nixos/modules/services/mail/postfix.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (lib) types;
   4   inherit (config.services) postfix;
   5 in
   6 {
   7   options = {
   8     services.postfix = {
   9       tls_server_sni_maps = lib.mkOption {
  10         type = types.attrsOf (types.listOf types.path);
  11         default = { };
  12         apply = m: pkgs.writeText "sni" (lib.concatStringsSep "\n" (lib.mapAttrsToList
  13           (domain: x509: ''
  14             ${domain} ${lib.concatStringsSep " " x509}
  15           '')
  16           m));
  17       };
  18     };
  19   };
  20   config = {
  21     systemd.services.postfix = {
  22       preStart = ''
  23         install -m 400 -o root -g root ${postfix.tls_server_sni_maps} /run/keys/postfix-sni
  24         ${pkgs.postfix}/bin/postmap -F hash:/run/keys/postfix-sni
  25       '';
  26     };
  27     services.postfix = {
  28       masterConfig = {
  29         submissions-header-cleanup = {
  30           type = "unix";
  31           private = false;
  32           maxproc = 0;
  33           command = "cleanup";
  34           args = [
  35             "-o"
  36             ("header_checks=pcre:" + pkgs.writeText "submission_header_cleanup_rules" ''
  37               # Removes sensitive headers from mails handed in via the submission or smtps port.
  38               # See https://thomas-leister.de/mailserver-debian-stretch/
  39               # Uses "pcre" style regex.
  40
  41               /^Received:/         IGNORE
  42               /^User-Agent:/       IGNORE
  43               /^X-Enigmail:/       IGNORE
  44               /^X-Mailer:/         IGNORE
  45               /^X-Originating-IP:/ IGNORE
  46             '')
  47           ];
  48         };
  49       };
  50     };
  51   };
  52 }