servers/mermet/postfix/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (pkgs.lib) loadFile;
   4   inherit (config.services) postfix;
   5   domain = "sourcephile.fr";
   6   domainSuffix = "dc=sourcephile,dc=fr";
   7 in
   8 {
   9 users.groups.acme.members = [ postfix.user ];
  10 systemd.services.postfix.after = [
  11   "acme-${domain}.service"
  12 ];
  13 services.postfix = {
  14   extraAliases = ''
  15   '';
  16   virtual = ''
  17     root@${domain} julm+root@${domain}
  18   '';
  19   tls_server_sni_maps =
  20     let chain = [
  21       "/var/lib/acme/${domain}/key.pem"
  22       "/var/lib/acme/${domain}/fullchain.pem"
  23     ]; in {
  24     "smtp.${domain}" = chain;
  25     "mail.${domain}" = chain;
  26   };
  27   config = {
  28     virtual_mailbox_domains = [ domain ];
  29     virtual_mailbox_maps = [
  30       # Map the main address and aliases to the main mail address.
  31       # This is checked by permit_auth_recipient
  32       ("ldap:"+pkgs.writeText "ldap-mail-${domain}.cf" ''
  33         domain           = ${domain}
  34         version          = 3
  35         debuglevel       = 0
  36         server_host      = ldapi://
  37         bind             = sasl
  38         sasl_mechs       = EXTERNAL
  39         search_base      = ou=posix,${domainSuffix}
  40         scope            = sub
  41         dereference      = 0
  42         query_filter     = (&(|(mail=%s)(mailAlias=%s))(mailEnabled=TRUE))
  43         result_format    = %s
  44         result_attribute = mail
  45       '')
  46     ];
  47     # Map MAIL FROM addresses to the SASL login names allowed to use it.
  48     smtpd_sender_login_maps = [
  49       ("ldap:"+pkgs.writeText "ldap-senders-${domain}.cf" ''
  50         domain           = ${domain}
  51         version          = 3
  52         debuglevel       = 0
  53         server_host      = ldapi://
  54         bind             = sasl
  55         sasl_mechs       = EXTERNAL
  56         search_base      = ou=posix,${domainSuffix}
  57         scope            = sub
  58         dereference      = 0
  59         query_filter     = (&(|(mail=%s)(mailAlias=%s))(mailEnabled=TRUE))
  60         result_format    = %s@${domain}
  61         result_attribute = uid
  62       '')
  63     ];
  64   };
  65 };
  66 }