servers/mermet/postfix/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (pkgs.lib) loadFile;
   4   domain = "sourcephile.fr";
   5   domainSuffix = "dc=sourcephile,dc=fr";
   6 in
   7 {
   8 systemd.services.postfix.after = [
   9   "${domain}.key.pem-key.service"
  10 ];
  11 services.postfix = {
  12   extraAliases = ''
  13   '';
  14   virtual = ''
  15     root@${domain} julm+root@${domain}
  16   '';
  17   tls_server_sni_maps =
  18     let chain = [
  19       "/run/keys/${domain}.key.pem"
  20       (loadFile (../../../../sec/openssl + "/${domain}/cert.self-signed.pem"))
  21     ]; in {
  22     "smtp.${domain}" = chain;
  23     "mail.${domain}" = chain;
  24   };
  25   config = {
  26     virtual_mailbox_domains = [ domain ];
  27     virtual_mailbox_maps = [
  28       # Map the main address and aliases to the main mail address.
  29       # This is checked by permit_auth_recipient
  30       ("ldap:"+pkgs.writeText "ldap-mail-${domain}.cf" ''
  31         domain           = ${domain}
  32         version          = 3
  33         debuglevel       = 0
  34         server_host      = ldapi://
  35         bind             = sasl
  36         sasl_mechs       = EXTERNAL
  37         search_base      = ou=posix,${domainSuffix}
  38         scope            = sub
  39         dereference      = 0
  40         query_filter     = (&(|(mail=%s)(mailAlias=%s))(mailEnabled=TRUE))
  41         result_format    = %s
  42         result_attribute = mail
  43       '')
  44     ];
  45     # Map MAIL FROM addresses to the SASL login names allowed to use it.
  46     smtpd_sender_login_maps = [
  47       ("ldap:"+pkgs.writeText "ldap-senders-${domain}.cf" ''
  48         domain           = ${domain}
  49         version          = 3
  50         debuglevel       = 0
  51         server_host      = ldapi://
  52         bind             = sasl
  53         sasl_mechs       = EXTERNAL
  54         search_base      = ou=posix,${domainSuffix}
  55         scope            = sub
  56         dereference      = 0
  57         query_filter     = (&(|(mail=%s)(mailAlias=%s))(mailEnabled=TRUE))
  58         result_format    = %s@${domain}
  59         result_attribute = uid
  60       '')
  61     ];
  62   };
  63 };
  64 }