hosts/losurdo/postfix.nix

   1 { lib, config, ... }:
   2 let
   3   inherit (config) networking users;
   4   inherit (config.services) postfix;
   5 in
   6 {
   7   imports = [
   8     #postfix/autogeree.net.nix
   9     #postfix/sourcephile.fr.nix
  10   ];
  11   users.groups.acme.members = [ postfix.user ];
  12   networking.nftables.ruleset = ''
  13     table inet filter {
  14       chain input-net {
  15         #tcp dport 25 counter accept comment "postfix: SMTP"
  16         #tcp dport 465 counter accept comment "postfix: submissions"
  17       }
  18       chain output-net {
  19         skuid ${postfix.user} tcp dport smtp counter accept comment "postfix: SMTP"
  20       }
  21     }
  22   '';
  23   services.postfix = {
  24     enable = true;
  25     networksStyle = "host";
  26     hostname = "${networking.hostName}.${networking.domain}";
  27     domain = networking.domain;
  28     origin = "$myhostname";
  29     destination = [
  30       "localhost"
  31       "localhost.localdomain"
  32       "$myhostname"
  33     ];
  34     postmasterAlias = "root";
  35     rootAlias = "root@${networking.domain}";
  36     sslKey = "/var/lib/acme/${networking.domain}/key.pem";
  37     sslCert = "/var/lib/acme/${networking.domain}/fullchain.pem";
  38     networks = [
  39       "127.0.0.0/8"
  40       "[::1]/128"
  41     ];
  42     setSendmail = true;
  43     # Parse the extension in email address, eg. contact+extension@
  44     recipientDelimiter = "+";
  45     config = {
  46       debug_peer_level = "4";
  47       debug_peer_list = [
  48         #"chomsky.autogeree.net"
  49         #"localhost"
  50         #"mail.sourcephile.fr"
  51       ];
  52
  53       #
  54       # Sending to the world
  55       #
  56       # Appending .domain is the MUA's job
  57       append_dot_mydomain = false;
  58       smtp_body_checks = "";
  59       #smtp_cname_overrides_servername = false;
  60       smtp_connect_timeout = "60s";
  61       #smtp_header_checks = "regexp:/var/lib/postfix/smtp_header_checks";
  62       smtp_mime_header_checks = "";
  63       smtp_nested_header_checks = "";
  64       smtp_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
  65       #smtp_tls_fingerprint_digest = "sha1";
  66       smtp_tls_loglevel = "1";
  67       #smtp_tls_note_starttls_offer = true;
  68       #smtp_tls_policy_maps = "hash:/var/lib/postfix/conf/tls_policy";
  69       # Only allow TLSv* protocols
  70       smtp_tls_protocols = [ "!SSLv2" "!SSLv3" ];
  71       #smtp_tls_scert_verifydepth = "5";
  72       #smtp_tls_secure_cert_match = [ "nexthop" "dot-nexthop" ];
  73       smtp_tls_security_level = "may";
  74       smtp_tls_session_cache_database = "btree:$data_directory/smtp_tls_session_cache";
  75       #smtp_tls_session_cache_timeout = "3600s";
  76       #smtp_tls_verify_cert_match = "hostname";
  77
  78       #
  79       # Receiving from the world
  80       #
  81       message_size_limit = "20480000";
  82       maximal_queue_lifetime = "5d";
  83       default_extra_recipient_limit = "5000";
  84       line_length_limit = "2048";
  85       duplicate_filter_limit = "5000";
  86       # Stops mail from poorly written software
  87       strict_rfc821_envelopes = true;
  88       mime_header_checks = [ ];
  89       milter_header_checks = [ ];
  90       nested_header_checks = [ ];
  91       body_checks = [ ];
  92       content_filter = "";
  93       permit_mx_backup_networks = [ ];
  94       propagate_unmatched_extensions = [ "canonical" "virtual" "alias" ];
  95       #masquerade_classes = [ "envelope_sender" "header_sender" "header_recipient" ];
  96       #masquerade_domains = "";
  97       #masquerade_exceptions = "root";
  98       queue_minfree = "0";
  99       # Stops some techniques used to harvest email addresses
 100       disable_vrfy_command = true;
 101       enable_long_queue_ids = false;
 102       # Useful to test restrictions
 103       smtpd_authorized_xclient_hosts = "127.0.0.1";
 104       smtpd_banner = "$myhostname ESMTP $mail_name (NixOS)";
 105       smtpd_client_connection_count_limit = "50";
 106       smtpd_client_connection_rate_limit = "0";
 107       smtpd_client_event_limit_exceptions = "$mynetworks";
 108       smtpd_client_message_rate_limit = "0";
 109       smtpd_client_new_tls_session_rate_limit = "0";
 110       smtpd_client_port_logging = false;
 111       smtpd_client_recipient_rate_limit = "0";
 112       # Ban 5 sec on error
 113       smtpd_error_sleep_time = "5";
 114       # Needed to enforce reject_unknown_helo_hostname
 115       smtpd_helo_required = true;
 116       smtpd_helo_restrictions = [
 117         "reject_invalid_helo_hostname"
 118         "reject_non_fqdn_helo_hostname"
 119         # Don't talk to mail systems that don't know their own hostname.
 120         "reject_unknown_helo_hostname"
 121         "permit"
 122       ];
 123       smtpd_client_restrictions = [
 124       ];
 125       # Set in postfix/*.nix and used in submissions/smptd
 126       # with reject_sender_login_mismatch
 127       smtpd_sender_login_maps = [ ];
 128       smtpd_sender_restrictions = [
 129         "reject_non_fqdn_sender"
 130         "permit"
 131       ];
 132       smtpd_reject_unlisted_recipient = true;
 133       # Check the RCPT TO, before smtpd_recipient_restrictions
 134       # Restrictions based on what is allowed or not,
 135       # these are applied before smtpd_recipient_restrictions
 136       smtpd_relay_restrictions = [
 137         "permit_mynetworks"
 138         # Check the recipient's address in virtual_mailbox_domains and virtual_mailbox_maps
 139         "permit_auth_destination"
 140         # The world is only authorized to use our relay for the above destinations.
 141         "reject"
 142       ];
 143       # Restrictions based on what is working or not
 144       smtpd_recipient_restrictions = [
 145         # Reject if the domain is not fully qualified
 146         "reject_non_fqdn_recipient"
 147         # Reject if the domain is not working, even before bothering to check the address
 148         "reject_unknown_recipient_domain"
 149         # Reject if the address is not working
 150         # WARNING: this does not work if the recipient is greylisting.
 151         # WARNING: verify(8) has a cache, dumpable if verify(8) is stopped, with:
 152         # postmap -s btree:/var/lib/postfix/data/verify_cache
 153         #"reject_unverified_recipient"
 154         "permit"
 155       ];
 156       # Trust the verify database
 157       #unverified_recipient_reject_code = "550";
 158       smtpd_data_restrictions = [
 159         # Force the smtpd's client to wait OK before sending
 160         "reject_unauth_pipelining"
 161         "permit"
 162       ];
 163       smtpd_end_of_data_restrictions = [
 164         # Enforce mail volume quota via policy service callouts.
 165         #check_policy_service unix:private/policy
 166       ];
 167       #smtpd_milters = "";
 168       smtpd_peername_lookup = true;
 169       smtpd_recipient_limit = "5000";
 170       smtpd_recipient_overshoot_limit = "5000";
 171       #smtpd_restriction_classes = "";
 172       #smtpd_sasl_auth_enable = true;
 173       #smtpd_sasl_path = "private/auth";
 174       #smtpd_sasl_security_options = "noanonymous";
 175       #smtpd_sasl_type = "dovecot";
 176       smtpd_starttls_timeout = "300s";
 177       #smtpd_tls_always_issue_session_ids = true;
 178       #smtpd_tls_CApath = "/etc/postfix/x509/ca/";
 179       smtpd_tls_ask_ccert = false;
 180       #smtpd_tls_ccert_verifydepth = "5";
 181       smtpd_tls_ciphers = "high";
 182       smtpd_tls_eecdh_grade = "auto";
 183       # Disable weak ciphers as reported by https://ssl-tools.net
 184       # https://serverfault.com/questions/744168/how-to-disable-rc4-on-postfix
 185       smtpd_tls_exclude_ciphers = [ "ADH" "MD5" "CAMELLIA" "SEED" "3DES" "DES" "RC4" "eNULL" "aNULL" ];
 186       smtpd_tls_fingerprint_digest = "sha512";
 187       # Log only a summary message on TLS handshake completion
 188       smtpd_tls_loglevel = "1";
 189       smtpd_tls_mandatory_ciphers = "high";
 190       smtpd_tls_mandatory_protocols = [ "!SSLv2" "!SSLv3" ];
 191       # Only allow TLSv*
 192       smtpd_tls_protocols = [ "!SSLv2" "!SSLv3" ];
 193       #smtpd_tls_received_header = false;
 194       smtpd_tls_req_ccert = false;
 195       # Postfix 2.3 and later
 196       # encrypt
 197       #  Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS
 198       #  encryption. According to [1720]RFC 2487 this MUST NOT be applied in case of a publicly-referenced
 199       #  SMTP server. Instead, this option should be used only on dedicated servers.
 200       smtpd_tls_security_level = "may";
 201       smtpd_tls_session_cache_database = "btree:$data_directory/smtpd_tls_session_cache";
 202       #smtpd_tls_session_cache_timeout = "3600s";
 203       #smtpd_tls_chain_files =
 204
 205       relayhost = [ ];
 206       #relay_clientcerts = hash:/var/lib/postfix/conf/relay_clientcerts
 207       # This is where to put backup MX domains
 208       relay_domains = [ ];
 209       relay_recipient_maps = [ ];
 210
 211       # Use a non blocking source of randomness
 212       tls_random_source = "dev:/dev/urandom";
 213       # Map each domain to a specific X.509 certificate
 214       tls_server_sni_maps = "hash:/run/keys/postfix-sni";
 215
 216       # Only explicitely aliased accounts have a mail, not all the passwd
 217       #local_recipient_maps = "$alias_maps";
 218       # Note that the local transport rewrites the envelope recipient
 219       # according to the alias_maps, and thus the aliasing is transparent
 220       # to the nexthop (eg. dovecot)
 221       local_transport = "local:$myhostname";
 222       # No console bell on new mail
 223       biff = false;
 224       forward_path = [
 225         /*
 226       "$home/.forward''${recipient_delimiter}''${extension}"
 227         */
 228         "$home/.forward"
 229       ];
 230
 231       # Filled by the postfix/*.nix
 232       virtual_mailbox_domains = [ ];
 233       # Completed by the postfix/*.nix
 234       virtual_mailbox_maps = [
 235         #"hash:/etc/postfix/virtual"
 236       ];
 237       #virtual_transport = "lmtp:unix:private/dovecot-lmtp";
 238       /*
 239         dovecot_destination_recipient_limit = "1";
 240         virtual_transport = "dovecot";
 241       */
 242
 243       # There is no fallback
 244       fallback_transport = "";
 245     };
 246     transport = ''
 247       sourcephile.wg local:losurdo
 248     '';
 249     virtualMapType = "hash";
 250     masterConfig =
 251       let
 252         mkVal = value:
 253           if lib.isList value
 254           then lib.concatStringsSep "," value
 255           else
 256             if value == true then "yes"
 257             else if value == false then "no"
 258             else toString value;
 259         mkKeyVal = opt: val: [ "-o" (opt + "=" + mkVal val) ];
 260         mkArgs = args: lib.concatLists (lib.mapAttrsToList mkKeyVal args);
 261       in
 262       {
 263         pickup = {
 264           args = mkArgs {
 265             cleanup_service_name = "submissions-header-cleanup";
 266           };
 267         };
 268         /*
 269           # Implicit TLS on port 465
 270           # https://tools.ietf.org/html/rfc8314#section-3.3
 271           submissions = {
 272       type = "inet";
 273       private = false;
 274       command = "smtpd";
 275       args = mkArgs {
 276         syslog_name = "postfix/submissions";
 277         # Implicit TLS, not STARTTLS
 278         smtpd_tls_wrappermode = true;
 279         smtpd_tls_mandatory_protocols = [
 280           "TLSv1.3"
 281           # FIXME: to be removed when K-9 Mail will support TLSv1.3,
 282           # K-9 Mail 5.600 does not.
 283           "TLSv1.2"
 284         ];
 285         milter_macro_daemon_name = "ORIGINATING";
 286         smtpd_helo_restrictions = [
 287           "permit_sasl_authenticated"
 288         ] ++ postfix.config.smtpd_helo_restrictions;
 289         smtpd_relay_restrictions = [
 290           # SASL authorizes to send to the world
 291           "permit_sasl_authenticated"
 292           "reject"
 293         ];
 294         smtpd_sasl_auth_enable = true;
 295         smtpd_sasl_type = "dovecot";
 296         smtpd_sasl_path = "private/auth";
 297         smtpd_sasl_local_domain = "";
 298         # Offer SASL authentication only after a TLS-encrypted session has been established
 299         smtpd_tls_auth_only = true;
 300         smtpd_sasl_tls_security_options = [ "noanonymous" ];
 301         # Do not put SASL logins in mail headers
 302         smtpd_sasl_authenticated_header = false;
 303         # Who cares about (old) Outlook
 304         broken_sasl_auth_clients = false;
 305         smtpd_sender_restrictions = [
 306           "reject_non_fqdn_sender"
 307           # Check that the SASL user is using only its own
 308           # mail addresses on the envelope, as indicated in smtpd_sender_login_maps
 309           "reject_sender_login_mismatch"
 310           "permit"
 311         ];
 312         # No X.509 certificates for users, for now
 313         smtpd_tls_ask_ccert = false;
 314         smtpd_tls_ccert_verifydepth = 0;
 315         smtpd_tls_loglevel = 1;
 316         smtpd_tls_req_ccert = false;
 317         cleanup_service_name = "submissions-header-cleanup";
 318       };
 319           };
 320         */
 321       };
 322     extraMasterConf = ''
 323   '';
 324   };
 325 }