104 lines
4.6 KiB
Nix
104 lines
4.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
inherit (config.vacu.liam) shel_domains julie_domains domains;
|
|
fqdn = config.networking.fqdn;
|
|
dovecot_transport = "lmtp:unix:private/dovecot-lmtp";
|
|
in {
|
|
networking.firewall.allowedTCPPorts = [ 25 465 ];
|
|
|
|
vacu.acmeCertDependencies."liam.dis8.net" = [ "postfix.service" ];
|
|
services.postfix = {
|
|
enable = true;
|
|
hostname = fqdn;
|
|
|
|
# this goes into virtual_alias_maps
|
|
# "Note: for historical reasons, virtual_alias_maps apply to recipients in all domain classes, not only the virtual alias domain class."
|
|
virtual = ''
|
|
julie@shelvacu.com julie
|
|
mom@shelvacu.com julie
|
|
psv@shelvacu.com psv
|
|
'' + (lib.concatMapStringsSep "\n" (d: "@${d} shelvacu") shel_domains) + "\n"
|
|
+ (lib.concatMapStringsSep "\n" (d: "@${d} julie") julie_domains);
|
|
|
|
transport = ''
|
|
shelvacu@${fqdn} ${dovecot_transport}
|
|
julie@${fqdn} ${dovecot_transport}
|
|
psv@${fqdn} ${dovecot_transport}
|
|
backup@${fqdn} ${dovecot_transport}
|
|
'';
|
|
|
|
sslKey = config.security.acme.certs."liam.dis8.net".directory + "/key.pem";
|
|
sslCert = config.security.acme.certs."liam.dis8.net".directory + "/full.pem";
|
|
postmasterAlias = "shelvacu";
|
|
rootAlias = "shelvacu";
|
|
enableSubmission = false;
|
|
enableSubmissions = true;
|
|
mapFiles.header_checks = pkgs.writeText "header-checks" ("/./ INFO checker headers\n" + (lib.concatMapStringsSep "\n" (d: "/^(from|x-original-from|return-path|mail-?from):.*@${lib.escape [ "." ] d}\\s*>?\\s*$/ REJECT") domains));
|
|
mapFiles.sender_access = pkgs.writeText "sender-access" (lib.concatMapStringsSep "\n" (d: "${d} REJECT") domains);
|
|
# hack to get postfix to add a X-Original-To header
|
|
mapFiles.add_envelope_to = pkgs.writeText "addenvelopeto" "/(.+)/ PREPEND X-Envelope-To: $1";
|
|
|
|
# verbatim appended to main.cf
|
|
extraConfig = ''
|
|
virtual_alias_domains =
|
|
${lib.concatStringsSep ",\n " domains}
|
|
|
|
header_checks = pcre:/etc/postfix/header_checks
|
|
smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access
|
|
smtpd_recipient_restrictions = check_recipient_access pcre:/etc/postfix/add_envelope_to
|
|
|
|
#we should never use these transport methods unless thru transport map
|
|
# RFC3463:
|
|
# 5.X.X = permanent error
|
|
# X.3.X = mail system failure
|
|
# X.3.5 = System incorrectly configured
|
|
# I would've never thought there'd be a standard way to specifically say "you found an error in my config"
|
|
local_transport = error:5.3.5 how did this even hapenn??
|
|
virtual_transport = error:5.3.5 how did this even happenn??
|
|
# X.7.1 = Delivery not authorized, message refused
|
|
relay_transport = error:5.7.1 relay is so very disabled
|
|
|
|
lmtp_destination_recipient_limit = 1
|
|
|
|
always_bcc = backup@${fqdn}
|
|
|
|
# not actually 1024 bits, this applies to all DHE >= 1024 bits
|
|
smtpd_tls_dh1024_param_file = ${lib.optionalString config.services.dovecot2.enableDHE config.security.dhparams.params.dovecot2.path}
|
|
|
|
# smtp_bind_address = 10.46.0.7
|
|
|
|
${lib.optionalString config.services.opendkim.enable (assert (config.services.opendkim.socket == "local:/run/opendkim/opendkim.sock"); ''
|
|
smtpd_milters = unix:/run/opendkim/opendkim.sock
|
|
non_smtpd_milters = unix:/run/opendkim/opendkim.sock
|
|
'')}
|
|
'';
|
|
|
|
submissionsOptions = {
|
|
smtpd_tls_key_file = config.security.acme.certs."liam.dis8.net".directory + "/key.pem";
|
|
smtpd_tls_cert_file = config.security.acme.certs."liam.dis8.net".directory + "/full.pem";
|
|
smtpd_tls_security_level = "encrypt";
|
|
smtpd_sasl_auth_enable = "yes";
|
|
smtpd_tls_auth_only = "yes";
|
|
smtpd_reject_unlisted_recipient = "no";
|
|
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
|
|
milter_macro_daemon_name = "ORIGINATING";
|
|
smtpd_sasl_security_options = "noanonymous";
|
|
smtpd_sasl_type = "dovecot";
|
|
smtpd_sasl_path = "private/dovecot-auth";
|
|
message_size_limit = "100000000";
|
|
smtpd_sender_login_maps = "hash:/etc/postfix/virtual";
|
|
smtpd_sender_restrictions = "reject_authenticated_sender_login_mismatch";
|
|
header_checks = "";
|
|
|
|
# mozilla intermediate config
|
|
smtpd_tls_mandatory_protocols = "!SSLv2,!SSLv3,!TLSv1,!TLSv1.1";
|
|
smtpd_tls_protocols = "!SSLv2,!SSLv3,!TLSv1,!TLSv1.1";
|
|
smtpd_tls_mandatory_ciphers = "medium";
|
|
|
|
tls_medium_cipherlist = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305";
|
|
tls_preempt_cipherlist = "no";
|
|
};
|
|
|
|
|
|
};
|
|
} |