commit 816cff860cc3c8f694733ee807cfe1cf08ae2130 · ryan.freumh.org/eilean-nix

+136 -1

flake.lock

···

       1
       1
        
       {

     

       2
       2
        
         "nodes": {

     

       3
       3
       +
           "blobs": {

     

       4
       4
       +
             "flake": false,

     

       5
       5
       +
             "locked": {

     

       6
       6
       +
               "lastModified": 1604995301,

     

       7
       7
       +
               "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",

     

       8
       8
       +
               "owner": "simple-nixos-mailserver",

     

       9
       9
       +
               "repo": "blobs",

     

       10
       10
       +
               "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",

     

       11
       11
       +
               "type": "gitlab"

     

       12
       12
       +
             },

     

       13
       13
       +
             "original": {

     

       14
       14
       +
               "owner": "simple-nixos-mailserver",

     

       15
       15
       +
               "repo": "blobs",

     

       16
       16
       +
               "type": "gitlab"

     

       17
       17
       +
             }

     

       18
       18
       +
           },

     

       19
       19
       +
           "flake-compat": {

     

       20
       20
       +
             "flake": false,

     

       21
       21
       +
             "locked": {

     

       22
       22
       +
               "lastModified": 1696426674,

     

       23
       23
       +
               "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",

     

       24
       24
       +
               "owner": "edolstra",

     

       25
       25
       +
               "repo": "flake-compat",

     

       26
       26
       +
               "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",

     

       27
       27
       +
               "type": "github"

     

       28
       28
       +
             },

     

       29
       29
       +
             "original": {

     

       30
       30
       +
               "owner": "edolstra",

     

       31
       31
       +
               "repo": "flake-compat",

     

       32
       32
       +
               "type": "github"

     

       33
       33
       +
             }

     

       34
       34
       +
           },

     

       35
       35
       +
           "nixos-mailserver": {

     

       36
       36
       +
             "inputs": {

     

       37
       37
       +
               "blobs": "blobs",

     

       38
       38
       +
               "flake-compat": "flake-compat",

     

       39
       39
       +
               "nixpkgs": "nixpkgs",

     

       40
       40
       +
               "nixpkgs-23_05": "nixpkgs-23_05",

     

       41
       41
       +
               "nixpkgs-23_11": "nixpkgs-23_11",

     

       42
       42
       +
               "utils": "utils"

     

       43
       43
       +
             },

     

       44
       44
       +
             "locked": {

     

       45
       45
       +
               "lastModified": 1711069052,

     

       46
       46
       +
               "narHash": "sha256-QScBLiWRDmrOhG4/jCrdZTNe8zQdf6gzSZocAYOcG3U=",

     

       47
       47
       +
               "owner": "RyanGibb",

     

       48
       48
       +
               "repo": "nixos-mailserver",

     

       49
       49
       +
               "rev": "435c3a167c52ebe443f6ed1ba3412331ae566d05",

     

       50
       50
       +
               "type": "github"

     

       51
       51
       +
             },

     

       52
       52
       +
             "original": {

     

       53
       53
       +
               "owner": "RyanGibb",

     

       54
       54
       +
               "ref": "fork-23.11",

     

       55
       55
       +
               "repo": "nixos-mailserver",

     

       56
       56
       +
               "type": "github"

     

       57
       57
       +
             }

     

       58
       58
       +
           },

     

       3
       59
        
           "nixpkgs": {

     

       4
       60
        
             "locked": {

     

       61
       61
       +
               "lastModified": 1709703039,

     

       62
       62
       +
               "narHash": "sha256-6hqgQ8OK6gsMu1VtcGKBxKQInRLHtzulDo9Z5jxHEFY=",

     

       63
       63
       +
               "owner": "NixOS",

     

       64
       64
       +
               "repo": "nixpkgs",

     

       65
       65
       +
               "rev": "9df3e30ce24fd28c7b3e2de0d986769db5d6225d",

     

       66
       66
       +
               "type": "github"

     

       67
       67
       +
             },

     

       68
       68
       +
             "original": {

     

       69
       69
       +
               "id": "nixpkgs",

     

       70
       70
       +
               "ref": "nixos-unstable",

     

       71
       71
       +
               "type": "indirect"

     

       72
       72
       +
             }

     

       73
       73
       +
           },

     

       74
       74
       +
           "nixpkgs-23_05": {

     

       75
       75
       +
             "locked": {

     

       76
       76
       +
               "lastModified": 1704290814,

     

       77
       77
       +
               "narHash": "sha256-LWvKHp7kGxk/GEtlrGYV68qIvPHkU9iToomNFGagixU=",

     

       78
       78
       +
               "owner": "NixOS",

     

       79
       79
       +
               "repo": "nixpkgs",

     

       80
       80
       +
               "rev": "70bdadeb94ffc8806c0570eb5c2695ad29f0e421",

     

       81
       81
       +
               "type": "github"

     

       82
       82
       +
             },

     

       83
       83
       +
             "original": {

     

       84
       84
       +
               "id": "nixpkgs",

     

       85
       85
       +
               "ref": "nixos-23.05",

     

       86
       86
       +
               "type": "indirect"

     

       87
       87
       +
             }

     

       88
       88
       +
           },

     

       89
       89
       +
           "nixpkgs-23_11": {

     

       90
       90
       +
             "locked": {

     

       91
       91
       +
               "lastModified": 1710951922,

     

       92
       92
       +
               "narHash": "sha256-FOOBJ3DQenLpTNdxMHR2CpGZmYuctb92gF0lpiirZ30=",

     

       93
       93
       +
               "owner": "NixOS",

     

       94
       94
       +
               "repo": "nixpkgs",

     

       95
       95
       +
               "rev": "f091af045dff8347d66d186a62d42aceff159456",

     

       96
       96
       +
               "type": "github"

     

       97
       97
       +
             },

     

       98
       98
       +
             "original": {

     

       99
       99
       +
               "id": "nixpkgs",

     

       100
       100
       +
               "ref": "nixos-23.11",

     

       101
       101
       +
               "type": "indirect"

     

       102
       102
       +
             }

     

       103
       103
       +
           },

     

       104
       104
       +
           "nixpkgs_2": {

     

       105
       105
       +
             "locked": {

     

       5
       106
        
               "lastModified": 1710272261,

     

       6
       107
        
               "narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=",

     

       7
       108
        
               "owner": "nixos",

     
···

       18
       119
        
           },

     

       19
       120
        
           "root": {

     

       20
       121
        
             "inputs": {

     

       21
       21
       -
               "nixpkgs": "nixpkgs"

     

       122
       122
       +
               "nixos-mailserver": "nixos-mailserver",

     

       123
       123
       +
               "nixpkgs": "nixpkgs_2"

     

       124
       124
       +
             }

     

       125
       125
       +
           },

     

       126
       126
       +
           "systems": {

     

       127
       127
       +
             "locked": {

     

       128
       128
       +
               "lastModified": 1681028828,

     

       129
       129
       +
               "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",

     

       130
       130
       +
               "owner": "nix-systems",

     

       131
       131
       +
               "repo": "default",

     

       132
       132
       +
               "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",

     

       133
       133
       +
               "type": "github"

     

       134
       134
       +
             },

     

       135
       135
       +
             "original": {

     

       136
       136
       +
               "owner": "nix-systems",

     

       137
       137
       +
               "repo": "default",

     

       138
       138
       +
               "type": "github"

     

       139
       139
       +
             }

     

       140
       140
       +
           },

     

       141
       141
       +
           "utils": {

     

       142
       142
       +
             "inputs": {

     

       143
       143
       +
               "systems": "systems"

     

       144
       144
       +
             },

     

       145
       145
       +
             "locked": {

     

       146
       146
       +
               "lastModified": 1709126324,

     

       147
       147
       +
               "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",

     

       148
       148
       +
               "owner": "numtide",

     

       149
       149
       +
               "repo": "flake-utils",

     

       150
       150
       +
               "rev": "d465f4819400de7c8d874d50b982301f28a84605",

     

       151
       151
       +
               "type": "github"

     

       152
       152
       +
             },

     

       153
       153
       +
             "original": {

     

       154
       154
       +
               "owner": "numtide",

     

       155
       155
       +
               "repo": "flake-utils",

     

       156
       156
       +
               "type": "github"

     

       22
       157
        
             }

     

       23
       158
        
           }

     

       24
       159
        
         },

+7 -3

flake.nix

···

       1
       1
        
       {

     

       2
       2
       -
         inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

     

       2
       2
       +
         inputs = {

     

       3
       3
       +
           nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

     

       4
       4
       +
           nixos-mailserver.url = "github:RyanGibb/nixos-mailserver/fork-23.11";

     

       5
       5
       +
         };

     

       3
       6
        
       

     

       4
       4
       -
         outputs = { self, nixpkgs, ... }: rec {

     

       7
       7
       +
         outputs = { self, nixpkgs, nixos-mailserver, ... }: rec {

     

       5
       8
        
           packages = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed (system:

     

       6
       9
        
             let

     

       7
       10
        
               pkgs = nixpkgs.legacyPackages.${system};

     

       8
       11
        
             in {

     

       9
       9
       -
               manpage = import ./man { inherit pkgs system; };

     

       12
       12
       +
               manpage = import ./man { inherit pkgs system nixos-mailserver; };

     

       10
       13
        
             });

     

       11
       14
        
       

     

       12
       15
        
           nixosModules.default = {

     

       13
       16
        
             imports = [

     

       14
       17
        
               ./modules/default.nix

     

       18
       18
       +
               nixos-mailserver.nixosModule

     

       15
       19
        
               ({ pkgs, config, ... }: {

     

       16
       20
        
                 nixpkgs.overlays = [ (final: prev: {

     

       17
       21
        
                   mautrix-meta = (prev.callPackage ./pkgs/mautrix-meta.nix { });

+2 -1

man/default.nix

···

       1
       1
       -
       { pkgs, system, ... }:

     

       1
       1
       +
       { pkgs, system, nixos-mailserver, ... }:

     

       2
       2
        
       

     

       3
       3
        
       with pkgs;

     

       4
       4
        
       let

     
···

       8
       8
        
                 inherit system;

     

       9
       9
        
                 modules = [

     

       10
       10
        
                   ../modules/default.nix

     

       11
       11
       +
                   nixos-mailserver

     

       11
       12
        
                 ];

     

       12
       13
        
               };

     

       13
       14
        
             in pkgs.nixosOptionsDoc {

+1 -3

modules/default.nix

···

       5
       5
        
       {

     

       6
       6
        
         imports = [

     

       7
       7
        
           ./services/dns/default.nix

     

       8
       8
       -
           ./mailserver/default.nix

     

       9
       8
        
           ./mastodon.nix

     

       10
       9
        
           ./mailserver.nix

     

       11
       10
        
           ./gitea.nix

     
···

       35
       34
        
         };

     

       36
       35
        
       

     

       37
       36
        
         config = {

     

       38
       38
       -
           # install manpage

     

       37
       37
       +
           # TODO install manpage

     

       39
       38
        
           environment.systemPackages = [

     

       40
       40
       -
             (import ../man/default.nix { inherit pkgs; system = config.nixpkgs.hostPlatform.system; })

     

       41
       39
        
           ];

     

       42
       40
        
           security.acme.defaults.email = "${config.eilean.username}@${config.networking.domain}";

     

       43
       41
        
           networking.firewall.allowedTCPPorts = mkIf config.services.nginx.enable [

+8 -1

modules/mailserver.nix

···

       31
       31
        
       

     

       32
       32
        
             # Use Let's Encrypt certificates. Note that this needs to set up a stripped

     

       33
       33
        
             # down nginx and opens port 80.

     

       34
       34
       -
             certificateScheme = 3;

     

       34
       34
       +
             certificateScheme = "acme-nginx";

     

       35
       35
        
       

     

       36
       36
        
             localDnsResolver = false;

     

       37
       37
        
           };

     
···

       40
       40
        
           services.nginx.virtualHosts."${config.mailserver.fqdn}".extraConfig = ''

     

       41
       41
        
             return 301 $scheme://${domain}$request_uri;

     

       42
       42
        
           '';

     

       43
       43
       +
       

     

       44
       44
       +
           services.postfix.config = {

     

       45
       45
       +
             smtpd_tls_protocols = mkForce "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       46
       46
       +
             smtp_tls_protocols = mkForce "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       47
       47
       +
             smtpd_tls_mandatory_protocols = mkForce "TLSv1.3, !TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       48
       48
       +
             smtp_tls_mandatory_protocols = mkForce "TLSv1.3, !TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       49
       49
       +
           };

     

       43
       50
        
       

     

       44
       51
        
           eilean.dns.enable = true;

     

       45
       52
        
           eilean.services.dns.zones.${config.networking.domain}.records = [

-78

modules/mailserver/borgbackup.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver.borgbackup;

     

       21
       21
       -
       

     

       22
       22
       -
         methodFragment = lib.optional (cfg.compression.method != null) cfg.compression.method;

     

       23
       23
       -
         autoFragment =

     

       24
       24
       -
           if cfg.compression.auto && cfg.compression.method == null

     

       25
       25
       -
           then throw "compression.method must be set when using auto."

     

       26
       26
       -
           else lib.optional cfg.compression.auto "auto";

     

       27
       27
       -
         levelFragment =

     

       28
       28
       -
           if cfg.compression.level != null && cfg.compression.method == null

     

       29
       29
       -
           then throw "compression.method must be set when using compression.level."

     

       30
       30
       -
           else lib.optional (cfg.compression.level != null) (toString cfg.compression.level);

     

       31
       31
       -
         compressionFragment = lib.concatStringsSep "," (lib.flatten [autoFragment methodFragment levelFragment]);

     

       32
       32
       -
         compression = lib.optionalString (compressionFragment != "") "--compression ${compressionFragment}";

     

       33
       33
       -
       

     

       34
       34
       -
         encryptionFragment = cfg.encryption.method;

     

       35
       35
       -
         passphraseFile = lib.escapeShellArg cfg.encryption.passphraseFile;

     

       36
       36
       -
         passphraseFragment = lib.optionalString (cfg.encryption.method != "none")

     

       37
       37
       -
                                (if cfg.encryption.passphraseFile != null then ''env BORG_PASSPHRASE="$(cat ${passphraseFile})"''

     

       38
       38
       -
                                 else throw "passphraseFile must be set when using encryption.");

     

       39
       39
       -
       

     

       40
       40
       -
         locations = lib.escapeShellArgs cfg.locations;

     

       41
       41
       -
         name = lib.escapeShellArg cfg.name;

     

       42
       42
       -
       

     

       43
       43
       -
         repoLocation = lib.escapeShellArg cfg.repoLocation;

     

       44
       44
       -
       

     

       45
       45
       -
         extraInitArgs = lib.escapeShellArgs cfg.extraArgumentsForInit;

     

       46
       46
       -
         extraCreateArgs = lib.escapeShellArgs cfg.extraArgumentsForCreate;

     

       47
       47
       -
       

     

       48
       48
       -
         cmdPreexec = lib.optionalString (cfg.cmdPreexec != null) cfg.cmdPreexec;

     

       49
       49
       -
         cmdPostexec = lib.optionalString (cfg.cmdPostexec != null) cfg.cmdPostexec;

     

       50
       50
       -
       

     

       51
       51
       -
         borgScript = ''

     

       52
       52
       -
           export BORG_REPO=${repoLocation}

     

       53
       53
       -
           ${cmdPreexec}

     

       54
       54
       -
           ${passphraseFragment} ${pkgs.borgbackup}/bin/borg init ${extraInitArgs} --encryption ${encryptionFragment} || true

     

       55
       55
       -
           ${passphraseFragment} ${pkgs.borgbackup}/bin/borg create ${extraCreateArgs} ${compression} ::${name} ${locations}

     

       56
       56
       -
           ${cmdPostexec}

     

       57
       57
       -
         '';

     

       58
       58
       -
       in {

     

       59
       59
       -
         config = lib.mkIf (config.mailserver.enable && cfg.enable) {

     

       60
       60
       -
           environment.systemPackages = with pkgs; [

     

       61
       61
       -
             borgbackup

     

       62
       62
       -
           ];

     

       63
       63
       -
       

     

       64
       64
       -
           systemd.services.borgbackup = {

     

       65
       65
       -
             description = "borgbackup";

     

       66
       66
       -
             unitConfig.Documentation = "man:borgbackup";

     

       67
       67
       -
             script = borgScript;

     

       68
       68
       -
             serviceConfig = {

     

       69
       69
       -
               User = cfg.user;

     

       70
       70
       -
               Group = cfg.group;

     

       71
       71
       -
               CPUSchedulingPolicy = "idle";

     

       72
       72
       -
               IOSchedulingClass = "idle";

     

       73
       73
       -
               ProtectSystem = "full";

     

       74
       74
       -
             };

     

       75
       75
       -
             startAt = cfg.startAt;

     

       76
       76
       -
           };

     

       77
       77
       -
         };

     

       78
       78
       -
       }

-30

modules/mailserver/clamav.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, options, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver;

     

       21
       21
       -
       in

     

       22
       22
       -
       {

     

       23
       23
       -
         config = lib.mkIf (cfg.enable && cfg.virusScanning) {

     

       24
       24
       -
           services.clamav.daemon = {

     

       25
       25
       -
             enable = true;

     

       26
       26
       -
             settings.PhishingScanURLs = "no";

     

       27
       27
       -
           };

     

       28
       28
       -
           services.clamav.updater.enable = true;

     

       29
       29
       -
         };

     

       30
       30
       -
       }

-48

modules/mailserver/common.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver;

     

       21
       21
       -
       in

     

       22
       22
       -
       {

     

       23
       23
       -
         # cert :: PATH

     

       24
       24
       -
         certificatePath = if cfg.certificateScheme == 1

     

       25
       25
       -
                    then cfg.certificateFile

     

       26
       26
       -
                    else if cfg.certificateScheme == 2

     

       27
       27
       -
                         then "${cfg.certificateDirectory}/cert-${cfg.fqdn}.pem"

     

       28
       28
       -
                         else if cfg.certificateScheme == 3

     

       29
       29
       -
                              then "${config.security.acme.certs.${cfg.fqdn}.directory}/fullchain.pem"

     

       30
       30
       -
                              else throw "Error: Certificate Scheme must be in { 1, 2, 3 }";

     

       31
       31
       -
       

     

       32
       32
       -
         # key :: PATH

     

       33
       33
       -
         keyPath = if cfg.certificateScheme == 1

     

       34
       34
       -
               then cfg.keyFile

     

       35
       35
       -
               else if cfg.certificateScheme == 2

     

       36
       36
       -
                    then "${cfg.certificateDirectory}/key-${cfg.fqdn}.pem"

     

       37
       37
       -
                     else if cfg.certificateScheme == 3

     

       38
       38
       -
                          then "${config.security.acme.certs.${cfg.fqdn}.directory}/key.pem"

     

       39
       39
       -
                          else throw "Error: Certificate Scheme must be in { 1, 2, 3 }";

     

       40
       40
       -
       

     

       41
       41
       -
         passwordFiles = let

     

       42
       42
       -
           mkHashFile = name: hash: pkgs.writeText "${builtins.hashString "sha256" name}-password" hash;

     

       43
       43
       -
         in

     

       44
       44
       -
           lib.mapAttrs (name: value:

     

       45
       45
       -
           if value.passwordFile == null then

     

       46
       46
       -
             builtins.toString (mkHashFile name value.password)

     

       47
       47
       -
           else value.passwordFile) cfg.loginAccounts;

     

       48
       48
       -
       }

-4

modules/mailserver/debug.nix

···

       1
       1
       -
       { config, lib, ... }:

     

       2
       2
       -
       {

     

       3
       3
       -
         mailserver.policydSPFExtraConfig = lib.mkIf config.mailserver.debug "debugLevel = 4";

     

       4
       4
       -
       }

-1035

modules/mailserver/default.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, lib, pkgs, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       with lib;

     

       20
       20
       -
       

     

       21
       21
       -
       let

     

       22
       22
       -
         cfg = config.mailserver;

     

       23
       23
       -
       in

     

       24
       24
       -
       {

     

       25
       25
       -
         options.mailserver = {

     

       26
       26
       -
           enable = lib.mkEnableOption "nixos-mailserver";

     

       27
       27
       -
       

     

       28
       28
       -
           openFirewall = mkOption {

     

       29
       29
       -
             type = types.bool;

     

       30
       30
       -
             default = true;

     

       31
       31
       -
             description = "Automatically open ports in the firewall.";

     

       32
       32
       -
           };

     

       33
       33
       -
       

     

       34
       34
       -
           fqdn = mkOption {

     

       35
       35
       -
             type = types.str;

     

       36
       36
       -
             example = "mx.example.com";

     

       37
       37
       -
             description = "The fully qualified domain name of the mail server.";

     

       38
       38
       -
           };

     

       39
       39
       -
       

     

       40
       40
       -
           domains = mkOption {

     

       41
       41
       -
             type = types.listOf types.str;

     

       42
       42
       -
             example = [ "example.com" ];

     

       43
       43
       -
             default = [];

     

       44
       44
       -
             description = "The domains that this mail server serves.";

     

       45
       45
       -
           };

     

       46
       46
       -
       

     

       47
       47
       -
           certificateDomains = mkOption {

     

       48
       48
       -
             type = types.listOf types.str;

     

       49
       49
       -
             example = [ "imap.example.com" "pop3.example.com" ];

     

       50
       50
       -
             default = [];

     

       51
       51
       -
             description = "Secondary domains and subdomains for which it is necessary to generate a certificate.";

     

       52
       52
       -
           };

     

       53
       53
       -
       

     

       54
       54
       -
           messageSizeLimit = mkOption {

     

       55
       55
       -
             type = types.int;

     

       56
       56
       -
             example = 52428800;

     

       57
       57
       -
             default = 20971520;

     

       58
       58
       -
             description = "Message size limit enforced by Postfix.";

     

       59
       59
       -
           };

     

       60
       60
       -
       

     

       61
       61
       -
           loginAccounts = mkOption {

     

       62
       62
       -
             type = types.attrsOf (types.submodule ({ name, ... }: {

     

       63
       63
       -
               options = {

     

       64
       64
       -
                 name = mkOption {

     

       65
       65
       -
                   type = types.str;

     

       66
       66
       -
                   example = "user1@example.com";

     

       67
       67
       -
                   description = "Username";

     

       68
       68
       -
                 };

     

       69
       69
       -
       

     

       70
       70
       -
                 password = mkOption {

     

       71
       71
       -
                   type = with types; nullOr str;

     

       72
       72
       -
                   default = null;

     

       73
       73
       -
                   example = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";

     

       74
       74
       -
                   description = ''

     

       75
       75
       -
                     The password.

     

       76
       76
       -
       

     

       77
       77
       -
                     Warning: this is stored in plaintext in the Nix store!

     

       78
       78
       -
                     Use `passwordFile` instead.

     

       79
       79
       -
                   '';

     

       80
       80
       -
                 };

     

       81
       81
       -
       

     

       82
       82
       -
                 passwordFile = mkOption {

     

       83
       83
       -
                   type = with types; nullOr path;

     

       84
       84
       -
                   default = null;

     

       85
       85
       -
                   example = "/run/keys/user1-passwordhash";

     

       86
       86
       -
                   description = ''

     

       87
       87
       -
                     A file containing the user's password.

     

       88
       88
       -
                   '';

     

       89
       89
       -
                 };

     

       90
       90
       -
       

     

       91
       91
       -
                 aliases = mkOption {

     

       92
       92
       -
                   type = with types; listOf types.str;

     

       93
       93
       -
                   example = ["abuse@example.com" "postmaster@example.com"];

     

       94
       94
       -
                   default = [];

     

       95
       95
       -
                   description = ''

     

       96
       96
       -
                     A list of aliases of this login account.

     

       97
       97
       -
                     Note: Use list entries like "@example.com" to create a catchAll

     

       98
       98
       -
                     that allows sending from all email addresses in these domain.

     

       99
       99
       -
                   '';

     

       100
       100
       -
                 };

     

       101
       101
       -
       

     

       102
       102
       -
                 catchAll = mkOption {

     

       103
       103
       -
                   type = with types; listOf (enum cfg.domains);

     

       104
       104
       -
                   example = ["example.com" "example2.com"];

     

       105
       105
       -
                   default = [];

     

       106
       106
       -
                   description = ''

     

       107
       107
       -
                     For which domains should this account act as a catch all?

     

       108
       108
       -
                     Note: Does not allow sending from all addresses of these domains.

     

       109
       109
       -
                   '';

     

       110
       110
       -
                 };

     

       111
       111
       -
       

     

       112
       112
       -
                 quota = mkOption {

     

       113
       113
       -
                   type = with types; nullOr types.str;

     

       114
       114
       -
                   default = null;

     

       115
       115
       -
                   example = "2G";

     

       116
       116
       -
                   description = ''

     

       117
       117
       -
                     Per user quota rules. Accepted sizes are `xx k/M/G/T` with the

     

       118
       118
       -
                     obvious meaning. Leave blank for the standard quota `100G`.

     

       119
       119
       -
                   '';

     

       120
       120
       -
                 };

     

       121
       121
       -
       

     

       122
       122
       -
                 sieveScript = mkOption {

     

       123
       123
       -
                   type = with types; nullOr lines;

     

       124
       124
       -
                   default = null;

     

       125
       125
       -
                   example = ''

     

       126
       126
       -
                     require ["fileinto", "mailbox"];

     

       127
       127
       -
       

     

       128
       128
       -
                     if address :is "from" "gitlab@mg.gitlab.com" {

     

       129
       129
       -
                       fileinto :create "GitLab";

     

       130
       130
       -
                       stop;

     

       131
       131
       -
                     }

     

       132
       132
       -
       

     

       133
       133
       -
                     # This must be the last rule, it will check if list-id is set, and

     

       134
       134
       -
                     # file the message into the Lists folder for further investigation

     

       135
       135
       -
                     elsif header :matches "list-id" "<?*>" {

     

       136
       136
       -
                       fileinto :create "Lists";

     

       137
       137
       -
                       stop;

     

       138
       138
       -
                     }

     

       139
       139
       -
                   '';

     

       140
       140
       -
                   description = ''

     

       141
       141
       -
                     Per-user sieve script.

     

       142
       142
       -
                   '';

     

       143
       143
       -
                 };

     

       144
       144
       -
       

     

       145
       145
       -
                 sendOnly = mkOption {

     

       146
       146
       -
                   type = types.bool;

     

       147
       147
       -
                   default = false;

     

       148
       148
       -
                   description = ''

     

       149
       149
       -
                     Specifies if the account should be a send-only account.

     

       150
       150
       -
                     Emails sent to send-only accounts will be rejected from

     

       151
       151
       -
                     unauthorized senders with the sendOnlyRejectMessage

     

       152
       152
       -
                     stating the reason.

     

       153
       153
       -
                   '';

     

       154
       154
       -
                 };

     

       155
       155
       -
       

     

       156
       156
       -
                 sendOnlyRejectMessage = mkOption {

     

       157
       157
       -
                   type = types.str;

     

       158
       158
       -
                   default = "This account cannot receive emails.";

     

       159
       159
       -
                   description = ''

     

       160
       160
       -
                     The message that will be returned to the sender when an email is

     

       161
       161
       -
                     sent to a send-only account. Only used if the account is marked

     

       162
       162
       -
                     as send-only.

     

       163
       163
       -
                   '';

     

       164
       164
       -
                 };

     

       165
       165
       -
               };

     

       166
       166
       -
       

     

       167
       167
       -
               config.name = mkDefault name;

     

       168
       168
       -
             }));

     

       169
       169
       -
             example = {

     

       170
       170
       -
               user1 = {

     

       171
       171
       -
                 password = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";

     

       172
       172
       -
               };

     

       173
       173
       -
               user2 = {

     

       174
       174
       -
                 password = "$6$oE0ZNv2n7Vk9gOf$9xcZWCCLGdMflIfuA0vR1Q1Xblw6RZqPrP94mEit2/81/7AKj2bqUai5yPyWE.QYPyv6wLMHZvjw3Rlg7yTCD/";

     

       175
       175
       -
               };

     

       176
       176
       -
             };

     

       177
       177
       -
             description = ''

     

       178
       178
       -
               The login account of the domain. Every account is mapped to a unix user,

     

       179
       179
       -
               e.g. `user1@example.com`. To generate the passwords use `htpasswd` as

     

       180
       180
       -
               follows

     

       181
       181
       -
       

     

       182
       182
       -
               ```

     

       183
       183
       -
               nix run nixpkgs.apacheHttpd -c htpasswd -nbB "" "super secret password" | cut -d: -f2

     

       184
       184
       -
               ```

     

       185
       185
       -
             '';

     

       186
       186
       -
             default = {};

     

       187
       187
       -
           };

     

       188
       188
       -
       

     

       189
       189
       -
           indexDir = mkOption {

     

       190
       190
       -
             type = types.nullOr types.str;

     

       191
       191
       -
             default = null;

     

       192
       192
       -
             description = ''

     

       193
       193
       -
               Folder to store search indices. If null, indices are stored

     

       194
       194
       -
               along with email, which could not necessarily be desirable,

     

       195
       195
       -
               especially when the fullTextSearch option is enable since

     

       196
       196
       -
               indices it creates are voluminous and do not need to be backed

     

       197
       197
       -
               up.

     

       198
       198
       -
       

     

       199
       199
       -
               Be careful when changing this option value since all indices

     

       200
       200
       -
               would be recreated at the new location (and clients would need

     

       201
       201
       -
               to resynchronize).

     

       202
       202
       -
       

     

       203
       203
       -
               Note the some variables can be used in the file path. See

     

       204
       204
       -
               https://doc.dovecot.org/configuration_manual/mail_location/#variables

     

       205
       205
       -
               for details.

     

       206
       206
       -
             '';

     

       207
       207
       -
             example = "/var/lib/dovecot/indices";

     

       208
       208
       -
           };

     

       209
       209
       -
       

     

       210
       210
       -
           fullTextSearch = {

     

       211
       211
       -
             enable = lib.mkEnableOption "Full text search indexing with xapian. This has significant performance and disk space cost.";

     

       212
       212
       -
             autoIndex = mkOption {

     

       213
       213
       -
               type = types.bool;

     

       214
       214
       -
               default = true;

     

       215
       215
       -
               description = "Enable automatic indexing of messages as they are received or modified.";

     

       216
       216
       -
             };

     

       217
       217
       -
             autoIndexExclude = mkOption {

     

       218
       218
       -
               type = types.listOf types.str;

     

       219
       219
       -
               default = [ ];

     

       220
       220
       -
               example = [ "\\Trash" "SomeFolder" "Other/*" ];

     

       221
       221
       -
               description = ''

     

       222
       222
       -
                 Mailboxes to exclude from automatic indexing.

     

       223
       223
       -
               '';

     

       224
       224
       -
             };

     

       225
       225
       -
       

     

       226
       226
       -
             indexAttachments = mkOption {

     

       227
       227
       -
               type = types.bool;

     

       228
       228
       -
               default = false;

     

       229
       229
       -
               description = "Also index text-only attachements. Binary attachements are never indexed.";

     

       230
       230
       -
             };

     

       231
       231
       -
       

     

       232
       232
       -
             enforced = mkOption {

     

       233
       233
       -
               type = types.enum [ "yes" "no" "body" ];

     

       234
       234
       -
               default = "no";

     

       235
       235
       -
               description = ''

     

       236
       236
       -
                 Fail searches when no index is available. If set to

     

       237
       237
       -
                 <literal>body</literal>, then only body searches (as opposed to

     

       238
       238
       -
                 header) are affected. If set to <literal>no</literal>, searches may

     

       239
       239
       -
                 fall back to a very slow brute force search.

     

       240
       240
       -
               '';

     

       241
       241
       -
             };

     

       242
       242
       -
       

     

       243
       243
       -
             minSize = mkOption {

     

       244
       244
       -
               type = types.int;

     

       245
       245
       -
               default = 2;

     

       246
       246
       -
               description = "Size of the smallest n-gram to index.";

     

       247
       247
       -
             };

     

       248
       248
       -
             maxSize = mkOption {

     

       249
       249
       -
               type = types.int;

     

       250
       250
       -
               default = 20;

     

       251
       251
       -
               description = "Size of the largest n-gram to index.";

     

       252
       252
       -
             };

     

       253
       253
       -
             memoryLimit = mkOption {

     

       254
       254
       -
               type = types.nullOr types.int;

     

       255
       255
       -
               default = null;

     

       256
       256
       -
               example = 2000;

     

       257
       257
       -
               description = "Memory limit for the indexer process, in MiB. If null, leaves the default (which is rather low), and if 0, no limit.";

     

       258
       258
       -
             };

     

       259
       259
       -
       

     

       260
       260
       -
             maintenance = {

     

       261
       261
       -
               enable = mkOption {

     

       262
       262
       -
                 type = types.bool;

     

       263
       263
       -
                 default = true;

     

       264
       264
       -
                 description = "Regularly optmize indices, as recommended by upstream.";

     

       265
       265
       -
               };

     

       266
       266
       -
       

     

       267
       267
       -
               onCalendar = mkOption {

     

       268
       268
       -
                 type = types.str;

     

       269
       269
       -
                 default = "daily";

     

       270
       270
       -
                 description = "When to run the maintenance job. See systemd.time(7) for more information about the format.";

     

       271
       271
       -
               };

     

       272
       272
       -
       

     

       273
       273
       -
               randomizedDelaySec = mkOption {

     

       274
       274
       -
                 type = types.int;

     

       275
       275
       -
                 default = 1000;

     

       276
       276
       -
                 description = "Run the maintenance job not exactly at the time specified with <literal>onCalendar</literal>, but plus or minus this many seconds.";

     

       277
       277
       -
               };

     

       278
       278
       -
             };

     

       279
       279
       -
           };

     

       280
       280
       -
       

     

       281
       281
       -
           lmtpSaveToDetailMailbox = mkOption {

     

       282
       282
       -
             type = types.enum ["yes" "no"];

     

       283
       283
       -
             default = "yes";

     

       284
       284
       -
             description = ''

     

       285
       285
       -
               If an email address is delimited by a "+", should it be filed into a

     

       286
       286
       -
               mailbox matching the string after the "+"?  For example,

     

       287
       287
       -
               user1+test@example.com would be filed into the mailbox "test".

     

       288
       288
       -
             '';

     

       289
       289
       -
           };

     

       290
       290
       -
       

     

       291
       291
       -
           extraVirtualAliases = mkOption {

     

       292
       292
       -
             type = let

     

       293
       293
       -
               loginAccount = mkOptionType {

     

       294
       294
       -
                 name = "Login Account";

     

       295
       295
       -
                 check = (account: builtins.elem account (builtins.attrNames cfg.loginAccounts));

     

       296
       296
       -
               };

     

       297
       297
       -
             in with types; attrsOf (either loginAccount (nonEmptyListOf loginAccount));

     

       298
       298
       -
             example = {

     

       299
       299
       -
               "info@example.com" = "user1@example.com";

     

       300
       300
       -
               "postmaster@example.com" = "user1@example.com";

     

       301
       301
       -
               "abuse@example.com" = "user1@example.com";

     

       302
       302
       -
               "multi@example.com" = [ "user1@example.com" "user2@example.com" ];

     

       303
       303
       -
             };

     

       304
       304
       -
             description = ''

     

       305
       305
       -
               Virtual Aliases. A virtual alias `"info@example.com" = "user1@example.com"` means that

     

       306
       306
       -
               all mail to `info@example.com` is forwarded to `user1@example.com`. Note

     

       307
       307
       -
               that it is expected that `postmaster@example.com` and `abuse@example.com` is

     

       308
       308
       -
               forwarded to some valid email address. (Alternatively you can create login

     

       309
       309
       -
               accounts for `postmaster` and (or) `abuse`). Furthermore, it also allows

     

       310
       310
       -
               the user `user1@example.com` to send emails as `info@example.com`.

     

       311
       311
       -
               It's also possible to create an alias for multiple accounts. In this

     

       312
       312
       -
               example all mails for `multi@example.com` will be forwarded to both

     

       313
       313
       -
               `user1@example.com` and `user2@example.com`.

     

       314
       314
       -
             '';

     

       315
       315
       -
             default = {};

     

       316
       316
       -
           };

     

       317
       317
       -
       

     

       318
       318
       -
           forwards = mkOption {

     

       319
       319
       -
             type = with types; attrsOf (either (listOf str) str);

     

       320
       320
       -
             example = {

     

       321
       321
       -
               "user@example.com" = "user@elsewhere.com";

     

       322
       322
       -
             };

     

       323
       323
       -
             description = ''

     

       324
       324
       -
               To forward mails to an external address. For instance,

     

       325
       325
       -
               the value {`"user@example.com" = "user@elsewhere.com";}`

     

       326
       326
       -
               means that mails to `user@example.com` are forwarded to

     

       327
       327
       -
               `user@elsewhere.com`. The difference with the

     

       328
       328
       -
               `extraVirtualAliases` option is that `user@elsewhere.com`

     

       329
       329
       -
               can't send mail as `user@example.com`. Also, this option

     

       330
       330
       -
               allows to forward mails to external addresses.

     

       331
       331
       -
             '';

     

       332
       332
       -
             default = {};

     

       333
       333
       -
           };

     

       334
       334
       -
       

     

       335
       335
       -
           rejectSender = mkOption {

     

       336
       336
       -
             type = types.listOf types.str;

     

       337
       337
       -
             example = [ "@example.com" "spammer@example.net" ];

     

       338
       338
       -
             description = ''

     

       339
       339
       -
               Reject emails from these addresses from unauthorized senders.

     

       340
       340
       -
               Use if a spammer is using the same domain or the same sender over and over.

     

       341
       341
       -
             '';

     

       342
       342
       -
             default = [];

     

       343
       343
       -
           };

     

       344
       344
       -
       

     

       345
       345
       -
           rejectRecipients = mkOption {

     

       346
       346
       -
             type = types.listOf types.str;

     

       347
       347
       -
             example = [ "sales@example.com" "info@example.com" ];

     

       348
       348
       -
             description = ''

     

       349
       349
       -
               Reject emails addressed to these local addresses from unauthorized senders.

     

       350
       350
       -
               Use if a spammer has found email addresses in a catchall domain but you do

     

       351
       351
       -
               not want to disable the catchall.

     

       352
       352
       -
             '';

     

       353
       353
       -
             default = [];

     

       354
       354
       -
           };

     

       355
       355
       -
       

     

       356
       356
       -
           vmailUID = mkOption {

     

       357
       357
       -
             type = types.int;

     

       358
       358
       -
             default = 5000;

     

       359
       359
       -
             description = ''

     

       360
       360
       -
               The unix UID of the virtual mail user.  Be mindful that if this is

     

       361
       361
       -
               changed, you will need to manually adjust the permissions of

     

       362
       362
       -
               mailDirectory.

     

       363
       363
       -
             '';

     

       364
       364
       -
           };

     

       365
       365
       -
       

     

       366
       366
       -
           vmailUserName = mkOption {

     

       367
       367
       -
             type = types.str;

     

       368
       368
       -
             default = "virtualMail";

     

       369
       369
       -
             description = ''

     

       370
       370
       -
               The user name and group name of the user that owns the directory where all

     

       371
       371
       -
               the mail is stored.

     

       372
       372
       -
             '';

     

       373
       373
       -
           };

     

       374
       374
       -
       

     

       375
       375
       -
           vmailGroupName = mkOption {

     

       376
       376
       -
             type = types.str;

     

       377
       377
       -
             default = "virtualMail";

     

       378
       378
       -
             description = ''

     

       379
       379
       -
               The user name and group name of the user that owns the directory where all

     

       380
       380
       -
               the mail is stored.

     

       381
       381
       -
             '';

     

       382
       382
       -
           };

     

       383
       383
       -
       

     

       384
       384
       -
           mailDirectory = mkOption {

     

       385
       385
       -
             type = types.path;

     

       386
       386
       -
             default = "/var/vmail";

     

       387
       387
       -
             description = ''

     

       388
       388
       -
               Where to store the mail.

     

       389
       389
       -
             '';

     

       390
       390
       -
           };

     

       391
       391
       -
       

     

       392
       392
       -
           useFsLayout = mkOption {

     

       393
       393
       -
             type = types.bool;

     

       394
       394
       -
             default = false;

     

       395
       395
       -
             description = ''

     

       396
       396
       -
               Sets whether dovecot should organize mail in subdirectories:

     

       397
       397
       -
       

     

       398
       398
       -
               - /var/vmail/example.com/user/.folder.subfolder/ (default layout)

     

       399
       399
       -
               - /var/vmail/example.com/user/folder/subfolder/  (FS layout)

     

       400
       400
       -
       

     

       401
       401
       -
               See https://wiki2.dovecot.org/MailboxFormat/Maildir for details.

     

       402
       402
       -
             '';

     

       403
       403
       -
           };

     

       404
       404
       -
       

     

       405
       405
       -
           hierarchySeparator = mkOption {

     

       406
       406
       -
             type = types.str;

     

       407
       407
       -
             default = ".";

     

       408
       408
       -
             description = ''

     

       409
       409
       -
               The hierarchy separator for mailboxes used by dovecot for the namespace 'inbox'.

     

       410
       410
       -
               Dovecot defaults to "." but recommends "/".

     

       411
       411
       -
               This affects how mailboxes appear to mail clients and sieve scripts.

     

       412
       412
       -
               For instance when using "." then in a sieve script "example.com" would refer to the mailbox "com" in the parent mailbox "example".

     

       413
       413
       -
               This does not determine the way your mails are stored on disk.

     

       414
       414
       -
               See https://wiki.dovecot.org/Namespaces for details.

     

       415
       415
       -
             '';

     

       416
       416
       -
           };

     

       417
       417
       -
       

     

       418
       418
       -
           mailboxes = mkOption {

     

       419
       419
       -
             description = ''

     

       420
       420
       -
               The mailboxes for dovecot.

     

       421
       421
       -
               Depending on the mail client used it might be necessary to change some mailbox's name.

     

       422
       422
       -
             '';

     

       423
       423
       -
             default = {

     

       424
       424
       -
               Trash = {

     

       425
       425
       -
                 auto = "no";

     

       426
       426
       -
                 specialUse = "Trash";

     

       427
       427
       -
               };

     

       428
       428
       -
               Junk = {

     

       429
       429
       -
                 auto = "subscribe";

     

       430
       430
       -
                 specialUse = "Junk";

     

       431
       431
       -
               };

     

       432
       432
       -
               Drafts = {

     

       433
       433
       -
                 auto = "subscribe";

     

       434
       434
       -
                 specialUse = "Drafts";

     

       435
       435
       -
               };

     

       436
       436
       -
               Sent = {

     

       437
       437
       -
                 auto = "subscribe";

     

       438
       438
       -
                 specialUse = "Sent";

     

       439
       439
       -
               };

     

       440
       440
       -
             };

     

       441
       441
       -
           };

     

       442
       442
       -
       

     

       443
       443
       -
           certificateScheme = mkOption {

     

       444
       444
       -
             type = types.enum [ 1 2 3 ];

     

       445
       445
       -
             default = 2;

     

       446
       446
       -
             description = ''

     

       447
       447
       -
               Certificate Files. There are three options for these.

     

       448
       448
       -
       

     

       449
       449
       -
               1) You specify locations and manually copy certificates there.

     

       450
       450
       -
               2) You let the server create new (self signed) certificates on the fly.

     

       451
       451
       -
               3) You let the server create a certificate via `Let's Encrypt`. Note that

     

       452
       452
       -
                  this implies that a stripped down webserver has to be started. This also

     

       453
       453
       -
                  implies that the FQDN must be set as an `A` record to point to the IP of

     

       454
       454
       -
                  the server. In particular port 80 on the server will be opened. For details

     

       455
       455
       -
                  on how to set up the domain records, see the guide in the readme.

     

       456
       456
       -
             '';

     

       457
       457
       -
           };

     

       458
       458
       -
       

     

       459
       459
       -
           certificateFile = mkOption {

     

       460
       460
       -
             type = types.path;

     

       461
       461
       -
             example = "/root/mail-server.crt";

     

       462
       462
       -
             description = ''

     

       463
       463
       -
               Scheme 1)

     

       464
       464
       -
               Location of the certificate

     

       465
       465
       -
             '';

     

       466
       466
       -
           };

     

       467
       467
       -
       

     

       468
       468
       -
           keyFile = mkOption {

     

       469
       469
       -
             type = types.path;

     

       470
       470
       -
             example = "/root/mail-server.key";

     

       471
       471
       -
             description = ''

     

       472
       472
       -
               Scheme 1)

     

       473
       473
       -
               Location of the key file

     

       474
       474
       -
             '';

     

       475
       475
       -
           };

     

       476
       476
       -
       

     

       477
       477
       -
           certificateDirectory = mkOption {

     

       478
       478
       -
             type = types.path;

     

       479
       479
       -
             default = "/var/certs";

     

       480
       480
       -
             description = ''

     

       481
       481
       -
               Scheme 2)

     

       482
       482
       -
               This is the folder where the certificate will be created. The name is

     

       483
       483
       -
               hardcoded to "cert-DOMAIN.pem" and "key-DOMAIN.pem" and the

     

       484
       484
       -
               certificate is valid for 10 years.

     

       485
       485
       -
             '';

     

       486
       486
       -
           };

     

       487
       487
       -
       

     

       488
       488
       -
           enableImap = mkOption {

     

       489
       489
       -
             type = types.bool;

     

       490
       490
       -
             default = true;

     

       491
       491
       -
             description = ''

     

       492
       492
       -
               Whether to enable IMAP with STARTTLS on port 143.

     

       493
       493
       -
             '';

     

       494
       494
       -
           };

     

       495
       495
       -
       

     

       496
       496
       -
           enableImapSsl = mkOption {

     

       497
       497
       -
             type = types.bool;

     

       498
       498
       -
             default = true;

     

       499
       499
       -
             description = ''

     

       500
       500
       -
               Whether to enable IMAP with TLS in wrapper-mode on port 993.

     

       501
       501
       -
             '';

     

       502
       502
       -
           };

     

       503
       503
       -
       

     

       504
       504
       -
           enableSubmission = mkOption {

     

       505
       505
       -
             type = types.bool;

     

       506
       506
       -
             default = true;

     

       507
       507
       -
             description = ''

     

       508
       508
       -
               Whether to enable SMTP with STARTTLS on port 587.

     

       509
       509
       -
             '';

     

       510
       510
       -
           };

     

       511
       511
       -
       

     

       512
       512
       -
           enableSubmissionSsl = mkOption {

     

       513
       513
       -
             type = types.bool;

     

       514
       514
       -
             default = true;

     

       515
       515
       -
             description = ''

     

       516
       516
       -
               Whether to enable SMTP with TLS in wrapper-mode on port 465.

     

       517
       517
       -
             '';

     

       518
       518
       -
           };

     

       519
       519
       -
       

     

       520
       520
       -
           enablePop3 = mkOption {

     

       521
       521
       -
             type = types.bool;

     

       522
       522
       -
             default = false;

     

       523
       523
       -
             description = ''

     

       524
       524
       -
               Whether to enable POP3 with STARTTLS on port on port 110.

     

       525
       525
       -
             '';

     

       526
       526
       -
           };

     

       527
       527
       -
       

     

       528
       528
       -
           enablePop3Ssl = mkOption {

     

       529
       529
       -
             type = types.bool;

     

       530
       530
       -
             default = false;

     

       531
       531
       -
             description = ''

     

       532
       532
       -
               Whether to enable POP3 with TLS in wrapper-mode on port 995.

     

       533
       533
       -
             '';

     

       534
       534
       -
           };

     

       535
       535
       -
       

     

       536
       536
       -
           enableManageSieve = mkOption {

     

       537
       537
       -
             type = types.bool;

     

       538
       538
       -
             default = false;

     

       539
       539
       -
             description = ''

     

       540
       540
       -
               Whether to enable ManageSieve, setting this option to true will open

     

       541
       541
       -
               port 4190 in the firewall.

     

       542
       542
       -
       

     

       543
       543
       -
               The ManageSieve protocol allows users to manage their Sieve scripts on

     

       544
       544
       -
               a remote server with a supported client, including Thunderbird.

     

       545
       545
       -
             '';

     

       546
       546
       -
           };

     

       547
       547
       -
       

     

       548
       548
       -
           sieveDirectory = mkOption {

     

       549
       549
       -
             type = types.path;

     

       550
       550
       -
             default = "/var/sieve";

     

       551
       551
       -
             description = ''

     

       552
       552
       -
               Where to store the sieve scripts.

     

       553
       553
       -
             '';

     

       554
       554
       -
           };

     

       555
       555
       -
       

     

       556
       556
       -
           virusScanning = mkOption {

     

       557
       557
       -
             type = types.bool;

     

       558
       558
       -
             default = false;

     

       559
       559
       -
             description = ''

     

       560
       560
       -
               Whether to activate virus scanning. Note that virus scanning is _very_

     

       561
       561
       -
               expensive memory wise.

     

       562
       562
       -
             '';

     

       563
       563
       -
           };

     

       564
       564
       -
       

     

       565
       565
       -
           dkimSigning = mkOption {

     

       566
       566
       -
             type = types.bool;

     

       567
       567
       -
             default = true;

     

       568
       568
       -
             description = ''

     

       569
       569
       -
               Whether to activate dkim signing.

     

       570
       570
       -
             '';

     

       571
       571
       -
           };

     

       572
       572
       -
       

     

       573
       573
       -
           dkimSelector = mkOption {

     

       574
       574
       -
             type = types.str;

     

       575
       575
       -
             default = "mail";

     

       576
       576
       -
             description = ''

     

       577
       577
       -
       

     

       578
       578
       -
             '';

     

       579
       579
       -
           };

     

       580
       580
       -
       

     

       581
       581
       -
           dkimKeyDirectory = mkOption {

     

       582
       582
       -
             type = types.path;

     

       583
       583
       -
             default = "/var/dkim";

     

       584
       584
       -
             description = ''

     

       585
       585
       -
       

     

       586
       586
       -
             '';

     

       587
       587
       -
           };

     

       588
       588
       -
       

     

       589
       589
       -
           dkimKeyBits = mkOption {

     

       590
       590
       -
               type = types.int;

     

       591
       591
       -
               default = 1024;

     

       592
       592
       -
               description = ''

     

       593
       593
       -
                   How many bits in generated DKIM keys. RFC6376 advises minimum 1024-bit keys.

     

       594
       594
       -
       

     

       595
       595
       -
                   If you have already deployed a key with a different number of bits than specified

     

       596
       596
       -
                   here, then you should use a different selector (dkimSelector). In order to get

     

       597
       597
       -
                   this package to generate a key with the new number of bits, you will either have to

     

       598
       598
       -
                   change the selector or delete the old key file.

     

       599
       599
       -
               '';

     

       600
       600
       -
           };

     

       601
       601
       -
       

     

       602
       602
       -
           dkimHeaderCanonicalization = mkOption {

     

       603
       603
       -
               type = types.enum ["relaxed" "simple"];

     

       604
       604
       -
               default = "relaxed";

     

       605
       605
       -
               description = ''

     

       606
       606
       -
                 DKIM canonicalization algorithm for message headers.

     

       607
       607
       -
       

     

       608
       608
       -
                 See https://datatracker.ietf.org/doc/html/rfc6376/#section-3.4 for details.

     

       609
       609
       -
               '';

     

       610
       610
       -
           };

     

       611
       611
       -
       

     

       612
       612
       -
           dkimBodyCanonicalization = mkOption {

     

       613
       613
       -
               type = types.enum ["relaxed" "simple"];

     

       614
       614
       -
               default = "relaxed";

     

       615
       615
       -
               description = ''

     

       616
       616
       -
                 DKIM canonicalization algorithm for message bodies.

     

       617
       617
       -
       

     

       618
       618
       -
                 See https://datatracker.ietf.org/doc/html/rfc6376/#section-3.4 for details.

     

       619
       619
       -
               '';

     

       620
       620
       -
           };

     

       621
       621
       -
       

     

       622
       622
       -
           debug = mkOption {

     

       623
       623
       -
             type = types.bool;

     

       624
       624
       -
             default = false;

     

       625
       625
       -
             description = ''

     

       626
       626
       -
               Whether to enable verbose logging for mailserver related services. This

     

       627
       627
       -
               intended be used for development purposes only, you probably don't want

     

       628
       628
       -
               to enable this unless you're hacking on nixos-mailserver.

     

       629
       629
       -
             '';

     

       630
       630
       -
           };

     

       631
       631
       -
       

     

       632
       632
       -
           maxConnectionsPerUser = mkOption {

     

       633
       633
       -
             type = types.int;

     

       634
       634
       -
             default = 100;

     

       635
       635
       -
             description = ''

     

       636
       636
       -
               Maximum number of IMAP/POP3 connections allowed for a user from each IP address.

     

       637
       637
       -
               E.g. a value of 50 allows for 50 IMAP and 50 POP3 connections at the same

     

       638
       638
       -
               time for a single user.

     

       639
       639
       -
             '';

     

       640
       640
       -
           };

     

       641
       641
       -
       

     

       642
       642
       -
           localDnsResolver = mkOption {

     

       643
       643
       -
             type = types.bool;

     

       644
       644
       -
             default = true;

     

       645
       645
       -
             description = ''

     

       646
       646
       -
               Runs a local DNS resolver (kresd) as recommended when running rspamd. This prevents your log file from filling up with rspamd_monitored_dns_mon entries.

     

       647
       647
       -
             '';

     

       648
       648
       -
           };

     

       649
       649
       -
       

     

       650
       650
       -
           recipientDelimiter = mkOption {

     

       651
       651
       -
             type = types.str;

     

       652
       652
       -
             default = "+";

     

       653
       653
       -
             description = ''

     

       654
       654
       -
               Configure the recipient delimiter.

     

       655
       655
       -
             '';

     

       656
       656
       -
           };

     

       657
       657
       -
       

     

       658
       658
       -
           redis = {

     

       659
       659
       -
             address = mkOption {

     

       660
       660
       -
               type = types.str;

     

       661
       661
       -
               # read the default from nixos' redis module

     

       662
       662
       -
               default = let

     

       663
       663
       -
                 cf = config.services.redis.servers.rspamd.bind;

     

       664
       664
       -
                 cfdefault = if cf == null then "127.0.0.1" else cf;

     

       665
       665
       -
                 ips = lib.strings.splitString " " cfdefault;

     

       666
       666
       -
                 ip = lib.lists.head (ips ++ [ "127.0.0.1" ]);

     

       667
       667
       -
                 isIpv6 = ip: lib.lists.elem ":" (lib.stringToCharacters ip);

     

       668
       668
       -
               in

     

       669
       669
       -
               if (ip == "0.0.0.0" || ip == "::")

     

       670
       670
       -
               then "127.0.0.1"

     

       671
       671
       -
               else if isIpv6 ip then "[${ip}]" else ip;

     

       672
       672
       -
               defaultText = lib.literalMD "computed from <option>config.services.redis.servers.rspamd.bind</option>";

     

       673
       673
       -
               description = ''

     

       674
       674
       -
                 Address that rspamd should use to contact redis.

     

       675
       675
       -
               '';

     

       676
       676
       -
             };

     

       677
       677
       -
       

     

       678
       678
       -
             port = mkOption {

     

       679
       679
       -
               type = types.port;

     

       680
       680
       -
               default = config.services.redis.servers.rspamd.port;

     

       681
       681
       -
               defaultText = lib.literalExpression "config.services.redis.servers.rspamd.port";

     

       682
       682
       -
               description = ''

     

       683
       683
       -
                 Port that rspamd should use to contact redis.

     

       684
       684
       -
               '';

     

       685
       685
       -
             };

     

       686
       686
       -
       

     

       687
       687
       -
             password = mkOption {

     

       688
       688
       -
               type = types.nullOr types.str;

     

       689
       689
       -
               default = config.services.redis.servers.rspamd.requirePass;

     

       690
       690
       -
               defaultText = lib.literalExpression "config.services.redis.servers.rspamd.requirePass";

     

       691
       691
       -
               description = ''

     

       692
       692
       -
                 Password that rspamd should use to contact redis, or null if not required.

     

       693
       693
       -
               '';

     

       694
       694
       -
             };

     

       695
       695
       -
           };

     

       696
       696
       -
       

     

       697
       697
       -
           rewriteMessageId = mkOption {

     

       698
       698
       -
             type = types.bool;

     

       699
       699
       -
             default = false;

     

       700
       700
       -
             description = ''

     

       701
       701
       -
               Rewrites the Message-ID's hostname-part of outgoing emails to the FQDN.

     

       702
       702
       -
               Please be aware that this may cause problems with some mail clients

     

       703
       703
       -
               relying on the original Message-ID.

     

       704
       704
       -
             '';

     

       705
       705
       -
           };

     

       706
       706
       -
       

     

       707
       707
       -
           sendingFqdn = mkOption {

     

       708
       708
       -
             type = types.str;

     

       709
       709
       -
             default = cfg.fqdn;

     

       710
       710
       -
             defaultText = "config.mailserver.fqdn";

     

       711
       711
       -
             example = "myserver.example.com";

     

       712
       712
       -
             description = ''

     

       713
       713
       -
               The fully qualified domain name of the mail server used to

     

       714
       714
       -
               identify with remote servers.

     

       715
       715
       -
       

     

       716
       716
       -
               If this server's IP serves purposes other than a mail server,

     

       717
       717
       -
               it may be desirable for the server to have a name other than

     

       718
       718
       -
               that to which the user will connect.  For example, the user

     

       719
       719
       -
               might connect to mx.example.com, but the server's IP has

     

       720
       720
       -
               reverse DNS that resolves to myserver.example.com; in this

     

       721
       721
       -
               scenario, some mail servers may reject or penalize the

     

       722
       722
       -
               message.

     

       723
       723
       -
       

     

       724
       724
       -
               This setting allows the server to identify as

     

       725
       725
       -
               myserver.example.com when forwarding mail, independently of

     

       726
       726
       -
               `fqdn` (which, for SSL reasons, should generally be the name

     

       727
       727
       -
               to which the user connects).

     

       728
       728
       -
       

     

       729
       729
       -
               Set this to the name to which the sending IP's reverse DNS

     

       730
       730
       -
               resolves.

     

       731
       731
       -
             '';

     

       732
       732
       -
           };

     

       733
       733
       -
       

     

       734
       734
       -
           policydSPFExtraConfig = mkOption {

     

       735
       735
       -
             type = types.lines;

     

       736
       736
       -
             default = "";

     

       737
       737
       -
             example = ''

     

       738
       738
       -
               skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1

     

       739
       739
       -
             '';

     

       740
       740
       -
             description = ''

     

       741
       741
       -
               Extra configuration options for policyd-spf. This can be use to among

     

       742
       742
       -
               other things skip spf checking for some IP addresses.

     

       743
       743
       -
             '';

     

       744
       744
       -
           };

     

       745
       745
       -
       

     

       746
       746
       -
           monitoring = {

     

       747
       747
       -
             enable = lib.mkEnableOption "monitoring via monit";

     

       748
       748
       -
       

     

       749
       749
       -
             alertAddress = mkOption {

     

       750
       750
       -
               type = types.str;

     

       751
       751
       -
               description = ''

     

       752
       752
       -
                 The email address to send alerts to.

     

       753
       753
       -
               '';

     

       754
       754
       -
             };

     

       755
       755
       -
       

     

       756
       756
       -
             config = mkOption {

     

       757
       757
       -
               type = types.str;

     

       758
       758
       -
               default = ''

     

       759
       759
       -
                 set daemon 120 with start delay 60

     

       760
       760
       -
                 set mailserver

     

       761
       761
       -
                     localhost

     

       762
       762
       -
       

     

       763
       763
       -
                 set httpd port 2812 and use address localhost

     

       764
       764
       -
                     allow localhost

     

       765
       765
       -
                     allow admin:obwjoawijerfoijsiwfj29jf2f2jd

     

       766
       766
       -
       

     

       767
       767
       -
                 check filesystem root with path /

     

       768
       768
       -
                       if space usage > 80% then alert

     

       769
       769
       -
                       if inode usage > 80% then alert

     

       770
       770
       -
       

     

       771
       771
       -
                 check system $HOST

     

       772
       772
       -
                       if cpu usage > 95% for 10 cycles then alert

     

       773
       773
       -
                       if memory usage > 75% for 5 cycles then alert

     

       774
       774
       -
                       if swap usage > 20% for 10 cycles then alert

     

       775
       775
       -
                       if loadavg (1min) > 90 for 15 cycles then alert

     

       776
       776
       -
                       if loadavg (5min) > 80 for 10 cycles then alert

     

       777
       777
       -
                       if loadavg (15min) > 70 for 8 cycles then alert

     

       778
       778
       -
       

     

       779
       779
       -
                 check process sshd with pidfile /var/run/sshd.pid

     

       780
       780
       -
                       start program  "${pkgs.systemd}/bin/systemctl start sshd"

     

       781
       781
       -
                       stop program  "${pkgs.systemd}/bin/systemctl stop sshd"

     

       782
       782
       -
                       if failed port 22 protocol ssh for 2 cycles then restart

     

       783
       783
       -
       

     

       784
       784
       -
                 check process postfix with pidfile /var/lib/postfix/queue/pid/master.pid

     

       785
       785
       -
                       start program = "${pkgs.systemd}/bin/systemctl start postfix"

     

       786
       786
       -
                       stop program = "${pkgs.systemd}/bin/systemctl stop postfix"

     

       787
       787
       -
                       if failed port 25 protocol smtp for 5 cycles then restart

     

       788
       788
       -
       

     

       789
       789
       -
                 check process dovecot with pidfile /var/run/dovecot2/master.pid

     

       790
       790
       -
                       start program = "${pkgs.systemd}/bin/systemctl start dovecot2"

     

       791
       791
       -
                       stop program = "${pkgs.systemd}/bin/systemctl stop dovecot2"

     

       792
       792
       -
                       if failed host ${cfg.fqdn} port 993 type tcpssl sslauto protocol imap for 5 cycles then restart

     

       793
       793
       -
       

     

       794
       794
       -
                 check process rspamd with matching "rspamd: main process"

     

       795
       795
       -
                       start program = "${pkgs.systemd}/bin/systemctl start rspamd"

     

       796
       796
       -
                       stop program = "${pkgs.systemd}/bin/systemctl stop rspamd"

     

       797
       797
       -
               '';

     

       798
       798
       -
               defaultText = lib.literalMD "see source";

     

       799
       799
       -
               description = ''

     

       800
       800
       -
                 The configuration used for monitoring via monit.

     

       801
       801
       -
                 Use a mail address that you actively check and set it via 'set alert ...'.

     

       802
       802
       -
               '';

     

       803
       803
       -
             };

     

       804
       804
       -
           };

     

       805
       805
       -
       

     

       806
       806
       -
           borgbackup = {

     

       807
       807
       -
             enable = lib.mkEnableOption "backup via borgbackup";

     

       808
       808
       -
       

     

       809
       809
       -
             repoLocation = mkOption {

     

       810
       810
       -
               type = types.str;

     

       811
       811
       -
               default = "/var/borgbackup";

     

       812
       812
       -
               description = ''

     

       813
       813
       -
                 The location where borg saves the backups.

     

       814
       814
       -
                 This can be a local path or a remote location such as user@host:/path/to/repo.

     

       815
       815
       -
                 It is exported and thus available as an environment variable to cmdPreexec and cmdPostexec.

     

       816
       816
       -
               '';

     

       817
       817
       -
             };

     

       818
       818
       -
       

     

       819
       819
       -
             startAt = mkOption {

     

       820
       820
       -
               type = types.str;

     

       821
       821
       -
               default = "hourly";

     

       822
       822
       -
               description = "When or how often the backup should run. Must be in the format described in systemd.time 7.";

     

       823
       823
       -
             };

     

       824
       824
       -
       

     

       825
       825
       -
             user = mkOption {

     

       826
       826
       -
               type = types.str;

     

       827
       827
       -
               default = "virtualMail";

     

       828
       828
       -
               description = "The user borg and its launch script is run as.";

     

       829
       829
       -
             };

     

       830
       830
       -
       

     

       831
       831
       -
             group = mkOption {

     

       832
       832
       -
               type = types.str;

     

       833
       833
       -
               default = "virtualMail";

     

       834
       834
       -
               description = "The group borg and its launch script is run as.";

     

       835
       835
       -
             };

     

       836
       836
       -
       

     

       837
       837
       -
             compression = {

     

       838
       838
       -
               method = mkOption {

     

       839
       839
       -
                 type = types.nullOr (types.enum ["none" "lz4" "zstd" "zlib" "lzma"]);

     

       840
       840
       -
                 default = null;

     

       841
       841
       -
                 description = "Leaving this unset allows borg to choose. The default for borg 1.1.4 is lz4.";

     

       842
       842
       -
               };

     

       843
       843
       -
       

     

       844
       844
       -
               level = mkOption {

     

       845
       845
       -
                 type = types.nullOr types.int;

     

       846
       846
       -
                 default = null;

     

       847
       847
       -
                 description = ''

     

       848
       848
       -
                   Denotes the level of compression used by borg.

     

       849
       849
       -
                   Most methods accept levels from 0 to 9 but zstd which accepts values from 1 to 22.

     

       850
       850
       -
                   If null the decision is left up to borg.

     

       851
       851
       -
                 '';

     

       852
       852
       -
               };

     

       853
       853
       -
       

     

       854
       854
       -
               auto = mkOption {

     

       855
       855
       -
                 type = types.bool;

     

       856
       856
       -
                 default = false;

     

       857
       857
       -
                 description = "Leaves it to borg to determine whether an individual file should be compressed.";

     

       858
       858
       -
               };

     

       859
       859
       -
             };

     

       860
       860
       -
       

     

       861
       861
       -
             encryption = {

     

       862
       862
       -
               method = mkOption {

     

       863
       863
       -
                 type = types.enum [

     

       864
       864
       -
                   "none"

     

       865
       865
       -
                   "authenticated"

     

       866
       866
       -
                   "authenticated-blake2"

     

       867
       867
       -
                   "repokey"

     

       868
       868
       -
                   "keyfile"

     

       869
       869
       -
                   "repokey-blake2"

     

       870
       870
       -
                   "keyfile-blake2"

     

       871
       871
       -
                 ];

     

       872
       872
       -
                 default = "none";

     

       873
       873
       -
                 description = ''

     

       874
       874
       -
                   The backup can be encrypted by choosing any other value than 'none'.

     

       875
       875
       -
                   When using encryption the password / passphrase must be provided in passphraseFile.

     

       876
       876
       -
                 '';

     

       877
       877
       -
               };

     

       878
       878
       -
       

     

       879
       879
       -
               passphraseFile = mkOption {

     

       880
       880
       -
                 type = types.nullOr types.path;

     

       881
       881
       -
                 default = null;

     

       882
       882
       -
                 description = "Path to a file containing the encryption password or passphrase.";

     

       883
       883
       -
               };

     

       884
       884
       -
             };

     

       885
       885
       -
       

     

       886
       886
       -
             name = mkOption {

     

       887
       887
       -
               type = types.str;

     

       888
       888
       -
               default = "{hostname}-{user}-{now}";

     

       889
       889
       -
               description = ''

     

       890
       890
       -
                 The name of the individual backups as used by borg.

     

       891
       891
       -
                 Certain placeholders will be replaced by borg.

     

       892
       892
       -
               '';

     

       893
       893
       -
             };

     

       894
       894
       -
       

     

       895
       895
       -
             locations = mkOption {

     

       896
       896
       -
               type = types.listOf types.path;

     

       897
       897
       -
               default = [cfg.mailDirectory];

     

       898
       898
       -
               description = "The locations that are to be backed up by borg.";

     

       899
       899
       -
             };

     

       900
       900
       -
       

     

       901
       901
       -
             extraArgumentsForInit = mkOption {

     

       902
       902
       -
               type = types.listOf types.str;

     

       903
       903
       -
               default = ["--critical"];

     

       904
       904
       -
               description = "Additional arguments to add to the borg init command line.";

     

       905
       905
       -
             };

     

       906
       906
       -
       

     

       907
       907
       -
             extraArgumentsForCreate = mkOption {

     

       908
       908
       -
               type = types.listOf types.str;

     

       909
       909
       -
               default = [ ];

     

       910
       910
       -
               description = "Additional arguments to add to the borg create command line e.g. '--stats'.";

     

       911
       911
       -
             };

     

       912
       912
       -
       

     

       913
       913
       -
             cmdPreexec = mkOption {

     

       914
       914
       -
               type = types.nullOr types.str;

     

       915
       915
       -
               default = null;

     

       916
       916
       -
               description = ''

     

       917
       917
       -
                 The command to be executed before each backup operation.

     

       918
       918
       -
                 This is called prior to borg init in the same script that runs borg init and create and cmdPostexec.

     

       919
       919
       -
                 Example:

     

       920
       920
       -
                   export BORG_RSH="ssh -i /path/to/private/key"

     

       921
       921
       -
               '';

     

       922
       922
       -
             };

     

       923
       923
       -
       

     

       924
       924
       -
             cmdPostexec = mkOption {

     

       925
       925
       -
               type = types.nullOr types.str;

     

       926
       926
       -
               default = null;

     

       927
       927
       -
               description = ''

     

       928
       928
       -
                 The command to be executed after each backup operation.

     

       929
       929
       -
                 This is called after borg create completed successfully and in the same script that runs

     

       930
       930
       -
                 cmdPreexec, borg init and create.

     

       931
       931
       -
               '';

     

       932
       932
       -
             };

     

       933
       933
       -
       

     

       934
       934
       -
           };

     

       935
       935
       -
       

     

       936
       936
       -
           rebootAfterKernelUpgrade = {

     

       937
       937
       -
             enable = mkOption {

     

       938
       938
       -
               type = types.bool;

     

       939
       939
       -
               default = false;

     

       940
       940
       -
               example = true;

     

       941
       941
       -
               description = ''

     

       942
       942
       -
                 Whether to enable automatic reboot after kernel upgrades.

     

       943
       943
       -
                 This is to be used in conjunction with system.autoUpgrade.enable = true"

     

       944
       944
       -
               '';

     

       945
       945
       -
             };

     

       946
       946
       -
             method = mkOption {

     

       947
       947
       -
               type = types.enum [ "reboot" "systemctl kexec" ];

     

       948
       948
       -
               default = "reboot";

     

       949
       949
       -
               description = ''

     

       950
       950
       -
                 Whether to issue a full "reboot" or just a "systemctl kexec"-only reboot.

     

       951
       951
       -
                 It is recommended to use the default value because the quicker kexec reboot has a number of problems.

     

       952
       952
       -
                 Also if your server is running in a virtual machine the regular reboot will already be very quick.

     

       953
       953
       -
               '';

     

       954
       954
       -
             };

     

       955
       955
       -
           };

     

       956
       956
       -
       

     

       957
       957
       -
           backup = {

     

       958
       958
       -
             enable = lib.mkEnableOption "backup via rsnapshot";

     

       959
       959
       -
       

     

       960
       960
       -
             snapshotRoot = mkOption {

     

       961
       961
       -
               type = types.path;

     

       962
       962
       -
               default = "/var/rsnapshot";

     

       963
       963
       -
               description = ''

     

       964
       964
       -
                 The directory where rsnapshot stores the backup.

     

       965
       965
       -
               '';

     

       966
       966
       -
             };

     

       967
       967
       -
       

     

       968
       968
       -
             cmdPreexec = mkOption {

     

       969
       969
       -
               type = types.nullOr types.str;

     

       970
       970
       -
               default = null;

     

       971
       971
       -
               description = ''

     

       972
       972
       -
                 The command to be executed before each backup operation. This is wrapped in a shell script to be called by rsnapshot.

     

       973
       973
       -
               '';

     

       974
       974
       -
             };

     

       975
       975
       -
       

     

       976
       976
       -
             cmdPostexec = mkOption {

     

       977
       977
       -
               type = types.nullOr types.str;

     

       978
       978
       -
               default = null;

     

       979
       979
       -
               description = "The command to be executed after each backup operation. This is wrapped in a shell script to be called by rsnapshot.";

     

       980
       980
       -
             };

     

       981
       981
       -
       

     

       982
       982
       -
             retain = {

     

       983
       983
       -
               hourly = mkOption {

     

       984
       984
       -
                 type = types.int;

     

       985
       985
       -
                 default = 24;

     

       986
       986
       -
                 description = "How many hourly snapshots are retained.";

     

       987
       987
       -
               };

     

       988
       988
       -
               daily = mkOption {

     

       989
       989
       -
                 type = types.int;

     

       990
       990
       -
                 default = 7;

     

       991
       991
       -
                 description = "How many daily snapshots are retained.";

     

       992
       992
       -
               };

     

       993
       993
       -
               weekly = mkOption {

     

       994
       994
       -
                 type = types.int;

     

       995
       995
       -
                 default = 54;

     

       996
       996
       -
                 description = "How many weekly snapshots are retained.";

     

       997
       997
       -
               };

     

       998
       998
       -
             };

     

       999
       999
       -
       

     

       1000
       1000
       -
             cronIntervals = mkOption {

     

       1001
       1001
       -
               type = types.attrsOf types.str;

     

       1002
       1002
       -
               default = {

     

       1003
       1003
       -
                          # minute, hour, day-in-month, month, weekday (0 = sunday)

     

       1004
       1004
       -
                 hourly = " 0  *  *  *  *"; # Every full hour

     

       1005
       1005
       -
                 daily  = "30  3  *  *  *"; # Every day at 3:30

     

       1006
       1006
       -
                 weekly = " 0  5  *  *  0"; # Every sunday at 5:00 AM

     

       1007
       1007
       -
               };

     

       1008
       1008
       -
               description = ''

     

       1009
       1009
       -
                 Periodicity at which intervals should be run by cron.

     

       1010
       1010
       -
                 Note that the intervals also have to exist in configuration

     

       1011
       1011
       -
                 as retain options.

     

       1012
       1012
       -
               '';

     

       1013
       1013
       -
             };

     

       1014
       1014
       -
           };

     

       1015
       1015
       -
         };

     

       1016
       1016
       -
       

     

       1017
       1017
       -
         imports = [

     

       1018
       1018
       -
           ./borgbackup.nix

     

       1019
       1019
       -
           ./debug.nix

     

       1020
       1020
       -
           ./rsnapshot.nix

     

       1021
       1021
       -
           ./clamav.nix

     

       1022
       1022
       -
           ./monit.nix

     

       1023
       1023
       -
           ./users.nix

     

       1024
       1024
       -
           ./environment.nix

     

       1025
       1025
       -
           ./networking.nix

     

       1026
       1026
       -
           ./systemd.nix

     

       1027
       1027
       -
           ./dovecot.nix

     

       1028
       1028
       -
           ./opendkim.nix

     

       1029
       1029
       -
           ./postfix.nix

     

       1030
       1030
       -
           ./rspamd.nix

     

       1031
       1031
       -
           ./nginx.nix

     

       1032
       1032
       -
           ./kresd.nix

     

       1033
       1033
       -
           ./post-upgrade-check.nix

     

       1034
       1034
       -
         ];

     

       1035
       1035
       -
       }

-319

modules/mailserver/dovecot.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       with (import ./common.nix { inherit config pkgs lib; });

     

       20
       20
       -
       

     

       21
       21
       -
       let

     

       22
       22
       -
         cfg = config.mailserver;

     

       23
       23
       -
       

     

       24
       24
       -
         passwdDir = "/run/dovecot2";

     

       25
       25
       -
         passwdFile = "${passwdDir}/passwd";

     

       26
       26
       -
       

     

       27
       27
       -
         bool2int = x: if x then "1" else "0";

     

       28
       28
       -
       

     

       29
       29
       -
         maildirLayoutAppendix = lib.optionalString cfg.useFsLayout ":LAYOUT=fs";

     

       30
       30
       -
       

     

       31
       31
       -
         # maildir in format "/${domain}/${user}"

     

       32
       32
       -
         dovecotMaildir =

     

       33
       33
       -
           "maildir:${cfg.mailDirectory}/%d/%n${maildirLayoutAppendix}"

     

       34
       34
       -
           + (lib.optionalString (cfg.indexDir != null)

     

       35
       35
       -
              ":INDEX=${cfg.indexDir}/%d/%n"

     

       36
       36
       -
             );

     

       37
       37
       -
       

     

       38
       38
       -
         postfixCfg = config.services.postfix;

     

       39
       39
       -
         dovecot2Cfg = config.services.dovecot2;

     

       40
       40
       -
       

     

       41
       41
       -
         stateDir = "/var/lib/dovecot";

     

       42
       42
       -
       

     

       43
       43
       -
         pipeBin = pkgs.stdenv.mkDerivation {

     

       44
       44
       -
           name = "pipe_bin";

     

       45
       45
       -
           src = ./dovecot/pipe_bin;

     

       46
       46
       -
           buildInputs = with pkgs; [ makeWrapper coreutils bash rspamd ];

     

       47
       47
       -
           buildCommand = ''

     

       48
       48
       -
             mkdir -p $out/pipe/bin

     

       49
       49
       -
             cp $src/* $out/pipe/bin/

     

       50
       50
       -
             chmod a+x $out/pipe/bin/*

     

       51
       51
       -
             patchShebangs $out/pipe/bin

     

       52
       52
       -
       

     

       53
       53
       -
             for file in $out/pipe/bin/*; do

     

       54
       54
       -
               wrapProgram $file \

     

       55
       55
       -
                 --set PATH "${pkgs.coreutils}/bin:${pkgs.rspamd}/bin"

     

       56
       56
       -
             done

     

       57
       57
       -
           '';

     

       58
       58
       -
         };

     

       59
       59
       -
       

     

       60
       60
       -
         genPasswdScript = pkgs.writeScript "generate-password-file" ''

     

       61
       61
       -
           #!${pkgs.stdenv.shell}

     

       62
       62
       -
       

     

       63
       63
       -
           set -euo pipefail

     

       64
       64
       -
       

     

       65
       65
       -
           if (! test -d "${passwdDir}"); then

     

       66
       66
       -
             mkdir "${passwdDir}"

     

       67
       67
       -
             chmod 755 "${passwdDir}"

     

       68
       68
       -
           fi

     

       69
       69
       -
       

     

       70
       70
       -
           for f in ${builtins.toString (lib.mapAttrsToList (name: value: passwordFiles."${name}") cfg.loginAccounts)}; do

     

       71
       71
       -
             if [ ! -f "$f" ]; then

     

       72
       72
       -
               echo "Expected password hash file $f does not exist!"

     

       73
       73
       -
               exit 1

     

       74
       74
       -
             fi

     

       75
       75
       -
           done

     

       76
       76
       -
       

     

       77
       77
       -
           cat <<EOF > ${passwdFile}

     

       78
       78
       -
           ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value:

     

       79
       79
       -
             let passwordHash = ''$(${pkgs.dovecot}/bin/doveadm pw -p "$(head -n 1 ${passwordFiles."${name}"})")''; in

     

       80
       80
       -
             "${name}:${passwordHash}:${builtins.toString cfg.vmailUID}:${builtins.toString cfg.vmailUID}::${cfg.mailDirectory}:/run/current-system/sw/bin/nologin:"

     

       81
       81
       -
               + (if lib.isString value.quota

     

       82
       82
       -
                     then "userdb_quota_rule=*:storage=${value.quota}"

     

       83
       83
       -
                     else "")

     

       84
       84
       -
           ) cfg.loginAccounts)}

     

       85
       85
       -
           EOF

     

       86
       86
       -
       

     

       87
       87
       -
           chmod 600 ${passwdFile}

     

       88
       88
       -
         '';

     

       89
       89
       -
       

     

       90
       90
       -
         junkMailboxes = builtins.attrNames (lib.filterAttrs (n: v: v ? "specialUse" && v.specialUse == "Junk") cfg.mailboxes);

     

       91
       91
       -
         junkMailboxNumber = builtins.length junkMailboxes;

     

       92
       92
       -
         # The assertion garantees there is exactly one Junk mailbox.

     

       93
       93
       -
         junkMailboxName = if junkMailboxNumber == 1 then builtins.elemAt junkMailboxes 0 else "";

     

       94
       94
       -
       

     

       95
       95
       -
       in

     

       96
       96
       -
       {

     

       97
       97
       -
         config = with cfg; lib.mkIf enable {

     

       98
       98
       -
       

     

       99
       99
       -
           services.dovecot2 = {

     

       100
       100
       -
             enable = true;

     

       101
       101
       -
             enableImap = enableImap || enableImapSsl;

     

       102
       102
       -
             enablePop3 = enablePop3 || enablePop3Ssl;

     

       103
       103
       -
             enablePAM = false;

     

       104
       104
       -
             enableQuota = true;

     

       105
       105
       -
             mailGroup = vmailGroupName;

     

       106
       106
       -
             mailUser = vmailUserName;

     

       107
       107
       -
             mailLocation = dovecotMaildir;

     

       108
       108
       -
             sslServerCert = certificatePath;

     

       109
       109
       -
             sslServerKey = keyPath;

     

       110
       110
       -
             enableLmtp = true;

     

       111
       111
       -
             modules = [ pkgs.dovecot_pigeonhole ] ++ (lib.optional cfg.fullTextSearch.enable pkgs.dovecot_fts_xapian );

     

       112
       112
       -
             mailPlugins.globally.enable = lib.optionals cfg.fullTextSearch.enable [ "fts" "fts_xapian" ];

     

       113
       113
       -
             protocols = lib.optional cfg.enableManageSieve "sieve";

     

       114
       114
       -
       

     

       115
       115
       -
             sieveScripts = {

     

       116
       116
       -
               after = builtins.toFile "spam.sieve" ''

     

       117
       117
       -
                 require "fileinto";

     

       118
       118
       -
       

     

       119
       119
       -
                 if header :is "X-Spam" "Yes" {

     

       120
       120
       -
                     fileinto "${junkMailboxName}";

     

       121
       121
       -
                     stop;

     

       122
       122
       -
                 }

     

       123
       123
       -
               '';

     

       124
       124
       -
             };

     

       125
       125
       -
       

     

       126
       126
       -
             mailboxes = cfg.mailboxes;

     

       127
       127
       -
       

     

       128
       128
       -
             extraConfig = ''

     

       129
       129
       -
               #Extra Config

     

       130
       130
       -
               ${lib.optionalString debug ''

     

       131
       131
       -
                 mail_debug = yes

     

       132
       132
       -
                 auth_debug = yes

     

       133
       133
       -
                 verbose_ssl = yes

     

       134
       134
       -
               ''}

     

       135
       135
       -
       

     

       136
       136
       -
               ${lib.optionalString (cfg.enableImap || cfg.enableImapSsl) ''

     

       137
       137
       -
                 service imap-login {

     

       138
       138
       -
                   inet_listener imap {

     

       139
       139
       -
                     ${if cfg.enableImap then ''

     

       140
       140
       -
                       port = 143

     

       141
       141
       -
                     '' else ''

     

       142
       142
       -
                       # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html

     

       143
       143
       -
                       port = 0

     

       144
       144
       -
                     ''}

     

       145
       145
       -
                   }

     

       146
       146
       -
                   inet_listener imaps {

     

       147
       147
       -
                     ${if cfg.enableImapSsl then ''

     

       148
       148
       -
                       port = 993

     

       149
       149
       -
                       ssl = yes

     

       150
       150
       -
                     '' else ''

     

       151
       151
       -
                       # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html

     

       152
       152
       -
                       port = 0

     

       153
       153
       -
                     ''}

     

       154
       154
       -
                   }

     

       155
       155
       -
                 }

     

       156
       156
       -
               ''}

     

       157
       157
       -
               ${lib.optionalString (cfg.enablePop3 || cfg.enablePop3Ssl) ''

     

       158
       158
       -
                 service pop3-login {

     

       159
       159
       -
                   inet_listener pop3 {

     

       160
       160
       -
                     ${if cfg.enablePop3 then ''

     

       161
       161
       -
                       port = 110

     

       162
       162
       -
                     '' else ''

     

       163
       163
       -
                       # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html

     

       164
       164
       -
                       port = 0

     

       165
       165
       -
                     ''}

     

       166
       166
       -
                   }

     

       167
       167
       -
                   inet_listener pop3s {

     

       168
       168
       -
                     ${if cfg.enablePop3Ssl then ''

     

       169
       169
       -
                       port = 995

     

       170
       170
       -
                       ssl = yes

     

       171
       171
       -
                     '' else ''

     

       172
       172
       -
                       # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html

     

       173
       173
       -
                       port = 0

     

       174
       174
       -
                     ''}

     

       175
       175
       -
                   }

     

       176
       176
       -
                 }

     

       177
       177
       -
               ''}

     

       178
       178
       -
       

     

       179
       179
       -
               protocol imap {

     

       180
       180
       -
                 mail_max_userip_connections = ${toString cfg.maxConnectionsPerUser}

     

       181
       181
       -
                 mail_plugins = $mail_plugins imap_sieve

     

       182
       182
       -
               }

     

       183
       183
       -
       

     

       184
       184
       -
               protocol pop3 {

     

       185
       185
       -
                 mail_max_userip_connections = ${toString cfg.maxConnectionsPerUser}

     

       186
       186
       -
               }

     

       187
       187
       -
       

     

       188
       188
       -
               mail_access_groups = ${vmailGroupName}

     

       189
       189
       -
               ssl = required

     

       190
       190
       -
               ssl_min_protocol = TLSv1.2

     

       191
       191
       -
               ssl_prefer_server_ciphers = yes

     

       192
       192
       -
       

     

       193
       193
       -
               service lmtp {

     

       194
       194
       -
                 unix_listener dovecot-lmtp {

     

       195
       195
       -
                   group = ${postfixCfg.group}

     

       196
       196
       -
                   mode = 0600

     

       197
       197
       -
                   user = ${postfixCfg.user}

     

       198
       198
       -
                 }

     

       199
       199
       -
               }

     

       200
       200
       -
       

     

       201
       201
       -
               recipient_delimiter = ${cfg.recipientDelimiter}

     

       202
       202
       -
               lmtp_save_to_detail_mailbox = ${cfg.lmtpSaveToDetailMailbox}

     

       203
       203
       -
       

     

       204
       204
       -
               protocol lmtp {

     

       205
       205
       -
                 mail_plugins = $mail_plugins sieve

     

       206
       206
       -
               }

     

       207
       207
       -
       

     

       208
       208
       -
               passdb {

     

       209
       209
       -
                 driver = passwd-file

     

       210
       210
       -
                 args = ${passwdFile}

     

       211
       211
       -
               }

     

       212
       212
       -
       

     

       213
       213
       -
               userdb {

     

       214
       214
       -
                 driver = passwd-file

     

       215
       215
       -
                 args = ${passwdFile}

     

       216
       216
       -
               }

     

       217
       217
       -
       

     

       218
       218
       -
               service auth {

     

       219
       219
       -
                 unix_listener auth {

     

       220
       220
       -
                   mode = 0660

     

       221
       221
       -
                   user = ${postfixCfg.user}

     

       222
       222
       -
                   group = ${postfixCfg.group}

     

       223
       223
       -
                 }

     

       224
       224
       -
               }

     

       225
       225
       -
       

     

       226
       226
       -
               auth_mechanisms = plain login

     

       227
       227
       -
       

     

       228
       228
       -
               namespace inbox {

     

       229
       229
       -
                 separator = ${cfg.hierarchySeparator}

     

       230
       230
       -
                 inbox = yes

     

       231
       231
       -
               }

     

       232
       232
       -
       

     

       233
       233
       -
               plugin {

     

       234
       234
       -
                 sieve_plugins = sieve_imapsieve sieve_extprograms

     

       235
       235
       -
                 sieve = file:${cfg.sieveDirectory}/%u/scripts;active=${cfg.sieveDirectory}/%u/active.sieve

     

       236
       236
       -
                 sieve_default = file:${cfg.sieveDirectory}/%u/default.sieve

     

       237
       237
       -
                 sieve_default_name = default

     

       238
       238
       -
       

     

       239
       239
       -
                 # From elsewhere to Spam folder

     

       240
       240
       -
                 imapsieve_mailbox1_name = ${junkMailboxName}

     

       241
       241
       -
                 imapsieve_mailbox1_causes = COPY

     

       242
       242
       -
                 imapsieve_mailbox1_before = file:${stateDir}/imap_sieve/report-spam.sieve

     

       243
       243
       -
       

     

       244
       244
       -
                 # From Spam folder to elsewhere

     

       245
       245
       -
                 imapsieve_mailbox2_name = *

     

       246
       246
       -
                 imapsieve_mailbox2_from = ${junkMailboxName}

     

       247
       247
       -
                 imapsieve_mailbox2_causes = COPY

     

       248
       248
       -
                 imapsieve_mailbox2_before = file:${stateDir}/imap_sieve/report-ham.sieve

     

       249
       249
       -
       

     

       250
       250
       -
                 sieve_pipe_bin_dir = ${pipeBin}/pipe/bin

     

       251
       251
       -
       

     

       252
       252
       -
                 sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment

     

       253
       253
       -
               }

     

       254
       254
       -
       

     

       255
       255
       -
               ${lib.optionalString cfg.fullTextSearch.enable ''

     

       256
       256
       -
               plugin {

     

       257
       257
       -
                 plugin = fts fts_xapian

     

       258
       258
       -
                 fts = xapian

     

       259
       259
       -
                 fts_xapian = partial=${toString cfg.fullTextSearch.minSize} full=${toString cfg.fullTextSearch.maxSize} attachments=${bool2int cfg.fullTextSearch.indexAttachments} verbose=${bool2int cfg.debug}

     

       260
       260
       -
       

     

       261
       261
       -
                 fts_autoindex = ${if cfg.fullTextSearch.autoIndex then "yes" else "no"}

     

       262
       262
       -
       

     

       263
       263
       -
                 ${lib.strings.concatImapStringsSep "\n" (n: x: "fts_autoindex_exclude${if n==1 then "" else toString n} = ${x}") cfg.fullTextSearch.autoIndexExclude}

     

       264
       264
       -
       

     

       265
       265
       -
                 fts_enforced = ${cfg.fullTextSearch.enforced}

     

       266
       266
       -
               }

     

       267
       267
       -
       

     

       268
       268
       -
               ${lib.optionalString (cfg.fullTextSearch.memoryLimit != null) ''

     

       269
       269
       -
               service indexer-worker {

     

       270
       270
       -
                 vsz_limit = ${toString (cfg.fullTextSearch.memoryLimit*1024*1024)}

     

       271
       271
       -
               }

     

       272
       272
       -
               ''}

     

       273
       273
       -
               ''}

     

       274
       274
       -
       

     

       275
       275
       -
               lda_mailbox_autosubscribe = yes

     

       276
       276
       -
               lda_mailbox_autocreate = yes

     

       277
       277
       -
             '';

     

       278
       278
       -
           };

     

       279
       279
       -
       

     

       280
       280
       -
           systemd.services.dovecot2 = {

     

       281
       281
       -
             preStart = ''

     

       282
       282
       -
               ${genPasswdScript}

     

       283
       283
       -
               rm -rf '${stateDir}/imap_sieve'

     

       284
       284
       -
               mkdir '${stateDir}/imap_sieve'

     

       285
       285
       -
               cp -p "${./dovecot/imap_sieve}"/*.sieve '${stateDir}/imap_sieve/'

     

       286
       286
       -
               for k in "${stateDir}/imap_sieve"/*.sieve ; do

     

       287
       287
       -
                 ${pkgs.dovecot_pigeonhole}/bin/sievec "$k"

     

       288
       288
       -
               done

     

       289
       289
       -
               chown -R '${dovecot2Cfg.mailUser}:${dovecot2Cfg.mailGroup}' '${stateDir}/imap_sieve'

     

       290
       290
       -
             '';

     

       291
       291
       -
           };

     

       292
       292
       -
       

     

       293
       293
       -
           systemd.services.postfix.restartTriggers = [ genPasswdScript ];

     

       294
       294
       -
       

     

       295
       295
       -
           systemd.services.dovecot-fts-xapian-optimize = lib.mkIf (cfg.fullTextSearch.enable && cfg.fullTextSearch.maintenance.enable) {

     

       296
       296
       -
             description = "Optimize dovecot indices for fts_xapian";

     

       297
       297
       -
             requisite = [ "dovecot2.service" ];

     

       298
       298
       -
             after = [ "dovecot2.service" ];

     

       299
       299
       -
             startAt = cfg.fullTextSearch.maintenance.onCalendar;

     

       300
       300
       -
             serviceConfig = {

     

       301
       301
       -
               Type = "oneshot";

     

       302
       302
       -
               ExecStart = "${pkgs.dovecot}/bin/doveadm fts optimize -A";

     

       303
       303
       -
               PrivateDevices = true;

     

       304
       304
       -
               PrivateNetwork = true;

     

       305
       305
       -
               ProtectKernelTunables = true;

     

       306
       306
       -
               ProtectKernelModules = true;

     

       307
       307
       -
               ProtectControlGroups = true;

     

       308
       308
       -
               ProtectHome = true;

     

       309
       309
       -
               ProtectSystem = true;

     

       310
       310
       -
               PrivateTmp = true;

     

       311
       311
       -
             };

     

       312
       312
       -
           };

     

       313
       313
       -
           systemd.timers.dovecot-fts-xapian-optimize = lib.mkIf (cfg.fullTextSearch.enable && cfg.fullTextSearch.maintenance.enable && cfg.fullTextSearch.maintenance.randomizedDelaySec != 0) {

     

       314
       314
       -
             timerConfig = {

     

       315
       315
       -
               RandomizedDelaySec = cfg.fullTextSearch.maintenance.randomizedDelaySec;

     

       316
       316
       -
             };

     

       317
       317
       -
           };

     

       318
       318
       -
         };

     

       319
       319
       -
       }

-15

modules/mailserver/dovecot/imap_sieve/report-ham.sieve

···

       1
       1
       -
       require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];

     

       2
       2
       -
       

     

       3
       3
       -
       if environment :matches "imap.mailbox" "*" {

     

       4
       4
       -
         set "mailbox" "${1}";

     

       5
       5
       -
       }

     

       6
       6
       -
       

     

       7
       7
       -
       if string "${mailbox}" "Trash" {

     

       8
       8
       -
         stop;

     

       9
       9
       -
       }

     

       10
       10
       -
       

     

       11
       11
       -
       if environment :matches "imap.user" "*" {

     

       12
       12
       -
         set "username" "${1}";

     

       13
       13
       -
       }

     

       14
       14
       -
       

     

       15
       15
       -
       pipe :copy "sa-learn-ham.sh" [ "${username}" ];

-7

modules/mailserver/dovecot/imap_sieve/report-spam.sieve

···

       1
       1
       -
       require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];

     

       2
       2
       -
       

     

       3
       3
       -
       if environment :matches "imap.user" "*" {

     

       4
       4
       -
         set "username" "${1}";

     

       5
       5
       -
       }

     

       6
       6
       -
       

     

       7
       7
       -
       pipe :copy "sa-learn-spam.sh" [ "${username}" ];

-3

modules/mailserver/dovecot/pipe_bin/sa-learn-ham.sh

···

       1
       1
       -
       #!/bin/bash

     

       2
       2
       -
       set -o errexit

     

       3
       3
       -
       exec rspamc -h /run/rspamd/worker-controller.sock learn_ham

-3

modules/mailserver/dovecot/pipe_bin/sa-learn-spam.sh

···

       1
       1
       -
       #!/bin/bash

     

       2
       2
       -
       set -o errexit

     

       3
       3
       -
       exec rspamc -h /run/rspamd/worker-controller.sock learn_spam

-28

modules/mailserver/environment.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver;

     

       21
       21
       -
       in

     

       22
       22
       -
       {

     

       23
       23
       -
         config = with cfg; lib.mkIf enable {

     

       24
       24
       -
           environment.systemPackages = with pkgs; [

     

       25
       25
       -
             dovecot opendkim openssh postfix rspamd

     

       26
       26
       -
           ] ++ (if certificateScheme == 2 then [ openssl ] else []);

     

       27
       27
       -
         };

     

       28
       28
       -
       }

-27

modules/mailserver/kresd.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2017  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver;

     

       21
       21
       -
       in

     

       22
       22
       -
       {

     

       23
       23
       -
         config = lib.mkIf (cfg.enable && cfg.localDnsResolver) {

     

       24
       24
       -
           services.kresd.enable = true;

     

       25
       25
       -
         };

     

       26
       26
       -
       }

     

       27
       27
       -

-32

modules/mailserver/monit.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver;

     

       21
       21
       -
       in

     

       22
       22
       -
       {

     

       23
       23
       -
         config = lib.mkIf (cfg.enable && cfg.monitoring.enable) {

     

       24
       24
       -
           services.monit = {

     

       25
       25
       -
             enable = true;

     

       26
       26
       -
             config = ''

     

       27
       27
       -
               set alert ${cfg.monitoring.alertAddress}

     

       28
       28
       -
               ${cfg.monitoring.config}

     

       29
       29
       -
             '';

     

       30
       30
       -
           };

     

       31
       31
       -
         };

     

       32
       32
       -
       }

-37

modules/mailserver/networking.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver;

     

       21
       21
       -
       in

     

       22
       22
       -
       {

     

       23
       23
       -
         config = with cfg; lib.mkIf (enable && openFirewall) {

     

       24
       24
       -
       

     

       25
       25
       -
           networking.firewall = {

     

       26
       26
       -
             allowedTCPPorts = [ 25 ]

     

       27
       27
       -
               ++ lib.optional enableSubmission 587

     

       28
       28
       -
               ++ lib.optional enableSubmissionSsl 465

     

       29
       29
       -
               ++ lib.optional enableImap 143

     

       30
       30
       -
               ++ lib.optional enableImapSsl 993

     

       31
       31
       -
               ++ lib.optional enablePop3 110

     

       32
       32
       -
               ++ lib.optional enablePop3Ssl 995

     

       33
       33
       -
               ++ lib.optional enableManageSieve 4190

     

       34
       34
       -
               ++ lib.optional (certificateScheme == 3) 80;

     

       35
       35
       -
           };

     

       36
       36
       -
         };

     

       37
       37
       -
       }

-44

modules/mailserver/nginx.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       

     

       18
       18
       -
       { config, pkgs, lib, ... }:

     

       19
       19
       -
       

     

       20
       20
       -
       with (import ./common.nix { inherit config; });

     

       21
       21
       -
       

     

       22
       22
       -
       let

     

       23
       23
       -
         cfg = config.mailserver;

     

       24
       24
       -
         acmeRoot = "/var/lib/acme/acme-challenge";

     

       25
       25
       -
       in

     

       26
       26
       -
       {

     

       27
       27
       -
         config = lib.mkIf (cfg.enable && cfg.certificateScheme == 3) {

     

       28
       28
       -
           services.nginx = {

     

       29
       29
       -
             enable = true;

     

       30
       30
       -
             virtualHosts."${cfg.fqdn}" = {

     

       31
       31
       -
               serverName = cfg.fqdn;

     

       32
       32
       -
               serverAliases = cfg.certificateDomains;

     

       33
       33
       -
               forceSSL = true;

     

       34
       34
       -
               enableACME = true;

     

       35
       35
       -
               acmeRoot = acmeRoot;

     

       36
       36
       -
             };

     

       37
       37
       -
           };

     

       38
       38
       -
       

     

       39
       39
       -
           security.acme.certs."${cfg.fqdn}".reloadServices = [

     

       40
       40
       -
             "postfix.service"

     

       41
       41
       -
             "dovecot2.service"

     

       42
       42
       -
           ];

     

       43
       43
       -
         };

     

       44
       44
       -
       }

-88

modules/mailserver/opendkim.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2017  Brian Olsen

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       { config, lib, pkgs, ... }:

     

       17
       17
       -
       

     

       18
       18
       -
       with lib;

     

       19
       19
       -
       

     

       20
       20
       -
       let

     

       21
       21
       -
         cfg = config.mailserver;

     

       22
       22
       -
       

     

       23
       23
       -
         dkimUser = config.services.opendkim.user;

     

       24
       24
       -
         dkimGroup = config.services.opendkim.group;

     

       25
       25
       -
       

     

       26
       26
       -
         createDomainDkimCert = dom:

     

       27
       27
       -
           let

     

       28
       28
       -
             dkim_key = "${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.key";

     

       29
       29
       -
             dkim_txt = "${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.txt";

     

       30
       30
       -
           in

     

       31
       31
       -
               ''

     

       32
       32
       -
                 if [ ! -f "${dkim_key}" ]

     

       33
       33
       -
                 then

     

       34
       34
       -
                     ${pkgs.opendkim}/bin/opendkim-genkey -s "${cfg.dkimSelector}" \

     

       35
       35
       -
                                                          -d "${dom}" \

     

       36
       36
       -
                                                          --bits="${toString cfg.dkimKeyBits}" \

     

       37
       37
       -
                                                          --directory="${cfg.dkimKeyDirectory}"

     

       38
       38
       -
                     mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.private" "${dkim_key}"

     

       39
       39
       -
                     mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.txt" "${dkim_txt}"

     

       40
       40
       -
                     echo "Generated key for domain ${dom} selector ${cfg.dkimSelector}"

     

       41
       41
       -
                 fi

     

       42
       42
       -
               '';

     

       43
       43
       -
         createAllCerts = lib.concatStringsSep "\n" (map createDomainDkimCert cfg.domains);

     

       44
       44
       -
       

     

       45
       45
       -
         keyTable = pkgs.writeText "opendkim-KeyTable"

     

       46
       46
       -
           (lib.concatStringsSep "\n" (lib.flip map cfg.domains

     

       47
       47
       -
             (dom: "${dom} ${dom}:${cfg.dkimSelector}:${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.key")));

     

       48
       48
       -
         signingTable = pkgs.writeText "opendkim-SigningTable"

     

       49
       49
       -
           (lib.concatStringsSep "\n" (lib.flip map cfg.domains (dom: "${dom} ${dom}")));

     

       50
       50
       -
       

     

       51
       51
       -
         dkim = config.services.opendkim;

     

       52
       52
       -
         args = [ "-f" "-l" ] ++ lib.optionals (dkim.configFile != null) [ "-x" dkim.configFile ];

     

       53
       53
       -
       in

     

       54
       54
       -
       {

     

       55
       55
       -
           config = mkIf (cfg.dkimSigning && cfg.enable) {

     

       56
       56
       -
             services.opendkim = {

     

       57
       57
       -
               enable = true;

     

       58
       58
       -
               selector = cfg.dkimSelector;

     

       59
       59
       -
               keyPath = cfg.dkimKeyDirectory;

     

       60
       60
       -
               domains = "csl:${builtins.concatStringsSep "," cfg.domains}";

     

       61
       61
       -
               configFile = pkgs.writeText "opendkim.conf" (''

     

       62
       62
       -
                 Canonicalization ${cfg.dkimHeaderCanonicalization}/${cfg.dkimBodyCanonicalization}

     

       63
       63
       -
                 UMask 0002

     

       64
       64
       -
                 Socket ${dkim.socket}

     

       65
       65
       -
                 KeyTable file:${keyTable}

     

       66
       66
       -
                 SigningTable file:${signingTable}

     

       67
       67
       -
               '' + (lib.optionalString cfg.debug ''

     

       68
       68
       -
                 Syslog yes

     

       69
       69
       -
                 SyslogSuccess yes

     

       70
       70
       -
                 LogWhy yes

     

       71
       71
       -
               ''));

     

       72
       72
       -
             };

     

       73
       73
       -
       

     

       74
       74
       -
             users.users = optionalAttrs (config.services.postfix.user == "postfix") {

     

       75
       75
       -
               postfix.extraGroups = [ "${dkimGroup}" ];

     

       76
       76
       -
             };

     

       77
       77
       -
             systemd.services.opendkim = {

     

       78
       78
       -
               preStart = lib.mkForce createAllCerts;

     

       79
       79
       -
               serviceConfig = {

     

       80
       80
       -
                 ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";

     

       81
       81
       -
                 PermissionsStartOnly = lib.mkForce false;

     

       82
       82
       -
               };

     

       83
       83
       -
             };

     

       84
       84
       -
             systemd.tmpfiles.rules = [

     

       85
       85
       -
               "d '${cfg.dkimKeyDirectory}' - ${dkimUser} ${dkimGroup} - -"

     

       86
       86
       -
             ];

     

       87
       87
       -
           };

     

       88
       88
       -
       }

-46

modules/mailserver/post-upgrade-check.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       with lib;

     

       20
       20
       -
       

     

       21
       21
       -
       let

     

       22
       22
       -
         cfg = config.mailserver;

     

       23
       23
       -
       in

     

       24
       24
       -
       {

     

       25
       25
       -
         config = mkIf (cfg.enable && cfg.rebootAfterKernelUpgrade.enable) {

     

       26
       26
       -
           systemd.services.nixos-upgrade.serviceConfig.ExecStartPost = pkgs.writeScript "post-upgrade-check" ''

     

       27
       27
       -
             #!${pkgs.stdenv.shell}

     

       28
       28
       -
       

     

       29
       29
       -
             # Checks whether the "current" kernel is different from the booted kernel

     

       30
       30
       -
             # and then triggers a reboot so that the "current" kernel will be the booted one.

     

       31
       31
       -
             # This is just an educated guess. If the links do not differ the kernels might still be different, according to spacefrogg in #nixos.

     

       32
       32
       -
       

     

       33
       33
       -
             current=$(readlink -f /run/current-system/kernel)

     

       34
       34
       -
             booted=$(readlink -f /run/booted-system/kernel)

     

       35
       35
       -
       

     

       36
       36
       -
             if [ "$current" == "$booted" ]; then

     

       37
       37
       -
               echo "kernel version seems unchanged, skipping reboot" | systemd-cat --priority 4 --identifier "post-upgrade-check";

     

       38
       38
       -
             else

     

       39
       39
       -
               echo "kernel path changed, possibly a new version" | systemd-cat --priority 2 --identifier "post-upgrade-check"

     

       40
       40
       -
               echo "$booted" | systemd-cat --priority 2 --identifier "post-upgrade-kernel-check"

     

       41
       41
       -
               echo "$current" | systemd-cat --priority 2 --identifier "post-upgrade-kernel-check"

     

       42
       42
       -
               ${cfg.rebootAfterKernelUpgrade.method}

     

       43
       43
       -
             fi

     

       44
       44
       -
           '';

     

       45
       45
       -
         };

     

       46
       46
       -
       }

-269

modules/mailserver/postfix.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       with (import ./common.nix { inherit config pkgs lib; });

     

       20
       20
       -
       

     

       21
       21
       -
       let

     

       22
       22
       -
         inherit (lib.strings) concatStringsSep;

     

       23
       23
       -
         cfg = config.mailserver;

     

       24
       24
       -
       

     

       25
       25
       -
         # Merge several lookup tables. A lookup table is a attribute set where

     

       26
       26
       -
         # - the key is an address (user@example.com) or a domain (@example.com)

     

       27
       27
       -
         # - the value is a list of addresses

     

       28
       28
       -
         mergeLookupTables = tables: lib.zipAttrsWith (n: v: lib.flatten v) tables;

     

       29
       29
       -
       

     

       30
       30
       -
         # valiases_postfix :: Map String [String]

     

       31
       31
       -
         valiases_postfix = mergeLookupTables (lib.flatten (lib.mapAttrsToList

     

       32
       32
       -
           (name: value:

     

       33
       33
       -
             let to = name;

     

       34
       34
       -
             in map (from: {"${from}" = to;}) (value.aliases ++ lib.singleton name))

     

       35
       35
       -
           cfg.loginAccounts));

     

       36
       36
       -
       

     

       37
       37
       -
         # catchAllPostfix :: Map String [String]

     

       38
       38
       -
         catchAllPostfix =  mergeLookupTables (lib.flatten (lib.mapAttrsToList

     

       39
       39
       -
           (name: value:

     

       40
       40
       -
             let to = name;

     

       41
       41
       -
             in map (from: {"@${from}" = to;}) value.catchAll)

     

       42
       42
       -
             cfg.loginAccounts));

     

       43
       43
       -
       

     

       44
       44
       -
         # all_valiases_postfix :: Map String [String]

     

       45
       45
       -
         all_valiases_postfix = mergeLookupTables [valiases_postfix extra_valiases_postfix];

     

       46
       46
       -
       

     

       47
       47
       -
         # attrsToLookupTable :: Map String (Either String [ String ]) -> Map String [String]

     

       48
       48
       -
         attrsToLookupTable = aliases: let

     

       49
       49
       -
           lookupTables = lib.mapAttrsToList (from: to: {"${from}" = to;}) aliases;

     

       50
       50
       -
         in mergeLookupTables lookupTables;

     

       51
       51
       -
       

     

       52
       52
       -
         # extra_valiases_postfix :: Map String [String]

     

       53
       53
       -
         extra_valiases_postfix = attrsToLookupTable cfg.extraVirtualAliases;

     

       54
       54
       -
       

     

       55
       55
       -
         # forwards :: Map String [String]

     

       56
       56
       -
         forwards = attrsToLookupTable cfg.forwards;

     

       57
       57
       -
       

     

       58
       58
       -
         # lookupTableToString :: Map String [String] -> String

     

       59
       59
       -
         lookupTableToString = attrs: let

     

       60
       60
       -
           valueToString = value: lib.concatStringsSep ", " value;

     

       61
       61
       -
         in lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value: "${name} ${valueToString value}") attrs);

     

       62
       62
       -
       

     

       63
       63
       -
         # valiases_file :: Path

     

       64
       64
       -
         valiases_file = let

     

       65
       65
       -
           content = lookupTableToString (mergeLookupTables [all_valiases_postfix catchAllPostfix]);

     

       66
       66
       -
         in builtins.toFile "valias" content;

     

       67
       67
       -
       

     

       68
       68
       -
         # denied_recipients_postfix :: [ String ]

     

       69
       69
       -
         denied_recipients_postfix = (map

     

       70
       70
       -
           (acct: "${acct.name} REJECT ${acct.sendOnlyRejectMessage}")

     

       71
       71
       -
           (lib.filter (acct: acct.sendOnly) (lib.attrValues cfg.loginAccounts)));

     

       72
       72
       -
         denied_recipients_file = builtins.toFile "denied_recipients" (lib.concatStringsSep "\n" denied_recipients_postfix);

     

       73
       73
       -
       

     

       74
       74
       -
         reject_senders_postfix = (map

     

       75
       75
       -
           (sender:

     

       76
       76
       -
             "${sender} REJECT")

     

       77
       77
       -
           (cfg.rejectSender));

     

       78
       78
       -
         reject_senders_file = builtins.toFile "reject_senders" (lib.concatStringsSep "\n" (reject_senders_postfix))  ;

     

       79
       79
       -
       

     

       80
       80
       -
         reject_recipients_postfix = (map

     

       81
       81
       -
           (recipient:

     

       82
       82
       -
             "${recipient} REJECT")

     

       83
       83
       -
           (cfg.rejectRecipients));

     

       84
       84
       -
         # rejectRecipients :: [ Path ]

     

       85
       85
       -
         reject_recipients_file = builtins.toFile "reject_recipients" (lib.concatStringsSep "\n" (reject_recipients_postfix))  ;

     

       86
       86
       -
       

     

       87
       87
       -
         # vhosts_file :: Path

     

       88
       88
       -
         vhosts_file = builtins.toFile "vhosts" (concatStringsSep "\n" cfg.domains);

     

       89
       89
       -
       

     

       90
       90
       -
         # vaccounts_file :: Path

     

       91
       91
       -
         # see

     

       92
       92
       -
         # https://blog.grimneko.de/2011/12/24/a-bunch-of-tips-for-improving-your-postfix-setup/

     

       93
       93
       -
         # for details on how this file looks. By using the same file as valiases,

     

       94
       94
       -
         # every alias is owned (uniquely) by its user.

     

       95
       95
       -
         # The user's own address is already in all_valiases_postfix.

     

       96
       96
       -
         vaccounts_file = builtins.toFile "vaccounts" (lookupTableToString all_valiases_postfix);

     

       97
       97
       -
       

     

       98
       98
       -
         submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" (''

     

       99
       99
       -
            # Removes sensitive headers from mails handed in via the submission port.

     

       100
       100
       -
            # See https://thomas-leister.de/mailserver-debian-stretch/

     

       101
       101
       -
            # Uses "pcre" style regex.

     

       102
       102
       -
       

     

       103
       103
       -
            /^Received:/            IGNORE

     

       104
       104
       -
            /^X-Originating-IP:/    IGNORE

     

       105
       105
       -
            /^X-Mailer:/            IGNORE

     

       106
       106
       -
            /^User-Agent:/          IGNORE

     

       107
       107
       -
            /^X-Enigmail:/          IGNORE

     

       108
       108
       -
         '' + lib.optionalString cfg.rewriteMessageId ''

     

       109
       109
       -
       

     

       110
       110
       -
            # Replaces the user submitted hostname with the server's FQDN to hide the

     

       111
       111
       -
            # user's host or network.

     

       112
       112
       -
       

     

       113
       113
       -
            /^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@${cfg.fqdn}>

     

       114
       114
       -
         '');

     

       115
       115
       -
       

     

       116
       116
       -
         inetSocket = addr: port: "inet:[${toString port}@${addr}]";

     

       117
       117
       -
         unixSocket = sock: "unix:${sock}";

     

       118
       118
       -
       

     

       119
       119
       -
         smtpdMilters =

     

       120
       120
       -
          (lib.optional cfg.dkimSigning "unix:/run/opendkim/opendkim.sock")

     

       121
       121
       -
          ++ [ "unix:/run/rspamd/rspamd-milter.sock" ];

     

       122
       122
       -
       

     

       123
       123
       -
         policyd-spf = pkgs.writeText "policyd-spf.conf" cfg.policydSPFExtraConfig;

     

       124
       124
       -
       

     

       125
       125
       -
         mappedFile = name: "hash:/var/lib/postfix/conf/${name}";

     

       126
       126
       -
       

     

       127
       127
       -
         submissionOptions =

     

       128
       128
       -
           {

     

       129
       129
       -
             smtpd_tls_security_level = "encrypt";

     

       130
       130
       -
             smtpd_sasl_auth_enable = "yes";

     

       131
       131
       -
             smtpd_sasl_type = "dovecot";

     

       132
       132
       -
             smtpd_sasl_path = "/run/dovecot2/auth";

     

       133
       133
       -
             smtpd_sasl_security_options = "noanonymous";

     

       134
       134
       -
             smtpd_sasl_local_domain = "$myhostname";

     

       135
       135
       -
             smtpd_client_restrictions = "permit_sasl_authenticated,reject";

     

       136
       136
       -
             smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";

     

       137
       137
       -
             smtpd_sender_restrictions = "reject_sender_login_mismatch";

     

       138
       138
       -
             smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";

     

       139
       139
       -
             cleanup_service_name = "submission-header-cleanup";

     

       140
       140
       -
           };

     

       141
       141
       -
       in

     

       142
       142
       -
       {

     

       143
       143
       -
         config = with cfg; lib.mkIf enable {

     

       144
       144
       -
       

     

       145
       145
       -
           services.postfix = {

     

       146
       146
       -
             enable = true;

     

       147
       147
       -
             hostname = "${sendingFqdn}";

     

       148
       148
       -
             networksStyle = "host";

     

       149
       149
       -
             mapFiles."valias" = valiases_file;

     

       150
       150
       -
             mapFiles."vaccounts" = vaccounts_file;

     

       151
       151
       -
             mapFiles."denied_recipients" = denied_recipients_file;

     

       152
       152
       -
             mapFiles."reject_senders" = reject_senders_file;

     

       153
       153
       -
             mapFiles."reject_recipients" = reject_recipients_file;

     

       154
       154
       -
             sslCert = certificatePath;

     

       155
       155
       -
             sslKey = keyPath;

     

       156
       156
       -
             enableSubmission = cfg.enableSubmission;

     

       157
       157
       -
             enableSubmissions = cfg.enableSubmissionSsl;

     

       158
       158
       -
             virtual = lookupTableToString (mergeLookupTables [all_valiases_postfix catchAllPostfix forwards]);

     

       159
       159
       -
       

     

       160
       160
       -
             config = {

     

       161
       161
       -
               # Extra Config

     

       162
       162
       -
               mydestination = "";

     

       163
       163
       -
               recipient_delimiter = cfg.recipientDelimiter;

     

       164
       164
       -
               smtpd_banner = "${fqdn} ESMTP NO UCE";

     

       165
       165
       -
               disable_vrfy_command = true;

     

       166
       166
       -
               message_size_limit = toString cfg.messageSizeLimit;

     

       167
       167
       -
       

     

       168
       168
       -
               # virtual mail system

     

       169
       169
       -
               virtual_uid_maps = "static:5000";

     

       170
       170
       -
               virtual_gid_maps = "static:5000";

     

       171
       171
       -
               virtual_mailbox_base = mailDirectory;

     

       172
       172
       -
               virtual_mailbox_domains = vhosts_file;

     

       173
       173
       -
               virtual_mailbox_maps = mappedFile "valias";

     

       174
       174
       -
               virtual_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";

     

       175
       175
       -
               # Avoid leakage of X-Original-To, X-Delivered-To headers between recipients

     

       176
       176
       -
               lmtp_destination_recipient_limit = "1";

     

       177
       177
       -
       

     

       178
       178
       -
               # sasl with dovecot

     

       179
       179
       -
               smtpd_sasl_type = "dovecot";

     

       180
       180
       -
               smtpd_sasl_path = "/run/dovecot2/auth";

     

       181
       181
       -
               smtpd_sasl_auth_enable = true;

     

       182
       182
       -
               smtpd_relay_restrictions = [

     

       183
       183
       -
                 "permit_mynetworks" "permit_sasl_authenticated" "reject_unauth_destination"

     

       184
       184
       -
               ];

     

       185
       185
       -
       

     

       186
       186
       -
               policy-spf_time_limit = "3600s";

     

       187
       187
       -
       

     

       188
       188
       -
               # reject selected senders

     

       189
       189
       -
               smtpd_sender_restrictions = [

     

       190
       190
       -
                 "check_sender_access ${mappedFile "reject_senders"}"

     

       191
       191
       -
               ];

     

       192
       192
       -
       

     

       193
       193
       -
               # quota and spf checking

     

       194
       194
       -
               smtpd_recipient_restrictions = [

     

       195
       195
       -
                 "check_recipient_access ${mappedFile "denied_recipients"}"

     

       196
       196
       -
                 "check_recipient_access ${mappedFile "reject_recipients"}"

     

       197
       197
       -
                 "check_policy_service inet:localhost:12340"

     

       198
       198
       -
                 "check_policy_service unix:private/policy-spf"

     

       199
       199
       -
               ];

     

       200
       200
       -
       

     

       201
       201
       -
               # TLS settings, inspired by https://github.com/jeaye/nix-files

     

       202
       202
       -
               # Submission by mail clients is handled in submissionOptions

     

       203
       203
       -
               smtpd_tls_security_level = "may";

     

       204
       204
       -
       

     

       205
       205
       -
               # strong might suffice and is computationally less expensive

     

       206
       206
       -
               smtpd_tls_eecdh_grade = "ultra";

     

       207
       207
       -
       

     

       208
       208
       -
               # Disable obselete protocols

     

       209
       209
       -
               smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       210
       210
       -
               smtp_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       211
       211
       -
               smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       212
       212
       -
               smtp_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       213
       213
       -
       

     

       214
       214
       -
               smtp_tls_ciphers = "high";

     

       215
       215
       -
               smtpd_tls_ciphers = "high";

     

       216
       216
       -
               smtp_tls_mandatory_ciphers = "high";

     

       217
       217
       -
               smtpd_tls_mandatory_ciphers = "high";

     

       218
       218
       -
       

     

       219
       219
       -
               # Disable deprecated ciphers

     

       220
       220
       -
               smtpd_tls_mandatory_exclude_ciphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";

     

       221
       221
       -
               smtpd_tls_exclude_ciphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";

     

       222
       222
       -
               smtp_tls_mandatory_exclude_ciphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";

     

       223
       223
       -
               smtp_tls_exclude_ciphers = "MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL";

     

       224
       224
       -
       

     

       225
       225
       -
               tls_preempt_cipherlist = true;

     

       226
       226
       -
       

     

       227
       227
       -
               # Allowing AUTH on a non encrypted connection poses a security risk

     

       228
       228
       -
               smtpd_tls_auth_only = true;

     

       229
       229
       -
               # Log only a summary message on TLS handshake completion

     

       230
       230
       -
               smtpd_tls_loglevel = "1";

     

       231
       231
       -
       

     

       232
       232
       -
               # Configure a non blocking source of randomness

     

       233
       233
       -
               tls_random_source = "dev:/dev/urandom";

     

       234
       234
       -
       

     

       235
       235
       -
               smtpd_milters = smtpdMilters;

     

       236
       236
       -
               non_smtpd_milters = lib.mkIf cfg.dkimSigning ["unix:/run/opendkim/opendkim.sock"];

     

       237
       237
       -
               milter_protocol = "6";

     

       238
       238
       -
               milter_mail_macros = "i {mail_addr} {client_addr} {client_name} {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer}";

     

       239
       239
       -
       

     

       240
       240
       -
             };

     

       241
       241
       -
       

     

       242
       242
       -
             submissionOptions = submissionOptions;

     

       243
       243
       -
             submissionsOptions = submissionOptions;

     

       244
       244
       -
       

     

       245
       245
       -
             masterConfig = {

     

       246
       246
       -
               "lmtp" = {

     

       247
       247
       -
                 # Add headers when delivering, see http://www.postfix.org/smtp.8.html

     

       248
       248
       -
                 # D => Delivered-To, O => X-Original-To, R => Return-Path

     

       249
       249
       -
                 args = [ "flags=O" ];

     

       250
       250
       -
               };

     

       251
       251
       -
               "policy-spf" = {

     

       252
       252
       -
                 type = "unix";

     

       253
       253
       -
                 privileged = true;

     

       254
       254
       -
                 chroot = false;

     

       255
       255
       -
                 command = "spawn";

     

       256
       256
       -
                 args = [ "user=nobody" "argv=${pkgs.pypolicyd-spf}/bin/policyd-spf" "${policyd-spf}"];

     

       257
       257
       -
               };

     

       258
       258
       -
               "submission-header-cleanup" = {

     

       259
       259
       -
                 type = "unix";

     

       260
       260
       -
                 private = false;

     

       261
       261
       -
                 chroot = false;

     

       262
       262
       -
                 maxproc = 0;

     

       263
       263
       -
                 command = "cleanup";

     

       264
       264
       -
                 args = ["-o" "header_checks=pcre:${submissionHeaderCleanupRules}"];

     

       265
       265
       -
               };

     

       266
       266
       -
             };

     

       267
       267
       -
           };

     

       268
       268
       -
         };

     

       269
       269
       -
       }

-59

modules/mailserver/rsnapshot.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       with lib;

     

       20
       20
       -
       

     

       21
       21
       -
       let

     

       22
       22
       -
         cfg = config.mailserver;

     

       23
       23
       -
       

     

       24
       24
       -
         preexecDefined = cfg.backup.cmdPreexec != null;

     

       25
       25
       -
         preexecWrapped = pkgs.writeScript "rsnapshot-preexec.sh" ''

     

       26
       26
       -
           #!${pkgs.stdenv.shell}

     

       27
       27
       -
           set -e

     

       28
       28
       -
       

     

       29
       29
       -
           ${cfg.backup.cmdPreexec}

     

       30
       30
       -
         '';

     

       31
       31
       -
         preexecString = optionalString preexecDefined "cmd_preexec	${preexecWrapped}";

     

       32
       32
       -
       

     

       33
       33
       -
         postexecDefined = cfg.backup.cmdPostexec != null;

     

       34
       34
       -
         postexecWrapped = pkgs.writeScript "rsnapshot-postexec.sh" ''

     

       35
       35
       -
           #!${pkgs.stdenv.shell}

     

       36
       36
       -
           set -e

     

       37
       37
       -
       

     

       38
       38
       -
           ${cfg.backup.cmdPostexec}

     

       39
       39
       -
         '';

     

       40
       40
       -
         postexecString = optionalString postexecDefined "cmd_postexec	${postexecWrapped}";

     

       41
       41
       -
       in {

     

       42
       42
       -
         config = mkIf (cfg.enable && cfg.backup.enable) {

     

       43
       43
       -
           services.rsnapshot = {

     

       44
       44
       -
             enable = true;

     

       45
       45
       -
             cronIntervals = cfg.backup.cronIntervals;

     

       46
       46
       -
             # rsnapshot expects intervals shortest first, e.g. hourly first, then daily.

     

       47
       47
       -
             # tabs must separate all elements

     

       48
       48
       -
             extraConfig = ''

     

       49
       49
       -
               ${preexecString}

     

       50
       50
       -
               ${postexecString}

     

       51
       51
       -
               snapshot_root	${cfg.backup.snapshotRoot}/

     

       52
       52
       -
               retain	hourly	${toString cfg.backup.retain.hourly}

     

       53
       53
       -
               retain	daily	${toString cfg.backup.retain.daily}

     

       54
       54
       -
               retain	weekly	${toString cfg.backup.retain.weekly}

     

       55
       55
       -
               backup	${cfg.mailDirectory}/	localhost/

     

       56
       56
       -
             '';

     

       57
       57
       -
           };

     

       58
       58
       -
         };

     

       59
       59
       -
       }

-119

modules/mailserver/rspamd.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver;

     

       21
       21
       -
       

     

       22
       22
       -
         postfixCfg = config.services.postfix;

     

       23
       23
       -
         rspamdCfg = config.services.rspamd;

     

       24
       24
       -
         rspamdSocket = "rspamd.service";

     

       25
       25
       -
       in

     

       26
       26
       -
       {

     

       27
       27
       -
         config = with cfg; lib.mkIf enable {

     

       28
       28
       -
           services.rspamd = {

     

       29
       29
       -
             enable = true;

     

       30
       30
       -
             inherit debug;

     

       31
       31
       -
             locals = {

     

       32
       32
       -
                 "milter_headers.conf" = { text = ''

     

       33
       33
       -
                     extended_spam_headers = yes;

     

       34
       34
       -
                 ''; };

     

       35
       35
       -
                 "redis.conf" = { text = ''

     

       36
       36
       -
                     servers = "${cfg.redis.address}:${toString cfg.redis.port}";

     

       37
       37
       -
                 '' + (lib.optionalString (cfg.redis.password != null) ''

     

       38
       38
       -
                     password = "${cfg.redis.password}";

     

       39
       39
       -
                 ''); };

     

       40
       40
       -
                 "classifier-bayes.conf" = { text = ''

     

       41
       41
       -
                     cache {

     

       42
       42
       -
                       backend = "redis";

     

       43
       43
       -
                     }

     

       44
       44
       -
                 ''; };

     

       45
       45
       -
                 "antivirus.conf" = lib.mkIf cfg.virusScanning { text = ''

     

       46
       46
       -
                     clamav {

     

       47
       47
       -
                       action = "reject";

     

       48
       48
       -
                       symbol = "CLAM_VIRUS";

     

       49
       49
       -
                       type = "clamav";

     

       50
       50
       -
                       log_clean = true;

     

       51
       51
       -
                       servers = "/run/clamav/clamd.ctl";

     

       52
       52
       -
                       scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all

     

       53
       53
       -
                     }

     

       54
       54
       -
                 ''; };

     

       55
       55
       -
                 "dkim_signing.conf" = { text = ''

     

       56
       56
       -
                     # Disable outbound email signing, we use opendkim for this

     

       57
       57
       -
                     enabled = false;

     

       58
       58
       -
                 ''; };

     

       59
       59
       -
             };

     

       60
       60
       -
       

     

       61
       61
       -
             overrides = {

     

       62
       62
       -
               "milter_headers.conf" = {

     

       63
       63
       -
                 text = ''

     

       64
       64
       -
                   extended_spam_headers = true;

     

       65
       65
       -
                 '';

     

       66
       66
       -
               };

     

       67
       67
       -
             };

     

       68
       68
       -
       

     

       69
       69
       -
             workers.rspamd_proxy = {

     

       70
       70
       -
               type = "rspamd_proxy";

     

       71
       71
       -
               bindSockets = [{

     

       72
       72
       -
                 socket = "/run/rspamd/rspamd-milter.sock";

     

       73
       73
       -
                 mode = "0664";

     

       74
       74
       -
               }];

     

       75
       75
       -
               count = 1; # Do not spawn too many processes of this type

     

       76
       76
       -
               extraConfig = ''

     

       77
       77
       -
                 milter = yes; # Enable milter mode

     

       78
       78
       -
                 timeout = 120s; # Needed for Milter usually

     

       79
       79
       -
       

     

       80
       80
       -
                 upstream "local" {

     

       81
       81
       -
                   default = yes; # Self-scan upstreams are always default

     

       82
       82
       -
                   self_scan = yes; # Enable self-scan

     

       83
       83
       -
                 }

     

       84
       84
       -
               '';

     

       85
       85
       -
             };

     

       86
       86
       -
             workers.controller = {

     

       87
       87
       -
               type = "controller";

     

       88
       88
       -
               count = 1;

     

       89
       89
       -
               bindSockets = [{

     

       90
       90
       -
                 socket = "/run/rspamd/worker-controller.sock";

     

       91
       91
       -
                 mode = "0666";

     

       92
       92
       -
               }];

     

       93
       93
       -
               includes = [];

     

       94
       94
       -
               extraConfig = ''

     

       95
       95
       -
                 static_dir = "''${WWWDIR}"; # Serve the web UI static assets

     

       96
       96
       -
               '';

     

       97
       97
       -
             };

     

       98
       98
       -
       

     

       99
       99
       -
           };

     

       100
       100
       -
       

     

       101
       101
       -
           services.redis.servers.rspamd = {

     

       102
       102
       -
             enable = lib.mkDefault true;

     

       103
       103
       -
             port = lib.mkDefault 6380;

     

       104
       104
       -
           };

     

       105
       105
       -
       

     

       106
       106
       -
           systemd.services.rspamd = {

     

       107
       107
       -
             requires = [ "redis-rspamd.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");

     

       108
       108
       -
             after = [ "redis-rspamd.service" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service");

     

       109
       109
       -
           };

     

       110
       110
       -
       

     

       111
       111
       -
           systemd.services.postfix = {

     

       112
       112
       -
             after = [ rspamdSocket ];

     

       113
       113
       -
             requires = [ rspamdSocket ];

     

       114
       114
       -
           };

     

       115
       115
       -
       

     

       116
       116
       -
           users.extraUsers.${postfixCfg.user}.extraGroups = [ rspamdCfg.group ];

     

       117
       117
       -
         };

     

       118
       118
       -
       }

     

       119
       119
       -

-83

modules/mailserver/systemd.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       let

     

       20
       20
       -
         cfg = config.mailserver;

     

       21
       21
       -
         certificatesDeps =

     

       22
       22
       -
           if cfg.certificateScheme == 1 then

     

       23
       23
       -
             []

     

       24
       24
       -
           else if cfg.certificateScheme == 2 then

     

       25
       25
       -
             [ "mailserver-selfsigned-certificate.service" ]

     

       26
       26
       -
           else

     

       27
       27
       -
             [ "acme-finished-${cfg.fqdn}.target" ];

     

       28
       28
       -
       in

     

       29
       29
       -
       {

     

       30
       30
       -
         config = with cfg; lib.mkIf enable {

     

       31
       31
       -
           # Create self signed certificate

     

       32
       32
       -
           systemd.services.mailserver-selfsigned-certificate = lib.mkIf (cfg.certificateScheme == 2) {

     

       33
       33
       -
             after = [ "local-fs.target" ];

     

       34
       34
       -
             script = ''

     

       35
       35
       -
               # Create certificates if they do not exist yet

     

       36
       36
       -
               dir="${cfg.certificateDirectory}"

     

       37
       37
       -
               fqdn="${cfg.fqdn}"

     

       38
       38
       -
               [[ $fqdn == /* ]] && fqdn=$(< "$fqdn")

     

       39
       39
       -
               key="$dir/key-${cfg.fqdn}.pem";

     

       40
       40
       -
               cert="$dir/cert-${cfg.fqdn}.pem";

     

       41
       41
       -
       

     

       42
       42
       -
               if [[ ! -f $key || ! -f $cert ]]; then

     

       43
       43
       -
                   mkdir -p "${cfg.certificateDirectory}"

     

       44
       44
       -
                   (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "$key" 2048) &&

     

       45
       45
       -
                       "${pkgs.openssl}/bin/openssl" req -new -key "$key" -x509 -subj "/CN=$fqdn" \

     

       46
       46
       -
                               -days 3650 -out "$cert"

     

       47
       47
       -
               fi

     

       48
       48
       -
             '';

     

       49
       49
       -
             serviceConfig = {

     

       50
       50
       -
               Type = "oneshot";

     

       51
       51
       -
               PrivateTmp = true;

     

       52
       52
       -
             };

     

       53
       53
       -
           };

     

       54
       54
       -
       

     

       55
       55
       -
           # Create maildir folder before dovecot startup

     

       56
       56
       -
           systemd.services.dovecot2 = {

     

       57
       57
       -
             wants = certificatesDeps;

     

       58
       58
       -
             after = certificatesDeps;

     

       59
       59
       -
             preStart = let

     

       60
       60
       -
               directories = lib.strings.escapeShellArgs (

     

       61
       61
       -
                 [ mailDirectory ]

     

       62
       62
       -
                 ++ lib.optional (cfg.indexDir != null) cfg.indexDir

     

       63
       63
       -
               );

     

       64
       64
       -
             in ''

     

       65
       65
       -
               # Create mail directory and set permissions. See

     

       66
       66
       -
               # <http://wiki2.dovecot.org/SharedMailboxes/Permissions>.

     

       67
       67
       -
               mkdir -p ${directories}

     

       68
       68
       -
               chgrp "${vmailGroupName}" ${directories}

     

       69
       69
       -
               chmod 02770 ${directories}

     

       70
       70
       -
             '';

     

       71
       71
       -
           };

     

       72
       72
       -
       

     

       73
       73
       -
           # Postfix requires dovecot lmtp socket, dovecot auth socket and certificate to work

     

       74
       74
       -
           systemd.services.postfix = {

     

       75
       75
       -
             wants = certificatesDeps;

     

       76
       76
       -
             after = [ "dovecot2.service" ]

     

       77
       77
       -
               ++ lib.optional cfg.dkimSigning "opendkim.service"

     

       78
       78
       -
               ++ certificatesDeps;

     

       79
       79
       -
             requires = [ "dovecot2.service" ]

     

       80
       80
       -
               ++ lib.optional cfg.dkimSigning "opendkim.service";

     

       81
       81
       -
           };

     

       82
       82
       -
         };

     

       83
       83
       -
       }

-97

modules/mailserver/users.nix

···

       1
       1
       -
       #  nixos-mailserver: a simple mail server

     

       2
       2
       -
       #  Copyright (C) 2016-2018  Robin Raymond

     

       3
       3
       -
       #

     

       4
       4
       -
       #  This program is free software: you can redistribute it and/or modify

     

       5
       5
       -
       #  it under the terms of the GNU General Public License as published by

     

       6
       6
       -
       #  the Free Software Foundation, either version 3 of the License, or

     

       7
       7
       -
       #  (at your option) any later version.

     

       8
       8
       -
       #

     

       9
       9
       -
       #  This program is distributed in the hope that it will be useful,

     

       10
       10
       -
       #  but WITHOUT ANY WARRANTY; without even the implied warranty of

     

       11
       11
       -
       #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

     

       12
       12
       -
       #  GNU General Public License for more details.

     

       13
       13
       -
       #

     

       14
       14
       -
       #  You should have received a copy of the GNU General Public License

     

       15
       15
       -
       #  along with this program. If not, see <http://www.gnu.org/licenses/>

     

       16
       16
       -
       

     

       17
       17
       -
       { config, pkgs, lib, ... }:

     

       18
       18
       -
       

     

       19
       19
       -
       with config.mailserver;

     

       20
       20
       -
       

     

       21
       21
       -
       let

     

       22
       22
       -
         vmail_user = {

     

       23
       23
       -
           name = vmailUserName;

     

       24
       24
       -
           isSystemUser = true;

     

       25
       25
       -
           uid = vmailUID;

     

       26
       26
       -
           home = mailDirectory;

     

       27
       27
       -
           createHome = true;

     

       28
       28
       -
           group = vmailGroupName;

     

       29
       29
       -
         };

     

       30
       30
       -
       

     

       31
       31
       -
       

     

       32
       32
       -
         virtualMailUsersActivationScript = pkgs.writeScript "activate-virtual-mail-users" ''

     

       33
       33
       -
           #!${pkgs.stdenv.shell}

     

       34
       34
       -
       

     

       35
       35
       -
           set -euo pipefail

     

       36
       36
       -
       

     

       37
       37
       -
           # Create directory to store user sieve scripts if it doesn't exist

     

       38
       38
       -
           if (! test -d "${sieveDirectory}"); then

     

       39
       39
       -
             mkdir "${sieveDirectory}"

     

       40
       40
       -
             chown "${vmailUserName}:${vmailGroupName}" "${sieveDirectory}"

     

       41
       41
       -
             chmod 770 "${sieveDirectory}"

     

       42
       42
       -
           fi

     

       43
       43
       -
       

     

       44
       44
       -
           # Copy user's sieve script to the correct location (if it exists).  If it

     

       45
       45
       -
           # is null, remove the file.

     

       46
       46
       -
           ${lib.concatMapStringsSep "\n" ({ name, sieveScript }:

     

       47
       47
       -
             if lib.isString sieveScript then ''

     

       48
       48
       -
               if (! test -d "${sieveDirectory}/${name}"); then

     

       49
       49
       -
                 mkdir -p "${sieveDirectory}/${name}"

     

       50
       50
       -
                 chown "${vmailUserName}:${vmailGroupName}" "${sieveDirectory}/${name}"

     

       51
       51
       -
                 chmod 770 "${sieveDirectory}/${name}"

     

       52
       52
       -
               fi

     

       53
       53
       -
               cat << 'EOF' > "${sieveDirectory}/${name}/default.sieve"

     

       54
       54
       -
               ${sieveScript}

     

       55
       55
       -
               EOF

     

       56
       56
       -
               chown "${vmailUserName}:${vmailGroupName}" "${sieveDirectory}/${name}/default.sieve"

     

       57
       57
       -
             '' else ''

     

       58
       58
       -
               if (test -f "${sieveDirectory}/${name}/default.sieve"); then

     

       59
       59
       -
                 rm "${sieveDirectory}/${name}/default.sieve"

     

       60
       60
       -
               fi

     

       61
       61
       -
               if (test -f "${sieveDirectory}/${name}.svbin"); then

     

       62
       62
       -
                 rm "${sieveDirectory}/${name}/default.svbin"

     

       63
       63
       -
               fi

     

       64
       64
       -
             '') (map (user: { inherit (user) name sieveScript; })

     

       65
       65
       -
                   (lib.attrValues loginAccounts))}

     

       66
       66
       -
         '';

     

       67
       67
       -
       in {

     

       68
       68
       -
         config = lib.mkIf enable {

     

       69
       69
       -
           # assert that all accounts provide a password

     

       70
       70
       -
       

     

       71
       71
       -
           # warn for accounts that specify both password and file

     

       72
       72
       -
           warnings = (map

     

       73
       73
       -
             (acct: "${acct.name} specifies both a password and password file; password file will be used")

     

       74
       74
       -
             (lib.filter

     

       75
       75
       -
               (acct: (acct.password != null && acct.passwordFile != null))

     

       76
       76
       -
               (lib.attrValues loginAccounts)));

     

       77
       77
       -
       

     

       78
       78
       -
           # set the vmail gid to a specific value

     

       79
       79
       -
           users.groups = {

     

       80
       80
       -
             "${vmailGroupName}" = { gid = vmailUID; };

     

       81
       81
       -
           };

     

       82
       82
       -
       

     

       83
       83
       -
           # define all users

     

       84
       84
       -
           users.users = {

     

       85
       85
       -
             "${vmail_user.name}" = lib.mkForce vmail_user;

     

       86
       86
       -
           };

     

       87
       87
       -
       

     

       88
       88
       -
           systemd.services.activate-virtual-mail-users = {

     

       89
       89
       -
             wantedBy = [ "multi-user.target" ];

     

       90
       90
       -
             before = [ "dovecot2.service" ];

     

       91
       91
       -
             serviceConfig = {

     

       92
       92
       -
               ExecStart = virtualMailUsersActivationScript;

     

       93
       93
       -
             };

     

       94
       94
       -
             enable = true;

     

       95
       95
       -
           };

     

       96
       96
       -
         };

     

       97
       97
       -
       }