339 lines
10 KiB
Nix
339 lines
10 KiB
Nix
{
|
|
flake,
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: let
|
|
hzDomain = lib.concatStrings ["hw" "dz" "z." "net"];
|
|
dkimDNSb12fio = ''
|
|
default._domainkey IN TXT ( "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyla9hW3TvoXvZQxwzaJ4SZ9ict1HU3E6+FWlwNIgE6tIpTCyRJtiSIUDqB8TLTIBoxIs+QQBXZi+QUi3Agu6OSY2RiV0EwO8+oOOqOD9pERftc/aqe51cXuv4kPqwvpXEBwrXFWVM+VxivEubUJ7eKkFyXJpelv0LslXv/MmYbUyed6dF+reOGZCsvnbiRv74qdxbAL/25j62E8WrnxzJwhUtx/JhdBOjsHBvuw9hy6rZsVJL9eXayWyGRV6qmsLRzsRSBs+mDrgmKk4dugADd11+A03ics3i8hplRoWDkqnNKz1qy4f5TsV6v9283IANrAzRfHwX8EvNiFsBz+ZCQIDAQAB" ) ;
|
|
'';
|
|
dkimDNSmezzabiz = ''
|
|
default._domainkey IN TXT ( "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDG8iuDq0eon2k7QlBJWGxwDiEv53iJQu2uqxOjr7Ul/nfQjuR6kVKs6oOVopnyFTGRpffrpSHHW1YUN5nF76p0fJphk4l+QmJP36/xweajsNU27PAkb88xG6yRKl28MCfPdMR96+Jobpei8S0UhqcskYs1aZybm7ci9ZuAMidziwIDAQAB" ) ;
|
|
'';
|
|
dkimDNShzDomain = ''
|
|
default._domainkey IN TXT ( "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDvVA2XZno6g6qBdmxoLgX2Qmd883M6yV4YkE/VaNH6xcR0AcTo4hEYoAOPryfKn4FE/TYvyk/k2cyBKpMBn2qbVhwUavYQh/e9bweS2FKQvdzCUUoqXk04o2MqSXb2ZFwkUCtfrPcckBgpF754PDL4HMZGPnkMSdDX7bmYe37CWQIDAQAB") ;
|
|
'';
|
|
in {
|
|
age.secrets."b12f.io-dkim-private-rsa" = {
|
|
file = "${flake.self}/secrets/b12f.io-dkim-private-rsa.age";
|
|
path = "/var/lib/maddy/dkim_keys/b12f.io_default.key";
|
|
mode = "400";
|
|
owner = "maddy";
|
|
};
|
|
|
|
age.secrets."mail@b12f.io-password" = {
|
|
file = "${flake.self}/secrets/mail@b12f.io-password.age";
|
|
mode = "400";
|
|
owner = "maddy";
|
|
};
|
|
|
|
age.secrets."mezza.biz-dkim-private-rsa" = {
|
|
file = "${flake.self}/secrets/mezza.biz-dkim-private-rsa.age";
|
|
path = "/var/lib/maddy/dkim_keys/mezza.biz_default.key";
|
|
mode = "400";
|
|
owner = "maddy";
|
|
};
|
|
|
|
age.secrets."mail@mezza.biz-password" = {
|
|
file = "${flake.self}/secrets/mail@mezza.biz-password.age";
|
|
mode = "400";
|
|
owner = "maddy";
|
|
};
|
|
|
|
age.secrets."hzdomain-dkim-private-rsa" = {
|
|
file = "${flake.self}/secrets/hzdomain-dkim-private-rsa.age";
|
|
path = "/var/lib/maddy/dkim_keys/hzdomain_default.key";
|
|
mode = "400";
|
|
owner = "maddy";
|
|
};
|
|
|
|
age.secrets."mail@hzdomain-password" = {
|
|
file = "${flake.self}/secrets/mail@hzdomain-password.age";
|
|
mode = "400";
|
|
owner = "maddy";
|
|
};
|
|
|
|
users.users.maddy.extraGroups = ["nginx"];
|
|
|
|
security.acme.certs = {
|
|
"mail.b12f.io".reloadServices = ["maddy"];
|
|
"b12f.io".reloadServices = ["maddy"];
|
|
"mta-sts.b12f.io" = {};
|
|
"mail.mezza.biz".reloadServices = ["maddy"];
|
|
"mezza.biz".reloadServices = ["maddy"];
|
|
"mta-sts.mezza.biz" = {};
|
|
"mail.${hzDomain}".reloadServices = ["maddy"];
|
|
"${hzDomain}".reloadServices = ["maddy"];
|
|
"mta-sts.${hzDomain}" = {};
|
|
};
|
|
|
|
services.nginx.virtualHosts = builtins.foldl' (hosts: hostName:
|
|
hosts
|
|
// {
|
|
"mta-sts.${hostName}" = {
|
|
forceSSL = true;
|
|
useACMEHost = "mta-sts.${hostName}";
|
|
locations."/" = {
|
|
root = pkgs.runCommand "create-well-known-mta-sts" {} ''
|
|
mkdir -p "$out/.well-known"
|
|
echo "
|
|
version: STSv1
|
|
mode: enforce
|
|
max_age: 604800
|
|
mx: mail.${hostName}
|
|
" > "$out/.well-known/mta-sts.txt"
|
|
'';
|
|
tryFiles = "$uri $uri/ =404";
|
|
};
|
|
};
|
|
}) {} ["b12f.io" "mezza.biz" hzDomain];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d '/run/maddy' 0750 maddy maddy - -"
|
|
];
|
|
|
|
system.activationScripts.makeMaddyDKIMDNS = lib.stringAfter ["var"] ''
|
|
mkdir -p /var/lib/maddy/dkim_keys
|
|
|
|
echo '${dkimDNSb12fio}' >> /var/lib/maddy/dkim_keys/b12f.io_default.dns
|
|
echo '${dkimDNSmezzabiz}' >> /var/lib/maddy/dkim_keys/mezza.biz_default.dns
|
|
echo '${dkimDNShzDomain}' >> /var/lib/maddy/dkim_keys/${hzDomain}_default.dns
|
|
chown -R maddy:maddy /var/lib/maddy
|
|
'';
|
|
|
|
networking.firewall.allowedTCPPorts = [25];
|
|
networking.firewall.interfaces.wg-private.allowedTCPPorts = [465 587 993];
|
|
|
|
services.maddy = {
|
|
enable = true;
|
|
openFirewall = false;
|
|
hostname = "mail.b12f.io";
|
|
primaryDomain = "b12f.io";
|
|
localDomains = [
|
|
"b12f.io"
|
|
"mail.b12f.io"
|
|
"mezza.biz"
|
|
"mail.mezza.biz"
|
|
hzDomain
|
|
"mail.${hzDomain}"
|
|
];
|
|
ensureAccounts = [
|
|
"mail@b12f.io"
|
|
"mail@mezza.biz"
|
|
"mail@${hzDomain}"
|
|
];
|
|
ensureCredentials = {
|
|
# Do not use this in production. This will make passwords world-readable
|
|
# in the Nix store
|
|
"mail@b12f.io".passwordFile = config.age.secrets."mail@b12f.io-password".path;
|
|
"mail@mezza.biz".passwordFile = config.age.secrets."mail@mezza.biz-password".path;
|
|
"mail@${hzDomain}".passwordFile = config.age.secrets."mail@hzdomain-password".path;
|
|
};
|
|
tls = {
|
|
loader = "file";
|
|
certificates = [
|
|
{
|
|
keyPath = "${config.security.acme.certs."mail.b12f.io".directory}/key.pem";
|
|
certPath = "${config.security.acme.certs."mail.b12f.io".directory}/cert.pem";
|
|
}
|
|
{
|
|
keyPath = "${config.security.acme.certs."b12f.io".directory}/key.pem";
|
|
certPath = "${config.security.acme.certs."b12f.io".directory}/cert.pem";
|
|
}
|
|
{
|
|
keyPath = "${config.security.acme.certs."mail.mezza.biz".directory}/key.pem";
|
|
certPath = "${config.security.acme.certs."mail.mezza.biz".directory}/cert.pem";
|
|
}
|
|
{
|
|
keyPath = "${config.security.acme.certs."mezza.biz".directory}/key.pem";
|
|
certPath = "${config.security.acme.certs."mezza.biz".directory}/cert.pem";
|
|
}
|
|
{
|
|
keyPath = "${config.security.acme.certs."mail.${hzDomain}".directory}/key.pem";
|
|
certPath = "${config.security.acme.certs."mail.${hzDomain}".directory}/cert.pem";
|
|
}
|
|
{
|
|
keyPath = "${config.security.acme.certs."${hzDomain}".directory}/key.pem";
|
|
certPath = "${config.security.acme.certs."${hzDomain}".directory}/cert.pem";
|
|
}
|
|
];
|
|
};
|
|
config = ''
|
|
auth.pass_table local_authdb {
|
|
table sql_table {
|
|
driver sqlite3
|
|
dsn credentials.db
|
|
table_name passwords
|
|
}
|
|
}
|
|
|
|
storage.imapsql local_mailboxes {
|
|
driver sqlite3
|
|
dsn imapsql.db
|
|
}
|
|
|
|
table.chain local_rewrites {
|
|
optional_step regexp "(.+)\+(.+)@(.+)" "$1@$3"
|
|
optional_step static {
|
|
entry postmaster postmaster@$(primary_domain)
|
|
}
|
|
optional_step file /etc/maddy/aliases
|
|
}
|
|
|
|
msgpipeline local_routing {
|
|
check {
|
|
rspamd {
|
|
api_path http://localhost:11334
|
|
}
|
|
}
|
|
|
|
modify {
|
|
replace_rcpt &local_rewrites
|
|
}
|
|
|
|
# at this point rcpt was normalized to either:
|
|
# postmaster@$(primary_domain),
|
|
# local_mailbox_without_tag@$(local_domains),
|
|
# replacements with alias
|
|
|
|
# destination_in block takes priority over destinations
|
|
destination_in &local_mailboxes {
|
|
deliver_to &local_mailboxes
|
|
}
|
|
|
|
# if rcpt is not in local_mailboxes, but has our domains,
|
|
# replace rcpt to catchall and deliver it there
|
|
destination $(local_domains) {
|
|
modify {
|
|
replace_rcpt regexp "(.+)@(.+)" "mail@$2"
|
|
}
|
|
deliver_to &local_mailboxes
|
|
}
|
|
|
|
default_destination {
|
|
reject 550 5.1.1 "User doesn't exist"
|
|
}
|
|
}
|
|
|
|
smtp tcp://0.0.0.0:25 {
|
|
limits {
|
|
all rate 20 1s
|
|
all concurrency 10
|
|
}
|
|
dmarc yes
|
|
check {
|
|
require_mx_record
|
|
dkim
|
|
spf
|
|
}
|
|
source $(local_domains) {
|
|
reject 501 5.1.8 "Use Submission for outgoing SMTP"
|
|
}
|
|
default_source {
|
|
destination postmaster $(local_domains) {
|
|
deliver_to &local_routing
|
|
}
|
|
default_destination {
|
|
reject 550 5.1.1 "User doesn't exist"
|
|
}
|
|
}
|
|
}
|
|
|
|
submission tls://10.13.12.7:465 tls://[fd00:b12f:acab:1312:acab:7::]:465 tcp://10.13.12.7:587 tcp://[fd00:b12f:acab:1312:acab:7::]:587 {
|
|
limits {
|
|
all rate 50 1s
|
|
}
|
|
auth &local_authdb
|
|
source $(local_domains) {
|
|
check {
|
|
authorize_sender {
|
|
prepare_email &local_rewrites
|
|
user_to_email identity
|
|
}
|
|
}
|
|
destination postmaster $(local_domains) {
|
|
deliver_to &local_routing
|
|
}
|
|
default_destination {
|
|
modify {
|
|
dkim $(primary_domain) $(local_domains) default
|
|
}
|
|
deliver_to &remote_queue
|
|
}
|
|
}
|
|
default_source {
|
|
reject 501 5.1.8 "Non-local sender domain"
|
|
}
|
|
}
|
|
|
|
target.remote outbound_delivery {
|
|
limits {
|
|
destination rate 20 1s
|
|
destination concurrency 10
|
|
}
|
|
mx_auth {
|
|
dane
|
|
mtasts {
|
|
cache fs
|
|
fs_dir mtasts_cache/
|
|
}
|
|
local_policy {
|
|
min_tls_level encrypted
|
|
min_mx_level none
|
|
}
|
|
}
|
|
}
|
|
|
|
target.queue remote_queue {
|
|
target &outbound_delivery
|
|
autogenerated_msg_domain $(primary_domain)
|
|
bounce {
|
|
destination postmaster $(local_domains) {
|
|
deliver_to &local_routing
|
|
}
|
|
default_destination {
|
|
reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
|
|
}
|
|
}
|
|
}
|
|
|
|
imap tls://10.13.12.7:993 tls://[fd00:b12f:acab:1312:acab:7::]:993 {
|
|
auth &local_authdb
|
|
storage &local_mailboxes
|
|
}
|
|
'';
|
|
};
|
|
|
|
services.rspamd = {
|
|
enable = true;
|
|
locals."dkim_signing.conf".text = ''
|
|
enabled = false;
|
|
'';
|
|
};
|
|
|
|
systemd.services.rspamd.serviceConfig.SupplementaryGroups = ["maddy"];
|
|
|
|
age.secrets."rclone-pubsolar.conf" = {
|
|
file = "${flake.self}/secrets/rclone-pubsolar.conf.age";
|
|
mode = "400";
|
|
};
|
|
|
|
age.secrets."restic-password" = {
|
|
file = "${flake.self}/secrets/restic-password.age";
|
|
mode = "400";
|
|
};
|
|
|
|
services.restic.backups = {
|
|
maddy = {
|
|
paths = ["/var/lib/maddy"];
|
|
initialize = true;
|
|
passwordFile = config.age.secrets."restic-password".path;
|
|
# See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
|
|
repository = "rclone:cloud.pub.solar:/backups/Maddy";
|
|
rcloneConfigFile = config.age.secrets."rclone-pubsolar.conf".path;
|
|
};
|
|
};
|
|
}
|