]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/postfix.nix
nix: fix PASSWORD_STORE_DIR
[sourcephile-nix.git] / machines / mermet / postfix.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins) attrNames concatStringsSep readFile toPath;
4 inherit (lib) types;
5 inherit (pkgs.lib) loadFile unlines unwords unlinesAttrs;
6 inherit (config) networking users;
7 inherit (config.services) postfix dovecot2 openldap;
8 domains = [
9 "sourcephile.fr"
10 "autogeree.net"
11 ];
12 in
13 {
14 imports = map (domain: (./postfix + "/${domain}.nix")) domains;
15 options = {
16 services.postfix = {
17 tls_server_sni_maps = lib.mkOption {
18 type = types.attrsOf (types.listOf types.path);
19 default = {};
20 apply = m: pkgs.writeText "sni" (lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: x509: ''
21 ${domain} ${unwords x509}
22 '') m));
23 };
24 };
25 };
26 config = {
27 users.groups.acme.members = [ postfix.user ];
28 systemd.services.postfix = {
29 wants = ["openldap.service"];
30 after = ["openldap.service"];
31 preStart = ''
32 install -m 400 -o root -g root ${postfix.tls_server_sni_maps} /run/keys/postfix-sni
33 ${pkgs.postfix}/bin/postmap -F hash:/run/keys/postfix-sni
34 '';
35 };
36 networking.nftables.ruleset = ''
37 add rule inet filter net2fw tcp dport 25 counter accept comment "SMTP"
38 add rule inet filter net2fw tcp dport 465 counter accept comment "submissions"
39 add rule inet filter fw2net meta skuid ${postfix.user} tcp dport 25 counter accept comment "SMTP"
40 '';
41 services.postfix = {
42 enable = true;
43 networksStyle = "host";
44 hostname ="${networking.hostName}.${networking.domain}";
45 domain = networking.domain;
46 origin = "$myhostname";
47 destination = [
48 "localhost"
49 "localhost.localdomain"
50 "$myhostname"
51 ];
52 postmasterAlias = "root";
53 rootAlias = "root@${networking.domain}";
54 sslKey = "/var/lib/acme/${networking.domain}/key.pem";
55 sslCert = "/var/lib/acme/${networking.domain}/fullchain.pem";
56 networks = [
57 "127.0.0.0/8"
58 "[::1]/128"
59 ];
60 setSendmail = true;
61 # Parse the extension in email address, eg. contact+extension@
62 recipientDelimiter = "+";
63 config = {
64 debug_peer_level = "4";
65 debug_peer_list = [
66 #"chomsky.autogeree.net"
67 #"localhost"
68 #"mail.sourcephile.fr"
69 ];
70
71 #
72 # Sending to the world
73 #
74 # Appending .domain is the MUA's job
75 append_dot_mydomain = false;
76 smtp_body_checks = "";
77 #smtp_cname_overrides_servername = false;
78 smtp_connect_timeout = "60s";
79 #smtp_header_checks = "regexp:/var/lib/postfix/smtp_header_checks";
80 smtp_mime_header_checks = "";
81 smtp_nested_header_checks = "";
82 smtp_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
83 #smtp_tls_fingerprint_digest = "sha1";
84 smtp_tls_loglevel = "1";
85 #smtp_tls_note_starttls_offer = true;
86 #smtp_tls_policy_maps = "hash:/var/lib/postfix/conf/tls_policy";
87 # Only allow TLSv* protocols
88 smtp_tls_protocols = [ "!SSLv2" "!SSLv3" ];
89 #smtp_tls_scert_verifydepth = "5";
90 #smtp_tls_secure_cert_match = [ "nexthop" "dot-nexthop" ];
91 smtp_tls_security_level = "may";
92 smtp_tls_session_cache_database = "btree:$data_directory/smtp_tls_session_cache";
93 #smtp_tls_session_cache_timeout = "3600s";
94 #smtp_tls_verify_cert_match = "hostname";
95
96 #
97 # Receiving from the world
98 #
99 message_size_limit = "20480000";
100 maximal_queue_lifetime = "5d";
101 default_extra_recipient_limit = "5000";
102 line_length_limit = "2048";
103 duplicate_filter_limit = "5000";
104 # Stops mail from poorly written software
105 strict_rfc821_envelopes = true;
106 mime_header_checks = [];
107 milter_header_checks = [];
108 nested_header_checks = [];
109 body_checks = [];
110 content_filter = "";
111 permit_mx_backup_networks = [];
112 propagate_unmatched_extensions = [ "canonical" "virtual" "alias" ];
113 #masquerade_classes = [ "envelope_sender" "header_sender" "header_recipient" ];
114 #masquerade_domains = "";
115 #masquerade_exceptions = "root";
116 queue_minfree = "0";
117 # Stops some techniques used to harvest email addresses
118 disable_vrfy_command = true;
119 enable_long_queue_ids = false;
120 # Useful to test restrictions
121 smtpd_authorized_xclient_hosts = "127.0.0.1";
122 smtpd_banner = "$myhostname ESMTP $mail_name (NixOS)";
123 smtpd_client_connection_count_limit = "50";
124 smtpd_client_connection_rate_limit = "0";
125 smtpd_client_event_limit_exceptions = "$mynetworks";
126 smtpd_client_message_rate_limit = "0";
127 smtpd_client_new_tls_session_rate_limit = "0";
128 smtpd_client_port_logging = false;
129 smtpd_client_recipient_rate_limit = "0";
130 # Ban 5 sec on error
131 smtpd_error_sleep_time = "5";
132 # Needed to enforce reject_unknown_helo_hostname
133 smtpd_helo_required = true;
134 smtpd_helo_restrictions = [
135 "reject_invalid_helo_hostname"
136 "reject_non_fqdn_helo_hostname"
137 # Don't talk to mail systems that don't know their own hostname.
138 "reject_unknown_helo_hostname"
139 "permit"
140 ];
141 smtpd_client_restrictions = [
142 ];
143 # Set in postfix/*.nix and used in submissions/smptd
144 # with reject_sender_login_mismatch
145 smtpd_sender_login_maps = [];
146 smtpd_sender_restrictions = [
147 "reject_non_fqdn_sender"
148 "permit"
149 ];
150 smtpd_reject_unlisted_recipient = true;
151 # Check the RCPT TO, before smtpd_recipient_restrictions
152 # Restrictions based on what is allowed or not,
153 # these are applied before smtpd_recipient_restrictions
154 smtpd_relay_restrictions = [
155 "permit_mynetworks"
156 # Check the recipient's address in virtual_mailbox_domains and virtual_mailbox_maps
157 "permit_auth_destination"
158 # The world is only authorized to use our relay for the above destinations.
159 "reject"
160 ];
161 # Restrictions based on what is working or not
162 smtpd_recipient_restrictions = [
163 # Reject if the domain is not fully qualified
164 "reject_non_fqdn_recipient"
165 # Reject if the domain is not working, even before bothering to check the address
166 "reject_unknown_recipient_domain"
167 # Reject if the address is not working
168 # WARNING: this does not work if the recipient is greylisting.
169 # WARNING: verify(8) has a cache, dumpable if verify(8) is stopped, with:
170 # postmap -s btree:/var/lib/postfix/data/verify_cache
171 #"reject_unverified_recipient"
172 "permit"
173 ];
174 # Trust the verify database
175 #unverified_recipient_reject_code = "550";
176 smtpd_data_restrictions = [
177 # Force the smtpd's client to wait OK before sending
178 "reject_unauth_pipelining"
179 "permit"
180 ];
181 smtpd_end_of_data_restrictions = [
182 # Enforce mail volume quota via policy service callouts.
183 #check_policy_service unix:private/policy
184 ];
185 #smtpd_milters = "";
186 smtpd_peername_lookup = true;
187 smtpd_recipient_limit = "5000";
188 smtpd_recipient_overshoot_limit = "5000";
189 #smtpd_restriction_classes = "";
190 #smtpd_sasl_auth_enable = true;
191 #smtpd_sasl_path = "private/auth";
192 #smtpd_sasl_security_options = "noanonymous";
193 #smtpd_sasl_type = "dovecot";
194 smtpd_starttls_timeout = "300s";
195 #smtpd_tls_always_issue_session_ids = true;
196 #smtpd_tls_CApath = "/etc/postfix/x509/ca/";
197 smtpd_tls_ask_ccert = false;
198 #smtpd_tls_ccert_verifydepth = "5";
199 smtpd_tls_ciphers = "high";
200 smtpd_tls_eecdh_grade = "auto";
201 # Disable weak ciphers as reported by https://ssl-tools.net
202 # https://serverfault.com/questions/744168/how-to-disable-rc4-on-postfix
203 smtpd_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
204 smtpd_tls_fingerprint_digest = "sha512";
205 # Log only a summary message on TLS handshake completion
206 smtpd_tls_loglevel = "1";
207 smtpd_tls_mandatory_ciphers = "high";
208 smtpd_tls_mandatory_protocols = [ "!SSLv2" "!SSLv3" ];
209 # Only allow TLSv*
210 smtpd_tls_protocols = [ "!SSLv2" "!SSLv3" ];
211 #smtpd_tls_received_header = false;
212 smtpd_tls_req_ccert = false;
213 # Postfix 2.3 and later
214 # encrypt
215 # Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
216 # encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
217 # SMTP server. Instead, this option should be used only on dedicated servers.
218 smtpd_tls_security_level = "may";
219 smtpd_tls_session_cache_database = "btree:$data_directory/smtpd_tls_session_cache";
220 #smtpd_tls_session_cache_timeout = "3600s";
221 #smtpd_tls_chain_files =
222
223 relayhost = [];
224 #relay_clientcerts = hash:/var/lib/postfix/conf/relay_clientcerts
225 # This is where to put backup MX domains
226 relay_domains = [];
227 relay_recipient_maps = [];
228
229 # Use a non blocking source of randomness
230 tls_random_source = "dev:/dev/urandom";
231 # Map each domain to a specific X.509 certificate
232 tls_server_sni_maps = "hash:/run/keys/postfix-sni";
233
234 # Only explicitely aliased accounts have a mail, not all the passwd
235 local_recipient_maps = "$alias_maps";
236 # Note that the local transport rewrites the envelope recipient
237 # according to the alias_maps, and thus the aliasing is transparent
238 # to the nexthop (eg. dovecot)
239 #local_transport = local:$myhostname
240 # No console bell on new mail
241 biff = false;
242 forward_path = [
243 /*
244 "$home/.forward''${recipient_delimiter}''${extension}"
245 */
246 "$home/.forward"
247 ];
248
249 # Filled by the postfix/*.nix
250 virtual_mailbox_domains = [];
251 # Completed by the postfix/*.nix
252 virtual_mailbox_maps = [
253 "hash:/etc/postfix/virtual"
254 ];
255 virtual_transport = "lmtp:unix:private/dovecot-lmtp";
256 /*
257 dovecot_destination_recipient_limit = "1";
258 virtual_transport = "dovecot";
259 */
260
261 # There is no fallback
262 fallback_transport = "";
263 };
264 virtualMapType = "hash";
265 masterConfig =
266 let
267 mkVal = value:
268 if lib.isList value
269 then concatStringsSep "," value
270 else
271 if value == true then "yes"
272 else if value == false then "no"
273 else toString value;
274 mkKeyVal = opt: val: [ "-o" (opt + "=" + mkVal val) ];
275 mkArgs = args: lib.concatLists (lib.mapAttrsToList mkKeyVal args);
276 in {
277 pickup = {
278 args = mkArgs {
279 cleanup_service_name = "submissions-header-cleanup";
280 };
281 };
282 # Implicit TLS on port 465
283 # https://tools.ietf.org/html/rfc8314#section-3.3
284 submissions = {
285 type = "inet";
286 private = false;
287 command = "smtpd";
288 args = mkArgs {
289 syslog_name = "postfix/submissions";
290 # Implicit TLS, not STARTTLS
291 smtpd_tls_wrappermode = true;
292 smtpd_tls_mandatory_protocols = [
293 "TLSv1.3"
294 # K-9 Mail 5.600 still requires this..
295 "TLSv1.2"
296 ];
297 milter_macro_daemon_name = "ORIGINATING";
298 smtpd_helo_restrictions = [
299 "permit_sasl_authenticated"
300 ] ++ postfix.config.smtpd_helo_restrictions;
301 smtpd_relay_restrictions = [
302 # SASL authorizes to send to the world
303 "permit_sasl_authenticated"
304 "reject"
305 ];
306 smtpd_sasl_auth_enable = true;
307 smtpd_sasl_type = "dovecot";
308 smtpd_sasl_path = "private/auth";
309 smtpd_sasl_local_domain = "";
310 # Offer SASL authentication only after a TLS-encrypted session has been established
311 smtpd_tls_auth_only = true;
312 smtpd_sasl_tls_security_options = [ "noanonymous" ];
313 # Do not put SASL logins in mail headers
314 smtpd_sasl_authenticated_header = false;
315 # Who cares about (old) Outlook
316 broken_sasl_auth_clients = false;
317 smtpd_sender_restrictions = [
318 "reject_non_fqdn_sender"
319 # Check that the SASL user is using only its own
320 # mail addresses on the envelope, as indicated in smtpd_sender_login_maps
321 "reject_sender_login_mismatch"
322 "permit"
323 ];
324 # No X.509 certificates for users, for now
325 smtpd_tls_ask_ccert = false;
326 smtpd_tls_ccert_verifydepth = 0;
327 smtpd_tls_loglevel = 1;
328 smtpd_tls_req_ccert = false;
329 cleanup_service_name = "submissions-header-cleanup";
330 };
331 };
332 submissions-header-cleanup = {
333 type = "unix";
334 private = false;
335 maxproc = 0;
336 command = "cleanup";
337 args = mkArgs {
338 header_checks = "pcre:" + pkgs.writeText "submission_header_cleanup_rules" ''
339 # Removes sensitive headers from mails handed in via the submission or smtps port.
340 # See https://thomas-leister.de/mailserver-debian-stretch/
341 # Uses "pcre" style regex.
342
343 /^Received:/ IGNORE
344 /^User-Agent:/ IGNORE
345 /^X-Enigmail:/ IGNORE
346 /^X-Mailer:/ IGNORE
347 /^X-Originating-IP:/ IGNORE
348 '';
349 };
350 };
351 };
352 extraMasterConf = ''
353 #spfcheck unix - n n - 0 spawn
354 # user=policyd-spf argv=/usr/sbin/postfix-policyd-spf-perl
355 # -o smtpd_sender_restrictions=reject_sender_login_mismatch
356 # -o smtpd_sender_login_maps=hash:/etc/postfix/vaccounts
357 # -o cleanup_service_name=submissions-header-cleanup
358 #spfcheck unix - n n - 0 spawn
359 # user=policyd-spf argv=/usr/bin/postfix-policyd-spf-perl
360 #uucp unix - n n - - pipe
361 # flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
362 #smtp inet n - - - - smtpd
363 # -o cleanup_service_name=pre-cleanup
364 # -o content_filter=amavis:[127.0.0.1]:10024
365 # -o smtpd_sender_restrictions=reject_unauth_pipelining,reject_non_fqdn_sender,permit
366 # -o receive_override_options=no_address_mappings
367 #amavis unix - - n - 2 lmtp
368 # -o lmtp_data_done_timeout=1200
369 # -o lmtp_send_xforward_command=yes
370 # -o lmtp_tls_note_starttls_offer=no
371 #127.0.0.1:10025 inet n - n - - smtpd
372 # -o content_filter=
373 # -o local_header_rewrite_clients=
374 # -o local_recipient_maps=
375 # -o mynetworks=127.0.0.0/8
376 # -o receive_override_options=no_header_body_checks,no_milters,no_unknown_recipient_checks
377 # -o relay_recipient_maps=
378 # -o smtpd_client_connection_count_limit=0
379 # -o smtpd_client_connection_rate_limit=0
380 # -o smtpd_client_restrictions=permit_mynetworks,reject
381 # -o smtpd_data_restrictions=reject_unauth_pipelining
382 # -o smtpd_delay_reject=no
383 # -o smtpd_end_of_data_restrictions=
384 # -o smtpd_error_sleep_time=0
385 # -o smtpd_hard_error_limit=1000
386 # -o smtpd_helo_restrictions=
387 # -o smtpd_milters=
388 # -o smtpd_recipient_restrictions=permit_mynetworks,reject
389 # -o smtpd_restriction_classes=
390 # -o smtpd_sender_restrictions=
391 # -o smtpd_soft_error_limit=1001
392 # -o strict_rfc821_envelopes=yes
393 #submission inet n - - - - smtpd
394 # -o cleanup_service_name=pre-cleanup
395 # -o content_filter=amavis:[127.0.0.1]:10024
396 # -o milter_macro_daemon_name=ORIGINATING
397 # -o receive_override_options=no_address_mappings
398 # -o smtpd_sender_restrictions=permit_tls_clientcerts,reject
399 # -o smtpd_tls_ask_ccert=yes
400 # -o smtpd_tls_auth_only=yes
401 # -o smtpd_tls_ccert_verifydepth=2
402 # -o smtpd_tls_loglevel=1
403 # -o smtpd_tls_req_ccert=yes
404 # -o smtpd_tls_security_level=encrypt
405 #smtps inet n - - - - smtpd
406 # -o milter_macro_daemon_name=ORIGINATING
407 # -o smtpd_client_restrictions=permit_sasl_authenticated,reject
408 # -o smtpd_sasl_auth_enable=yes
409 # -o smtpd_tls_ask_ccert=yes
410 # -o smtpd_tls_auth_only=yes
411 # -o smtpd_tls_ccert_verifydepth=0
412 # -o smtpd_tls_loglevel=1
413 # -o smtpd_tls_req_ccert=no
414 # -o smtpd_tls_security_level=encrypt
415 # -o smtpd_tls_wrappermode=yes
416 #pickup fifo n - - 60 1 pickup
417 # -o cleanup_service_name=pre-cleanup
418 # -o content_filter=amavis:[127.0.0.1]:10024
419 #pre-cleanup unix n - - - 0 cleanup
420 # -o virtual_alias_maps=
421 #cleanup unix n - - - 0 cleanup
422 # -o mime_header_checks=
423 # -o nested_header_checks=
424 # -o body_checks=
425 # -o header_checks=
426 #-- SYMPA begin
427 #sympa unix - n n - - pipe
428 # flags=R user=sympa argv=/usr/lib/sympa/bin/queue ''${recipient}
429 #sympabounce unix - n n - - pipe
430 # flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ''${recipient}
431 #-- SYMPA end
432 '';
433 #noclue unix - n n - - pipe
434 # flags=q user=noclue argv=/usr/local/bin/noclue-delivery ${recipient} ${sender}
435 };
436 };
437 }