nixos/modules/services/mail/postfix.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (lib) types;
   4   inherit (config.services) postfix;
   5 in
   6 {
   7 options = {
   8   services.postfix = {
   9     tls_server_sni_maps = lib.mkOption {
  10       type = types.attrsOf (types.listOf types.path);
  11       default = {};
  12       apply = m: pkgs.writeText "sni" (lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: x509: ''
  13         ${domain} ${lib.concatStringsSep " " x509}
  14       '') m));
  15     };
  16   };
  17 };
  18 config = {
  19   systemd.services.postfix = {
  20     preStart = ''
  21       install -m 400 -o root -g root ${postfix.tls_server_sni_maps} /run/keys/postfix-sni
  22       ${pkgs.postfix}/bin/postmap -F hash:/run/keys/postfix-sni
  23     '';
  24   };
  25   services.postfix = {
  26     masterConfig = {
  27       submissions-header-cleanup = {
  28         type = "unix";
  29         private = false;
  30         maxproc = 0;
  31         command = "cleanup";
  32         args = ["-o" ("header_checks=pcre:" + pkgs.writeText "submission_header_cleanup_rules" ''
  33           # Removes sensitive headers from mails handed in via the submission or smtps port.
  34           # See https://thomas-leister.de/mailserver-debian-stretch/
  35           # Uses "pcre" style regex.
  36
  37           /^Received:/         IGNORE
  38           /^User-Agent:/       IGNORE
  39           /^X-Enigmail:/       IGNORE
  40           /^X-Mailer:/         IGNORE
  41           /^X-Originating-IP:/ IGNORE
  42         '')];
  43       };
  44     };
  45   };
  46 };
  47 }