616 lines
18 KiB
Nix
616 lines
18 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
with lib;
|
|
let
|
|
cfg = config.mail-server;
|
|
dcList = strings.splitString "." cfg.domain;
|
|
ldapDomain = strings.concatStringsSep "," (lists.forEach dcList (dc: "dc=" + dc));
|
|
|
|
dovecotSecretPath = "/run/dovecot-secret";
|
|
authBaseConf = pkgs.writeText "dovecot-auth.conf.ext" ''
|
|
passdb ldap {
|
|
auth_username_format = %{user | lower}
|
|
ldap_bind = no
|
|
ldap_filter = (&(objectClass=inetOrgPerson)(uid=%{user | username}))
|
|
use_worker = no
|
|
|
|
fields {
|
|
user = %{ldap:mail}
|
|
password = %{ldap:userPassword}
|
|
}
|
|
}
|
|
ldap_auth_dn = cn=admin,${ldapDomain}
|
|
ldap_auth_dn_password = $LDAP_PASSWORD
|
|
ldap_uris = ldap://localhost
|
|
ldap_base = ${ldapDomain}
|
|
'';
|
|
authConf = "${dovecotSecretPath}/dovecot-auth.conf.ext";
|
|
|
|
dovecotDomain = config.services.postfix.settings.main.myhostname;
|
|
in
|
|
{
|
|
config = mkIf cfg.enable {
|
|
security.acme.certs = mkIf cfg.configureACME {
|
|
"${config.services.postfix.settings.main.myhostname}" = {
|
|
dnsProvider = null;
|
|
webroot = "/var/lib/acme/acme-challenge";
|
|
postRun = ''
|
|
systemctl restart postfix.service
|
|
systemctl restart dovecot.service
|
|
'';
|
|
};
|
|
"${cfg.domain}" = {
|
|
dnsProvider = null;
|
|
webroot = "/var/lib/acme/acme-challenge";
|
|
};
|
|
};
|
|
|
|
# ===== opendkim ===== #
|
|
services.opendkim = {
|
|
enable = true;
|
|
domains = "csl:${cfg.domain}";
|
|
selector = "mail";
|
|
};
|
|
|
|
# ===== Postfix ===== #
|
|
environment.sessionVariables = {
|
|
MAILDIR = cfg.mailDir;
|
|
};
|
|
|
|
systemd.services.postfix = {
|
|
requires = [
|
|
"acme-finished-${config.services.postfix.settings.main.myhostname}.target"
|
|
];
|
|
serviceConfig.LoadCredential =
|
|
let
|
|
certDir =
|
|
config.security.acme.certs."${config.services.postfix.settings.main.myhostname}".directory;
|
|
in
|
|
[
|
|
"cert.pem:${certDir}/cert.pem"
|
|
"key.pem:${certDir}/key.pem"
|
|
];
|
|
};
|
|
|
|
services.postfix = {
|
|
enable = true;
|
|
virtual = cfg.virtual;
|
|
enableSubmissions = true;
|
|
|
|
settings.main =
|
|
let
|
|
credsDir = "/run/credentials/postfix.service";
|
|
certDir = "${credsDir}/cert.pem";
|
|
keyDir = "${credsDir}/key.pem";
|
|
in
|
|
{
|
|
myhostname = "mail.${cfg.domain}";
|
|
mynetworks = cfg.networks;
|
|
mydestination = cfg.destination;
|
|
myorigin = if cfg.origin == "" then cfg.domain else cfg.origin;
|
|
relayhost = [ "0.0.0.0:465" ];
|
|
smtpd_tls_security_level = "encrypt";
|
|
smtpd_client_restrictions = "permit_mynetworks, permit_sasl_authenticated, reject";
|
|
smtpd_relay_restrictions = "permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination";
|
|
milter_macro_daemon_name = "ORIGINATING";
|
|
|
|
virtual_uid_maps = [
|
|
"static:${toString cfg.uid}"
|
|
];
|
|
virtual_gid_maps = [
|
|
"static:${toString cfg.gid}"
|
|
];
|
|
|
|
virtual_mailbox_domains = [ cfg.domain ];
|
|
virtual_transport = "lmtp:unix:private/dovecot-lmtp";
|
|
smtpd_sasl_type = "dovecot";
|
|
smtpd_sasl_path = "private/auth";
|
|
smtpd_sasl_auth_enable = "yes";
|
|
tls_random_source = "dev:/dev/urandom";
|
|
|
|
smtp_tls_security_level = "may";
|
|
smtp_tls_chain_files = [
|
|
keyDir
|
|
certDir
|
|
];
|
|
|
|
smtpd_tls_chain_files = [
|
|
keyDir
|
|
certDir
|
|
];
|
|
|
|
home_mailbox = cfg.mailDir;
|
|
}
|
|
// optionalAttrs config.services.opendkim.enable (
|
|
let
|
|
opendkimSocket = strings.removePrefix "local:" config.services.opendkim.socket;
|
|
in
|
|
{
|
|
smtpd_milters = [ "unix:${opendkimSocket}" ];
|
|
non_smtpd_milters = [ "unix:${opendkimSocket}" ];
|
|
milter_default_action = "accept";
|
|
}
|
|
);
|
|
|
|
rootAlias = cfg.rootAlias;
|
|
postmasterAlias = "root";
|
|
extraAliases = ''
|
|
mailer-daemon: postmaster
|
|
nobody: root
|
|
hostmaster: root
|
|
usenet: root
|
|
news: root
|
|
webmaster: root
|
|
www: root
|
|
ftp: root
|
|
abuse: root
|
|
noc: root
|
|
security: root
|
|
''
|
|
+ cfg.extraAliases;
|
|
};
|
|
|
|
services.rspamd = {
|
|
enable = true;
|
|
postfix.enable = true;
|
|
workers = {
|
|
normal = {
|
|
includes = [ "$CONFDIR/worker-normal.inc" ];
|
|
bindSockets = [
|
|
{
|
|
socket = "/run/rspamd/rspamd.sock";
|
|
mode = "0660";
|
|
owner = "${config.services.rspamd.user}";
|
|
group = "${config.services.rspamd.group}";
|
|
}
|
|
];
|
|
};
|
|
controller = {
|
|
includes = [ "$CONFDIR/worker-controller.inc" ];
|
|
bindSockets = [ "127.0.0.1:${toString cfg.rspamd.port}" ];
|
|
extraConfig = ''
|
|
password=$2$w3asngzxwp3hoa67gimtrgmdxzmpq1n1$knfe5cyb1f769zro4rsi3j8ipc1p7ewh3u4cz63ngidmpjs8955y
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
# ===== rspamd trainer ===== #
|
|
services.rspamd-trainer = {
|
|
enable = true;
|
|
settings = {
|
|
HOST = dovecotDomain;
|
|
USERNAME = "spam@${cfg.domain}";
|
|
INBOXPREFIX = "INBOX.";
|
|
};
|
|
secrets = [
|
|
cfg.rspamd.trainerSecret
|
|
];
|
|
};
|
|
|
|
systemd.services.rspamd-trainer = lib.mkIf config.services.rspamd-trainer.enable {
|
|
after = [
|
|
"postfix.service"
|
|
"dovecot.service"
|
|
"rspamd-trainer-pre.service"
|
|
];
|
|
requires = [ "rspamd-trainer-pre.service" ];
|
|
};
|
|
|
|
# ===== Create Mailbox for rspamd trainer ===== #
|
|
systemd.services.rspamd-trainer-pre = lib.mkIf config.services.rspamd-trainer.enable {
|
|
serviceConfig = {
|
|
ExecStart =
|
|
let
|
|
script = pkgs.writeShellScript "rspamd-trainer-pre.sh" ''
|
|
set -euo pipefail
|
|
|
|
username=${config.services.rspamd-trainer.settings.USERNAME}
|
|
domain="${cfg.domain}"
|
|
mailbox_list=("report_spam" "report_ham" "report_spam_reply")
|
|
for mailbox in ''\${mailbox_list[@]}; do
|
|
echo "Creating $mailbox..."
|
|
${pkgs.dovecot}/bin/doveadm mailbox create -u "$username@$domain" "INBOX.$mailbox" 2>/dev/null || true
|
|
done
|
|
'';
|
|
in
|
|
"${pkgs.bash}/bin/bash ${script}";
|
|
Type = "oneshot";
|
|
};
|
|
};
|
|
|
|
# ===== Dovecot ===== #
|
|
systemd.services.dovecot = {
|
|
requires = [ "acme-finished-${dovecotDomain}.target" ];
|
|
serviceConfig = {
|
|
RuntimeDirectory = [ "dovecot-secret" ];
|
|
RuntimeDirectoryMode = "0640";
|
|
ExecStartPre = [
|
|
''${pkgs.busybox.out}/bin/mkdir -p ${cfg.virtualMailDir}''
|
|
''${pkgs.busybox.out}/bin/chown -R vmail:vmail ${cfg.virtualMailDir}''
|
|
''${pkgs.busybox.out}/bin/chmod 770 ${cfg.virtualMailDir}''
|
|
''${pkgs.bash}/bin/bash -c "LDAP_PASSWORD=$(cat ${cfg.ldap.passwordFile}) ${pkgs.gettext.out}/bin/envsubst < ${authBaseConf} > ${authConf}"''
|
|
''${pkgs.busybox.out}/bin/chown ${config.services.dovecot.user}:${config.services.dovecot.group} ${authConf}''
|
|
''${pkgs.busybox.out}/bin/chmod 660 ${authConf}''
|
|
];
|
|
|
|
LoadCredential =
|
|
let
|
|
certDir = config.security.acme.certs."${dovecotDomain}".directory;
|
|
in
|
|
[
|
|
"cert.pem:${certDir}/cert.pem"
|
|
"key.pem:${certDir}/key.pem"
|
|
];
|
|
};
|
|
};
|
|
|
|
services.dovecot =
|
|
let
|
|
credsDir = "/run/credentials/dovecot.service";
|
|
certDir = "${credsDir}/cert.pem";
|
|
keyDir = "${credsDir}/key.pem";
|
|
in
|
|
{
|
|
enable = true;
|
|
enablePAM = false;
|
|
enableImap = true;
|
|
enablePop3 = true;
|
|
enableLmtp = true;
|
|
enableHealthCheck = true;
|
|
mailLocation = lib.mkDefault "${cfg.mailDir}";
|
|
mailUser = "vmail";
|
|
mailGroup = "vmail";
|
|
sslServerKey = keyDir;
|
|
sslServerCert = certDir;
|
|
|
|
mailboxes = {
|
|
Junk = {
|
|
specialUse = "Junk";
|
|
auto = "subscribe";
|
|
};
|
|
Drafts = {
|
|
specialUse = "Drafts";
|
|
auto = "subscribe";
|
|
};
|
|
Archive = {
|
|
specialUse = "Archive";
|
|
auto = "subscribe";
|
|
};
|
|
Sent = {
|
|
specialUse = "Sent";
|
|
auto = "subscribe";
|
|
};
|
|
};
|
|
|
|
extraConfig = ''
|
|
# authentication debug logging
|
|
log_path = /dev/stderr
|
|
log_debug = (category=auth-client) OR (event=auth_client_passdb_lookup_started)
|
|
|
|
auth_mechanisms = plain login oauthbearer
|
|
ssl = required
|
|
|
|
service auth {
|
|
unix_listener ${config.services.postfix.settings.main.queue_directory}/private/auth {
|
|
mode = 0660
|
|
user = ${config.services.postfix.user}
|
|
group = ${config.services.postfix.group}
|
|
type = postfix
|
|
}
|
|
}
|
|
|
|
service lmtp {
|
|
unix_listener ${config.services.postfix.settings.main.queue_directory}/private/dovecot-lmtp {
|
|
mode = 0660
|
|
user = ${config.services.postfix.user}
|
|
group = ${config.services.postfix.group}
|
|
type = postfix
|
|
}
|
|
}
|
|
|
|
userdb static {
|
|
fields {
|
|
uid = ${toString cfg.uid}
|
|
gid = ${toString cfg.gid}
|
|
home = ${cfg.virtualMailDir}/%{user | domain}/%{user | username}
|
|
}
|
|
}
|
|
|
|
lda_mailbox_autosubscribe = yes
|
|
lda_mailbox_autocreate = yes
|
|
|
|
!include ${authConf}
|
|
'';
|
|
};
|
|
|
|
systemd.services.dovecot-healthcheck = mkIf config.services.dovecot.enableHealthCheck (
|
|
let
|
|
pythonServer =
|
|
pkgs.writeScript "dovecot-healthcheck"
|
|
# python
|
|
''
|
|
#!${pkgs.python3}/bin/python3
|
|
import socket
|
|
from http.server import BaseHTTPRequestHandler, HTTPServer
|
|
|
|
DOVECOT_HOST = '127.0.0.1'
|
|
DOVECOT_PORT = ${toString config.services.dovecot.healthCheckPort}
|
|
|
|
class HealthCheckHandler(BaseHTTPRequestHandler):
|
|
def do_GET(self):
|
|
if self.path != '/ping':
|
|
self.send_response(404)
|
|
self.end_headers()
|
|
return
|
|
try:
|
|
with socket.create_connection((DOVECOT_HOST, DOVECOT_PORT), timeout=5) as sock:
|
|
sock.sendall(b"PING\n")
|
|
data = sock.recv(1024).strip()
|
|
except Exception as e:
|
|
self.send_response(500)
|
|
self.end_headers()
|
|
self.wfile.write(b"Error connecting to healthcheck service")
|
|
return
|
|
|
|
if data == b"PONG":
|
|
self.send_response(200)
|
|
self.send_header("Content-Type", "text/plain")
|
|
self.end_headers()
|
|
self.wfile.write(b"PONG")
|
|
else:
|
|
self.send_response(500)
|
|
self.end_headers()
|
|
self.wfile.write(b"Unexpected response")
|
|
|
|
if __name__ == '__main__':
|
|
server = HTTPServer(('0.0.0.0', 5002), HealthCheckHandler)
|
|
print("HTTP healthcheck proxy running on port 5002")
|
|
server.serve_forever()
|
|
'';
|
|
in
|
|
{
|
|
requires = [ "dovecot.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "dovecot.service" ];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = pythonServer;
|
|
};
|
|
}
|
|
);
|
|
|
|
# ===== Firewall ===== #
|
|
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [
|
|
80 # HTTP
|
|
443 # HTTPS
|
|
25 # SMTP
|
|
465 # SMTPS
|
|
587 # STARTTLS
|
|
143 # IMAP STARTTLS
|
|
993 # IMAPS
|
|
110 # POP3 STARTTLS
|
|
995 # POP3S
|
|
389 # LDAP
|
|
];
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ "keycloak" ];
|
|
ensureUsers = [
|
|
{
|
|
name = "keycloak";
|
|
ensureDBOwnership = true;
|
|
}
|
|
];
|
|
};
|
|
|
|
# ===== OAuth keycloak ===== #
|
|
services.keycloak = {
|
|
enable = true;
|
|
|
|
database = {
|
|
type = "postgresql";
|
|
host = "localhost";
|
|
name = "keycloak";
|
|
createLocally = false;
|
|
passwordFile = cfg.oauth.passwordFile;
|
|
};
|
|
|
|
settings = {
|
|
hostname = "keycloak.${cfg.domain}";
|
|
proxy-headers = "xforwarded";
|
|
http-port = 38080;
|
|
http-enabled = true;
|
|
health-enabled = true;
|
|
http-management-port = 38081;
|
|
truststore-paths = cfg.caFile;
|
|
};
|
|
};
|
|
|
|
# ==== LDAP ===== #
|
|
services.openldap = {
|
|
enable = true;
|
|
|
|
urlList = [ "ldap:///" ];
|
|
settings = {
|
|
attrs = {
|
|
olcLogLevel = "conns config";
|
|
};
|
|
|
|
children = {
|
|
"cn=schema".includes = [
|
|
"${pkgs.openldap}/etc/schema/core.ldif"
|
|
"${pkgs.openldap}/etc/schema/cosine.ldif"
|
|
"${pkgs.openldap}/etc/schema/inetorgperson.ldif"
|
|
];
|
|
|
|
"olcDatabase={1}mdb" = {
|
|
attrs = {
|
|
objectClass = [
|
|
"olcDatabaseConfig"
|
|
"olcMdbConfig"
|
|
];
|
|
|
|
olcDatabase = "{1}mdb";
|
|
olcDbDirectory = "/var/lib/openldap/data";
|
|
|
|
olcSuffix = ldapDomain;
|
|
|
|
olcRootDN = "cn=admin,${ldapDomain}";
|
|
olcRootPW.path = cfg.ldap.passwordFile;
|
|
|
|
olcAccess = [
|
|
''
|
|
{0}to attrs=userPassword
|
|
by dn.exact="cn=admin,${ldapDomain}" read
|
|
by dn.exact="uid=admin@${cfg.domain},ou=people,${ldapDomain}" write
|
|
by self write
|
|
by anonymous auth
|
|
by * none
|
|
''
|
|
''
|
|
{1}to *
|
|
by dn.exact="uid=admin@${cfg.domain},ou=people,${ldapDomain}" write
|
|
by * read
|
|
''
|
|
];
|
|
};
|
|
|
|
children = {
|
|
"olcOverlay={2}ppolicy".attrs = {
|
|
objectClass = [
|
|
"olcOverlayConfig"
|
|
"olcPPolicyConfig"
|
|
"top"
|
|
];
|
|
olcOverlay = "{2}ppolicy";
|
|
olcPPolicyHashCleartext = "TRUE";
|
|
};
|
|
|
|
"olcOverlay={3}memberof".attrs = {
|
|
objectClass = [
|
|
"olcOverlayConfig"
|
|
"olcMemberOf"
|
|
"top"
|
|
];
|
|
olcOverlay = "{3}memberof";
|
|
olcMemberOfRefInt = "TRUE";
|
|
olcMemberOfDangling = "ignore";
|
|
olcMemberOfGroupOC = "groupOfNames";
|
|
olcMemberOfMemberAD = "member";
|
|
olcMemberOfMemberOfAD = "memberOf";
|
|
};
|
|
|
|
"olcOverlay={4}refint".attrs = {
|
|
objectClass = [
|
|
"olcOverlayConfig"
|
|
"olcRefintConfig"
|
|
"top"
|
|
];
|
|
olcOverlay = "{4}refint";
|
|
olcRefintAttribute = "memberof member manager owner";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
# ==== postsrsd ==== #
|
|
services.postsrsd = {
|
|
enable = true;
|
|
configurePostfix = true;
|
|
secretsFile = config.sops.secrets."postsrsd/secret".path;
|
|
settings = {
|
|
srs-domain = cfg.domain;
|
|
domains = [ cfg.domain ];
|
|
};
|
|
};
|
|
|
|
virtualisation = {
|
|
docker = {
|
|
enable = true;
|
|
rootless = {
|
|
enable = true;
|
|
setSocketVariable = true;
|
|
};
|
|
};
|
|
oci-containers = {
|
|
backend = "docker";
|
|
containers = {
|
|
phpLDAPadmin = {
|
|
extraOptions = [ "--network=host" ];
|
|
image = "phpldapadmin/phpldapadmin";
|
|
volumes = [
|
|
"/var/lib/pla/logs:/app/storage/logs"
|
|
"/var/lib/pla/sessions:/app/storage/framework/sessions"
|
|
];
|
|
environment = {
|
|
APP_URL = "https://ldap.${cfg.domain}";
|
|
ASSET_URL = "https://ldap.${cfg.domain}";
|
|
APP_TIMEZONE = "Asia/Taipei";
|
|
LDAP_HOST = "127.0.0.1";
|
|
SERVER_NAME = ":8080";
|
|
LDAP_LOGIN_OBJECTCLASS = "inetOrgPerson";
|
|
LDAP_BASE_DN = "${ldapDomain}";
|
|
LDAP_LOGIN_ATTR = "dn";
|
|
LDAP_LOGIN_ATTR_DESC = "Username";
|
|
};
|
|
environmentFiles = [
|
|
cfg.ldap.webEnv
|
|
];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
# ===== Virtual Mail User ===== #
|
|
users.groups.vmail = {
|
|
gid = cfg.gid;
|
|
};
|
|
|
|
users.users.vmail = {
|
|
uid = cfg.uid;
|
|
group = "vmail";
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = mkDefault true;
|
|
recommendedGzipSettings = mkDefault true;
|
|
recommendedOptimisation = mkDefault true;
|
|
recommendedTlsSettings = mkDefault true;
|
|
recommendedProxySettings = mkDefault true;
|
|
|
|
virtualHosts = {
|
|
"${config.services.postfix.settings.main.myhostname}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/dovecot/ping".proxyPass = "http://localhost:${toString 5002}/ping";
|
|
};
|
|
"ldap.${cfg.domain}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/".proxyPass = "http://localhost:${toString 8080}/";
|
|
};
|
|
"rspamd.${cfg.domain}" = mkIf config.services.rspamd.enable {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/".proxyPass = "http://localhost:${toString cfg.rspamd.port}/";
|
|
};
|
|
"${config.services.keycloak.settings.hostname}" = mkIf config.services.keycloak.enable {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/".proxyPass =
|
|
"http://localhost:${toString config.services.keycloak.settings.http-port}";
|
|
locations."/health".proxyPass =
|
|
"http://localhost:${toString config.services.keycloak.settings.http-management-port}/health";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|