]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/postfix.nix
public-inbox: change inboxes
[sourcephile-nix.git] / machines / mermet / postfix.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins) attrNames concatStringsSep readFile toPath;
4 inherit (lib) types;
5 inherit (pkgs.lib) loadFile unlines unwords unlinesAttrs;
6 inherit (config) networking users;
7 inherit (config.services) postfix dovecot2 openldap;
8 domains = [
9 "sourcephile.fr"
10 "autogeree.net"
11 ];
12 in
13 {
14 imports = map (domain: (./postfix + "/${domain}.nix")) domains;
15 options = {
16 services.postfix = {
17 tls_server_sni_maps = lib.mkOption {
18 type = types.attrsOf (types.listOf types.path);
19 default = {};
20 apply = m: pkgs.writeText "sni" (lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: x509: ''
21 ${domain} ${unwords x509}
22 '') m));
23 };
24 };
25 };
26 config = {
27 users.groups.acme.members = [ postfix.user ];
28 systemd.services.postfix = {
29 wants = ["openldap.service"];
30 after = ["openldap.service"];
31 preStart = ''
32 install -m 400 -o root -g root ${postfix.tls_server_sni_maps} /run/keys/postfix-sni
33 ${pkgs.postfix}/bin/postmap -F hash:/run/keys/postfix-sni
34 '';
35 };
36 networking.nftables.ruleset = ''
37 add rule inet filter net2fw tcp dport 25 counter accept comment "SMTP"
38 add rule inet filter net2fw tcp dport 465 counter accept comment "submissions"
39 add rule inet filter fw2net meta skuid ${postfix.user} tcp dport 25 counter accept comment "SMTP"
40 '';
41 services.postfix = {
42 enable = true;
43 networksStyle = "host";
44 hostname ="${networking.hostName}.${networking.domain}";
45 domain = networking.domain;
46 origin = "$myhostname";
47 destination = [
48 "localhost"
49 "localhost.localdomain"
50 "$myhostname"
51 ];
52 postmasterAlias = "root";
53 rootAlias = "root@${networking.domain}";
54 sslKey = "/var/lib/acme/${networking.domain}/key.pem";
55 sslCert = "/var/lib/acme/${networking.domain}/fullchain.pem";
56 networks = [
57 "127.0.0.0/8"
58 "[::1]/128"
59 ];
60 setSendmail = true;
61 # Parse the extension in email address, eg. contact+extension@
62 recipientDelimiter = "+";
63 config = {
64 debug_peer_level = "4";
65 debug_peer_list = [
66 #"chomsky.autogeree.net"
67 #"localhost"
68 #"mail.sourcephile.fr"
69 ];
70
71 #
72 # Sending to the world
73 #
74 # Appending .domain is the MUA's job
75 append_dot_mydomain = false;
76 smtp_body_checks = "";
77 #smtp_cname_overrides_servername = false;
78 smtp_connect_timeout = "60s";
79 #smtp_header_checks = "regexp:/var/lib/postfix/smtp_header_checks";
80 smtp_mime_header_checks = "";
81 smtp_nested_header_checks = "";
82 smtp_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
83 #smtp_tls_fingerprint_digest = "sha1";
84 smtp_tls_loglevel = "1";
85 #smtp_tls_note_starttls_offer = true;
86 #smtp_tls_policy_maps = "hash:/var/lib/postfix/conf/tls_policy";
87 # Only allow TLSv* protocols
88 smtp_tls_protocols = [ "!SSLv2" "!SSLv3" ];
89 #smtp_tls_scert_verifydepth = "5";
90 #smtp_tls_secure_cert_match = [ "nexthop" "dot-nexthop" ];
91 smtp_tls_security_level = "may";
92 smtp_tls_session_cache_database = "btree:$data_directory/smtp_tls_session_cache";
93 #smtp_tls_session_cache_timeout = "3600s";
94 #smtp_tls_verify_cert_match = "hostname";
95
96 #
97 # Receiving from the world
98 #
99 message_size_limit = "20480000";
100 maximal_queue_lifetime = "5d";
101 default_extra_recipient_limit = "5000";
102 line_length_limit = "2048";
103 duplicate_filter_limit = "5000";
104 # Stops mail from poorly written software
105 strict_rfc821_envelopes = true;
106 mime_header_checks = [];
107 milter_header_checks = [];
108 nested_header_checks = [];
109 body_checks = [];
110 content_filter = "";
111 permit_mx_backup_networks = [];
112 propagate_unmatched_extensions = [ "canonical" "virtual" "alias" ];
113 #masquerade_classes = [ "envelope_sender" "header_sender" "header_recipient" ];
114 #masquerade_domains = "";
115 #masquerade_exceptions = "root";
116 queue_minfree = "0";
117 # Stops some techniques used to harvest email addresses
118 disable_vrfy_command = true;
119 enable_long_queue_ids = false;
120 # Useful to test restrictions
121 smtpd_authorized_xclient_hosts = "127.0.0.1";
122 smtpd_banner = "$myhostname ESMTP $mail_name (NixOS)";
123 smtpd_client_connection_count_limit = "50";
124 smtpd_client_connection_rate_limit = "0";
125 smtpd_client_event_limit_exceptions = "$mynetworks";
126 smtpd_client_message_rate_limit = "0";
127 smtpd_client_new_tls_session_rate_limit = "0";
128 smtpd_client_port_logging = false;
129 smtpd_client_recipient_rate_limit = "0";
130 # Ban 5 sec on error
131 smtpd_error_sleep_time = "5";
132 # Needed to enforce reject_unknown_helo_hostname
133 smtpd_helo_required = true;
134 smtpd_helo_restrictions = [
135 "reject_invalid_helo_hostname"
136 "reject_non_fqdn_helo_hostname"
137 # Don't talk to mail systems that don't know their own hostname.
138 "reject_unknown_helo_hostname"
139 "permit"
140 ];
141 smtpd_client_restrictions = [
142 ];
143 # Set in postfix/*.nix and used in submissions/smptd
144 # with reject_sender_login_mismatch
145 smtpd_sender_login_maps = [];
146 smtpd_sender_restrictions = [
147 "reject_non_fqdn_sender"
148 "permit"
149 ];
150 smtpd_reject_unlisted_recipient = true;
151 # Check the RCPT TO, before smtpd_recipient_restrictions
152 # Restrictions based on what is allowed or not,
153 # these are applied before smtpd_recipient_restrictions
154 smtpd_relay_restrictions = [
155 "permit_mynetworks"
156 # Check the recipient's address in virtual_mailbox_domains and virtual_mailbox_maps
157 "permit_auth_destination"
158 # The world is only authorized to use our relay for the above destinations.
159 "reject"
160 ];
161 # Restrictions based on what is working or not
162 smtpd_recipient_restrictions = [
163 # Reject if the domain is not fully qualified
164 "reject_non_fqdn_recipient"
165 # Reject if the domain is not working, even before bothering to check the address
166 "reject_unknown_recipient_domain"
167 # Reject if the address is not working
168 # WARNING: this does not work if the recipient is greylisting.
169 # WARNING: verify(8) has a cache, dumpable if verify(8) is stopped, with:
170 # postmap -s btree:/var/lib/postfix/data/verify_cache
171 #"reject_unverified_recipient"
172 "permit"
173 ];
174 # Trust the verify database
175 #unverified_recipient_reject_code = "550";
176 smtpd_data_restrictions = [
177 # Force the smtpd's client to wait OK before sending
178 "reject_unauth_pipelining"
179 "permit"
180 ];
181 smtpd_end_of_data_restrictions = [
182 # Enforce mail volume quota via policy service callouts.
183 #check_policy_service unix:private/policy
184 ];
185 #smtpd_milters = "";
186 smtpd_peername_lookup = true;
187 smtpd_recipient_limit = "5000";
188 smtpd_recipient_overshoot_limit = "5000";
189 #smtpd_restriction_classes = "";
190 #smtpd_sasl_auth_enable = true;
191 #smtpd_sasl_path = "private/auth";
192 #smtpd_sasl_security_options = "noanonymous";
193 #smtpd_sasl_type = "dovecot";
194 smtpd_starttls_timeout = "300s";
195 #smtpd_tls_always_issue_session_ids = true;
196 #smtpd_tls_CApath = "/etc/postfix/x509/ca/";
197 smtpd_tls_ask_ccert = false;
198 #smtpd_tls_ccert_verifydepth = "5";
199 smtpd_tls_ciphers = "high";
200 smtpd_tls_eecdh_grade = "auto";
201 # Disable weak ciphers as reported by https://ssl-tools.net
202 # https://serverfault.com/questions/744168/how-to-disable-rc4-on-postfix
203 smtpd_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
204 smtpd_tls_fingerprint_digest = "sha512";
205 # Log only a summary message on TLS handshake completion
206 smtpd_tls_loglevel = "1";
207 smtpd_tls_mandatory_ciphers = "high";
208 smtpd_tls_mandatory_protocols = [ "!SSLv2" "!SSLv3" ];
209 # Only allow TLSv*
210 smtpd_tls_protocols = [ "!SSLv2" "!SSLv3" ];
211 #smtpd_tls_received_header = false;
212 smtpd_tls_req_ccert = false;
213 # Postfix 2.3 and later
214 # encrypt
215 # Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
216 # encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
217 # SMTP server. Instead, this option should be used only on dedicated servers.
218 smtpd_tls_security_level = "may";
219 smtpd_tls_session_cache_database = "btree:$data_directory/smtpd_tls_session_cache";
220 #smtpd_tls_session_cache_timeout = "3600s";
221 #smtpd_tls_chain_files =
222
223 relayhost = [];
224 #relay_clientcerts = hash:/var/lib/postfix/conf/relay_clientcerts
225 # This is where to put backup MX domains
226 relay_domains = [];
227 relay_recipient_maps = [];
228
229 # Use a non blocking source of randomness
230 tls_random_source = "dev:/dev/urandom";
231 # Map each domain to a specific X.509 certificate
232 tls_server_sni_maps = "hash:/run/keys/postfix-sni";
233
234 # Only explicitely aliased accounts have a mail, not all the passwd
235 local_recipient_maps = "$alias_maps";
236 # Note that the local transport rewrites the envelope recipient
237 # according to the alias_maps, and thus the aliasing is transparent
238 # to the nexthop (eg. dovecot)
239 #local_transport = local:$myhostname
240 # No console bell on new mail
241 biff = false;
242 forward_path = [
243 /*
244 "$home/.forward''${recipient_delimiter}''${extension}"
245 */
246 "$home/.forward"
247 ];
248
249 # Filled by the postfix/*.nix
250 virtual_mailbox_domains = [];
251 # Completed by the postfix/*.nix
252 virtual_mailbox_maps = [
253 "hash:/etc/postfix/virtual"
254 ];
255 virtual_transport = "lmtp:unix:private/dovecot-lmtp";
256 /*
257 dovecot_destination_recipient_limit = "1";
258 virtual_transport = "dovecot";
259 */
260
261 # There is no fallback
262 fallback_transport = "";
263 };
264 virtualMapType = "hash";
265 masterConfig =
266 let
267 mkVal = value:
268 if lib.isList value
269 then concatStringsSep "," value
270 else
271 if value == true then "yes"
272 else if value == false then "no"
273 else toString value;
274 mkKeyVal = opt: val: [ "-o" (opt + "=" + mkVal val) ];
275 mkArgs = args: lib.concatLists (lib.mapAttrsToList mkKeyVal args);
276 in {
277 pickup = {
278 args = mkArgs {
279 cleanup_service_name = "submissions-header-cleanup";
280 };
281 };
282 # Implicit TLS on port 465
283 # https://tools.ietf.org/html/rfc8314#section-3.3
284 submissions = {
285 type = "inet";
286 private = false;
287 command = "smtpd";
288 args = mkArgs {
289 syslog_name = "postfix/submissions";
290 # Implicit TLS, not STARTTLS
291 smtpd_tls_wrappermode = true;
292 smtpd_tls_mandatory_protocols = [
293 "TLSv1.3"
294 # FIXME: to be removed when K-9 Mail will support TLSv1.3,
295 # K-9 Mail 5.600 does not.
296 "TLSv1.2"
297 ];
298 milter_macro_daemon_name = "ORIGINATING";
299 smtpd_helo_restrictions = [
300 "permit_sasl_authenticated"
301 ] ++ postfix.config.smtpd_helo_restrictions;
302 smtpd_relay_restrictions = [
303 # SASL authorizes to send to the world
304 "permit_sasl_authenticated"
305 "reject"
306 ];
307 smtpd_sasl_auth_enable = true;
308 smtpd_sasl_type = "dovecot";
309 smtpd_sasl_path = "private/auth";
310 smtpd_sasl_local_domain = "";
311 # Offer SASL authentication only after a TLS-encrypted session has been established
312 smtpd_tls_auth_only = true;
313 smtpd_sasl_tls_security_options = [ "noanonymous" ];
314 # Do not put SASL logins in mail headers
315 smtpd_sasl_authenticated_header = false;
316 # Who cares about (old) Outlook
317 broken_sasl_auth_clients = false;
318 smtpd_sender_restrictions = [
319 "reject_non_fqdn_sender"
320 # Check that the SASL user is using only its own
321 # mail addresses on the envelope, as indicated in smtpd_sender_login_maps
322 "reject_sender_login_mismatch"
323 "permit"
324 ];
325 # No X.509 certificates for users, for now
326 smtpd_tls_ask_ccert = false;
327 smtpd_tls_ccert_verifydepth = 0;
328 smtpd_tls_loglevel = 1;
329 smtpd_tls_req_ccert = false;
330 cleanup_service_name = "submissions-header-cleanup";
331 };
332 };
333 submissions-header-cleanup = {
334 type = "unix";
335 private = false;
336 maxproc = 0;
337 command = "cleanup";
338 args = mkArgs {
339 header_checks = "pcre:" + pkgs.writeText "submission_header_cleanup_rules" ''
340 # Removes sensitive headers from mails handed in via the submission or smtps port.
341 # See https://thomas-leister.de/mailserver-debian-stretch/
342 # Uses "pcre" style regex.
343
344 /^Received:/ IGNORE
345 /^User-Agent:/ IGNORE
346 /^X-Enigmail:/ IGNORE
347 /^X-Mailer:/ IGNORE
348 /^X-Originating-IP:/ IGNORE
349 '';
350 };
351 };
352 };
353 extraMasterConf = ''
354 #spfcheck unix - n n - 0 spawn
355 # user=policyd-spf argv=/usr/sbin/postfix-policyd-spf-perl
356 # -o smtpd_sender_restrictions=reject_sender_login_mismatch
357 # -o smtpd_sender_login_maps=hash:/etc/postfix/vaccounts
358 # -o cleanup_service_name=submissions-header-cleanup
359 #spfcheck unix - n n - 0 spawn
360 # user=policyd-spf argv=/usr/bin/postfix-policyd-spf-perl
361 #uucp unix - n n - - pipe
362 # flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
363 #smtp inet n - - - - smtpd
364 # -o cleanup_service_name=pre-cleanup
365 # -o content_filter=amavis:[127.0.0.1]:10024
366 # -o smtpd_sender_restrictions=reject_unauth_pipelining,reject_non_fqdn_sender,permit
367 # -o receive_override_options=no_address_mappings
368 #amavis unix - - n - 2 lmtp
369 # -o lmtp_data_done_timeout=1200
370 # -o lmtp_send_xforward_command=yes
371 # -o lmtp_tls_note_starttls_offer=no
372 #127.0.0.1:10025 inet n - n - - smtpd
373 # -o content_filter=
374 # -o local_header_rewrite_clients=
375 # -o local_recipient_maps=
376 # -o mynetworks=127.0.0.0/8
377 # -o receive_override_options=no_header_body_checks,no_milters,no_unknown_recipient_checks
378 # -o relay_recipient_maps=
379 # -o smtpd_client_connection_count_limit=0
380 # -o smtpd_client_connection_rate_limit=0
381 # -o smtpd_client_restrictions=permit_mynetworks,reject
382 # -o smtpd_data_restrictions=reject_unauth_pipelining
383 # -o smtpd_delay_reject=no
384 # -o smtpd_end_of_data_restrictions=
385 # -o smtpd_error_sleep_time=0
386 # -o smtpd_hard_error_limit=1000
387 # -o smtpd_helo_restrictions=
388 # -o smtpd_milters=
389 # -o smtpd_recipient_restrictions=permit_mynetworks,reject
390 # -o smtpd_restriction_classes=
391 # -o smtpd_sender_restrictions=
392 # -o smtpd_soft_error_limit=1001
393 # -o strict_rfc821_envelopes=yes
394 #submission inet n - - - - smtpd
395 # -o cleanup_service_name=pre-cleanup
396 # -o content_filter=amavis:[127.0.0.1]:10024
397 # -o milter_macro_daemon_name=ORIGINATING
398 # -o receive_override_options=no_address_mappings
399 # -o smtpd_sender_restrictions=permit_tls_clientcerts,reject
400 # -o smtpd_tls_ask_ccert=yes
401 # -o smtpd_tls_auth_only=yes
402 # -o smtpd_tls_ccert_verifydepth=2
403 # -o smtpd_tls_loglevel=1
404 # -o smtpd_tls_req_ccert=yes
405 # -o smtpd_tls_security_level=encrypt
406 #smtps inet n - - - - smtpd
407 # -o milter_macro_daemon_name=ORIGINATING
408 # -o smtpd_client_restrictions=permit_sasl_authenticated,reject
409 # -o smtpd_sasl_auth_enable=yes
410 # -o smtpd_tls_ask_ccert=yes
411 # -o smtpd_tls_auth_only=yes
412 # -o smtpd_tls_ccert_verifydepth=0
413 # -o smtpd_tls_loglevel=1
414 # -o smtpd_tls_req_ccert=no
415 # -o smtpd_tls_security_level=encrypt
416 # -o smtpd_tls_wrappermode=yes
417 #pickup fifo n - - 60 1 pickup
418 # -o cleanup_service_name=pre-cleanup
419 # -o content_filter=amavis:[127.0.0.1]:10024
420 #pre-cleanup unix n - - - 0 cleanup
421 # -o virtual_alias_maps=
422 #cleanup unix n - - - 0 cleanup
423 # -o mime_header_checks=
424 # -o nested_header_checks=
425 # -o body_checks=
426 # -o header_checks=
427 #-- SYMPA begin
428 #sympa unix - n n - - pipe
429 # flags=R user=sympa argv=/usr/lib/sympa/bin/queue ''${recipient}
430 #sympabounce unix - n n - - pipe
431 # flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ''${recipient}
432 #-- SYMPA end
433 '';
434 #noclue unix - n n - - pipe
435 # flags=q user=noclue argv=/usr/local/bin/noclue-delivery ${recipient} ${sender}
436 };
437 };
438 }