]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/postfix.nix
nix: update flake.lock
[sourcephile-nix.git] / hosts / losurdo / postfix.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (lib) types;
4 inherit (config) networking users;
5 inherit (config.services) postfix;
6 in
7 {
8 imports = [
9 #postfix/autogeree.net.nix
10 #postfix/sourcephile.fr.nix
11 ];
12 users.groups.acme.members = [ postfix.user ];
13 /*
14 networking.nftables.ruleset = ''
15 add rule inet filter net2fw tcp dport 25 counter accept comment "SMTP"
16 add rule inet filter net2fw tcp dport 465 counter accept comment "submissions"
17 add rule inet filter fw2net meta skuid ${postfix.user} tcp dport 25 counter accept comment "SMTP"
18 '';
19 */
20 services.postfix = {
21 enable = true;
22 networksStyle = "host";
23 hostname ="${networking.hostName}.${networking.domain}";
24 domain = networking.domain;
25 origin = "$myhostname";
26 destination = [
27 "localhost"
28 "localhost.localdomain"
29 "$myhostname"
30 ];
31 postmasterAlias = "root";
32 rootAlias = "root@${networking.domain}";
33 sslKey = "/var/lib/acme/${networking.domain}/key.pem";
34 sslCert = "/var/lib/acme/${networking.domain}/fullchain.pem";
35 networks = [
36 "127.0.0.0/8"
37 "[::1]/128"
38 ];
39 setSendmail = true;
40 # Parse the extension in email address, eg. contact+extension@
41 recipientDelimiter = "+";
42 config = {
43 debug_peer_level = "4";
44 debug_peer_list = [
45 #"chomsky.autogeree.net"
46 #"localhost"
47 #"mail.sourcephile.fr"
48 ];
49
50 #
51 # Sending to the world
52 #
53 # Appending .domain is the MUA's job
54 append_dot_mydomain = false;
55 smtp_body_checks = "";
56 #smtp_cname_overrides_servername = false;
57 smtp_connect_timeout = "60s";
58 #smtp_header_checks = "regexp:/var/lib/postfix/smtp_header_checks";
59 smtp_mime_header_checks = "";
60 smtp_nested_header_checks = "";
61 smtp_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
62 #smtp_tls_fingerprint_digest = "sha1";
63 smtp_tls_loglevel = "1";
64 #smtp_tls_note_starttls_offer = true;
65 #smtp_tls_policy_maps = "hash:/var/lib/postfix/conf/tls_policy";
66 # Only allow TLSv* protocols
67 smtp_tls_protocols = [ "!SSLv2" "!SSLv3" ];
68 #smtp_tls_scert_verifydepth = "5";
69 #smtp_tls_secure_cert_match = [ "nexthop" "dot-nexthop" ];
70 smtp_tls_security_level = "may";
71 smtp_tls_session_cache_database = "btree:$data_directory/smtp_tls_session_cache";
72 #smtp_tls_session_cache_timeout = "3600s";
73 #smtp_tls_verify_cert_match = "hostname";
74
75 #
76 # Receiving from the world
77 #
78 message_size_limit = "20480000";
79 maximal_queue_lifetime = "5d";
80 default_extra_recipient_limit = "5000";
81 line_length_limit = "2048";
82 duplicate_filter_limit = "5000";
83 # Stops mail from poorly written software
84 strict_rfc821_envelopes = true;
85 mime_header_checks = [];
86 milter_header_checks = [];
87 nested_header_checks = [];
88 body_checks = [];
89 content_filter = "";
90 permit_mx_backup_networks = [];
91 propagate_unmatched_extensions = [ "canonical" "virtual" "alias" ];
92 #masquerade_classes = [ "envelope_sender" "header_sender" "header_recipient" ];
93 #masquerade_domains = "";
94 #masquerade_exceptions = "root";
95 queue_minfree = "0";
96 # Stops some techniques used to harvest email addresses
97 disable_vrfy_command = true;
98 enable_long_queue_ids = false;
99 # Useful to test restrictions
100 smtpd_authorized_xclient_hosts = "127.0.0.1";
101 smtpd_banner = "$myhostname ESMTP $mail_name (NixOS)";
102 smtpd_client_connection_count_limit = "50";
103 smtpd_client_connection_rate_limit = "0";
104 smtpd_client_event_limit_exceptions = "$mynetworks";
105 smtpd_client_message_rate_limit = "0";
106 smtpd_client_new_tls_session_rate_limit = "0";
107 smtpd_client_port_logging = false;
108 smtpd_client_recipient_rate_limit = "0";
109 # Ban 5 sec on error
110 smtpd_error_sleep_time = "5";
111 # Needed to enforce reject_unknown_helo_hostname
112 smtpd_helo_required = true;
113 smtpd_helo_restrictions = [
114 "reject_invalid_helo_hostname"
115 "reject_non_fqdn_helo_hostname"
116 # Don't talk to mail systems that don't know their own hostname.
117 "reject_unknown_helo_hostname"
118 "permit"
119 ];
120 smtpd_client_restrictions = [
121 ];
122 # Set in postfix/*.nix and used in submissions/smptd
123 # with reject_sender_login_mismatch
124 smtpd_sender_login_maps = [];
125 smtpd_sender_restrictions = [
126 "reject_non_fqdn_sender"
127 "permit"
128 ];
129 smtpd_reject_unlisted_recipient = true;
130 # Check the RCPT TO, before smtpd_recipient_restrictions
131 # Restrictions based on what is allowed or not,
132 # these are applied before smtpd_recipient_restrictions
133 smtpd_relay_restrictions = [
134 "permit_mynetworks"
135 # Check the recipient's address in virtual_mailbox_domains and virtual_mailbox_maps
136 "permit_auth_destination"
137 # The world is only authorized to use our relay for the above destinations.
138 "reject"
139 ];
140 # Restrictions based on what is working or not
141 smtpd_recipient_restrictions = [
142 # Reject if the domain is not fully qualified
143 "reject_non_fqdn_recipient"
144 # Reject if the domain is not working, even before bothering to check the address
145 "reject_unknown_recipient_domain"
146 # Reject if the address is not working
147 # WARNING: this does not work if the recipient is greylisting.
148 # WARNING: verify(8) has a cache, dumpable if verify(8) is stopped, with:
149 # postmap -s btree:/var/lib/postfix/data/verify_cache
150 #"reject_unverified_recipient"
151 "permit"
152 ];
153 # Trust the verify database
154 #unverified_recipient_reject_code = "550";
155 smtpd_data_restrictions = [
156 # Force the smtpd's client to wait OK before sending
157 "reject_unauth_pipelining"
158 "permit"
159 ];
160 smtpd_end_of_data_restrictions = [
161 # Enforce mail volume quota via policy service callouts.
162 #check_policy_service unix:private/policy
163 ];
164 #smtpd_milters = "";
165 smtpd_peername_lookup = true;
166 smtpd_recipient_limit = "5000";
167 smtpd_recipient_overshoot_limit = "5000";
168 #smtpd_restriction_classes = "";
169 #smtpd_sasl_auth_enable = true;
170 #smtpd_sasl_path = "private/auth";
171 #smtpd_sasl_security_options = "noanonymous";
172 #smtpd_sasl_type = "dovecot";
173 smtpd_starttls_timeout = "300s";
174 #smtpd_tls_always_issue_session_ids = true;
175 #smtpd_tls_CApath = "/etc/postfix/x509/ca/";
176 smtpd_tls_ask_ccert = false;
177 #smtpd_tls_ccert_verifydepth = "5";
178 smtpd_tls_ciphers = "high";
179 smtpd_tls_eecdh_grade = "auto";
180 # Disable weak ciphers as reported by https://ssl-tools.net
181 # https://serverfault.com/questions/744168/how-to-disable-rc4-on-postfix
182 smtpd_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
183 smtpd_tls_fingerprint_digest = "sha512";
184 # Log only a summary message on TLS handshake completion
185 smtpd_tls_loglevel = "1";
186 smtpd_tls_mandatory_ciphers = "high";
187 smtpd_tls_mandatory_protocols = [ "!SSLv2" "!SSLv3" ];
188 # Only allow TLSv*
189 smtpd_tls_protocols = [ "!SSLv2" "!SSLv3" ];
190 #smtpd_tls_received_header = false;
191 smtpd_tls_req_ccert = false;
192 # Postfix 2.3 and later
193 # encrypt
194 # Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
195 # encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
196 # SMTP server. Instead, this option should be used only on dedicated servers.
197 smtpd_tls_security_level = "may";
198 smtpd_tls_session_cache_database = "btree:$data_directory/smtpd_tls_session_cache";
199 #smtpd_tls_session_cache_timeout = "3600s";
200 #smtpd_tls_chain_files =
201
202 relayhost = [];
203 #relay_clientcerts = hash:/var/lib/postfix/conf/relay_clientcerts
204 # This is where to put backup MX domains
205 relay_domains = [];
206 relay_recipient_maps = [];
207
208 # Use a non blocking source of randomness
209 tls_random_source = "dev:/dev/urandom";
210 # Map each domain to a specific X.509 certificate
211 tls_server_sni_maps = "hash:/run/keys/postfix-sni";
212
213 # Only explicitely aliased accounts have a mail, not all the passwd
214 local_recipient_maps = "$alias_maps";
215 # Note that the local transport rewrites the envelope recipient
216 # according to the alias_maps, and thus the aliasing is transparent
217 # to the nexthop (eg. dovecot)
218 #local_transport = local:$myhostname
219 # No console bell on new mail
220 biff = false;
221 forward_path = [
222 /*
223 "$home/.forward''${recipient_delimiter}''${extension}"
224 */
225 "$home/.forward"
226 ];
227
228 # Filled by the postfix/*.nix
229 virtual_mailbox_domains = [];
230 # Completed by the postfix/*.nix
231 virtual_mailbox_maps = [
232 "hash:/etc/postfix/virtual"
233 ];
234 #virtual_transport = "lmtp:unix:private/dovecot-lmtp";
235 /*
236 dovecot_destination_recipient_limit = "1";
237 virtual_transport = "dovecot";
238 */
239
240 # There is no fallback
241 fallback_transport = "";
242 };
243 virtualMapType = "hash";
244 masterConfig =
245 let
246 mkVal = value:
247 if lib.isList value
248 then lib.concatStringsSep "," value
249 else
250 if value == true then "yes"
251 else if value == false then "no"
252 else toString value;
253 mkKeyVal = opt: val: [ "-o" (opt + "=" + mkVal val) ];
254 mkArgs = args: lib.concatLists (lib.mapAttrsToList mkKeyVal args);
255 in {
256 pickup = {
257 args = mkArgs {
258 cleanup_service_name = "submissions-header-cleanup";
259 };
260 };
261 /*
262 # Implicit TLS on port 465
263 # https://tools.ietf.org/html/rfc8314#section-3.3
264 submissions = {
265 type = "inet";
266 private = false;
267 command = "smtpd";
268 args = mkArgs {
269 syslog_name = "postfix/submissions";
270 # Implicit TLS, not STARTTLS
271 smtpd_tls_wrappermode = true;
272 smtpd_tls_mandatory_protocols = [
273 "TLSv1.3"
274 # FIXME: to be removed when K-9 Mail will support TLSv1.3,
275 # K-9 Mail 5.600 does not.
276 "TLSv1.2"
277 ];
278 milter_macro_daemon_name = "ORIGINATING";
279 smtpd_helo_restrictions = [
280 "permit_sasl_authenticated"
281 ] ++ postfix.config.smtpd_helo_restrictions;
282 smtpd_relay_restrictions = [
283 # SASL authorizes to send to the world
284 "permit_sasl_authenticated"
285 "reject"
286 ];
287 smtpd_sasl_auth_enable = true;
288 smtpd_sasl_type = "dovecot";
289 smtpd_sasl_path = "private/auth";
290 smtpd_sasl_local_domain = "";
291 # Offer SASL authentication only after a TLS-encrypted session has been established
292 smtpd_tls_auth_only = true;
293 smtpd_sasl_tls_security_options = [ "noanonymous" ];
294 # Do not put SASL logins in mail headers
295 smtpd_sasl_authenticated_header = false;
296 # Who cares about (old) Outlook
297 broken_sasl_auth_clients = false;
298 smtpd_sender_restrictions = [
299 "reject_non_fqdn_sender"
300 # Check that the SASL user is using only its own
301 # mail addresses on the envelope, as indicated in smtpd_sender_login_maps
302 "reject_sender_login_mismatch"
303 "permit"
304 ];
305 # No X.509 certificates for users, for now
306 smtpd_tls_ask_ccert = false;
307 smtpd_tls_ccert_verifydepth = 0;
308 smtpd_tls_loglevel = 1;
309 smtpd_tls_req_ccert = false;
310 cleanup_service_name = "submissions-header-cleanup";
311 };
312 };
313 */
314 };
315 extraMasterConf = ''
316 '';
317 };
318 }