]> Git — Sourcephile - sourcephile-nix.git/blob - nixos/modules/services/mail/postfix.nix
julm-nix: update
[sourcephile-nix.git] / nixos / modules / services / mail / postfix.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (lib) types;
4 inherit (config.services) postfix;
5 in
6 {
7 options = {
8 services.postfix = {
9 tls_server_sni_maps = lib.mkOption {
10 type = types.attrsOf (types.listOf types.path);
11 default = {};
12 apply = m: pkgs.writeText "sni" (lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: x509: ''
13 ${domain} ${lib.concatStringsSep " " x509}
14 '') m));
15 };
16 };
17 };
18 config = {
19 systemd.services.postfix = {
20 preStart = ''
21 install -m 400 -o root -g root ${postfix.tls_server_sni_maps} /run/keys/postfix-sni
22 ${pkgs.postfix}/bin/postmap -F hash:/run/keys/postfix-sni
23 '';
24 };
25 services.postfix = {
26 masterConfig = {
27 submissions-header-cleanup = {
28 type = "unix";
29 private = false;
30 maxproc = 0;
31 command = "cleanup";
32 args = ["-o" ("header_checks=pcre:" + pkgs.writeText "submission_header_cleanup_rules" ''
33 # Removes sensitive headers from mails handed in via the submission or smtps port.
34 # See https://thomas-leister.de/mailserver-debian-stretch/
35 # Uses "pcre" style regex.
36
37 /^Received:/ IGNORE
38 /^User-Agent:/ IGNORE
39 /^X-Enigmail:/ IGNORE
40 /^X-Mailer:/ IGNORE
41 /^X-Originating-IP:/ IGNORE
42 '')];
43 };
44 };
45 };
46 };
47 }