nixos-config/mastus/mail.nix

142 lines
3.7 KiB
Nix

{ config, pkgs, ... }:
{
# services.opensmtpd = {
# enable = true;
# serverConfiguration = ''
# listen on 0.0.0.0
# filter sa spamassassin "-s accept"
# accept for any deliver to lmtp localhost:24
# '';
# procPackages = [ pkgs.opensmtpd-extras ];
# };
services.postfix = {
enable = true;
postmasterAlias = "gebner";
rootAlias = "gebner";
extraAliases = ''
ge: gebner
cutintro: gebner
gebne: gebner
'';
hostname = "mastus.gebner.org";
sslCert = "/var/lib/acme/gebner.org/fullchain.pem";
sslKey = "/var/lib/acme/gebner.org/key.pem";
destination = [ "gebner.org" "gabrielebner.at" "2b7e.org"
"mastus.gebner.org" "localhost" ];
extraConfig = ''
mailbox_command = ${pkgs.procmail}/bin/procmail
smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3
smtp_tls_mandatory_protocols=!SSLv2,!SSLv3
smtpd_tls_protocols=!SSLv2,!SSLv3
smtp_tls_protocols=!SSLv2,!SSLv3
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = yes
# Google sucks, https://serverfault.com/questions/832945/how-to-contact-gmail-team-regarding-block
smtp_address_preference = ipv4
message_size_limit = 81920000
mailbox_size_limit = 81920000
# Do not send spam bounces
# http://www.postfix.org/ADDRESS_VERIFICATION_README.html
smtpd_recipient_restrictions =
permit_mynetworks permit_sasl_authenticated
reject_unauth_destination
reject_unknown_recipient_domain
reject_unverified_recipient
'';
extraMasterConf = ''
submission inet n - n - - smtpd
'';
};
services.dovecot2 = {
enable = true;
enablePop3 = false;
mailLocation = "maildir:~/mail";
sslCACert = "/var/lib/acme/gebner.org/fullchain.pem";
sslServerCert = "/var/lib/acme/gebner.org/fullchain.pem";
sslServerKey = "/var/lib/acme/gebner.org-dovecot/key.pem";
extraConfig = ''
service auth {
unix_listener /var/lib/postfix/queue/private/auth {
mode = 0660
user = postfix
group = postfix
}
}
# # use mailPlugins.globally.enable after nixos 20.09
# mail_plugins = fts fts_xapian
#
# plugin {
# plugin = fts fts_xapian
#
# fts = xapian
# fts_xapian = partial=2 full=20 attachments=1 verbose=0
#
# fts_autoindex = yes
# fts_enforced = yes
#
# fts_autoindex_exclude = Trash
# fts_autoindex_exclude2 = spam
# }
#
# default_vsz_limit = 0
#
# service indexer-worker {
# vsz_limit = 0
# }
'';
# modules = [ (pkgs.callPackage ./fts_xapian.nix {}) ];
};
systemd.services.dovecotSslKey = rec {
wantedBy = [ "dovecot2.service" ];
before = wantedBy;
after = [ "acme-gebner.org.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = "yes";
};
script = ''
cd /var/lib/acme
mkdir -p gebner.org-dovecot
cp gebner.org/key.pem gebner.org-dovecot/key.pem
chown dovecot2 gebner.org-dovecot/key.pem
'';
};
services.spamassassin.enable = true;
systemd.services.setupSpamassassin = {
wantedBy = [ "spamd.service" ];
after = [ "network.target" ];
path = [ pkgs.spamassassin ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = "yes";
};
script = ''
if [ ! -d /etc/spamassassin ]; then
cp -rv ${pkgs.spamassassin}/share/spamassassin /etc/
sa-update
fi
'';
};
environment.systemPackages = with pkgs; [
spamassassin
procmail
mailutils
];
}