servers/mermet/postfix.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) attrNames readFile toPath;
   4   inherit (builtins.extraBuiltins) pass;
   5   inherit (lib) types;
   6   inherit (pkgs.lib) loadFile unlines unwords unlinesAttrs;
   7   inherit (config) networking;
   8   inherit (config.services) postfix dovecot2 openldap;
   9
  10   submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
  11     # Removes sensitive headers from mails handed in via the submission or smtps port.
  12     # See https://thomas-leister.de/mailserver-debian-stretch/
  13     # Uses "pcre" style regex.
  14
  15     /^Received:/         IGNORE
  16     /^User-Agent:/       IGNORE
  17     /^X-Enigmail:/       IGNORE
  18     /^X-Mailer:/         IGNORE
  19     /^X-Originating-IP:/ IGNORE
  20   '';
  21 in
  22 {
  23 systemd.services.postfix.after = [
  24   "openldap.service"
  25   "postfix.${networking.domainBase}.key.pem-key.service"
  26 ];
  27 deployment.keys = {
  28   "postfix.${networking.domainBase}.key.pem" = {
  29     text        = pass "x509/${networking.domainBase}/key.pem";
  30     user        = postfix.user;
  31     group       = "root";
  32     destDir     = "/run/keys/";
  33     permissions = "0400"; # WARNING: not enforced when deployment.storeKeysOnMachine = true
  34   };
  35 };
  36 services.postfix = {
  37   enable = true;
  38   aliases = {
  39     "root@${networking.domain}" = [
  40       "julm@${networking.domain}"
  41     ];
  42     "admin@${networking.domain}" = [
  43       "julm@${networking.domain}"
  44     ];
  45     "webmaster@${networking.domain}" = [
  46       "julm@${networking.domain}"
  47     ];
  48     "postmaster@${networking.domain}" = [
  49       "julm@${networking.domain}"
  50     ];
  51   };
  52   #hostname = networking.domain;
  53   #domain = "localdomain";
  54   networksStyle = "host";
  55   #mapFiles."valias" = toFile "valias" (unlines (all_valiases_postfix ++ catchAllPostfix));
  56   # See https://blog.grimneko.de/2011/12/24/a-bunch-of-tips-for-improving-your-postfix-setup/
  57   # for details on how this file looks. By using the same file as valias,
  58   # every alias is uniquely owned by its user.
  59   # The user's own address is already in all_valiases_postfix.
  60   #mapFiles."vaccounts" = toFile "vaccounts" (unlines all_valiases_postfix);
  61   mapFiles."ldap-virtual_alias_maps.cf" = pkgs.writeText "ldap-virtual_alias_maps.cf" ''
  62     version          = 3
  63     debuglevel       = 0
  64     server_host      = ldapi://
  65     bind             = sasl
  66     sasl_mechs       = EXTERNAL
  67     search_base      = ou=posix,${openldap.domainSuffix}
  68     scope            = sub
  69     dereference      = 0
  70     query_filter     = (&(mailAlias=%s)(mailEnabled=TRUE))
  71     result_format    = %s
  72     result_attribute = mail
  73   '';
  74   mapFiles."ldap-forward.cf" = pkgs.writeText "ldap-forward.cf" ''
  75     version          = 3
  76     debuglevel       = 0
  77     server_host      = ldapi://
  78     bind             = sasl
  79     sasl_mechs       = EXTERNAL
  80     search_base      = ou=posix,${openldap.domainSuffix}
  81     scope            = sub
  82     dereference      = 0
  83     query_filter     = (&(mail=%s)(mailEnabled=TRUE))
  84     result_format    = %s
  85     result_attribute = mailForwardingAddress
  86   '';
  87   sslCert = loadFile (../../../sec/openssl + "/${networking.domainBase}/cert.self-signed.pem");
  88   sslKey = "/run/keys/postfix.${networking.domainBase}.key.pem";
  89   #enableSubmission = true;
  90   #enableSmtp = true;
  91   destination = [
  92     "localhost"
  93     "localhost.localdomain"
  94     networking.hostName
  95     "${networking.hostName}.localdomain"
  96   ];
  97   networks = [
  98     "127.0.0.0/8"
  99     "[::1]/128"
 100   ];
 101   recipientDelimiter = "+";
 102   config = {
 103     # Appending .domain is the MUA's job
 104     append_dot_mydomain = false;
 105     # No console bell on new mail
 106     biff = false;
 107     body_checks = "";
 108     #content_filter = "amavisfeed:[127.0.0.1]:10024";
 109     #debug_peer_level = 4;
 110     #debug_peer_list = ".$myhostname";
 111     default_extra_recipient_limit = "5000";
 112     # Uncomment the next line to generate "delayed mail" warnings
 113     #delay_warning_time = "4h";
 114     # Stops some techniques used to harvest email addresses
 115     disable_vrfy_command = true;
 116     duplicate_filter_limit = "5000";
 117     enable_long_queue_ids = false;
 118     # Pass unexisting $mydestination recipients to dovecot
 119     fallback_transport = "lmtp:unix:private/dovecot-lmtp";
 120     forward_path = [
 121       ''$home/.forward''${recipient_delimiter}''${extension}''
 122       "$home/.forward"
 123     ];
 124     #header_checks = "regexp:/var/lib/postfix/conf/header_checks";
 125     #inet_interfaces = "all";
 126     line_length_limit = "2048";
 127
 128     # Let $fallback_transport check existence of recipients
 129     local_recipient_maps = "";
 130     #mail_spool_directory = "/var/spool/mail";
 131       # NOTE: nixpkgs's default
 132     #local_header_rewrite_clients = "";
 133     #home_mailbox = "Maildir/";
 134     #mailbox_command = ''
 135     #  ${pkgs.procmail}/bin/procmail -t -a "$SENDER" -a "$RECIPIENT" -a "$USER" -a "$EXTENSION" -a "$DOMAIN" -a "$ORIGINAL_RECIPIENT" "$HOME/.procmailrc"
 136     #'';
 137     mailbox_size_limit = "204800000";
 138
 139     masquerade_classes = [ "envelope_sender" "header_sender" "header_recipient" ];
 140     masquerade_domains = "";
 141     masquerade_exceptions = "root";
 142     maximal_queue_lifetime = "5d";
 143     message_size_limit = "20480000";
 144     mime_header_checks = "";
 145     milter_header_checks = "";
 146     nested_header_checks = "";
 147     #non_smtpd_milters = "";
 148     parent_domain_matches_subdomains = [
 149       #"debug_peer_list"
 150       #"fast_flush_domains"
 151       #"mynetworks"
 152       #"permit_mx_backup_networks"
 153       #"qmqpd_authorized_clients"
 154       #"smtpd_access_maps"
 155     ];
 156     permit_mx_backup_networks = "";
 157     #policy-spf_time_limit = "3600s";
 158     propagate_unmatched_extensions = [ "canonical" "virtual" "alias" ];
 159     queue_minfree = "0";
 160     #receive_override_options = "no_address_mappings";
 161       # no_unknown_recipient_checks
 162       #         Do not try to reject unknown recipients (SMTP server only).
 163       #         This is typically specified AFTER an external content filter.
 164       # no_address_mappings
 165       #         Disable canonical address mapping, virtual alias map expansion,
 166       #         address masquerading, and automatic BCC (blind carbon-copy) recipients.
 167       #         This is typically specified BEFORE an external content filter (eg. amavis).
 168       # no_header_body_checks
 169       #         Disable header/body_checks. This is typically specified AFTER
 170       #         an external content filter.
 171       # no_milters
 172       #         Disable Milter (mail filter) applications.
 173       #         This is typically specified AFTER an external content filter.
 174     # Parse the extension in email address, eg. contact+extension@
 175     relayhost = "";
 176     #relay_clientcerts = hash:/var/lib/postfix/conf/relay_clientcerts
 177     # This is where to put backup MX domains
 178     relay_domains = "$mydestination";
 179     relay_recipient_maps = "";
 180     smtp_body_checks = "";
 181     #smtp_cname_overrides_servername = false;
 182     smtp_connect_timeout = "60s";
 183     #smtp_header_checks = "regexp:/var/lib/postfix/smtp_header_checks";
 184     smtp_mime_header_checks = "";
 185     smtp_nested_header_checks = "";
 186     smtp_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
 187     #smtp_tls_fingerprint_digest = "sha1";
 188     smtp_tls_loglevel = "1";
 189     #smtp_tls_note_starttls_offer = true;
 190     #smtp_tls_policy_maps = "hash:/var/lib/postfix/conf/tls_policy";
 191     # Only allow TLSv* protocols
 192     smtp_tls_protocols = [ "!SSLv2" "!SSLv3" ];
 193     smtp_tls_scert_verifydepth = "5";
 194     #smtp_tls_secure_cert_match = [ "nexthop" "dot-nexthop" ];
 195     smtp_tls_security_level = "may";
 196     smtp_tls_session_cache_database = "btree:$data_directory/smtp_tls_session_cache";
 197     #smtp_tls_session_cache_timeout = "3600s";
 198     #smtp_tls_verify_cert_match = "hostname";
 199     # Useful to test restrictions
 200     smtpd_authorized_xclient_hosts = "127.0.0.1";
 201     smtpd_banner = "${networking.hostName} ESMTP $mail_name (NixOS)";
 202     smtpd_client_connection_count_limit = "50";
 203     smtpd_client_connection_rate_limit = "0";
 204     smtpd_client_event_limit_exceptions = "$mynetworks";
 205     smtpd_client_message_rate_limit = "0";
 206     smtpd_client_new_tls_session_rate_limit = "0";
 207     smtpd_client_port_logging = false;
 208     smtpd_client_recipient_rate_limit = "0";
 209     smtpd_client_restrictions = [
 210       #"check_client_access hash:/var/lib/postfix/conf/client_blacklist"
 211     ];
 212     smtpd_data_restrictions = [
 213       "reject_unauth_pipelining"
 214         # Force the smtp client to wait OK before sending
 215       "permit"
 216     ];
 217     # Disable opportunistic encryption
 218     smtpd_discard_ehlo_keywords = "starttls";
 219     #smtpd_end_of_data_restrictions = "";
 220     # Ban 5 sec on error
 221     smtpd_error_sleep_time = "5";
 222     smtpd_helo_required = true;
 223     smtpd_helo_restrictions = [
 224       "reject_invalid_helo_hostname"
 225       "reject_non_fqdn_helo_hostname"
 226       #"reject_unknown_helo_hostname"
 227         # May be useful to fight spam
 228       "permit"
 229     ];
 230     #smtpd_milters = "";
 231     smtpd_peername_lookup = true;
 232     smtpd_recipient_limit = "5000";
 233     smtpd_recipient_overshoot_limit = "5000";
 234     smtpd_recipient_restrictions = [
 235       "reject_non_fqdn_recipient"
 236       #"reject_invalid_hostname"
 237       "reject_unknown_recipient_domain"
 238       #"reject_non_fqdn_sender"
 239       "reject_unauth_pipelining"
 240       #"check_policy_service inet:localhost:12340"
 241       # check quota
 242       "permit_mynetworks"
 243       #"permit_tls_clientcerts"
 244       "permit_sasl_authenticated"
 245       "reject_unverified_recipient"
 246         # $fallback_transport is responsible of checking the existence of the recipient
 247         # WARNING: verify(8) has a cache, dumpable if verify(8) is stopped, with:
 248         # postmap -s btree:/var/lib/postfix/data/verify_cache
 249       # Bypass SPF check and postgrey if the recipient is not for us or someone in backup_mx
 250       "reject_unauth_destination"
 251       # Check SPF
 252       #"check_policy_service unix:private/spfcheck"
 253       # Greylisting using postgrey
 254       #"check_policy_service unix:${postgrey.socket.path}"
 255       "permit_auth_destination"
 256       "reject"
 257       #"reject_unknown_sender_domain"
 258         # Maybe better in smtpd_sender_restrictions
 259       #"reject_rbl_client bl.spamcop.net"
 260       #"reject_rbl_client list.dsbl.org"
 261       #"reject_rbl_client zen.spamhaus.org"
 262       #"reject_rbl_client dnsbl.sorbs.net"
 263     ];
 264     smtpd_relay_restrictions = [
 265       "permit_mynetworks"
 266       "permit_sasl_authenticated"
 267         # NOTE: permit auth through dovecot's SASL
 268       "reject_unauth_destination"
 269     ];
 270     #smtpd_restriction_classes = "";
 271     broken_sasl_auth_clients = false;
 272     #smtpd_sasl_auth_enable = true;
 273     #smtpd_sasl_path = "private/auth";
 274     #smtpd_sasl_security_options = "noanonymous";
 275     #smtpd_sasl_type = "dovecot";
 276     smtpd_sender_restrictions = [
 277       "permit_mynetworks"
 278       #"permit_tls_clientcerts"
 279       "permit_sasl_authenticated"
 280         # NOTE: permit auth through dovecot's SASL
 281       #"check_sender_access hash:/var/lib/postfix/conf/sender_access"
 282       "reject_unauth_pipelining"
 283       "reject_non_fqdn_sender"
 284       #"reject_sender_login_mismatch"
 285       #"reject_unknown_sender_domain"
 286       "permit"
 287     ];
 288     smtpd_starttls_timeout = "300s";
 289     #smtpd_tls_always_issue_session_ids = true;
 290     # No SASL AUTH without TLS
 291     smtpd_tls_auth_only = true;
 292     #smtpd_tls_CApath = "/etc/postfix/x509/ca/";
 293     smtpd_tls_ask_ccert = false;
 294     #smtpd_tls_ccert_verifydepth = "5";
 295     smtpd_tls_ciphers = "high";
 296     smtpd_tls_eecdh_grade = "ultra";
 297     # Disable weak ciphers as reported by https://ssl-tools.net
 298     # https://serverfault.com/questions/744168/how-to-disable-rc4-on-postfix
 299     smtpd_tls_exclude_ciphers = [ "RC4" "aNULL" ];
 300     smtpd_tls_fingerprint_digest = "sha512";
 301     # Log only a summary message on TLS handshake completion
 302     smtpd_tls_loglevel = "1";
 303     smtpd_tls_mandatory_ciphers = "high";
 304     smtpd_tls_mandatory_protocols = [ "!SSLv2" "!SSLv3" ];
 305     # Only allow TLSv*
 306     smtpd_tls_protocols = [ "!SSLv2" "!SSLv3" ];
 307     #smtpd_tls_received_header = false;
 308     smtpd_tls_req_ccert = false;
 309     # Postfix 2.3 and later
 310     # encrypt
 311     #  Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
 312     #  encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
 313     #  SMTP server. Instead, this option should be used only on dedicated servers.
 314     smtpd_tls_security_level = "may";
 315     smtpd_tls_session_cache_database = "btree:$data_directory/smtpd_tls_session_cache";
 316     #smtpd_tls_session_cache_timeout = "3600s";
 317     # Stops mail from poorly written software
 318     strict_rfc821_envelopes = true;
 319     #sympa_destination_recipient_limit = "1";
 320     #sympabounce_destination_recipient_limit = "1";
 321     # postconf(5) discourages to change this
 322     #tls_high_cipherlist = "AES256-SHA";
 323     #tls_random_bytes = "32";
 324     # Must not be in a chroot
 325     #tls_random_exchange_name = "$data_directory/prng_exch";
 326     #tls_random_prng_update_period = "3600s";
 327     #tls_random_reseed_period = "3600s";
 328     # Use a non blocking source of randomness
 329     tls_random_source = "dev:/dev/urandom";
 330     transport_maps = [
 331       #"ldap:transport"
 332       #"hash:/etc/postfix/transport-dovecot"
 333       #"hash:/etc/postfix/$mydomain/transport"
 334       #"hash:/etc/dovecot/transport"
 335       #"regexp:/etc/sympa/transport"
 336     ];
 337     # Rejects immediately what $fallback_transport rejects
 338     unverified_recipient_reject_code = "550";
 339     # Do not specify virtual alias domain names in mydestination
 340     # or relay_domains configuration parameters
 341     #
 342     # With  a  virtual  alias  domain,  the  Postfix SMTP server
 343     # accepts  mail  for  known-user@virtual-alias.domain,   and
 344     # rejects   mail  for  unknown-user@virtual-alias.domain  as
 345     # undeliverable.
 346     virtual_alias_domains = [];
 347     virtual_alias_maps = [
 348       #"hash:/etc/postfix/virtual_alias_maps"
 349       #"hash:/etc/postfix/virtual_domain_alias_maps"
 350       "ldap:/etc/postfix/ldap-forward.cf"
 351       "ldap:/etc/postfix/ldap-virtual_alias_maps.cf"
 352       #"hash:/etc/postfix/virtual_alias-dovecot"
 353       #"hash:/var/lib/postfix/conf/valias"
 354       #"regexp:/etc/sympa/virtual_alias"
 355     ];
 356     #virtual_uid_maps = "static:5000";
 357     #virtual_gid_maps = "static:5000";
 358     #virtual_mailbox_base = dovecot2.mailDir;
 359     virtual_mailbox_domains = [ networking.domain ] ++ networking.domainAliases;
 360     #virtual_mailbox_maps = "hash:/etc/postfix/virtual_mailbox_maps";
 361     virtual_transport = "lmtp:unix:private/dovecot-lmtp";
 362   };
 363   #submissionOptions = {
 364   #  smtpd_tls_security_level     = "encrypt";
 365   #  smtpd_sasl_auth_enable       = "yes";
 366   #  smtpd_sasl_type              = "dovecot";
 367   #  smtpd_sasl_path              = "private/auth";
 368   #  smtpd_sasl_security_options  = "noanonymous";
 369   #  smtpd_sasl_local_domain      = "$myhostname";
 370   #  smtpd_client_restrictions    = "permit_sasl_authenticated,reject";
 371   #  smtpd_sender_login_maps      = "hash:/etc/postfix/vaccounts";
 372   #  smtpd_sender_restrictions    = "reject_sender_login_mismatch";
 373   #  smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
 374   #  cleanup_service_name         = "submission-header-cleanup";
 375   #};
 376   extraMasterConf = ''
 377     #spfcheck    unix  -        n       n       -        0        spawn
 378     #  user=policyd-spf argv=/usr/sbin/postfix-policyd-spf-perl
 379     465         inet  n        -       -       -        -        smtpd
 380       -o milter_macro_daemon_name=ORIGINATING
 381       -o smtpd_client_restrictions=permit_sasl_authenticated,reject
 382       -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject
 383       -o smtpd_sasl_auth_enable=yes
 384       -o smtpd_sasl_local_domain=$myhostname
 385       -o smtpd_sasl_path=private/auth
 386       -o smtpd_sasl_security_options=noanonymous
 387       -o smtpd_sasl_type=dovecot
 388       -o smtpd_tls_ask_ccert=no
 389       -o smtpd_tls_auth_only=yes
 390       -o smtpd_tls_ccert_verifydepth=0
 391       -o smtpd_tls_loglevel=1
 392       -o smtpd_tls_req_ccert=no
 393       -o smtpd_tls_security_level=encrypt
 394       -o smtpd_tls_wrappermode=yes
 395     # -o smtpd_sender_restrictions=reject_sender_login_mismatch
 396     # -o smtpd_sender_login_maps=hash:/etc/postfix/vaccounts
 397     # -o cleanup_service_name=submission-header-cleanup
 398     submission-header-cleanup unix n - n    -       0       cleanup
 399       -o header_checks=pcre:${submissionHeaderCleanupRules}
 400     #spfcheck  unix  -       n       n       -       0       spawn
 401     #  user=policyd-spf argv=/usr/bin/postfix-policyd-spf-perl
 402     #uucp      unix  -       n       n       -       -       pipe
 403     #  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
 404     #smtp      inet  n       -       -       -       -       smtpd
 405     #  -o cleanup_service_name=pre-cleanup
 406     #  -o content_filter=amavis:[127.0.0.1]:10024
 407     #  -o smtpd_sender_restrictions=reject_unauth_pipelining,reject_non_fqdn_sender,permit
 408     #  -o receive_override_options=no_address_mappings
 409     #amavis    unix  -       -       n        -      2       lmtp
 410     #  -o lmtp_data_done_timeout=1200
 411     #  -o lmtp_send_xforward_command=yes
 412     #  -o lmtp_tls_note_starttls_offer=no
 413     #127.0.0.1:10025 inet n  -       n       -       -       smtpd
 414     #  -o content_filter=
 415     #  -o local_header_rewrite_clients=
 416     #  -o local_recipient_maps=
 417     #  -o mynetworks=127.0.0.0/8
 418     #  -o receive_override_options=no_header_body_checks,no_milters,no_unknown_recipient_checks
 419     #  -o relay_recipient_maps=
 420     #  -o smtpd_client_connection_count_limit=0
 421     #  -o smtpd_client_connection_rate_limit=0
 422     #  -o smtpd_client_restrictions=permit_mynetworks,reject
 423     #  -o smtpd_data_restrictions=reject_unauth_pipelining
 424     #  -o smtpd_delay_reject=no
 425     #  -o smtpd_end_of_data_restrictions=
 426     #  -o smtpd_error_sleep_time=0
 427     #  -o smtpd_hard_error_limit=1000
 428     #  -o smtpd_helo_restrictions=
 429     #  -o smtpd_milters=
 430     #  -o smtpd_recipient_restrictions=permit_mynetworks,reject
 431     #  -o smtpd_restriction_classes=
 432     #  -o smtpd_sender_restrictions=
 433     #  -o smtpd_soft_error_limit=1001
 434     #  -o strict_rfc821_envelopes=yes
 435     #submission inet n       -       -       -       -       smtpd
 436     #  -o cleanup_service_name=pre-cleanup
 437     #  -o content_filter=amavis:[127.0.0.1]:10024
 438     #  -o milter_macro_daemon_name=ORIGINATING
 439     #  -o receive_override_options=no_address_mappings
 440     #  -o smtpd_sender_restrictions=permit_tls_clientcerts,reject
 441     #  -o smtpd_tls_ask_ccert=yes
 442     #  -o smtpd_tls_auth_only=yes
 443     #  -o smtpd_tls_ccert_verifydepth=2
 444     #  -o smtpd_tls_loglevel=1
 445     #  -o smtpd_tls_req_ccert=yes
 446     #  -o smtpd_tls_security_level=encrypt
 447     #smtps     inet  n       -       -       -       -       smtpd
 448     #  -o milter_macro_daemon_name=ORIGINATING
 449     #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
 450     #  -o smtpd_sasl_auth_enable=yes
 451     #  -o smtpd_tls_ask_ccert=yes
 452     #  -o smtpd_tls_auth_only=yes
 453     #  -o smtpd_tls_ccert_verifydepth=0
 454     #  -o smtpd_tls_loglevel=1
 455     #  -o smtpd_tls_req_ccert=no
 456     #  -o smtpd_tls_security_level=encrypt
 457     #  -o smtpd_tls_wrappermode=yes
 458     #pickup    fifo  n       -       -       60      1       pickup
 459     #  -o cleanup_service_name=pre-cleanup
 460     #  -o content_filter=amavis:[127.0.0.1]:10024
 461     #pre-cleanup unix n      -       -       -       0       cleanup
 462     #  -o virtual_alias_maps=
 463     #cleanup   unix  n       -       -       -       0       cleanup
 464     #  -o mime_header_checks=
 465     #  -o nested_header_checks=
 466     #  -o body_checks=
 467     #  -o header_checks=
 468     #-- SYMPA begin
 469     #sympa unix - n n - - pipe
 470     #  flags=R user=sympa argv=/usr/lib/sympa/bin/queue ''${recipient}
 471     #sympabounce unix - n n - - pipe
 472     #  flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ''${recipient}
 473     #-- SYMPA end
 474   '';
 475    #noclue    unix  -       n       n       -       -       pipe
 476    #  flags=q user=noclue argv=/usr/local/bin/noclue-delivery ${recipient} ${sender}
 477 };
 478 }