]> Git — Sourcephile - sourcephile-nix.git/blob - nixos/modules/services/mail/postfix.nix
nix: update inputs
[sourcephile-nix.git] / nixos / modules / services / mail / postfix.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (lib) types;
4 inherit (config.services) postfix;
5 in
6 {
7 options = {
8 services.postfix = {
9 tls_server_sni_maps = lib.mkOption {
10 type = types.attrsOf (types.listOf types.path);
11 default = { };
12 apply = m: pkgs.writeText "sni" (lib.concatStringsSep "\n" (lib.mapAttrsToList
13 (domain: x509: ''
14 ${domain} ${lib.concatStringsSep " " x509}
15 '')
16 m));
17 };
18 };
19 };
20 config = {
21 systemd.services.postfix = {
22 preStart = ''
23 install -m 400 -o root -g root ${postfix.tls_server_sni_maps} /run/keys/postfix-sni
24 ${pkgs.postfix}/bin/postmap -F hash:/run/keys/postfix-sni
25 '';
26 };
27 services.postfix = {
28 masterConfig = {
29 submissions-header-cleanup = {
30 type = "unix";
31 private = false;
32 maxproc = 0;
33 command = "cleanup";
34 args = [
35 "-o"
36 ("header_checks=pcre:" + pkgs.writeText "submission_header_cleanup_rules" ''
37 # Removes sensitive headers from mails handed in via the submission or smtps port.
38 # See https://thomas-leister.de/mailserver-debian-stretch/
39 # Uses "pcre" style regex.
40
41 /^Received:/ IGNORE
42 /^User-Agent:/ IGNORE
43 /^X-Enigmail:/ IGNORE
44 /^X-Mailer:/ IGNORE
45 /^X-Originating-IP:/ IGNORE
46 '')
47 ];
48 };
49 };
50 };
51 };
52 }