install/logical/friot/rmilter.nix

   1 {pkgs, lib, config, ...}:
   2 let inherit (builtins) attrNames;
   3     inherit (lib) types;
   4     inherit (config.services) dkim dovecot2 rmilter;
   5
   6     createDomainDkimCert = domain:
   7       let dkim_key = "${dkim.keyDir}/${domain}.${dkim.selector}.key";
   8           dkim_txt = "${dkim.keyDir}/${domain}.${dkim.selector}.txt";
   9       in ''
  10       if [ ! -f "${dkim_key}" ] || [ ! -f "${dkim_txt}" ]
  11        then
  12         ${pkgs.opendkim}/bin/opendkim-genkey \
  13           --domain "${domain}" \
  14           --selector "${dkim.selector}" \
  15           --directory="${dkim.keyDir}"
  16         mv "${dkim.keyDir}/${dkim.selector}.private" "${dkim_key}"
  17         mv "${dkim.keyDir}/${dkim.selector}.txt" "${dkim_txt}"
  18        fi
  19     '';
  20 in
  21 {
  22   options.services.dkim = lib.mkOption {
  23     default = {};
  24     type = types.submodule {
  25       options = {
  26         keyDir = lib.mkOption {
  27           type        = types.path;
  28           default     = "/var/lib/dkim";
  29           description = ''
  30           '';
  31         };
  32         selector = lib.mkOption {
  33           type        = types.str;
  34           default     = "mail";
  35           description = ''
  36           '';
  37         };
  38       };
  39     };
  40   };
  41   config = {
  42     services.rspamd = {
  43       enable = true;
  44     };
  45     services.rmilter = {
  46       enable = true;
  47       #debug = true;
  48       postfix = {
  49         enable = true;
  50       };
  51       rspamd = {
  52         enable      = true;
  53         extraConfig = "extended_spam_headers = yes;";
  54       };
  55       extraConfig = ''
  56         use_redis = true;
  57         max_size  = 20M;
  58         #clamav {
  59         #  servers = /var/run/clamav/clamd.ctl;
  60         #};
  61         # NOTE: domain = "*"; causes rmilter to try to search key in the key path
  62         # as keypath/domain.selector.key for any domain.
  63         dkim {
  64           domain {
  65             domain   = "*";
  66             key      = "${dkim.keyDir}";
  67             selector = "${dkim.selector}";
  68           };
  69           sign_alg  = sha256;
  70           auth_only = yes;
  71         };
  72       '';
  73       bindSocket.type = "unix";
  74       bindSocket.path = "/run/rmilter.sock";
  75         # NOTE: fix default which is in wiped out directory /run/rmilter/rmilter.sock
  76     };
  77     #systemd.sockets.rmilter.socketConfig.Accept = false;
  78     systemd.services.rmilter = {
  79       requires = [ "rmilter.socket" ];
  80       after    = [ "rmilter.socket" ];
  81       preStart = ''
  82         install -D -d -o rmilter -g rmilter ${dkim.keyDir}
  83         ${lib.concatStringsSep "\n" (map createDomainDkimCert (attrNames dovecot2.domains))}
  84         chown -R rmilter:rmilter "${dkim.keyDir}"
  85       '';
  86     };
  87   };
  88 }