2021-09-10 11:08:58 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
|
|
|
with lib;
|
|
|
|
|
|
|
|
let
|
2021-12-29 11:49:14 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
name = "maddy";
|
2021-12-29 11:49:14 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
cfg = config.services.maddy;
|
2021-12-29 11:49:14 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
defaultConfig = ''
|
2021-12-29 11:49:14 +00:00
|
|
|
# Minimal configuration with TLS disabled, adapted from upstream example
|
|
|
|
# configuration here https://github.com/foxcpp/maddy/blob/master/maddy.conf
|
|
|
|
# Do not use this in production!
|
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
auth.pass_table local_authdb {
|
|
|
|
table sql_table {
|
|
|
|
driver sqlite3
|
|
|
|
dsn credentials.db
|
|
|
|
table_name passwords
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
storage.imapsql local_mailboxes {
|
|
|
|
driver sqlite3
|
|
|
|
dsn imapsql.db
|
|
|
|
}
|
|
|
|
|
|
|
|
table.chain local_rewrites {
|
|
|
|
optional_step regexp "(.+)\+(.+)@(.+)" "$1@$3"
|
|
|
|
optional_step static {
|
|
|
|
entry postmaster postmaster@$(primary_domain)
|
|
|
|
}
|
|
|
|
optional_step file /etc/maddy/aliases
|
|
|
|
}
|
2023-04-21 06:59:13 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
msgpipeline local_routing {
|
|
|
|
destination postmaster $(local_domains) {
|
|
|
|
modify {
|
|
|
|
replace_rcpt &local_rewrites
|
|
|
|
}
|
|
|
|
deliver_to &local_mailboxes
|
|
|
|
}
|
|
|
|
default_destination {
|
|
|
|
reject 550 5.1.1 "User doesn't exist"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
smtp tcp://0.0.0.0:25 {
|
|
|
|
limits {
|
|
|
|
all rate 20 1s
|
|
|
|
all concurrency 10
|
|
|
|
}
|
|
|
|
dmarc yes
|
|
|
|
check {
|
|
|
|
require_mx_record
|
|
|
|
dkim
|
|
|
|
spf
|
|
|
|
}
|
|
|
|
source $(local_domains) {
|
|
|
|
reject 501 5.1.8 "Use Submission for outgoing SMTP"
|
|
|
|
}
|
|
|
|
default_source {
|
|
|
|
destination postmaster $(local_domains) {
|
|
|
|
deliver_to &local_routing
|
|
|
|
}
|
|
|
|
default_destination {
|
|
|
|
reject 550 5.1.1 "User doesn't exist"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
submission tcp://0.0.0.0:587 {
|
|
|
|
limits {
|
|
|
|
all rate 50 1s
|
|
|
|
}
|
|
|
|
auth &local_authdb
|
|
|
|
source $(local_domains) {
|
|
|
|
check {
|
|
|
|
authorize_sender {
|
|
|
|
prepare_email &local_rewrites
|
|
|
|
user_to_email identity
|
|
|
|
}
|
|
|
|
}
|
|
|
|
destination postmaster $(local_domains) {
|
|
|
|
deliver_to &local_routing
|
|
|
|
}
|
|
|
|
default_destination {
|
|
|
|
modify {
|
|
|
|
dkim $(primary_domain) $(local_domains) default
|
|
|
|
}
|
|
|
|
deliver_to &remote_queue
|
|
|
|
}
|
|
|
|
}
|
|
|
|
default_source {
|
|
|
|
reject 501 5.1.8 "Non-local sender domain"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
target.remote outbound_delivery {
|
|
|
|
limits {
|
|
|
|
destination rate 20 1s
|
|
|
|
destination concurrency 10
|
|
|
|
}
|
|
|
|
mx_auth {
|
|
|
|
dane
|
|
|
|
mtasts {
|
|
|
|
cache fs
|
|
|
|
fs_dir mtasts_cache/
|
|
|
|
}
|
|
|
|
local_policy {
|
|
|
|
min_tls_level encrypted
|
|
|
|
min_mx_level none
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
target.queue remote_queue {
|
|
|
|
target &outbound_delivery
|
|
|
|
autogenerated_msg_domain $(primary_domain)
|
|
|
|
bounce {
|
|
|
|
destination postmaster $(local_domains) {
|
|
|
|
deliver_to &local_routing
|
|
|
|
}
|
|
|
|
default_destination {
|
|
|
|
reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
imap tcp://0.0.0.0:143 {
|
|
|
|
auth &local_authdb
|
|
|
|
storage &local_mailboxes
|
|
|
|
}
|
|
|
|
'';
|
|
|
|
|
|
|
|
in {
|
|
|
|
options = {
|
|
|
|
services.maddy = {
|
2021-12-29 11:49:14 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
enable = mkEnableOption (lib.mdDoc "Maddy, a free an open source mail server");
|
|
|
|
|
|
|
|
user = mkOption {
|
|
|
|
default = "maddy";
|
|
|
|
type = with types; uniq string;
|
|
|
|
description = lib.mdDoc ''
|
2021-12-29 11:49:14 +00:00
|
|
|
User account under which maddy runs.
|
|
|
|
|
|
|
|
::: {.note}
|
|
|
|
If left as the default value this user will automatically be created
|
|
|
|
on system activation, otherwise the sysadmin is responsible for
|
|
|
|
ensuring the user exists before the maddy service starts.
|
2022-08-30 00:30:04 +00:00
|
|
|
:::
|
2021-09-10 11:08:58 +00:00
|
|
|
'';
|
|
|
|
};
|
2021-12-29 11:49:14 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
group = mkOption {
|
|
|
|
default = "maddy";
|
|
|
|
type = with types; uniq string;
|
|
|
|
description = lib.mdDoc ''
|
2021-12-29 11:49:14 +00:00
|
|
|
Group account under which maddy runs.
|
|
|
|
|
|
|
|
::: {.note}
|
|
|
|
If left as the default value this group will automatically be created
|
|
|
|
on system activation, otherwise the sysadmin is responsible for
|
|
|
|
ensuring the group exists before the maddy service starts.
|
2022-08-30 00:30:04 +00:00
|
|
|
:::
|
2021-09-10 11:08:58 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
hostname = mkOption {
|
|
|
|
default = "localhost";
|
|
|
|
type = with types; uniq string;
|
|
|
|
example = ''example.com'';
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
Hostname to use. It should be FQDN.
|
|
|
|
'';
|
|
|
|
};
|
2021-12-29 11:49:14 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
primaryDomain = mkOption {
|
|
|
|
default = "localhost";
|
|
|
|
type = with types; uniq string;
|
|
|
|
example = ''mail.example.com'';
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
Primary MX domain to use. It should be FQDN.
|
|
|
|
'';
|
|
|
|
};
|
2021-12-29 11:49:14 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
localDomains = mkOption {
|
|
|
|
type = with types; listOf str;
|
|
|
|
default = ["$(primary_domain)"];
|
|
|
|
example = [
|
|
|
|
"$(primary_domain)"
|
|
|
|
"example.com"
|
|
|
|
"other.example.com"
|
|
|
|
];
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
Define list of allowed domains.
|
|
|
|
'';
|
|
|
|
};
|
2021-12-29 11:49:14 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
config = mkOption {
|
|
|
|
type = with types; nullOr lines;
|
|
|
|
default = defaultConfig;
|
|
|
|
description = lib.mdDoc ''
|
2021-12-29 11:49:14 +00:00
|
|
|
Server configuration, see
|
|
|
|
[https://maddy.email](https://maddy.email) for
|
|
|
|
more information. The default configuration of this module will setup
|
2023-05-05 13:51:25 +00:00
|
|
|
minimal Maddy instance for mail transfer without TLS encryption.
|
2022-08-30 00:30:04 +00:00
|
|
|
|
2021-12-29 11:49:14 +00:00
|
|
|
::: {.note}
|
|
|
|
This should not be used in a production environment.
|
2022-08-30 00:30:04 +00:00
|
|
|
:::
|
2021-09-10 11:08:58 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2023-04-21 06:59:13 +00:00
|
|
|
tls = {
|
|
|
|
loader = mkOption {
|
2023-05-05 13:51:25 +00:00
|
|
|
type = with types; nullOr (enum [ "off" "file" "acme" ]);
|
2023-04-21 06:59:13 +00:00
|
|
|
default = "off";
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
TLS certificates are obtained by modules called "certificate
|
2023-05-05 13:51:25 +00:00
|
|
|
loaders".
|
|
|
|
|
|
|
|
The `file` loader module reads certificates from files specified by
|
|
|
|
the `certificates` option.
|
|
|
|
|
|
|
|
Alternatively the `acme` module can be used to automatically obtain
|
|
|
|
certificates using the ACME protocol.
|
|
|
|
|
|
|
|
Module configuration is done via the `tls.extraConfig` option.
|
|
|
|
|
|
|
|
Secrets such as API keys or passwords should not be supplied in
|
|
|
|
plaintext. Instead the `secrets` option can be used to read secrets
|
|
|
|
at runtime as environment variables. Secrets can be referenced with
|
|
|
|
`{env:VAR}`.
|
2023-04-21 06:59:13 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
certificates = mkOption {
|
|
|
|
type = with types; listOf (submodule {
|
|
|
|
options = {
|
|
|
|
keyPath = mkOption {
|
|
|
|
type = types.path;
|
|
|
|
example = "/etc/ssl/mx1.example.org.key";
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
Path to the private key used for TLS.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
certPath = mkOption {
|
|
|
|
type = types.path;
|
|
|
|
example = "/etc/ssl/mx1.example.org.crt";
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
Path to the certificate used for TLS.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
});
|
|
|
|
default = [];
|
|
|
|
example = lib.literalExpression ''
|
|
|
|
[{
|
|
|
|
keyPath = "/etc/ssl/mx1.example.org.key";
|
|
|
|
certPath = "/etc/ssl/mx1.example.org.crt";
|
|
|
|
}]
|
|
|
|
'';
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
A list of attribute sets containing paths to TLS certificates and
|
|
|
|
keys. Maddy will use SNI if multiple pairs are selected.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
extraConfig = mkOption {
|
|
|
|
type = with types; nullOr lines;
|
|
|
|
description = lib.mdDoc ''
|
2023-05-05 13:51:25 +00:00
|
|
|
Arguments for the specified certificate loader.
|
|
|
|
|
|
|
|
In case the `tls` loader is set, the defaults are considered secure
|
|
|
|
and there is no need to change anything in most cases.
|
|
|
|
For available options see [upstream manual](https://maddy.email/reference/tls/).
|
|
|
|
|
|
|
|
For ACME configuration, see [following page](https://maddy.email/reference/tls-acme).
|
2023-04-21 06:59:13 +00:00
|
|
|
'';
|
|
|
|
default = "";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
openFirewall = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
Open the configured incoming and outgoing mail server ports.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2023-02-16 21:47:11 +00:00
|
|
|
ensureAccounts = mkOption {
|
2023-04-21 06:59:13 +00:00
|
|
|
type = with types; listOf str;
|
2023-02-16 21:47:11 +00:00
|
|
|
default = [];
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
List of IMAP accounts which get automatically created. Note that for
|
2023-04-11 08:17:04 +00:00
|
|
|
a complete setup, user credentials for these accounts are required
|
|
|
|
and can be created using the `ensureCredentials` option.
|
2023-02-16 21:47:11 +00:00
|
|
|
This option does not delete accounts which are not (anymore) listed.
|
|
|
|
'';
|
|
|
|
example = [
|
|
|
|
"user1@localhost"
|
|
|
|
"user2@localhost"
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
2023-04-11 08:17:04 +00:00
|
|
|
ensureCredentials = mkOption {
|
|
|
|
default = {};
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
List of user accounts which get automatically created if they don't
|
|
|
|
exist yet. Note that for a complete setup, corresponding mail boxes
|
|
|
|
have to get created using the `ensureAccounts` option.
|
|
|
|
This option does not delete accounts which are not (anymore) listed.
|
|
|
|
'';
|
|
|
|
example = {
|
|
|
|
"user1@localhost".passwordFile = /secrets/user1-localhost;
|
|
|
|
"user2@localhost".passwordFile = /secrets/user2-localhost;
|
|
|
|
};
|
|
|
|
type = types.attrsOf (types.submodule {
|
|
|
|
options = {
|
|
|
|
passwordFile = mkOption {
|
|
|
|
type = types.path;
|
|
|
|
example = "/path/to/file";
|
|
|
|
default = null;
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
Specifies the path to a file containing the
|
|
|
|
clear text password for the user.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
});
|
|
|
|
};
|
|
|
|
|
2023-05-05 13:51:25 +00:00
|
|
|
secrets = lib.mkOption {
|
2023-05-27 13:49:05 +00:00
|
|
|
type = with types; listOf path;
|
2023-05-05 13:51:25 +00:00
|
|
|
description = lib.mdDoc ''
|
2023-05-27 13:49:05 +00:00
|
|
|
A list of files containing the various secrets. Should be in the format
|
2023-05-05 13:51:25 +00:00
|
|
|
expected by systemd's `EnvironmentFile` directory. Secrets can be
|
|
|
|
referenced in the format `{env:VAR}`.
|
|
|
|
'';
|
2023-05-27 13:49:05 +00:00
|
|
|
default = [ ];
|
2023-05-05 13:51:25 +00:00
|
|
|
};
|
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
config = mkIf cfg.enable {
|
|
|
|
|
2023-05-05 13:51:25 +00:00
|
|
|
assertions = [
|
|
|
|
{
|
|
|
|
assertion = cfg.tls.loader == "file" -> cfg.tls.certificates != [];
|
|
|
|
message = ''
|
|
|
|
If Maddy is configured to use TLS, tls.certificates with attribute sets
|
|
|
|
of certPath and keyPath must be provided.
|
|
|
|
Read more about obtaining TLS certificates here:
|
|
|
|
https://maddy.email/tutorials/setting-up/#tls-certificates
|
|
|
|
'';
|
|
|
|
}
|
|
|
|
{
|
|
|
|
assertion = cfg.tls.loader == "acme" -> cfg.tls.extraConfig != "";
|
|
|
|
message = ''
|
|
|
|
If Maddy is configured to obtain TLS certificates using the ACME
|
|
|
|
loader, extra configuration options must be supplied via
|
|
|
|
tls.extraConfig option.
|
|
|
|
See upstream documentation for more details:
|
|
|
|
https://maddy.email/reference/tls-acme
|
|
|
|
'';
|
|
|
|
}
|
|
|
|
];
|
2023-04-21 06:59:13 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
systemd = {
|
2023-02-16 21:47:11 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
packages = [ pkgs.maddy ];
|
2023-02-16 21:47:11 +00:00
|
|
|
services = {
|
|
|
|
maddy = {
|
|
|
|
serviceConfig = {
|
|
|
|
User = cfg.user;
|
|
|
|
Group = cfg.group;
|
|
|
|
StateDirectory = [ "maddy" ];
|
2023-05-27 13:49:05 +00:00
|
|
|
EnvironmentFile = cfg.secrets;
|
2023-02-16 21:47:11 +00:00
|
|
|
};
|
|
|
|
restartTriggers = [ config.environment.etc."maddy/maddy.conf".source ];
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
};
|
|
|
|
maddy-ensure-accounts = {
|
|
|
|
script = ''
|
|
|
|
${optionalString (cfg.ensureAccounts != []) ''
|
|
|
|
${concatMapStrings (account: ''
|
|
|
|
if ! ${pkgs.maddy}/bin/maddyctl imap-acct list | grep "${account}"; then
|
|
|
|
${pkgs.maddy}/bin/maddyctl imap-acct create ${account}
|
|
|
|
fi
|
|
|
|
'') cfg.ensureAccounts}
|
|
|
|
''}
|
2023-04-11 08:17:04 +00:00
|
|
|
${optionalString (cfg.ensureCredentials != {}) ''
|
|
|
|
${concatStringsSep "\n" (mapAttrsToList (name: cfg: ''
|
|
|
|
if ! ${pkgs.maddy}/bin/maddyctl creds list | grep "${name}"; then
|
|
|
|
${pkgs.maddy}/bin/maddyctl creds create --password $(cat ${escapeShellArg cfg.passwordFile}) ${name}
|
|
|
|
fi
|
|
|
|
'') cfg.ensureCredentials)}
|
|
|
|
''}
|
2023-02-16 21:47:11 +00:00
|
|
|
'';
|
|
|
|
serviceConfig = {
|
|
|
|
Type = "oneshot";
|
|
|
|
User= "maddy";
|
|
|
|
};
|
|
|
|
after = [ "maddy.service" ];
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
2021-09-10 11:08:58 +00:00
|
|
|
};
|
2023-02-16 21:47:11 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
};
|
2023-02-16 21:47:11 +00:00
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
environment.etc."maddy/maddy.conf" = {
|
|
|
|
text = ''
|
|
|
|
$(hostname) = ${cfg.hostname}
|
|
|
|
$(primary_domain) = ${cfg.primaryDomain}
|
|
|
|
$(local_domains) = ${toString cfg.localDomains}
|
|
|
|
hostname ${cfg.hostname}
|
2023-04-21 06:59:13 +00:00
|
|
|
|
|
|
|
${if (cfg.tls.loader == "file") then ''
|
|
|
|
tls file ${concatStringsSep " " (
|
|
|
|
map (x: x.certPath + " " + x.keyPath
|
|
|
|
) cfg.tls.certificates)} ${optionalString (cfg.tls.extraConfig != "") ''
|
|
|
|
{ ${cfg.tls.extraConfig} }
|
|
|
|
''}
|
2023-05-05 13:51:25 +00:00
|
|
|
'' else if (cfg.tls.loader == "acme") then ''
|
|
|
|
tls {
|
|
|
|
loader acme {
|
|
|
|
${cfg.tls.extraConfig}
|
|
|
|
}
|
|
|
|
}
|
2023-04-21 06:59:13 +00:00
|
|
|
'' else if (cfg.tls.loader == "off") then ''
|
|
|
|
tls off
|
|
|
|
'' else ""}
|
|
|
|
|
2021-09-10 11:08:58 +00:00
|
|
|
${cfg.config}
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2021-12-29 11:49:14 +00:00
|
|
|
users.users = optionalAttrs (cfg.user == name) {
|
|
|
|
${name} = {
|
2021-09-10 11:08:58 +00:00
|
|
|
isSystemUser = true;
|
2021-12-29 11:49:14 +00:00
|
|
|
group = cfg.group;
|
|
|
|
description = "Maddy mail transfer agent user";
|
2021-09-10 11:08:58 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2021-12-29 11:49:14 +00:00
|
|
|
users.groups = optionalAttrs (cfg.group == name) {
|
|
|
|
${cfg.group} = { };
|
2021-09-10 11:08:58 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
networking.firewall = mkIf cfg.openFirewall {
|
|
|
|
allowedTCPPorts = [ 25 143 587 ];
|
|
|
|
};
|
|
|
|
|
|
|
|
environment.systemPackages = [
|
|
|
|
pkgs.maddy
|
|
|
|
];
|
|
|
|
};
|
|
|
|
}
|