkimUser} ${dkimGroup} - -"

     

       86
       86
       +
             ];

     

       87
       87
       +
           };

     

       88
       88
       +
       }

+46

modules/mailserver/post-upgrade-check.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       with lib;

     

       20
       20
       +
       

     

       21
       21
       +
       let

     

       22
       22
       +
         cfg = config.mailserver;

     

       23
       23
       +
       in

     

       24
       24
       +
       {

     

       25
       25
       +
         config = mkIf (cfg.enable && cfg.rebootAfterKernelUpgrade.enable) {

     

       26
       26
       +
           systemd.services.nixos-upgrade.serviceConfig.ExecStartPost = pkgs.writeScript "post-upgrade-check" ''

     

       27
       27
       +
             #!${pkgs.stdenv.shell}

     

       28
       28
       +
       

     

       29
       29
       +
             # Checks whether the "current" kernel is different from the booted kernel

     

       30
       30
       +
             # and then triggers a reboot so that the "current" kernel will be the booted one.

     

       31
       31
       +
             # This is just an educated guess. If the links do not differ the kernels might still be different, according to spacefrogg in #nixos.

     

       32
       32
       +
       

     

       33
       33
       +
             current=$(readlink -f /run/current-system/kernel)

     

       34
       34
       +
             booted=$(readlink -f /run/booted-system/kernel)

     

       35
       35
       +
       

     

       36
       36
       +
             if [ "$current" == "$booted" ]; then

     

       37
       37
       +
               echo "kernel version seems unchanged, skipping reboot" | systemd-cat --priority 4 --identifier "post-upgrade-check";

     

       38
       38
       +
             else

     

       39
       39
       +
               echo "kernel path changed, possibly a new version" | systemd-cat --priority 2 --identifier "post-upgrade-check"

     

       40
       40
       +
               echo "$booted" | systemd-cat --priority 2 --identifier "post-upgrade-kernel-check"

     

       41
       41
       +
               echo "$current" | systemd-cat --priority 2 --identifier "post-upgrade-kernel-check"

     

       42
       42
       +
               ${cfg.rebootAfterKernelUpgrade.method}

     

       43
       43
       +
             fi

     

       44
       44
       +
           '';

     

       45
       45
       +
         };

     

       46
       46
       +
       }

+269

modules/mailserver/postfix.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       with (import ./common.nix { inherit config pkgs lib; });

     

       20
       20
       +
       

     

       21
       21
       +
       let

     

       22
       22
       +
         inherit (lib.strings) concatStringsSep;

     

       23
       23
       +
         cfg = config.mailserver;

     

       24
       24
       +
       

     

       25
       25
       +
         # Merge several lookup tables. A lookup table is a attribute set where

     

       26
       26
       +
         # - the key is an address (user@example.com) or a domain (@example.com)

     

       27
       27
       +
         # - the value is a list of addresses

     

       28
       28
       +
         mergeLookupTables = tables: lib.zipAttrsWith (n: v: lib.flatten v) tables;

     

       29
       29
       +
       

     

       30
       30
       +
         # valiases_postfix :: Map String [String]

     

       31
       31
       +
         valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList

     

       32
       32
       +
           (name: value:

     

       33
       33
       +
             let to = name;

     

       34
       34
       +
             in map (from: {"${from}" = to;}) (value.aliases ++ lib.singleton name))

     

       35
       35
       +
           cfg.loginAccounts));

     

       36
       36
       +
       

     

       37
       37
       +
         # catchAllPostfix :: Map String [String]

     

       38
       38
       +
         catchAllPostfix =  mergeLookupTables (lib.flatten (lib.mapAttrsToList

     

       39
       39
       +
           (name: value:

     

       40
       40
       +
             let to = name;

     

       41
       41
       +
             in map (from: {"@${from}" = to;}) value.catchAll)

     

       42
       42
       +
             cfg.loginAccounts));

     

       43
       43
       +
       

     

       44
       44
       +
         # all_valiases_postfix :: Map String [String]

     

       45
       45
       +
         all_valiases_postfix = mergeLookupTables [valiases_postfix extra_valiases_postfix];

     

       46
       46
       +
       

     

       47
       47
       +
         # attrsToLookupTable :: Map String (Either String [ String ]) -> Map String [String]

     

       48
       48
       +
         attrsToLookupTable = aliases: let

     

       49
       49
       +
           lookupTables = lib.mapAttrsToList (from: to: {"${from}" = to;}) aliases;

     

       50
       50
       +
         in mergeLookupTables lookupTables;

     

       51
       51
       +
       

     

       52
       52
       +
         # extra_valiases_postfix :: Map String [String]

     

       53
       53
       +
         extra_valiases_postfix = attrsToLookupTable cfg.extraVirtualAliases;

     

       54
       54
       +
       

     

       55
       55
       +
         # forwards :: Map String [String]

     

       56
       56
       +
         forwards = attrsToLookupTable cfg.forwards;

     

       57
       57
       +
       

     

       58
       58
       +
         # lookupTableToString :: Map String [String] -> String

     

       59
       59
       +
         lookupTableToString = attrs: let

     

       60
       60
       +
           valueToString = value: lib.concatStringsSep ", " value;

     

       61
       61
       +
         in lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value: "${name} ${valueToString value}") attrs);

     

       62
       62
       +
       

     

       63
       63
       +
         # valiases_file :: Path

     

       64
       64
       +
         valiases_file = let

     

       65
       65
       +
           content = lookupTableToString (mergeLookupTables [all_valiases_postfix catchAllPostfix]);

     

       66
       66
       +
         in builtins.toFile "valias" content;

     

       67
       67
       +
       

     

       68
       68
       +
         # denied_recipients_postfix :: [ String ]

     

       69
       69
       +
         denied_recipients_postfix = (map

     

       70
       70
       +
           (acct: "${acct.name} REJECT ${acct.sendOnlyRejectMessage}")

     

       71
       71
       +
           (lib.filter (acct: acct.sendOnly) (lib.attrValues cfg.loginAccounts)));

     

       72
       72
       +
         denied_recipients_file = builtins.toFile "denied_recipients" (lib.concatStringsSep "\n" denied_recipients_postfix);

     

       73
       73
       +
       

     

       74
       74
       +
         reject_senders_postfix = (map

     

       75
       75
       +
           (sender:

     

       76
       76
       +
             "${sender} REJECT")

     

       77
       77
       +
           (cfg.rejectSender));

     

       78
       78
       +
         reject_senders_file = builtins.toFile "reject_senders" (lib.concatStringsSep "\n" (reject_senders_postfix))  ;

     

       79
       79
       +
       

     

       80
       80
       +
         reject_recipients_postfix = (map

     

       81
       81
       +
           (recipient:

     

       82
       82
       +
             "${recipient} REJECT")

     

       83
       83
       +
           (cfg.rejectRecipients));

     

       84
       84
       +
         # rejectRecipients :: [ Path ]

     

       85
       85
       +
         reject_recipients_file = builtins.toFile "reject_recipients" (lib.concatStringsSep "\n" (reject_recipients_postfix))  ;

     

       86
       86
       +
       

     

       87
       87
       +
         # vhosts_file :: Path

     

       88
       88
       +
         vhosts_file = builtins.toFile "vhosts" (concatStringsSep "\n" cfg.domains);

     

       89
       89
       +
       

     

       90
       90
       +
         # vaccounts_file :: Path

     

       91
       91
       +
         # see

     

       92
       92
       +
         # https://blog.grimneko.de/2011/12/24/a-bunch-of-tips-for-improving-your-postfix-setup/

     

       93
       93
       +
         # for details on how this file looks. By using the same file as valiases,

     

       94
       94
       +
         # every alias is owned (uniquely) by its user.

     

       95
       95
       +
         # The user's own address is already in all_valiases_postfix.

     

       96
       96
       +
         vaccounts_file = builtins.toFile "vaccounts" (lookupTableToString all_valiases_postfix);

     

       97
       97
       +
       

     

       98
       98
       +
         submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" (''

     

       99
       99
       +
            # Removes sensitive headers from mails handed in via the submission port.

     

       100
       100
       +
            # See https://thomas-leister.de/mailserver-debian-stretch/

     

       101
       101
       +
            # Uses "pcre" style regex.

     

       102
       102
       +
       

     

       103
       103
       +
            /^Received:/            IGNORE

     

       104
       104
       +
            /^X-Originating-IP:/    IGNORE

     

       105
       105
       +
            /^X-Mailer:/            IGNORE

     

       106
       106
       +
            /^User-Agent:/          IGNORE

     

       107
       107
       +
            /^X-Enigmail:/          IGNORE

     

       108
       108
       +
         '' + lib.optionalString cfg.rewriteMessageId ''

     

       109
       109
       +
       

     

       110
       110
       +
            # Replaces the user submitted hostname with the server's FQDN to hide the

     

       111
       111
       +
            # user's host or network.

     

       112
       112
       +
       

     

       113
       113
       +
            /^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@${cfg.fqdn}>

     

       114
       114
       +
         '');

     

       115
       115
       +
       

     

       116
       116
       +
         inetSocket = addr: port: "inet:[${toString port}@${addr}]";

     

       117
       117
       +
         unixSocket = sock: "unix:${sock}";

     

       118
       118
       +
       

     

       119
       119
       +
         smtpdMilters =

     

       120
       120
       +
          (lib.optional cfg.dkimSigning "unix:/run/opendkim/opendkim.sock")

     

       121
       121
       +
          ++ [ "unix:/run/rspamd/rspamd-milter.sock" ];

     

       122
       122
       +
       

     

       123
       123
       +
         policyd-spf = pkgs.writeText "policyd-spf.conf" cfg.policydSPFExtraConfig;

     

       124
       124
       +
       

     

       125
       125
       +
         mappedFile = name: "hash:/var/lib/postfix/conf/${name}";

     

       126
       126
       +
       

     

       127
       127
       +
         submissionOptions =

     

       128
       128
       +
           {

     

       129
       129
       +
             smtpd_tls_security_level = "encrypt";

     

       130
       130
       +
             smtpd_sasl_auth_enable = "yes";

     

       131
       131
       +
             smtpd_sasl_type = "dovecot";

     

       132
       132
       +
             smtpd_sasl_path = "/run/dovecot2/auth";

     

       133
       133
       +
             smtpd_sasl_security_options = "noanonymous";

     

       134
       134
       +
             smtpd_sasl_local_domain = "$myhostname";

     

       135
       135
       +
             smtpd_client_restrictions = "permit_sasl_authenticated,reject";

     

       136
       136
       +
             smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";

     

       137
       137
       +
             smtpd_sender_restrictions = "reject_sender_login_mismatch";

     

       138
       138
       +
             smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";

     

       139
       139
       +
             cleanup_service_name = "submission-header-cleanup";

     

       140
       140
       +
           };

     

       141
       141
       +
       in

     

       142
       142
       +
       {

     

       143
       143
       +
         config = with cfg; lib.mkIf enable {

     

       144
       144
       +
       

     

       145
       145
       +
           services.postfix = {

     

       146
       146
       +
             enable = true;

     

       147
       147
       +
             hostname = "${sendingFqdn}";

     

       148
       148
       +
             networksStyle = "host";

     

       149
       149
       +
             mapFiles."valias" = valiases_file;

     

       150
       150
       +
             mapFiles."vaccounts" = vaccounts_file;

     

       151
       151
       +
             mapFiles."denied_recipients" = denied_recipients_file;

     

       152
       152
       +
             mapFiles."reject_senders" = reject_senders_file;

     

       153
       153
       +
             mapFiles."reject_recipients" = reject_recipients_file;

     

       154
       154
       +
             sslCert = certificatePath;

     

       155
       155
       +
             sslKey = keyPath;

     

       156
       156
       +
             enableSubmission = cfg.enableSubmission;

     

       157
       157
       +
             enableSubmissions = cfg.enableSubmissionSsl;

     

       158
       158
       +
             virtual = lookupTableToString (mergeLookupTables [all_valiases_postfix catchAllPostfix forwards]);

     

       159
       159
       +
       

     

       160
       160
       +
             config = {

     

       161
       161
       +
               # Extra Config

     

       162
       162
       +
               mydestination = "";

     

       163
       163
       +
               recipient_delimiter = cfg.recipientDelimiter;

     

       164
       164
       +
               smtpd_banner = "${fqdn} ESMTP NO UCE";

     

       165
       165
       +
               disable_vrfy_command = true;

     

       166
       166
       +
               message_size_limit = toString cfg.messageSizeLimit;

     

       167
       167
       +
       

     

       168
       168
       +
               # virtual mail system

     

       169
       169
       +
               virtual_uid_maps = "static:5000";

     

       170
       170
       +
               virtual_gid_maps = "static:5000";

     

       171
       171
       +
               virtual_mailbox_base = mailDirectory;

     

       172
       172
       +
               virtual_mailbox_domains = vhosts_file;

     

       173
       173
       +
               virtual_mailbox_maps = mappedFile "valias";

     

       174
       174
       +
               virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";

     

       175
       175
       +
               # Avoid leakage of X-Original-To, X-Delivered-To headers between recipients

     

       176
       176
       +
               lmtp_destination_recipient_limit = "1";

     

       177
       177
       +
       

     

       178
       178
       +
               # sasl with dovecot

     

       179
       179
       +
               smtpd_sasl_type = "dovecot";

     

       180
       180
       +
               smtpd_sasl_path = "/run/dovecot2/auth";

     

       181
       181
       +
               smtpd_sasl_auth_enable = true;

     

       182
       182
       +
               smtpd_relay_restrictions = [

     

       183
       183
       +
                 "permit_mynetworks" "permit_sasl_authenticated" "reject_unauth_destination"

     

       184
       184
       +
               ];

     

       185
       185
       +
       

     

       186
       186
       +
               policy-spf_time_limit = "3600s";

     

       187
       187
       +
       

     

       188
       188
       +
               # reject selected senders

     

       189
       189
       +
               smtpd_sender_restrictions = [

     

       190
       190
       +
                 "check_sender_access ${mappedFile "reject_senders"}"

     

       191
       191
       +
               ];

     

       192
       192
       +
       

     

       193
       193
       +
               # quota and spf checking

     

       194
       194
       +
               smtpd_recipient_restrictions = [

     

       195
       195
       +
                 "check_recipient_access ${mappedFile "denied_recipients"}"

     

       196
       196
       +
                 "check_recipient_access ${mappedFile "reject_recipients"}"

     

       197
       197
       +
                 "check_policy_service inet:localhost:12340"

     

       198
       198
       +
                 "check_policy_service unix:private/policy-spf"

     

       199
       199
       +
               ];

     

       200
       200
       +
       

     

       201
       201
       +
               # TLS settings, inspired by https://github.com/jeaye/nix-files

     

       202
       202
       +
               # Submission by mail clients is handled in submissionOptions

     

       203
       203
       +
               smtpd_tls_security_level = "may";

     

       204
       204
       +
       

     

       205
       205
       +
               # strong might suffice and is computationally less expensive

     

       206
       206
       +
               smtpd_tls_eecdh_grade = "ultra";

     

       207
       207
       +
       

     

       208
       208
       +
               # Disable obselete protocols

     

       209
       209
       +
               smtpd_tls_protocols = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       210
       210
       +
               smtp_tls_protocols = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       211
       211
       +
               smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       212
       212
       +
               smtp_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       213
       213
       +
       

     

       214
       214
       +
               smtp_tls_ciphers = "high";

     

       215
       215
       +
               smtpd_tls_ciphers = "high";

     

       216
       216
       +
               smtp_tls_mandatory_ciphers = "high";

     

       217
       217
       +
               smtpd_tls_mandatory_ciphers = "high";

     

       218
       218
       +
       

     

       219
       219
       +
               # Disable deprecated ciphers

     

       220
       220
       +
               smtpd_tls_mandatory_exclude_ciphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";

     

       221
       221
       +
               smtpd_tls_exclude_ciphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";

     

       222
       222
       +
               smtp_tls_mandatory_exclude_ciphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";

     

       223
       223
       +
               smtp_tls_exclude_ciphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";

     

       224
       224
       +
       

     

       225
       225
       +
               tls_preempt_cipherlist = true;

     

       226
       226
       +
       

     

       227
       227
       +
               # Allowing AUTH on a non encrypted connection poses a security risk

     

       228
       228
       +
               smtpd_tls_auth_only = true;

     

       229
       229
       +
               # Log only a summary message on TLS handshake completion

     

       230
       230
       +
               smtpd_tls_loglevel = "1";

     

       231
       231
       +
       

     

       232
       232
       +
               # Configure a non blocking source of randomness

     

       233
       233
       +
               tls_random_source = "dev:/dev/urandom";

     

       234
       234
       +
       

     

       235
       235
       +
               smtpd_milters = smtpdMilters;

     

       236
       236
       +
               non_smtpd_milters = lib.mkIf cfg.dkimSigning ["unix:/run/opendkim/opendkim.sock"];

     

       237
       237
       +
               milter_protocol = "6";

     

       238
       238
       +
               milter_mail_macros = "i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer}";

     

       239
       239
       +
       

     

       240
       240
       +
             };

     

       241
       241
       +
       

     

       242
       242
       +
             submissionOptions = submissionOptions;

     

       243
       243
       +
             submissionsOptions = submissionOptions;

     

       244
       244
       +
       

     

       245
       245
       +
             masterConfig = {

     

       246
       246
       +
               "lmtp" = {

     

       247
       247
       +
                 # Add headers when delivering, see http://www.postfix.org/smtp.8.html

     

       248
       248
       +
                 # D => Delivered-To, O => X-Original-To, R => Return-Path

     

       249
       249
       +
                 args = [ "flags=O" ];

     

       250
       250
       +
               };

     

       251
       251
       +
               "policy-spf" = {

     

       252
       252
       +
                 type = "unix";

     

       253
       253
       +
                 privileged = true;

     

       254
       254
       +
                 chroot = false;

     

       255
       255
       +
                 command = "spawn";

     

       256
       256
       +
                 args = [ "user=nobody" "argv=${pkgs.pypolicyd-spf}/bin/policyd-spf" "${policyd-spf}"];

     

       257
       257
       +
               };

     

       258
       258
       +
               "submission-header-cleanup" = {

     

       259
       259
       +
                 type = "unix";

     

       260
       260
       +
                 private = false;

     

       261
       261
       +
                 chroot = false;

     

       262
       262
       +
                 maxproc = 0;

     

       263
       263
       +
                 command = "cleanup";

     

       264
       264
       +
                 args = ["-o" "header_checks=pcre:${submissionHeaderCleanupRules}"];

     

       265
       265
       +
               };

     

       266
       266
       +
             };

     

       267
       267
       +
           };

     

       268
       268
       +
         };

     

       269
       269
       +
       }

+59

modules/mailserver/rsnapshot.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       with lib;

     

       20
       20
       +
       

     

       21
       21
       +
       let

     

       22
       22
       +
         cfg = config.mailserver;

     

       23
       23
       +
       

     

       24
       24
       +
         preexecDefined = cfg.backup.cmdPreexec != null;

     

       25
       25
       +
         preexecWrapped = pkgs.writeScript "rsnapshot-preexec.sh" ''

     

       26
       26
       +
           #!${pkgs.stdenv.shell}

     

       27
       27
       +
           set -e

     

       28
       28
       +
       

     

       29
       29
       +
           ${cfg.backup.cmdPreexec}

     

       30
       30
       +
         '';

     

       31
       31
       +
         preexecString = optionalString preexecDefined "cmd_preexec	${preexecWrapped}";

     

       32
       32
       +
       

     

       33
       33
       +
         postexecDefined = cfg.backup.cmdPostexec != null;

     

       34
       34
       +
         postexecWrapped = pkgs.writeScript "rsnapshot-postexec.sh" ''

     

       35
       35
       +
           #!${pkgs.stdenv.shell}

     

       36
       36
       +
           set -e

     

       37
       37
       +
       

     

       38
       38
       +
           ${cfg.backup.cmdPostexec}

     

       39
       39
       +
         '';

     

       40
       40
       +
         postexecString = optionalString postexecDefined "cmd_postexec	${postexecWrapped}";

     

       41
       41
       +
       in {

     

       42
       42
       +
         config = mkIf (cfg.enable && cfg.backup.enable) {

     

       43
       43
       +
           services.rsnapshot = {

     

       44
       44
       +
             enable = true;

     

       45
       45
       +
             cronIntervals = cfg.backup.cronIntervals;

     

       46
       46
       +
             # rsnapshot expects intervals shortest first, e.g. hourly first, then daily.

     

       47
       47
       +
             # tabs must separate all elements

     

       48
       48
       +
             extraConfig = ''

     

       49
       49
       +
               ${preexecString}

     

       50
       50
       +
               ${postexecString}

     

       51
       51
       +
               snapshot_root	${cfg.backup.snapshotRoot}/

     

       52
       52
       +
               retain	hourly	${toString cfg.backup.retain.hourly}

     

       53
       53
       +
               retain	daily	${toString cfg.backup.retain.daily}

     

       54
       54
       +
               retain	weekly	${toString cfg.backup.retain.weekly}

     

       55
       55
       +
               backup	${cfg.mailDirectory}/	localhost/

     

       56
       56
       +
             '';

     

       57
       57
       +
           };

     

       58
       58
       +
         };

     

       59
       59
       +
       }

+119

modules/mailserver/rspamd.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver;

     

       21
       21
       +
       

     

       22
       22
       +
         postfixCfg = config.services.postfix;

     

       23
       23
       +
         rspamdCfg = config.services.rspamd;

     

       24
       24
       +
         rspamdSocket = "rspamd.service";

     

       25
       25
       +
       in

     

       26
       26
       +
       {

     

       27
       27
       +
         config = with cfg; lib.mkIf enable {

     

       28
       28
       +
           services.rspamd = {

     

       29
       29
       +
             enable = true;

     

       30
       30
       +
             inherit debug;

     

       31
       31
       +
             locals = {

     

       32
       32
       +
                 "milter_headers.conf" = { text = ''

     

       33
       33
       +
                     extended_spam_headers = yes;

     

       34
       34
       +
                 ''; };

     

       35
       35
       +
                 "redis.conf" = { text = ''

     

       36
       36
       +
                     servers = "${cfg.redis.address}:${toString cfg.redis.port}";

     

       37
       37
       +
                 '' + (lib.optionalString (cfg.redis.password != null) ''

     

       38
       38
       +
                     password = "${cfg.redis.password}";

     

       39
       39
       +
                 ''); };

     

       40
       40
       +
                 "classifier-bayes.conf" = { text = ''

     

       41
       41
       +
                     cache {

     

       42
       42
       +
                       backend = "redis";

     

       43
       43
       +
                     }

     

       44
       44
       +
                 ''; };

     

       45
       45
       +
                 "antivirus.conf" = lib.mkIf cfg.virusScanning { text = ''

     

       46
       46
       +
                     clamav {

     

       47
       47
       +
                       action = "reject";

     

       48
       48
       +
                       symbol = "CLAM_VIRUS";

     

       49
       49
       +
                       type = "clamav";

     

       50
       50
       +
                       log_clean = true;

     

       51
       51
       +
                       servers = "/run/clamav/clamd.ctl";

     

       52
       52
       +
                       scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all

     

       53
       53
       +
                     }

     

       54
       54
       +
                 ''; };

     

       55
       55
       +
                 "dkim_signing.conf" = { text = ''

     

       56
       56
       +
                     # Disable outbound email signing, we use opendkim for this

     

       57
       57
       +
                     enabled = false;

     

       58
       58
       +
                 ''; };

     

       59
       59
       +
             };

     

       60
       60
       +
       

     

       61
       61
       +
             overrides = {

     

       62
       62
       +
               "milter_headers.conf" = {

     

       63
       63
       +
                 text = ''

     

       64
       64
       +
                   extended_spam_headers = true;

     

       65
       65
       +
                 '';

     

       66
       66
       +
               };

     

       67
       67
       +
             };

     

       68
       68
       +
       

     

       69
       69
       +
             workers.rspamd_proxy = {

     

       70
       70
       +
               type = "rspamd_proxy";

     

       71
       71
       +
               bindSockets = [{

     

       72
       72
       +
                 socket = "/run/rspamd/rspamd-milter.sock";

     

       73
       73
       +
                 mode = "0664";

     

       74
       74
       +
               }];

     

       75
       75
       +
               count = 1; # Do not spawn too many processes of this type

     

       76
       76
       +
               extraConfig = ''

     

       77
       77
       +
                 milter = yes; # Enable milter mode

     

       78
       78
       +
                 timeout = 120s; # Needed for Milter usually

     

       79
       79
       +
       

     

       80
       80
       +
                 upstream "local" {

     

       81
       81
       +
                   default = yes; # Self-scan upstreams are always default

     

       82
       82
       +
                   self_scan = yes; # Enable self-scan

     

       83
       83
       +
                 }

     

       84
       84
       +
               '';

     

       85
       85
       +
             };

     

       86
       86
       +
             workers.controller = {

     

       87
       87
       +
               type = "controller";

     

       88
       88
       +
               count = 1;

     

       89
       89
       +
               bindSockets = [{

     

       90
       90
       +
                 socket = "/run/rspamd/worker-controller.sock";

     

       91
       91
       +
                 mode = "0666";

     

       92
       92
       +
               }];

     

       93
       93
       +
               includes = [];

     

       94
       94
       +
               extraConfig = ''

     

       95
       95
       +
                 static_dir = "''${WWWDIR}"; # Serve the web UI static assets

     

       96
       96
       +
               '';

     

       97
       97
       +
             };

     

       98
       98
       +
       

     

       99
       99
       +
           };

     

       100
       100
       +
       

     

       101
       101
       +
           services.redis.servers.rspamd = {

     

       102
       102
       +
             enable = lib.mkDefault true;

     

       103
       103
       +
             port = lib.mkDefault 6380;

     

       104
       104
       +
           };

     

       105
       105
       +
       

     

       106
       106
       +
           systemd.services.rspamd = {

     

       107
       107
       +
             requires = [ "redis-rspamd.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");

     

       108
       108
       +
             after = [ "redis-rspamd.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");

     

       109
       109
       +
           };

     

       110
       110
       +
       

     

       111
       111
       +
           systemd.services.postfix = {

     

       112
       112
       +
             after = [ rspamdSocket ];

     

       113
       113
       +
             requires = [ rspamdSocket ];

     

       114
       114
       +
           };

     

       115
       115
       +
       

     

       116
       116
       +
           users.extraUsers.${postfixCfg.user}.extraGroups = [ rspamdCfg.group ];

     

       117
       117
       +
         };

     

       118
       118
       +
       }

     

       119
       119
       +

+83

modules/mailserver/systemd.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       let

     

       20
       20
       +
         cfg = config.mailserver;

     

       21
       21
       +
         certificatesDeps =

     

       22
       22
       +
           if cfg.certificateScheme == 1 then

     

       23
       23
       +
             []

     

       24
       24
       +
           else if cfg.certificateScheme == 2 then

     

       25
       25
       +
             [ "mailserver-selfsigned-certificate.service" ]

     

       26
       26
       +
           else

     

       27
       27
       +
             [ "acme-finished-${cfg.fqdn}.target" ];

     

       28
       28
       +
       in

     

       29
       29
       +
       {

     

       30
       30
       +
         config = with cfg; lib.mkIf enable {

     

       31
       31
       +
           # Create self signed certificate

     

       32
       32
       +
           systemd.services.mailserver-selfsigned-certificate = lib.mkIf (cfg.certificateScheme == 2) {

     

       33
       33
       +
             after = [ "local-fs.target" ];

     

       34
       34
       +
             script = ''

     

       35
       35
       +
               # Create certificates if they do not exist yet

     

       36
       36
       +
               dir="${cfg.certificateDirectory}"

     

       37
       37
       +
               fqdn="${cfg.fqdn}"

     

       38
       38
       +
               [[ $fqdn == /* ]] && fqdn=$(< "$fqdn")

     

       39
       39
       +
               key="$dir/key-${cfg.fqdn}.pem";

     

       40
       40
       +
               cert="$dir/cert-${cfg.fqdn}.pem";

     

       41
       41
       +
       

     

       42
       42
       +
               if [[ ! -f $key || ! -f $cert ]]; then

     

       43
       43
       +
                   mkdir -p "${cfg.certificateDirectory}"

     

       44
       44
       +
                   (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "$key" 2048) &&

     

       45
       45
       +
                       "${pkgs.openssl}/bin/openssl" req -new -key "$key" -x509 -subj "/CN=$fqdn" \

     

       46
       46
       +
                               -days 3650 -out "$cert"

     

       47
       47
       +
               fi

     

       48
       48
       +
             '';

     

       49
       49
       +
             serviceConfig = {

     

       50
       50
       +
               Type = "oneshot";

     

       51
       51
       +
               PrivateTmp = true;

     

       52
       52
       +
             };

     

       53
       53
       +
           };

     

       54
       54
       +
       

     

       55
       55
       +
           # Create maildir folder before dovecot startup

     

       56
       56
       +
           systemd.services.dovecot2 = {

     

       57
       57
       +
             wants = certificatesDeps;

     

       58
       58
       +
             after = certificatesDeps;

     

       59
       59
       +
             preStart = let

     

       60
       60
       +
               directories = lib.strings.escapeShellArgs (

     

       61
       61
       +
                 [ mailDirectory ]

     

       62
       62
       +
                 ++ lib.optional (cfg.indexDir != null) cfg.indexDir

     

       63
       63
       +
               );

     

       64
       64
       +
             in ''

     

       65
       65
       +
               # Create mail directory and set permissions. See

     

       66
       66
       +
               # <http://wiki2.dovecot.org/SharedMailboxes/Permissions>.

     

       67
       67
       +
               mkdir -p ${directories}

     

       68
       68
       +
               chgrp "${vmailGroupName}" ${directories}

     

       69
       69
       +
               chmod 02770 ${directories}

     

       70
       70
       +
             '';

     

       71
       71
       +
           };

     

       72
       72
       +
       

     

       73
       73
       +
           # Postfix requires dovecot lmtp socket, dovecot auth socket and certificate to work

     

       74
       74
       +
           systemd.services.postfix = {

     

       75
       75
       +
             wants = certificatesDeps;

     

       76
       76
       +
             after = [ "dovecot2.service" ]

     

       77
       77
       +
               ++ lib.optional cfg.dkimSigning "opendkim.service"

     

       78
       78
       +
               ++ certificatesDeps;

     

       79
       79
       +
             requires = [ "dovecot2.service" ]

     

       80
       80
       +
               ++ lib.optional cfg.dkimSigning "opendkim.service";

     

       81
       81
       +
           };

     

       82
       82
       +
         };

     

       83
       83
       +
       }

+101

modules/mailserver/users.nix

···

       1
       1
       +
       #  nixos-mailserver: a simple mail server

     

       2
       2
       +
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       +
       #

     

       4
       4
       +
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       +
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       +
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       +
       #  (at your option) any later version.

     

       8
       8
       +
       #

     

       9
       9
       +
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       +
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       +
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       +
       #  GNU General Public License for more details.

     

       13
       13
       +
       #

     

       14
       14
       +
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       +
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       +
       

     

       17
       17
       +
       { config, pkgs, lib, ... }:

     

       18
       18
       +
       

     

       19
       19
       +
       with config.mailserver;

     

       20
       20
       +
       

     

       21
       21
       +
       let

     

       22
       22
       +
         vmail_user = {

     

       23
       23
       +
           name = vmailUserName;

     

       24
       24
       +
           isSystemUser = true;

     

       25
       25
       +
           uid = vmailUID;

     

       26
       26
       +
           home = mailDirectory;

     

       27
       27
       +
           createHome = true;

     

       28
       28
       +
           group = vmailGroupName;

     

       29
       29
       +
         };

     

       30
       30
       +
       

     

       31
       31
       +
       

     

       32
       32
       +
         virtualMailUsersActivationScript = pkgs.writeScript "activate-virtual-mail-users" ''

     

       33
       33
       +
           #!${pkgs.stdenv.shell}

     

       34
       34
       +
       

     

       35
       35
       +
           set -euo pipefail

     

       36
       36
       +
       

     

       37
       37
       +
           # Create directory to store user sieve scripts if it doesn't exist

     

       38
       38
       +
           if (! test -d "${sieveDirectory}"); then

     

       39
       39
       +
             mkdir "${sieveDirectory}"

     

       40
       40
       +
             chown "${vmailUserName}:${vmailGroupName}" "${sieveDirectory}"

     

       41
       41
       +
             chmod 770 "${sieveDirectory}"

     

       42
       42
       +
           fi

     

       43
       43
       +
       

     

       44
       44
       +
           # Copy user's sieve script to the correct location (if it exists).  If it

     

       45
       45
       +
           # is null, remove the file.

     

       46
       46
       +
           ${lib.concatMapStringsSep "\n" ({ name, sieveScript }:

     

       47
       47
       +
             if lib.isString sieveScript then ''

     

       48
       48
       +
               if (! test -d "${sieveDirectory}/${name}"); then

     

       49
       49
       +
                 mkdir -p "${sieveDirectory}/${name}"

     

       50
       50
       +
                 chown "${vmailUserName}:${vmailGroupName}" "${sieveDirectory}/${name}"

     

       51
       51
       +
                 chmod 770 "${sieveDirectory}/${name}"

     

       52
       52
       +
               fi

     

       53
       53
       +
               cat << 'EOF' > "${sieveDirectory}/${name}/default.sieve"

     

       54
       54
       +
               ${sieveScript}

     

       55
       55
       +
               EOF

     

       56
       56
       +
               chown "${vmailUserName}:${vmailGroupName}" "${sieveDirectory}/${name}/default.sieve"

     

       57
       57
       +
             '' else ''

     

       58
       58
       +
               if (test -f "${sieveDirectory}/${name}/default.sieve"); then

     

       59
       59
       +
                 rm "${sieveDirectory}/${name}/default.sieve"

     

       60
       60
       +
               fi

     

       61
       61
       +
               if (test -f "${sieveDirectory}/${name}.svbin"); then

     

       62
       62
       +
                 rm "${sieveDirectory}/${name}/default.svbin"

     

       63
       63
       +
               fi

     

       64
       64
       +
             '') (map (user: { inherit (user) name sieveScript; })

     

       65
       65
       +
                   (lib.attrValues loginAccounts))}

     

       66
       66
       +
         '';

     

       67
       67
       +
       in {

     

       68
       68
       +
         config = lib.mkIf enable {

     

       69
       69
       +
           # assert that all accounts provide a password

     

       70
       70
       +
           assertions = (map (acct: {

     

       71
       71
       +
             assertion = (acct.hashedPassword != null || acct.hashedPasswordFile != null);

     

       72
       72
       +
             message = "${acct.name} must provide either a hashed password or a password hash file";

     

       73
       73
       +
           }) (lib.attrValues loginAccounts));

     

       74
       74
       +
       

     

       75
       75
       +
           # warn for accounts that specify both password and file

     

       76
       76
       +
           warnings = (map

     

       77
       77
       +
             (acct: "${acct.name} specifies both a password hash and hash file; hash file will be used")

     

       78
       78
       +
             (lib.filter

     

       79
       79
       +
               (acct: (acct.hashedPassword != null && acct.hashedPasswordFile != null))

     

       80
       80
       +
               (lib.attrValues loginAccounts)));

     

       81
       81
       +
       

     

       82
       82
       +
           # set the vmail gid to a specific value

     

       83
       83
       +
           users.groups = {

     

       84
       84
       +
             "${vmailGroupName}" = { gid = vmailUID; };

     

       85
       85
       +
           };

     

       86
       86
       +
       

     

       87
       87
       +
           # define all users

     

       88
       88
       +
           users.users = {

     

       89
       89
       +
             "${vmail_user.name}" = lib.mkForce vmail_user;

     

       90
       90
       +
           };

     

       91
       91
       +
       

     

       92
       92
       +
           systemd.services.activate-virtual-mail-users = {

     

       93
       93
       +
             wantedBy = [ "multi-user.target" ];

     

       94
       94
       +
             before = [ "dovecot2.service" ];

     

       95
       95
       +
             serviceConfig = {

     

       96
       96
       +
               ExecStart = virtualMailUsersActivationScript;

     

       97
       97
       +
             };

     

       98
       98
       +
             enable = true;

     

       99
       99
       +
           };

     

       100
       100
       +
         };

     

       101
       101
       +
       }

+66

modules/wireguard/default.nix

···

       1
       1
       +
       { pkgs, config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       with lib;

     

       4
       4
       +
       

     

       5
       5
       +
       let cfg = config.wireguard; in

     

       6
       6
       +
       {

     

       7
       7
       +
         options.wireguard = {

     

       8
       8
       +
           enable = lib.mkEnableOption "wireguard";

     

       9
       9
       +
           server = mkOption {

     

       10
       10
       +
             type = with types; bool;

     

       11
       11
       +
             default = cfg.hosts.${config.networking.hostName}.server;

     

       12
       12
       +
           };

     

       13
       13
       +
           hosts =

     

       14
       14
       +
             let hostOps = { ... }: {

     

       15
       15
       +
               options = {

     

       16
       16
       +
                 ip = mkOption {

     

       17
       17
       +
                   type = types.str;

     

       18
       18
       +
                 };

     

       19
       19
       +
                 publicKey = mkOption {

     

       20
       20
       +
                   type = types.str;

     

       21
       21
       +
                 };

     

       22
       22
       +
                 server = mkOption {

     

       23
       23
       +
                   type = types.bool;

     

       24
       24
       +
                   default = false;

     

       25
       25
       +
                 };

     

       26
       26
       +
               };

     

       27
       27
       +
             };

     

       28
       28
       +
             in mkOption {

     

       29
       29
       +
               type = with types; attrsOf (submodule hostOps);

     

       30
       30
       +
             };

     

       31
       31
       +
         };

     

       32
       32
       +
       

     

       33
       33
       +
         config = mkIf cfg.enable {

     

       34
       34
       +
           environment.systemPackages = with pkgs; [ wireguard-tools ];

     

       35
       35
       +
           networking = {

     

       36
       36
       +
             # populate /etc/hosts with hostnames and IPs

     

       37
       37
       +
             extraHosts = builtins.concatStringsSep "\n" (

     

       38
       38
       +
               attrsets.mapAttrsToList (

     

       39
       39
       +
                 hostName: values: "${values.ip} ${hostName}"

     

       40
       40
       +
               ) cfg.hosts

     

       41
       41
       +
             );

     

       42
       42
       +
       

     

       43
       43
       +
             firewall = {

     

       44
       44
       +
               allowedUDPPorts = [ 51820 ];

     

       45
       45
       +
               checkReversePath = false;

     

       46
       46
       +
             };

     

       47
       47
       +
       

     

       48
       48
       +
             wireguard = {

     

       49
       49
       +
               enable = true;

     

       50
       50
       +
               interfaces.wg0 = {

     

       51
       51
       +
                 ips = [ "${cfg.hosts.${config.networking.hostName}.ip}/24" ];

     

       52
       52
       +
                 listenPort = 51820;

     

       53
       53
       +
                 privateKeyFile = "${config.custom.secretsDir}/wireguard-key-${config.networking.hostName}";

     

       54
       54
       +
                 peers = mkIf (!cfg.server) [

     

       55
       55
       +
                   {

     

       56
       56
       +
                     allowedIPs = [ "10.0.0.0/24" ];

     

       57
       57
       +
                     publicKey = "${cfg.hosts.vps.publicKey}";

     

       58
       58
       +
                     endpoint = "${config.hosting.serverIpv4}:51820";

     

       59
       59
       +
                     persistentKeepalive = mkIf (config.networking.hostName == "rasp-pi") 25;

     

       60
       60
       +
                   }

     

       61
       61
       +
                 ];

     

       62
       62
       +
               };

     

       63
       63
       +
             };

     

       64
       64
       +
           };

     

       65
       65
       +
         };

     

       66
       66
       +
       }

+10

modules/wireguard/generate-key.sh

···

       1
       1
       +
       #!/usr/bin/env bash

     

       2
       2
       +
       

     

       3
       3
       +
       dir=$1

     

       4
       4
       +
       file=wireguard_key_"$(hostname)"

     

       5
       5
       +
       A

     

       6
       6
       +
       umask 077

     

       7
       7
       +
       chmod 700 "$dir"

     

       8
       8
       +
       

     

       9
       9
       +
       wg genkey > "$dir/$file"

     

       10
       10
       +
       wg pubkey < "$dir/$file"

+39

modules/wireguard/server.nix

···

       1
       1
       +
       { pkgs, config, lib, ... }:

     

       2
       2
       +
       

     

       3
       3
       +
       let cfg = config.wireguard; in

     

       4
       4
       +
       {

     

       5
       5
       +
         networking = lib.mkIf (cfg.enable && cfg.server) {

     

       6
       6
       +
           nat = {

     

       7
       7
       +
             enable = true;

     

       8
       8
       +
             externalInterface = "enp1s0";

     

       9
       9
       +
             internalInterfaces = [ "wg0" ];

     

       10
       10
       +
           };

     

       11
       11
       +
           firewall = {

     

       12
       12
       +
             extraCommands = ''

     

       13
       13
       +
               iptables -I FORWARD -i wg0 -o wg0 -j ACCEPT

     

       14
       14
       +
             '';

     

       15
       15
       +
             trustedInterfaces = [ "wg0" ];

     

       16
       16
       +
           };

     

       17
       17
       +
       

     

       18
       18
       +
           wireguard.interfaces.wg0 = {

     

       19
       19
       +
             # Route from wireguard to public internet, allowing server to act as VPN

     

       20
       20
       +
             postSetup = ''

     

       21
       21
       +
               ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE

     

       22
       22
       +
             '';

     

       23
       23
       +
       

     

       24
       24
       +
             postShutdown = ''

     

       25
       25
       +
               ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp1s0 -j MASQUERADE

     

       26
       26
       +
             '';

     

       27
       27
       +
       

     

       28
       28
       +
             # add clients

     

       29
       29
       +
             peers = with lib.attrsets;

     

       30
       30
       +
               mapAttrsToList (

     

       31
       31
       +
                 hostName: values: {

     

       32
       32
       +
                   allowedIPs = [ "${values.ip}/32" ];

     

       33
       33
       +
                   publicKey = values.publicKey;

     

       34
       34
       +
                   persistentKeepalive = lib.mkIf (hostName == "rasp-pi") 25;

     

       35
       35
       +
                 }

     

       36
       36
       +
               ) cfg.hosts;

     

       37
       37
       +
           };

     

       38
       38
       +
         };

     

       39
       39
       +
       }