1 { pkgs, lib, config, ... }:
3 inherit (builtins) attrNames listToAttrs readFile;
5 inherit (pkgs.lib) unlinesAttrs;
6 inherit (config.security) gnupg;
7 inherit (config.services) postfix rspamd dovecot2 redis;
8 inherit (config.users) users;
12 rspamd/autogeree.net.nix
13 rspamd/sourcephile.fr.nix
16 services.rspamd.dkimSelectorMap = lib.mkOption {
19 description = ''Each line maps a domain to its active DKIM selector'';
20 apply = s: pkgs.writeText "dkim_selectors.map" s;
24 users.users."${rspamd.user}".extraGroups = [
30 postfix.enable = postfix.enable;
32 "dkim_signing.conf".text = ''
33 selector_map = ${rspamd.dkimSelectorMap};
34 path = "/run/keys/gnupg/rspamd/dkim/$domain/$selector.key";
35 allow_username_mismatch = true;
38 selector_map = ${rspamd.dkimSelectorMap};
39 path = "/run/keys/gnupg/rspamd/dkim/$domain/$selector.key";
40 allow_username_mismatch = true;
42 "redis.conf".text = ''
43 servers = "${redis.unixSocket}";
46 "classifier-bayes.conf".text = ''
47 users_enabled = false;
49 servers = "${redis.unixSocket}";
67 debug_modules = [“dkim_signing”]
72 "milter_headers.conf".text = ''
73 extended_spam_headers = true;
75 "actions.conf".text = ''
76 reject = 15; # Reject when reaching this score
77 add_header = 6; # Add header when reaching this score
78 greylist = 4; # Apply greylisting when reaching this score (will emit `soft reject action`)
83 # Like controller but without a password, only the bindSockets' permissions
85 includes = [ "$CONFDIR/worker-controller.inc" ];
87 { socket = "/run/rspamd/learner.sock";
89 owner = "${rspamd.user}";
90 group = "${dovecot2.group}";
98 "$CONFDIR/worker-controller.inc"
99 gnupg.secrets."rspamd/controller/hashedPassword".path
106 #static_dir = "''${WWWDIR}";
111 security.gnupg.secrets."rspamd/controller/hashedPassword" = {
112 # Generated with: rspamadm pw
114 pipe = ''${pkgs.gnused}/bin/sed -e 's/.*/password = "\0";/' '';
115 postStart = "systemctl try-restart --no-block rspamd"; # rspamd does not support reloading so far
117 systemd.services.rspamd = {
118 wants = [ gnupg.secrets."rspamd/controller/hashedPassword".service ];
119 after = [ gnupg.secrets."rspamd/controller/hashedPassword".service ];
122 services.postfix.extraConfig = ''
123 smtpd_milters = unix:/run/rspamd.sock
124 milter_default_action = accept
126 # Allow users to run 'rspamc' and 'rspamadm'.
127 environment.systemPackages = [ pkgs.rspamd ];