]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/rspamd.nix
dovecot: add dovecot_fts_xapian
[sourcephile-nix.git] / servers / mermet / rspamd.nix
1 { pkgs, lib, config, ... }:
2 let inherit (builtins) attrNames listToAttrs;
3 inherit (builtins.extraBuiltins) pass pass-chomp;
4 inherit (lib) types;
5 inherit (pkgs.lib) unlinesAttrs;
6 inherit (config) networking;
7 inherit (config.services) postfix rspamd dovecot2;
8 in
9 {
10 systemd.services.rspamd.after =
11 lib.mapAttrsToList
12 (domain: dom: "dkim.${domain}.${dom.selector}.key-key.service")
13 rspamd.dkim.domains;
14 deployment.keys = lib.mapAttrs'
15 (domain: dom:
16 lib.nameValuePair "dkim.${domain}.${dom.selector}.key" {
17 text = pass dom.selectors."${dom.selector}".key;
18 user = rspamd.user;
19 group = rspamd.group;
20 destDir = "/run/keys/";
21 permissions = "0400"; # WARNING: not enforced when deployment.storeKeysOnMachine = true
22 })
23 rspamd.dkim.domains;
24 services.rspamd = {
25 enable = true;
26 debug = false;
27 postfix = {
28 enable = postfix.enable;
29 };
30 dkim = {
31 enable = true;
32 domains = {
33 "${networking.domainBase}.fr" = {
34 selector = "20200101";
35 selectors = {
36 "20200101" = {
37 key = "dkim/${networking.domainBase}.20200101.key";
38 dns = ''
39 20200101._domainkey IN TXT ( "v=DKIM1; k=rsa; "
40 "p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7EKzverbG+5JF+yFjH3MrxLyauiHyLqBbV/8LEMunoKXF8sqhBpQtAQXruLqsyUkxR/4CAyPMyzmcdrU43boMj9yFqLrg/kEz2RIvai9jXBqRoWRW1y7F0LbZmdtOTncuDSP8Zzo02XUzsOC4f/C3tEQHS5rc"
41 "hzfhU5FY1CeO6eBMV79qKBOvGMKahQTrrtU6olAAJxOhn6wRuwSf"
42 "+m3on1OqiuXYYIgNHKdRhJ8gDwIm/3LEpYMD0gTgJiyclCLoLGHGtKZy1Wf9xV9/7V6fHE4JW5SDivwslVTL+KPXOlIpo5NDHpMxPYOcIg2K4Rj/j7jhavo+fG43q1LhwaPkEMQMbplgnjeMY8300odRiklTkMMpH0m35ZNeHQJSRpEtV8y5xUNxVaGzfqX5iStwV/mQ1Kn"
43 "ZSe8ORTNq+eTTFnDk6zdUXjagcf0wO6QsSTeAz/G8CqOBbwmrU+q"
44 "F8WbGAeRnhz51mH6fTTfsQ1nwjAiF4ou+eQGTkTMN23KkCKpuozJnxqx4DCEr6J1bL83fhXw7CgcfgKgTOk/HFJpeiGhqodw18r4DWBA6G57z9utm7Mr/9SoVnMq6iK9iEcbCllLR8Sz4viatLSRzhodbk7hfvXS3jmCFjILAjFmA7aMTemDMBDQhpAGF9F8sjFUbEJIZjK"
45 "rWWtSTdO8DilDqN8CAwEAAQ=="
46 );
47 '';
48 };
49 };
50 };
51 };
52 };
53 locals =
54 let selector_map_file =
55 pkgs.writeText "dkim_selectors.map"
56 (unlinesAttrs
57 (domain: dom: "${domain} ${dom.selector}")
58 rspamd.dkim.domains);
59 in {
60 "dkim_signing.conf".text = ''
61 selector_map = ${selector_map_file};
62 path = "/run/keys/rspamd/dkim.$domain.$selector.key";
63 allow_username_mismatch = true;
64 '';
65 "arc.conf".text = ''
66 selector_map = ${selector_map_file};
67 path = "/run/keys/rspamd/dkim.$domain.$selector.key";
68 allow_username_mismatch = true;
69 '';
70 /*
71 "logging.conf" = ''
72 debug_modules = [“dkim_signing”]
73 '';
74 */
75 };
76 overrides = {
77 "milter_headers.conf".text = ''
78 extended_spam_headers = true;
79 '';
80 "actions.conf".text = ''
81 reject = 15; # Reject when reaching this score
82 add_header = 6; # Add header when reaching this score
83 greylist = 4; # Apply greylisting when reaching this score (will emit `soft reject action`)
84 '';
85 };
86 workers = {
87 learner = {
88 # Like controller but without a password, only the bindSockets' permissions
89 type = "controller";
90 includes = [ "$CONFDIR/worker-controller.inc" ];
91 bindSockets = [
92 { socket = "/run/rspamd/learner.sock";
93 mode = "0660";
94 owner = "${rspamd.user}";
95 group = "${dovecot2.group}";
96 }
97 ];
98 extraConfig = ''
99 '';
100 };
101 controller = {
102 includes = [ "$CONFDIR/worker-controller.inc" ];
103 bindSockets = [
104 "127.0.0.1:11334"
105 ];
106 extraConfig = ''
107 #count = 1;
108 #static_dir = "''${WWWDIR}";
109 # USE: rspamadm pw
110 password = "${pass-chomp "servers/mermet/rspamd/controller/hashedPassword"}";
111 '';
112 };
113 };
114 };
115 /*
116 services.postfix.extraConfig = ''
117 smtpd_milters = unix:/run/rspamd.sock
118 milter_default_action = accept
119 '';
120 # Allow users to run 'rspamc' and 'rspamadm'.
121 environment.systemPackages = [ pkgs.rspamd ];
122 */
123
124 /*
125 services.redis = {
126 enable = true;
127 };
128 */
129 }