christian
/
nixos-mailserver
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

complete module rewrite

This commit is contained in:
Robin Raymond 2017-09-03 11:13:34 +02:00
parent 3eb363fc71
commit 28225fb1d6
5 changed files with 144 additions and 143 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
default.nix
View File

@ -253,15 +253,8 @@ in
./mail-server/environment.nix ./mail-server/environment.nix
./mail-server/networking.nix ./mail-server/networking.nix
./mail-server/systemd.nix ./mail-server/systemd.nix
./mail-server/dovecot.nix
./mail-server/postfix.nix
./mail-server/rmilter.nix
]; ];
config = mkIf cfg.enable {
services = import ./mail-server/services.nix {
inherit lib;
inherit (cfg) mailDirectory vmailUserName vmailGroupName virtualAliases domain
enableImap enablePop3 dkimSigning dkimSelector dkimKeyDirectory
certificateScheme certificateFile keyFile certificateDirectory virusScanning;
};
};
} }

103
mail-server/dovecot.nix
View File

@ -14,73 +14,80 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/> # along with this program. If not, see <http://www.gnu.org/licenses/>
{ vmailGroupName, vmailUserName, mailDirectory, enableImap, enablePop3, cert, { config, pkgs, lib, ... }:
key }:
with (import ./common.nix { inherit config; });
let let
cfg = config.mailserver;
# maildir in format "/${domain}/${user}/" # maildir in format "/${domain}/${user}/"
dovecot_maildir = "maildir:${mailDirectory}/%d/%n/"; dovecot_maildir = "maildir:${cfg.mailDirectory}/%d/%n/";
in in
{ {
enable = true; config = with cfg; lib.mkIf enable {
enableImap = enableImap; services.dovecot2 = {
enablePop3 = enablePop3; enable = true;
mailGroup = vmailGroupName; enableImap = enableImap;
mailUser = vmailUserName; enablePop3 = enablePop3;
mailLocation = dovecot_maildir; mailGroup = vmailGroupName;
sslServerCert = cert; mailUser = vmailUserName;
sslServerKey = key; mailLocation = dovecot_maildir;
enableLmtp = true; sslServerCert = certificatePath;
extraConfig = '' sslServerKey = keyPath;
#Extra Config enableLmtp = true;
mail_access_groups = ${vmailGroupName} extraConfig = ''
ssl = required #Extra Config
mail_access_groups = ${vmailGroupName}
ssl = required
service lmtp { service lmtp {
unix_listener /var/lib/postfix/queue/private/dovecot-lmtp { unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
group = postfix group = postfix
mode = 0600 mode = 0600
user = postfix # TODO: < make variable user = postfix # TODO: < make variable
} }
} }
service auth { service auth {
unix_listener /var/lib/postfix/queue/private/auth { unix_listener /var/lib/postfix/queue/private/auth {
mode = 0660 mode = 0660
user = postfix # TODO: < make variable user = postfix # TODO: < make variable
group = postfix # TODO: < make variable group = postfix # TODO: < make variable
} }
} }
auth_mechanisms = plain login auth_mechanisms = plain login
namespace inbox { namespace inbox {
#prefix = INBOX. #prefix = INBOX.
# the namespace prefix isn't added again to the mailbox names. # the namespace prefix isn't added again to the mailbox names.
inbox = yes inbox = yes
# ... # ...
mailbox "Trash" { mailbox "Trash" {
auto = no auto = no
special_use = \Trash special_use = \Trash
} }
mailbox "Junk" { mailbox "Junk" {
auto = subscribe auto = subscribe
special_use = \Junk special_use = \Junk
} }
mailbox "Drafts" { mailbox "Drafts" {
auto = subscribe auto = subscribe
special_use = \Drafts special_use = \Drafts
} }
mailbox "Sent" { mailbox "Sent" {
auto = subscribe auto = subscribe
special_use = \Sent special_use = \Sent
} }
} }
''; '';
};
};
} }

96
mail-server/postfix.nix
View File

@ -14,21 +14,25 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/> # along with this program. If not, see <http://www.gnu.org/licenses/>
{ lib, mailDirectory, domain, virtualAliases, cert, key }: { config, pkgs, lib, ... }:
with (import ./common.nix { inherit config; });
let let
cfg = config.mailserver;
# valiases_postfix :: [ String ] # valiases_postfix :: [ String ]
valiases_postfix = map valiases_postfix = map
(from: (from:
let to = virtualAliases.${from}; let to = cfg.virtualAliases.${from};
in "${from}@${domain} ${to}@${domain}") in "${from}@${cfg.domain} ${to}@${cfg.domain}")
(builtins.attrNames virtualAliases); (builtins.attrNames cfg.virtualAliases);
# valiases_file :: Path # valiases_file :: Path
valiases_file = builtins.toFile "valias" (lib.concatStringsSep "\n" valiases_postfix); valiases_file = builtins.toFile "valias" (lib.concatStringsSep "\n" valiases_postfix);
# vhosts_file :: Path # vhosts_file :: Path
vhosts_file = builtins.toFile "vhosts" domain; vhosts_file = builtins.toFile "vhosts" cfg.domain;
# vaccounts_file :: Path # vaccounts_file :: Path
# see # see
@ -39,50 +43,54 @@ let
in in
{ {
enable = true; config = with cfg; lib.mkIf enable {
networksStyle = "host";
mapFiles."valias" = valiases_file;
mapFiles."vaccounts" = vaccounts_file;
sslCert = cert;
sslKey = key;
enableSubmission = true;
extraConfig = services.postfix = {
'' enable = true;
networksStyle = "host";
mapFiles."valias" = valiases_file;
mapFiles."vaccounts" = vaccounts_file;
sslCert = certificatePath;
sslKey = keyPath;
enableSubmission = true;
# Extra Config extraConfig =
''
# Extra Config
smtpd_banner = $myhostname ESMTP NO UCE smtpd_banner = $myhostname ESMTP NO UCE
smtpd_tls_auth_only = yes smtpd_tls_auth_only = yes
disable_vrfy_command = yes disable_vrfy_command = yes
message_size_limit = 20971520 message_size_limit = 20971520
# virtual mail system # virtual mail system
virtual_uid_maps = static:5000 virtual_uid_maps = static:5000
virtual_gid_maps = static:5000 virtual_gid_maps = static:5000
virtual_mailbox_base = ${mailDirectory} virtual_mailbox_base = ${mailDirectory}
virtual_mailbox_domains = ${vhosts_file} virtual_mailbox_domains = ${vhosts_file}
virtual_alias_maps = hash:/var/lib/postfix/conf/valias virtual_alias_maps = hash:/var/lib/postfix/conf/valias
virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_transport = lmtp:unix:private/dovecot-lmtp
# sasl with dovecot # sasl with dovecot
smtpd_sasl_type = dovecot smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
''; '';
submissionOptions = submissionOptions =
{ {
smtpd_tls_security_level = "encrypt"; smtpd_tls_security_level = "encrypt";
smtpd_sasl_auth_enable = "yes"; smtpd_sasl_auth_enable = "yes";
smtpd_sasl_type = "dovecot"; smtpd_sasl_type = "dovecot";
smtpd_sasl_path = "private/auth"; smtpd_sasl_path = "private/auth";
smtpd_sasl_security_options = "noanonymous"; smtpd_sasl_security_options = "noanonymous";
smtpd_sasl_local_domain = "$myhostname"; smtpd_sasl_local_domain = "$myhostname";
smtpd_client_restrictions = "permit_sasl_authenticated,reject"; smtpd_client_restrictions = "permit_sasl_authenticated,reject";
smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts"; smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
smtpd_sender_restrictions = "reject_sender_login_mismatch"; smtpd_sender_restrictions = "reject_sender_login_mismatch";
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject"; smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
};
};
}; };
} }

28
mail-server/rmilter.nix
View File

@ -14,10 +14,12 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/> # along with this program. If not, see <http://www.gnu.org/licenses/>
{ domain, virusScanning, dkimSigning, dkimKeyDirectory, dkimSelector }: { config, pkgs, lib, ... }:
let let
clamav = if virusScanning cfg = config.mailserver;
clamav = if cfg.virusScanning
then then
'' ''
clamav { clamav {
@ -25,14 +27,14 @@ let
}; };
'' ''
else ""; else "";
dkim = if dkimSigning dkim = if cfg.dkimSigning
then then
'' ''
dkim { dkim {
domain { domain {
key = "${dkimKeyDirectory}"; key = "${cfg.dkimKeyDirectory}";
domain = "*"; domain = "*";
selector = "${dkimSelector}"; selector = "${cfg.dkimSelector}";
}; };
sign_alg = sha256; sign_alg = sha256;
auth_only = yes; auth_only = yes;
@ -41,15 +43,17 @@ let
else ""; else "";
in in
{ {
enable = true; config = with cfg; lib.mkIf enable {
# debug = true; services.rmilter.enable = true;
postfix.enable = true; # services.rmilter.debug = true;
rspamd.enable = true; services.rmilter.postfix.enable = true;
extraConfig = services.rmilter.rspamd.enable = true;
'' services.rmilter.extraConfig =
''
${clamav} ${clamav}
${dkim} ${dkim}
''; '';
};
} }

47
mail-server/services.nix
View File

@ -14,42 +14,31 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/> # along with this program. If not, see <http://www.gnu.org/licenses/>
{ lib, mailDirectory, vmailUserName, vmailGroupName, virtualAliases, domain,
enableImap, enablePop3, virusScanning, dkimSigning, dkimSelector, { config, pkgs, lib, ... }:
dkimKeyDirectory, certificateScheme, certificateFile, keyFile,
certificateDirectory }:
let let
cfg = config.mailserver;
# cert :: PATH # cert :: PATH
cert = if certificateScheme == 1 cert = if cfg.certificateScheme == 1
then certificateFile then cfg.certificateFile
else if certificateScheme == 2 else if cfg.certificateScheme == 2
then "${certificateDirectory}/cert-${domain}.pem" then "${cfg.certificateDirectory}/cert-${cfg.domain}.pem"
else ""; else "";
# key :: PATH # key :: PATH
key = if certificateScheme == 1 key = if cfg.certificateScheme == 1
then keyFile then cfg.keyFile
else if certificateScheme == 2 else if cfg.certificateScheme == 2
then "${certificateDirectory}/key-${domain}.pem" then "${cfg.certificateDirectory}/key-${cfg.domain}.pem"
else ""; else "";
in in
{ {
# rspamd
rspamd = { imports = [
enable = true; ./rmilter.nix
}; ./postfix.nix key
./dovecot.nix
rmilter = import ./rmilter.nix { ];
inherit domain virusScanning dkimSigning dkimSelector dkimKeyDirectory;
};
postfix = import ./postfix.nix {
inherit lib mailDirectory domain virtualAliases cert key;
};
dovecot2 = import ./dovecot.nix {
inherit vmailGroupName vmailUserName mailDirectory enableImap
enablePop3 cert key;
};
} }