113 lines
3.1 KiB
Nix
113 lines
3.1 KiB
Nix
# Portions of this file are sourced from
|
|
# https://github.com/NickCao/flakes/blob/3b03efb676ea602575c916b2b8bc9d9cd13b0d85/nixos/hcloud/iad0/postfix.nix
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
mylib,
|
|
...
|
|
}:
|
|
{
|
|
systemd.services.postfix.serviceConfig = mylib.misc.serviceHardened // {
|
|
StateDirectory = "postfix";
|
|
PrivateTmp = true;
|
|
ExecStartPre = ''
|
|
${pkgs.openssl}/bin/openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout /tmp/selfsigned.key -out /tmp/selfsigned.crt -batch
|
|
'';
|
|
ProtectSystem = lib.mkForce "strict";
|
|
RestrictAddressFamilies = lib.mkForce [
|
|
"AF_INET"
|
|
"AF_INET6"
|
|
"AF_NETLINK"
|
|
"AF_UNIX"
|
|
];
|
|
CapabilityBoundingSet = lib.mkForce [
|
|
""
|
|
"CAP_DAC_READ_SEARCH"
|
|
"CAP_DAC_OVERRIDE"
|
|
"CAP_KILL"
|
|
"CAP_SETUID"
|
|
"CAP_SETGID"
|
|
"CAP_NET_BIND_SERVICE"
|
|
];
|
|
SystemCallFilter = lib.mkForce [ "@system-service" ];
|
|
};
|
|
|
|
services.postfix = {
|
|
enable = true;
|
|
hostname = config.networking.fqdn;
|
|
mapFiles.senders = builtins.toFile "senders" ''
|
|
rebmit@rebmit.moe rebmit
|
|
'';
|
|
mapFiles.aliases = builtins.toFile "aliases" ''
|
|
abuse@rebmit.moe rebmit@rebmit.moe
|
|
hostmaster@rebmit.link rebmit@rebmit.moe
|
|
hostmaster@rebmit.moe rebmit@rebmit.moe
|
|
noc@rebmit.moe rebmit@rebmit.moe
|
|
postmaster@rebmit.link rebmit@rebmit.moe
|
|
postmaster@rebmit.moe rebmit@rebmit.moe
|
|
'';
|
|
config = {
|
|
smtp_tls_security_level = "may";
|
|
|
|
smtpd_tls_chain_files = [
|
|
"/tmp/selfsigned.key"
|
|
"/tmp/selfsigned.crt"
|
|
];
|
|
smtpd_tls_security_level = "may";
|
|
smtpd_relay_restrictions = [
|
|
"permit_sasl_authenticated"
|
|
"defer_unauth_destination"
|
|
];
|
|
|
|
virtual_mailbox_domains = [
|
|
"rebmit.moe"
|
|
"rebmit.link"
|
|
];
|
|
virtual_alias_maps = "hash:/etc/postfix/aliases";
|
|
|
|
lmtp_destination_recipient_limit = "1";
|
|
recipient_delimiter = "+";
|
|
disable_vrfy_command = true;
|
|
|
|
milter_default_action = "accept";
|
|
internal_mail_filter_classes = [ "bounce" ];
|
|
};
|
|
masterConfig =
|
|
let
|
|
mkKeyVal = opt: val: [
|
|
"-o"
|
|
(opt + "=" + val)
|
|
];
|
|
mkOpts = opts: lib.concatLists (lib.mapAttrsToList mkKeyVal opts);
|
|
in
|
|
{
|
|
lmtp = {
|
|
args = [ "flags=O" ];
|
|
};
|
|
"127.0.0.1:${toString config.networking.ports.smtp-submission}" = {
|
|
type = "inet";
|
|
private = false;
|
|
command = "smtpd";
|
|
args = mkOpts {
|
|
smtpd_tls_security_level = "none";
|
|
smtpd_sender_login_maps = "hash:/etc/postfix/senders";
|
|
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
|
|
smtpd_sender_restrictions = "reject_sender_login_mismatch";
|
|
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
|
|
smtpd_upstream_proxy_protocol = "haproxy";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
preservation.preserveAt."/persist".directories = [
|
|
{
|
|
directory = "/var/lib/postfix";
|
|
mode = "-";
|
|
user = "-";
|
|
group = "-";
|
|
}
|
|
];
|
|
}
|