]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/postfix.nix
mermet: gitolite: update
[sourcephile-nix.git] / hosts / losurdo / postfix.nix
1 { lib, config, ... }:
2 let
3 inherit (config) networking users;
4 inherit (config.services) postfix;
5 in
6 {
7 imports = [
8 #postfix/autogeree.net.nix
9 #postfix/sourcephile.fr.nix
10 ];
11 users.groups.acme.members = [ postfix.user ];
12 networking.nftables.ruleset = ''
13 table inet filter {
14 chain input-net {
15 #tcp dport 25 counter accept comment "postfix: SMTP"
16 #tcp dport 465 counter accept comment "postfix: submissions"
17 }
18 chain output-net {
19 skuid ${postfix.user} tcp dport smtp counter accept comment "postfix: SMTP"
20 }
21 }
22 '';
23 services.postfix = {
24 enable = true;
25 networksStyle = "host";
26 hostname = "${networking.hostName}.${networking.domain}";
27 domain = networking.domain;
28 origin = "$myhostname";
29 destination = [
30 "localhost"
31 "localhost.localdomain"
32 "$myhostname"
33 ];
34 postmasterAlias = "root";
35 rootAlias = "root@${networking.domain}";
36 sslKey = "/var/lib/acme/${networking.domain}/key.pem";
37 sslCert = "/var/lib/acme/${networking.domain}/fullchain.pem";
38 networks = [
39 "127.0.0.0/8"
40 "[::1]/128"
41 ];
42 setSendmail = true;
43 # Parse the extension in email address, eg. contact+extension@
44 recipientDelimiter = "+";
45 config = {
46 debug_peer_level = "4";
47 debug_peer_list = [
48 #"chomsky.autogeree.net"
49 #"localhost"
50 #"mail.sourcephile.fr"
51 ];
52
53 #
54 # Sending to the world
55 #
56 # Appending .domain is the MUA's job
57 append_dot_mydomain = false;
58 smtp_body_checks = "";
59 #smtp_cname_overrides_servername = false;
60 smtp_connect_timeout = "60s";
61 #smtp_header_checks = "regexp:/var/lib/postfix/smtp_header_checks";
62 smtp_mime_header_checks = "";
63 smtp_nested_header_checks = "";
64 smtp_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
65 #smtp_tls_fingerprint_digest = "sha1";
66 smtp_tls_loglevel = "1";
67 #smtp_tls_note_starttls_offer = true;
68 #smtp_tls_policy_maps = "hash:/var/lib/postfix/conf/tls_policy";
69 # Only allow TLSv* protocols
70 smtp_tls_protocols = [ "!SSLv2" "!SSLv3" ];
71 #smtp_tls_scert_verifydepth = "5";
72 #smtp_tls_secure_cert_match = [ "nexthop" "dot-nexthop" ];
73 smtp_tls_security_level = "may";
74 smtp_tls_session_cache_database = "btree:$data_directory/smtp_tls_session_cache";
75 #smtp_tls_session_cache_timeout = "3600s";
76 #smtp_tls_verify_cert_match = "hostname";
77
78 #
79 # Receiving from the world
80 #
81 message_size_limit = "20480000";
82 maximal_queue_lifetime = "5d";
83 default_extra_recipient_limit = "5000";
84 line_length_limit = "2048";
85 duplicate_filter_limit = "5000";
86 # Stops mail from poorly written software
87 strict_rfc821_envelopes = true;
88 mime_header_checks = [ ];
89 milter_header_checks = [ ];
90 nested_header_checks = [ ];
91 body_checks = [ ];
92 content_filter = "";
93 permit_mx_backup_networks = [ ];
94 propagate_unmatched_extensions = [ "canonical" "virtual" "alias" ];
95 #masquerade_classes = [ "envelope_sender" "header_sender" "header_recipient" ];
96 #masquerade_domains = "";
97 #masquerade_exceptions = "root";
98 queue_minfree = "0";
99 # Stops some techniques used to harvest email addresses
100 disable_vrfy_command = true;
101 enable_long_queue_ids = false;
102 # Useful to test restrictions
103 smtpd_authorized_xclient_hosts = "127.0.0.1";
104 smtpd_banner = "$myhostname ESMTP $mail_name (NixOS)";
105 smtpd_client_connection_count_limit = "50";
106 smtpd_client_connection_rate_limit = "0";
107 smtpd_client_event_limit_exceptions = "$mynetworks";
108 smtpd_client_message_rate_limit = "0";
109 smtpd_client_new_tls_session_rate_limit = "0";
110 smtpd_client_port_logging = false;
111 smtpd_client_recipient_rate_limit = "0";
112 # Ban 5 sec on error
113 smtpd_error_sleep_time = "5";
114 # Needed to enforce reject_unknown_helo_hostname
115 smtpd_helo_required = true;
116 smtpd_helo_restrictions = [
117 "reject_invalid_helo_hostname"
118 "reject_non_fqdn_helo_hostname"
119 # Don't talk to mail systems that don't know their own hostname.
120 "reject_unknown_helo_hostname"
121 "permit"
122 ];
123 smtpd_client_restrictions = [
124 ];
125 # Set in postfix/*.nix and used in submissions/smptd
126 # with reject_sender_login_mismatch
127 smtpd_sender_login_maps = [ ];
128 smtpd_sender_restrictions = [
129 "reject_non_fqdn_sender"
130 "permit"
131 ];
132 smtpd_reject_unlisted_recipient = true;
133 # Check the RCPT TO, before smtpd_recipient_restrictions
134 # Restrictions based on what is allowed or not,
135 # these are applied before smtpd_recipient_restrictions
136 smtpd_relay_restrictions = [
137 "permit_mynetworks"
138 # Check the recipient's address in virtual_mailbox_domains and virtual_mailbox_maps
139 "permit_auth_destination"
140 # The world is only authorized to use our relay for the above destinations.
141 "reject"
142 ];
143 # Restrictions based on what is working or not
144 smtpd_recipient_restrictions = [
145 # Reject if the domain is not fully qualified
146 "reject_non_fqdn_recipient"
147 # Reject if the domain is not working, even before bothering to check the address
148 "reject_unknown_recipient_domain"
149 # Reject if the address is not working
150 # WARNING: this does not work if the recipient is greylisting.
151 # WARNING: verify(8) has a cache, dumpable if verify(8) is stopped, with:
152 # postmap -s btree:/var/lib/postfix/data/verify_cache
153 #"reject_unverified_recipient"
154 "permit"
155 ];
156 # Trust the verify database
157 #unverified_recipient_reject_code = "550";
158 smtpd_data_restrictions = [
159 # Force the smtpd's client to wait OK before sending
160 "reject_unauth_pipelining"
161 "permit"
162 ];
163 smtpd_end_of_data_restrictions = [
164 # Enforce mail volume quota via policy service callouts.
165 #check_policy_service unix:private/policy
166 ];
167 #smtpd_milters = "";
168 smtpd_peername_lookup = true;
169 smtpd_recipient_limit = "5000";
170 smtpd_recipient_overshoot_limit = "5000";
171 #smtpd_restriction_classes = "";
172 #smtpd_sasl_auth_enable = true;
173 #smtpd_sasl_path = "private/auth";
174 #smtpd_sasl_security_options = "noanonymous";
175 #smtpd_sasl_type = "dovecot";
176 smtpd_starttls_timeout = "300s";
177 #smtpd_tls_always_issue_session_ids = true;
178 #smtpd_tls_CApath = "/etc/postfix/x509/ca/";
179 smtpd_tls_ask_ccert = false;
180 #smtpd_tls_ccert_verifydepth = "5";
181 smtpd_tls_ciphers = "high";
182 smtpd_tls_eecdh_grade = "auto";
183 # Disable weak ciphers as reported by https://ssl-tools.net
184 # https://serverfault.com/questions/744168/how-to-disable-rc4-on-postfix
185 smtpd_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
186 smtpd_tls_fingerprint_digest = "sha512";
187 # Log only a summary message on TLS handshake completion
188 smtpd_tls_loglevel = "1";
189 smtpd_tls_mandatory_ciphers = "high";
190 smtpd_tls_mandatory_protocols = [ "!SSLv2" "!SSLv3" ];
191 # Only allow TLSv*
192 smtpd_tls_protocols = [ "!SSLv2" "!SSLv3" ];
193 #smtpd_tls_received_header = false;
194 smtpd_tls_req_ccert = false;
195 # Postfix 2.3 and later
196 # encrypt
197 # Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
198 # encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
199 # SMTP server. Instead, this option should be used only on dedicated servers.
200 smtpd_tls_security_level = "may";
201 smtpd_tls_session_cache_database = "btree:$data_directory/smtpd_tls_session_cache";
202 #smtpd_tls_session_cache_timeout = "3600s";
203 #smtpd_tls_chain_files =
204
205 relayhost = [ ];
206 #relay_clientcerts = hash:/var/lib/postfix/conf/relay_clientcerts
207 # This is where to put backup MX domains
208 relay_domains = [ ];
209 relay_recipient_maps = [ ];
210
211 # Use a non blocking source of randomness
212 tls_random_source = "dev:/dev/urandom";
213 # Map each domain to a specific X.509 certificate
214 tls_server_sni_maps = "hash:/run/keys/postfix-sni";
215
216 # Only explicitely aliased accounts have a mail, not all the passwd
217 #local_recipient_maps = "$alias_maps";
218 # Note that the local transport rewrites the envelope recipient
219 # according to the alias_maps, and thus the aliasing is transparent
220 # to the nexthop (eg. dovecot)
221 local_transport = "local:$myhostname";
222 # No console bell on new mail
223 biff = false;
224 forward_path = [
225 /*
226 "$home/.forward''${recipient_delimiter}''${extension}"
227 */
228 "$home/.forward"
229 ];
230
231 # Filled by the postfix/*.nix
232 virtual_mailbox_domains = [ ];
233 # Completed by the postfix/*.nix
234 virtual_mailbox_maps = [
235 #"hash:/etc/postfix/virtual"
236 ];
237 #virtual_transport = "lmtp:unix:private/dovecot-lmtp";
238 /*
239 dovecot_destination_recipient_limit = "1";
240 virtual_transport = "dovecot";
241 */
242
243 # There is no fallback
244 fallback_transport = "";
245 };
246 transport = ''
247 sourcephile.wg local:losurdo
248 '';
249 virtualMapType = "hash";
250 masterConfig =
251 let
252 mkVal = value:
253 if lib.isList value
254 then lib.concatStringsSep "," value
255 else
256 if value == true then "yes"
257 else if value == false then "no"
258 else toString value;
259 mkKeyVal = opt: val: [ "-o" (opt + "=" + mkVal val) ];
260 mkArgs = args: lib.concatLists (lib.mapAttrsToList mkKeyVal args);
261 in
262 {
263 pickup = {
264 args = mkArgs {
265 cleanup_service_name = "submissions-header-cleanup";
266 };
267 };
268 /*
269 # Implicit TLS on port 465
270 # https://tools.ietf.org/html/rfc8314#section-3.3
271 submissions = {
272 type = "inet";
273 private = false;
274 command = "smtpd";
275 args = mkArgs {
276 syslog_name = "postfix/submissions";
277 # Implicit TLS, not STARTTLS
278 smtpd_tls_wrappermode = true;
279 smtpd_tls_mandatory_protocols = [
280 "TLSv1.3"
281 # FIXME: to be removed when K-9 Mail will support TLSv1.3,
282 # K-9 Mail 5.600 does not.
283 "TLSv1.2"
284 ];
285 milter_macro_daemon_name = "ORIGINATING";
286 smtpd_helo_restrictions = [
287 "permit_sasl_authenticated"
288 ] ++ postfix.config.smtpd_helo_restrictions;
289 smtpd_relay_restrictions = [
290 # SASL authorizes to send to the world
291 "permit_sasl_authenticated"
292 "reject"
293 ];
294 smtpd_sasl_auth_enable = true;
295 smtpd_sasl_type = "dovecot";
296 smtpd_sasl_path = "private/auth";
297 smtpd_sasl_local_domain = "";
298 # Offer SASL authentication only after a TLS-encrypted session has been established
299 smtpd_tls_auth_only = true;
300 smtpd_sasl_tls_security_options = [ "noanonymous" ];
301 # Do not put SASL logins in mail headers
302 smtpd_sasl_authenticated_header = false;
303 # Who cares about (old) Outlook
304 broken_sasl_auth_clients = false;
305 smtpd_sender_restrictions = [
306 "reject_non_fqdn_sender"
307 # Check that the SASL user is using only its own
308 # mail addresses on the envelope, as indicated in smtpd_sender_login_maps
309 "reject_sender_login_mismatch"
310 "permit"
311 ];
312 # No X.509 certificates for users, for now
313 smtpd_tls_ask_ccert = false;
314 smtpd_tls_ccert_verifydepth = 0;
315 smtpd_tls_loglevel = 1;
316 smtpd_tls_req_ccert = false;
317 cleanup_service_name = "submissions-header-cleanup";
318 };
319 };
320 */
321 };
322 extraMasterConf = ''
323 '';
324 };
325 }