install/logical/friot/postfix.nix

   1 {pkgs, lib, config, nodes, ...}:
   2 let inherit (builtins) attrNames toFile;
   3     inherit (lib) types;
   4     inherit (pkgs.lib) unlines unlinesAttrs;
   5     inherit (config) networking;
   6     inherit (config.services) x509 postfix dovecot2 postgrey openldap;
   7     unwords = lib.concatStringsSep " ";
   8     when    = x: y: if x == null then "" else y;
   9
  10     submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
  11       # Removes sensitive headers from mails handed in via the submission or smtps port.
  12       # See https://thomas-leister.de/mailserver-debian-stretch/
  13       # Uses "pcre" style regex.
  14
  15       /^Received:/         IGNORE
  16       /^User-Agent:/       IGNORE
  17       /^X-Enigmail:/       IGNORE
  18       /^X-Mailer:/         IGNORE
  19       /^X-Originating-IP:/ IGNORE
  20     '';
  21 in
  22 {
  23 options.services.postfix.aliases = lib.mkOption {
  24   type    = with types; attrsOf (listOf str);
  25   default = {};
  26   example = { "root@${networking.domain}" = [
  27                 "user1@${networking.domain}"
  28                 "user2@${networking.domain}"
  29               ];
  30               "@example.coop" = ["user1@${networking.domain}"];
  31             };
  32 };
  33 config = {
  34   systemd.services.postfix.after =
  35     [ "openldap.service"
  36     ] ++ (if x509.scheme == "letsencrypt"
  37           then [ "nginx.service" ] # XXX: not sure if this is enough
  38           else []);
  39   services.postfix = {
  40     enable = true;
  41     #hostname = networking.domain;
  42     #domain = "localdomain";
  43     networksStyle = "host";
  44     #mapFiles."valias" = toFile "valias" (unlines (all_valiases_postfix ++ catchAllPostfix));
  45     # See https://blog.grimneko.de/2011/12/24/a-bunch-of-tips-for-improving-your-postfix-setup/
  46     # for details on how this file looks. By using the same file as valias,
  47     # every alias is uniquely owned by its user.
  48     # The user's own address is already in all_valiases_postfix.
  49     #mapFiles."vaccounts" = toFile "vaccounts" (unlines all_valiases_postfix);
  50     mapFiles."virtual_alias_maps" =
  51       toFile "virtual_alias_maps"
  52         (unlinesAttrs
  53          (from: to: "${from} ${unwords to}")
  54          postfix.aliases);
  55     mapFiles."ldap-virtual_alias_maps.cf" =
  56       toFile "ldap-virtual_alias_maps.cf" ''
  57         version          = 3
  58         debuglevel       = 3
  59         server_host      = ldapi://
  60         bind             = sasl
  61         sasl_mechs       = EXTERNAL
  62         search_base      = ou=posix,${openldap.domainSuffix}
  63         scope            = sub
  64         dereference      = 0
  65         query_filter     = (&(mailAlias=%s)(mailEnabled=TRUE))
  66         result_format    = %s
  67         result_attribute = mail
  68       '';
  69     mapFiles."ldap-forward.cf" =
  70       toFile "ldap-forward.cf" ''
  71         version          = 3
  72         debuglevel       = 3
  73         server_host      = ldapi://
  74         bind             = sasl
  75         sasl_mechs       = EXTERNAL
  76         search_base      = ou=posix,${openldap.domainSuffix}
  77         scope            = sub
  78         dereference      = 0
  79         query_filter     = (&(mail=%s)(mailEnabled=TRUE))
  80         result_format    = %s
  81         result_attribute = mailForwardingAddress
  82       '';
  83     sslCert = x509.cert;
  84     sslKey = x509.key;
  85     #enableSubmission = true;
  86     #enableSmtp = true;
  87     destination = [
  88       "localhost"
  89       "localhost.localdomain"
  90       networking.hostName
  91       "${networking.hostName}.localdomain"
  92     ];
  93     networks = [
  94       "127.0.0.0/8"
  95       "[::1]/128"
  96     ];
  97     recipientDelimiter = "+";
  98     config = {
  99       # Appending .domain is the MUA's job
 100       append_dot_mydomain = false;
 101       # No console bell on new mail
 102       biff = false;
 103       body_checks = "";
 104       #content_filter = "amavisfeed:[127.0.0.1]:10024";
 105       #debug_peer_level = 4;
 106       #debug_peer_list = ".$myhostname";
 107       default_extra_recipient_limit = "5000";
 108       # Uncomment the next line to generate "delayed mail" warnings
 109       #delay_warning_time = "4h";
 110       # Stops some techniques used to harvest email addresses
 111       disable_vrfy_command = true;
 112       duplicate_filter_limit = "5000";
 113       enable_long_queue_ids = false;
 114       # Pass unexisting $mydestination recipients to dovecot
 115       fallback_transport = "lmtp:unix:private/dovecot-lmtp";
 116       forward_path = [
 117         ''$home/.forward''${recipient_delimiter}''${extension}''
 118         "$home/.forward"
 119       ];
 120       #header_checks = "regexp:/var/lib/postfix/conf/header_checks";
 121       #inet_interfaces = "all";
 122       line_length_limit = "2048";
 123
 124       # Let $fallback_transport check existence of recipients
 125       local_recipient_maps = "";
 126       #mail_spool_directory = "/var/spool/mail";
 127         # NOTE: nixpkgs's default
 128       #local_header_rewrite_clients = "";
 129       #home_mailbox = "Maildir/";
 130       #mailbox_command = ''
 131       #  ${pkgs.procmail}/bin/procmail -t -a "$SENDER" -a "$RECIPIENT" -a "$USER" -a "$EXTENSION" -a "$DOMAIN" -a "$ORIGINAL_RECIPIENT" "$HOME/.procmailrc"
 132       #'';
 133       mailbox_size_limit = "204800000";
 134
 135       masquerade_classes = [ "envelope_sender" "header_sender" "header_recipient" ];
 136       masquerade_domains = "";
 137       masquerade_exceptions = "root";
 138       maximal_queue_lifetime = "5d";
 139       message_size_limit = "20480000";
 140       mime_header_checks = "";
 141       milter_header_checks = "";
 142       nested_header_checks = "";
 143       non_smtpd_milters = "";
 144       parent_domain_matches_subdomains = [
 145         #"debug_peer_list"
 146         #"fast_flush_domains"
 147         #"mynetworks"
 148         #"permit_mx_backup_networks"
 149         #"qmqpd_authorized_clients"
 150         #"smtpd_access_maps"
 151       ];
 152       permit_mx_backup_networks = "";
 153       #policy-spf_time_limit = "3600s";
 154       propagate_unmatched_extensions = [ "canonical" "virtual" "alias" ];
 155       queue_minfree = "0";
 156       #receive_override_options = "no_address_mappings";
 157         # no_unknown_recipient_checks
 158         #         Do not try to reject unknown recipients (SMTP server only).
 159         #         This is typically specified AFTER an external content filter.
 160         # no_address_mappings
 161         #         Disable canonical address mapping, virtual alias map expansion,
 162         #         address masquerading, and automatic BCC (blind carbon-copy) recipients.
 163         #         This is typically specified BEFORE an external content filter (eg. amavis).
 164         # no_header_body_checks
 165         #         Disable header/body_checks. This is typically specified AFTER
 166         #         an external content filter.
 167         # no_milters
 168         #         Disable Milter (mail filter) applications.
 169         #         This is typically specified AFTER an external content filter.
 170       # Parse the extension in email address, eg. contact+extension@
 171       relayhost = "";
 172       #relay_clientcerts = hash:/var/lib/postfix/conf/relay_clientcerts
 173       # This is where to put backup MX domains
 174       relay_domains = "$mydestination";
 175       relay_recipient_maps = "";
 176       smtp_body_checks = "";
 177       #smtp_cname_overrides_servername = false;
 178       smtp_connect_timeout = "60s";
 179       #smtp_header_checks = "regexp:/var/lib/postfix/smtp_header_checks";
 180       smtp_mime_header_checks = "";
 181       smtp_nested_header_checks = "";
 182       smtp_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
 183       #smtp_tls_fingerprint_digest = "sha1";
 184       smtp_tls_loglevel = "1";
 185       #smtp_tls_note_starttls_offer = true;
 186       #smtp_tls_policy_maps = "hash:/var/lib/postfix/conf/tls_policy";
 187       # Only allow TLSv* protocols
 188       smtp_tls_protocols = [ "!SSLv2" "!SSLv3" ];
 189       smtp_tls_scert_verifydepth = "5";
 190       #smtp_tls_secure_cert_match = [ "nexthop" "dot-nexthop" ];
 191       smtp_tls_security_level = "may";
 192       smtp_tls_session_cache_database = "btree:$data_directory/smtp_tls_session_cache";
 193       #smtp_tls_session_cache_timeout = "3600s";
 194       #smtp_tls_verify_cert_match = "hostname";
 195       # Useful to test restrictions
 196       smtpd_authorized_xclient_hosts = "127.0.0.1";
 197       smtpd_banner = "${networking.fqdn} ESMTP $mail_name (NixOS)";
 198       smtpd_client_connection_count_limit = "50";
 199       smtpd_client_connection_rate_limit = "0";
 200       smtpd_client_event_limit_exceptions = "$mynetworks";
 201       smtpd_client_message_rate_limit = "0";
 202       smtpd_client_new_tls_session_rate_limit = "0";
 203       smtpd_client_port_logging = false;
 204       smtpd_client_recipient_rate_limit = "0";
 205       smtpd_client_restrictions = [
 206         #"check_client_access hash:/var/lib/postfix/conf/client_blacklist"
 207       ];
 208       smtpd_data_restrictions = [
 209         "reject_unauth_pipelining"
 210           # Force the smtp client to wait OK before sending
 211         "permit"
 212       ];
 213       # Disable opportunistic encryption
 214       smtpd_discard_ehlo_keywords = "starttls";
 215       #smtpd_end_of_data_restrictions = "";
 216       # Ban 5 sec on error
 217       smtpd_error_sleep_time = "5";
 218       smtpd_helo_required = true;
 219       smtpd_helo_restrictions = [
 220         "reject_invalid_helo_hostname"
 221         "reject_non_fqdn_helo_hostname"
 222         #"reject_unknown_helo_hostname"
 223           # May be useful to fight spam
 224         "permit"
 225       ];
 226       #smtpd_milters = "";
 227       # Needed by postgrey
 228       smtpd_peername_lookup = true;
 229       smtpd_recipient_limit = "5000";
 230       smtpd_recipient_overshoot_limit = "5000";
 231       smtpd_recipient_restrictions = [
 232         "reject_non_fqdn_recipient"
 233         #"reject_invalid_hostname"
 234         "reject_unknown_recipient_domain"
 235         #"reject_non_fqdn_sender"
 236         "reject_unauth_pipelining"
 237         #"check_policy_service inet:localhost:12340"
 238         # check quota
 239         "permit_mynetworks"
 240         "permit_tls_clientcerts"
 241         "permit_sasl_authenticated"
 242         "reject_unverified_recipient"
 243           # $fallback_transport is responsible of checking the existence of the recipient
 244           # WARNING: verify(8) has a cache, dumpable if verify(8) is stopped, with:
 245           # postmap -s btree:/var/lib/postfix/data/verify_cache
 246         # Bypass SPF check and postgrey if the recipient is not for us or someone in backup_mx
 247         "reject_unauth_destination"
 248         # Check SPF
 249         #"check_policy_service unix:private/spfcheck"
 250         # Greylisting using postgrey
 251         "check_policy_service unix:${postgrey.socket.path}"
 252         # Once postgrey passed, permit what is for us
 253         "permit_auth_destination"
 254         "reject"
 255         #"reject_unknown_sender_domain"
 256           # Maybe better in smtpd_sender_restrictions
 257         #"reject_rbl_client bl.spamcop.net"
 258         #"reject_rbl_client list.dsbl.org"
 259         #"reject_rbl_client zen.spamhaus.org"
 260         #"reject_rbl_client dnsbl.sorbs.net"
 261       ];
 262       smtpd_relay_restrictions = [
 263         "permit_mynetworks"
 264         "permit_sasl_authenticated"
 265           # NOTE: permit auth through dovecot's SASL
 266         "reject_unauth_destination"
 267       ];
 268       #smtpd_restriction_classes = "";
 269       broken_sasl_auth_clients = false;
 270       #smtpd_sasl_auth_enable = true;
 271       #smtpd_sasl_path = "private/auth";
 272       #smtpd_sasl_security_options = "noanonymous";
 273       #smtpd_sasl_type = "dovecot";
 274       smtpd_sender_restrictions = [
 275         "permit_mynetworks"
 276         "permit_tls_clientcerts"
 277         "permit_sasl_authenticated"
 278           # NOTE: permit auth through dovecot's SASL
 279         #"check_sender_access hash:/var/lib/postfix/conf/sender_access"
 280         "reject_unauth_pipelining"
 281         "reject_non_fqdn_sender"
 282         #"reject_sender_login_mismatch"
 283         #"reject_unknown_sender_domain"
 284         "permit"
 285       ];
 286       smtpd_starttls_timeout = "300s";
 287       #smtpd_tls_always_issue_session_ids = true;
 288       # No SASL AUTH without TLS
 289       smtpd_tls_auth_only = true;
 290       #smtpd_tls_CApath = "/etc/postfix/x509/ca/";
 291       smtpd_tls_ask_ccert = false;
 292       #smtpd_tls_ccert_verifydepth = "5";
 293       smtpd_tls_ciphers = "high";
 294       smtpd_tls_eecdh_grade = "ultra";
 295       # Disable weak ciphers as reported by https://ssl-tools.net
 296       # https://serverfault.com/questions/744168/how-to-disable-rc4-on-postfix
 297       smtpd_tls_exclude_ciphers = [ "RC4" "aNULL" ];
 298       smtpd_tls_fingerprint_digest = "sha512";
 299       # Log only a summary message on TLS handshake completion
 300       smtpd_tls_loglevel = "1";
 301       smtpd_tls_mandatory_ciphers = "high";
 302       smtpd_tls_mandatory_protocols = "TLSv1";
 303       # Only allow TLSv*
 304       smtpd_tls_protocols = [ "!SSLv2" "!SSLv3" ];
 305       #smtpd_tls_received_header = false;
 306       smtpd_tls_req_ccert = false;
 307       # Postfix 2.3 and later
 308       # encrypt
 309       #  Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
 310       #  encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
 311       #  SMTP server. Instead, this option should be used only on dedicated servers.
 312       smtpd_tls_security_level = "may";
 313       smtpd_tls_session_cache_database = "btree:$data_directory/smtpd_tls_session_cache";
 314       #smtpd_tls_session_cache_timeout = "3600s";
 315       # Stops mail from poorly written software
 316       strict_rfc821_envelopes = true;
 317       #sympa_destination_recipient_limit = "1";
 318       #sympabounce_destination_recipient_limit = "1";
 319       # postconf(5) discourages to change this
 320       #tls_high_cipherlist = "AES256-SHA";
 321       #tls_random_bytes = "32";
 322       # Must not be in a chroot
 323       #tls_random_exchange_name = "$data_directory/prng_exch";
 324       #tls_random_prng_update_period = "3600s";
 325       #tls_random_reseed_period = "3600s";
 326       # Use a non blocking source of randomness
 327       tls_random_source = "dev:/dev/urandom";
 328       transport_maps = [
 329         #"ldap:transport"
 330         #"hash:/etc/postfix/transport-dovecot"
 331         #"hash:/etc/postfix/$mydomain/transport"
 332         #"hash:/etc/dovecot/transport"
 333         #"regexp:/etc/sympa/transport"
 334       ];
 335       # Rejects immediately what $fallback_transport rejects
 336       unverified_recipient_reject_code = "550";
 337       # Do not specify virtual alias domain names in mydestination
 338       # or relay_domains configuration parameters
 339       #
 340       # With  a  virtual  alias  domain,  the  Postfix SMTP server
 341       # accepts  mail  for  known-user@virtual-alias.domain,   and
 342       # rejects   mail  for  unknown-user@virtual-alias.domain  as
 343       # undeliverable.
 344       virtual_alias_domains = [];
 345       virtual_alias_maps = [
 346         #"hash:/etc/postfix/virtual_alias_maps"
 347         #"hash:/etc/postfix/virtual_domain_alias_maps"
 348         "ldap:/etc/postfix/ldap-forward.cf"
 349         "ldap:/etc/postfix/ldap-virtual_alias_maps.cf"
 350         #"hash:/etc/postfix/virtual_alias-dovecot"
 351         #"hash:/var/lib/postfix/conf/valias"
 352         #"regexp:/etc/sympa/virtual_alias"
 353       ];
 354       #virtual_uid_maps = "static:5000";
 355       #virtual_gid_maps = "static:5000";
 356       #virtual_mailbox_base = dovecot2.mailDir;
 357       virtual_mailbox_domains = [networking.domain] ++ networking.domainAliases;
 358       #virtual_mailbox_maps = "hash:/etc/postfix/virtual_mailbox_maps";
 359       virtual_transport = "lmtp:unix:private/dovecot-lmtp";
 360     };
 361     #submissionOptions = {
 362     #  smtpd_tls_security_level     = "encrypt";
 363     #  smtpd_sasl_auth_enable       = "yes";
 364     #  smtpd_sasl_type              = "dovecot";
 365     #  smtpd_sasl_path              = "private/auth";
 366     #  smtpd_sasl_security_options  = "noanonymous";
 367     #  smtpd_sasl_local_domain      = "$myhostname";
 368     #  smtpd_client_restrictions    = "permit_sasl_authenticated,reject";
 369     #  smtpd_sender_login_maps      = "hash:/etc/postfix/vaccounts";
 370     #  smtpd_sender_restrictions    = "reject_sender_login_mismatch";
 371     #  smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
 372     #  cleanup_service_name         = "submission-header-cleanup";
 373     #};
 374     extraMasterConf = ''
 375       #spfcheck    unix  -        n       n       -        0        spawn
 376       #  user=policyd-spf argv=/usr/sbin/postfix-policyd-spf-perl
 377       465         inet  n        -       -       -        -        smtpd
 378         -o milter_macro_daemon_name=ORIGINATING
 379         -o smtpd_client_restrictions=permit_sasl_authenticated,reject
 380         -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject
 381         -o smtpd_sasl_auth_enable=yes
 382         -o smtpd_sasl_local_domain=$myhostname
 383         -o smtpd_sasl_path=private/auth
 384         -o smtpd_sasl_security_options=noanonymous
 385         -o smtpd_sasl_type=dovecot
 386         -o smtpd_tls_ask_ccert=no
 387         -o smtpd_tls_auth_only=yes
 388         -o smtpd_tls_ccert_verifydepth=0
 389         -o smtpd_tls_loglevel=1
 390         -o smtpd_tls_req_ccert=no
 391         -o smtpd_tls_security_level=encrypt
 392         -o smtpd_tls_wrappermode=yes
 393       # -o smtpd_sender_restrictions=reject_sender_login_mismatch
 394       # -o smtpd_sender_login_maps=hash:/etc/postfix/vaccounts
 395       # -o cleanup_service_name=submission-header-cleanup
 396       submission-header-cleanup unix n - n    -       0       cleanup
 397         -o header_checks=pcre:${submissionHeaderCleanupRules}
 398       #spfcheck  unix  -       n       n       -       0       spawn
 399       #  user=policyd-spf argv=/usr/bin/postfix-policyd-spf-perl
 400       #uucp      unix  -       n       n       -       -       pipe
 401       #  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
 402       #smtp      inet  n       -       -       -       -       smtpd
 403       #  -o cleanup_service_name=pre-cleanup
 404       #  -o content_filter=amavis:[127.0.0.1]:10024
 405       #  -o smtpd_sender_restrictions=reject_unauth_pipelining,reject_non_fqdn_sender,permit
 406       #  -o receive_override_options=no_address_mappings
 407       #amavis    unix  -       -       n        -      2       lmtp
 408       #  -o lmtp_data_done_timeout=1200
 409       #  -o lmtp_send_xforward_command=yes
 410       #  -o lmtp_tls_note_starttls_offer=no
 411       #127.0.0.1:10025 inet n  -       n       -       -       smtpd
 412       #  -o content_filter=
 413       #  -o local_header_rewrite_clients=
 414       #  -o local_recipient_maps=
 415       #  -o mynetworks=127.0.0.0/8
 416       #  -o receive_override_options=no_header_body_checks,no_milters,no_unknown_recipient_checks
 417       #  -o relay_recipient_maps=
 418       #  -o smtpd_client_connection_count_limit=0
 419       #  -o smtpd_client_connection_rate_limit=0
 420       #  -o smtpd_client_restrictions=permit_mynetworks,reject
 421       #  -o smtpd_data_restrictions=reject_unauth_pipelining
 422       #  -o smtpd_delay_reject=no
 423       #  -o smtpd_end_of_data_restrictions=
 424       #  -o smtpd_error_sleep_time=0
 425       #  -o smtpd_hard_error_limit=1000
 426       #  -o smtpd_helo_restrictions=
 427       #  -o smtpd_milters=
 428       #  -o smtpd_recipient_restrictions=permit_mynetworks,reject
 429       #  -o smtpd_restriction_classes=
 430       #  -o smtpd_sender_restrictions=
 431       #  -o smtpd_soft_error_limit=1001
 432       #  -o strict_rfc821_envelopes=yes
 433       #submission inet n       -       -       -       -       smtpd
 434       #  -o cleanup_service_name=pre-cleanup
 435       #  -o content_filter=amavis:[127.0.0.1]:10024
 436       #  -o milter_macro_daemon_name=ORIGINATING
 437       #  -o receive_override_options=no_address_mappings
 438       #  -o smtpd_sender_restrictions=permit_tls_clientcerts,reject
 439       #  -o smtpd_tls_ask_ccert=yes
 440       #  -o smtpd_tls_auth_only=yes
 441       #  -o smtpd_tls_ccert_verifydepth=2
 442       #  -o smtpd_tls_loglevel=1
 443       #  -o smtpd_tls_req_ccert=yes
 444       #  -o smtpd_tls_security_level=encrypt
 445       #smtps     inet  n       -       -       -       -       smtpd
 446       #  -o milter_macro_daemon_name=ORIGINATING
 447       #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
 448       #  -o smtpd_sasl_auth_enable=yes
 449       #  -o smtpd_tls_ask_ccert=yes
 450       #  -o smtpd_tls_auth_only=yes
 451       #  -o smtpd_tls_ccert_verifydepth=0
 452       #  -o smtpd_tls_loglevel=1
 453       #  -o smtpd_tls_req_ccert=no
 454       #  -o smtpd_tls_security_level=encrypt
 455       #  -o smtpd_tls_wrappermode=yes
 456       #pickup    fifo  n       -       -       60      1       pickup
 457       #  -o cleanup_service_name=pre-cleanup
 458       #  -o content_filter=amavis:[127.0.0.1]:10024
 459       #pre-cleanup unix n      -       -       -       0       cleanup
 460       #  -o virtual_alias_maps=
 461       #cleanup   unix  n       -       -       -       0       cleanup
 462       #  -o mime_header_checks=
 463       #  -o nested_header_checks=
 464       #  -o body_checks=
 465       #  -o header_checks=
 466       #-- SYMPA begin
 467       #sympa unix - n n - - pipe
 468       #  flags=R user=sympa argv=/usr/lib/sympa/bin/queue ''${recipient}
 469       #sympabounce unix - n n - - pipe
 470       #  flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ''${recipient}
 471       #-- SYMPA end
 472     '';
 473      #noclue    unix  -       n       n       -       -       pipe
 474      #  flags=q user=noclue argv=/usr/local/bin/noclue-delivery ${recipient} ${sender}
 475   };
 476 };
 477 }