hosts/mermet/rspamd.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) attrNames listToAttrs readFile;
   4   inherit (lib) types;
   5   inherit (pkgs.lib) unlinesAttrs;
   6   inherit (config.security) gnupg;
   7   inherit (config.services) postfix rspamd dovecot2;
   8   redis = config.services.redis.servers.rspamd;
   9   inherit (config.users) users groups;
  10 in
  11 {
  12 imports = [
  13   rspamd/autogeree.net.nix
  14   rspamd/sourcephile.fr.nix
  15 ];
  16 options = {
  17   services.rspamd.dkimSelectorMap = lib.mkOption {
  18     type = types.lines;
  19     default = "";
  20     description = ''Each line maps a domain to its active DKIM selector'';
  21     apply = s: pkgs.writeText "dkim_selectors.map" s;
  22   };
  23 };
  24 config = {
  25 users.groups.redis-rspamd.members = [ rspamd.user ];
  26 users.groups.keys.members = [ rspamd.user ];
  27 services.rspamd = {
  28   enable = true;
  29   debug = false;
  30   postfix.enable = postfix.enable;
  31   locals = {
  32     "dkim_signing.conf".text = ''
  33       selector_map = ${rspamd.dkimSelectorMap};
  34       path = "/run/keys/gnupg/rspamd/dkim/$domain/$selector.key/file";
  35       allow_username_mismatch = true;
  36     '';
  37     "arc.conf".text = ''
  38       selector_map = ${rspamd.dkimSelectorMap};
  39       path = "/run/keys/gnupg/rspamd/dkim/$domain/$selector.key/file";
  40       allow_username_mismatch = true;
  41     '';
  42     "redis.conf".text = ''
  43       servers = "${redis.unixSocket}";
  44       db = "1";
  45     '';
  46     "classifier-bayes.conf".text = ''
  47       users_enabled = false;
  48       backend = "redis";
  49       servers = "${redis.unixSocket}";
  50       database = "1";
  51       autolearn = true;
  52       cache {
  53         backend = "redis";
  54       }
  55       new_schema = true;
  56       expire = 86400;
  57       statfile {
  58         BAYES_HAM {
  59           spam = false;
  60         }
  61         BAYES_SPAM {
  62           spam = true;
  63         }
  64       }
  65     '';
  66     /*
  67     "logging.conf" = ''
  68       debug_modules = [“dkim_signing”]
  69     '';
  70     */
  71   };
  72   overrides = {
  73     "milter_headers.conf".text = ''
  74       extended_spam_headers = true;
  75     '';
  76     "actions.conf".text = ''
  77       reject     = 15; # Reject when reaching this score
  78       add_header =  6; # Add header when reaching this score
  79       greylist   =  4; # Apply greylisting when reaching this score (will emit `soft reject action`)
  80     '';
  81   };
  82   workers = {
  83     learner = {
  84       # Like controller but without a password, only the bindSockets' permissions
  85       type = "controller";
  86       includes = [ "$CONFDIR/worker-controller.inc" ];
  87       bindSockets = [
  88         { socket = "/run/rspamd/learner.sock";
  89           mode = "0660";
  90           owner = "${rspamd.user}";
  91           group = "${dovecot2.group}";
  92         }
  93       ];
  94       extraConfig = ''
  95       '';
  96     };
  97     controller = {
  98       includes = [
  99         "$CONFDIR/worker-controller.inc"
 100         gnupg.secrets."rspamd/controller/hashedPassword".path
 101       ];
 102       bindSockets = [
 103         "127.0.0.1:11334"
 104       ];
 105       extraConfig = ''
 106         #count = 1;
 107         #static_dir = "''${WWWDIR}";
 108       '';
 109     };
 110   };
 111 };
 112 security.gnupg.secrets."rspamd/controller/hashedPassword" = {
 113   # Generated with: rspamadm pw
 114   user = rspamd.user;
 115   pipe = ''${pkgs.gnused}/bin/sed -e 's/.*/password = "\0";/' '';
 116   systemdConfig.postStart = "systemctl try-restart --no-block rspamd"; # rspamd does not support reloading so far
 117 };
 118 systemd.services.rspamd = {
 119   wants = [ gnupg.secrets."rspamd/controller/hashedPassword".service ];
 120   after = [ gnupg.secrets."rspamd/controller/hashedPassword".service ];
 121 };
 122
 123 fileSystems."/var/lib/redis-rspamd" = {
 124   device = "rpool/var/redis-rspamd";
 125   fsType = "zfs";
 126 };
 127 services.sanoid.datasets."rpool/var/redis-rspamd" = {
 128   use_template = [ "snap" ];
 129   hourly = 0;
 130   daily = 7;
 131   monthly = 0;
 132   yearly = 0;
 133 };
 134
 135 services.redis.vmOverCommit = true;
 136 services.redis.servers.rspamd = {
 137   enable = true;
 138   databases = 16;
 139   syslog = true;
 140   save = [ [1800 100] [300 1000] ];
 141   #unixSocketPerm = "660";
 142   settings = {
 143     maxmemory = "64MB";
 144     maxmemory-policy = "volatile-ttl";
 145   };
 146 };
 147 /*
 148 services.postfix.extraConfig = ''
 149   smtpd_milters = unix:/run/rspamd.sock
 150   milter_default_action = accept
 151 '';
 152 # Allow users to run 'rspamc' and 'rspamadm'.
 153 environment.systemPackages = [ pkgs.rspamd ];
 154 */
 155 };
 156 }