forked from
lass.pds.lassul.us/superconfig
This repository has no description
mailserver: enable ManageSieve, move sieve to user-managed, backup /var/sieve
- Remove declarative sieveScript, manage rules dynamically via ManageSieve (port 4190)
- Replace krebs.iptables with networking.firewall.allowedTCPPorts
- Add /var/sieve to borg backup paths
author
lassulus
date
(Mar 5, 2026, 11:42 PM CET)
commit
e5e6b396
e5e6b396628d75b3fddb6c7e30f0009a8320d462
parent
5d67c2c9
5d67c2c9687ff5914c76c0568951d5e3d105dc2d
+11
-89
+10
-89
2configs/mailserver.nix
+10
-89
2configs/mailserver.nix
···
43
43
"lassulus@lassul.us"
44
44
];
45
45
catchAll = [ "lassul.us" ];
46
-
sieveScript = ''
47
-
require ["fileinto", "mailbox"];
48
-
49
-
# GitHub — sort by repo from List-Id header
50
-
if header :contains "List-Id" ".github.com" {
51
-
if header :contains "List-Id" "nixpkgs" { fileinto :create "GitHub.nixpkgs"; }
52
-
elsif header :contains "List-Id" "disko" { fileinto :create "GitHub.disko"; }
53
-
elsif header :contains "List-Id" "clan-core" { fileinto :create "GitHub.clan-core"; }
54
-
elsif header :contains "List-Id" "data-mesher" { fileinto :create "GitHub.data-mesher"; }
55
-
elsif header :contains "List-Id" "foundation" { fileinto :create "GitHub.foundation"; }
56
-
elsif header :contains "List-Id" "nix." { fileinto :create "GitHub.nix"; }
57
-
elsif header :contains "List-Id" "nixos-wiki" { fileinto :create "GitHub.nixos-wiki"; }
58
-
elsif header :contains "List-Id" "nixos-homepage" { fileinto :create "GitHub.nixos-homepage"; }
59
-
else { fileinto :create "GitHub.other"; }
60
-
stop;
61
-
}
62
-
63
-
# Gitea (clan)
64
-
if anyof (
65
-
header :matches "X-Gitea-*" "*",
66
-
address :domain "From" "clan.lol"
67
-
) {
68
-
fileinto :create "GitHub.clan";
69
-
stop;
70
-
}
71
-
72
-
# Mailing lists — sort by List-Id
73
-
if exists "List-Id" {
74
-
if header :contains "List-Id" "vorstand.c-base" { fileinto :create "Lists.c-base-vorstand"; }
75
-
elsif header :contains "List-Id" "c-base" { fileinto :create "Lists.c-base"; }
76
-
elsif header :contains "List-Id" "afra" { fileinto :create "Lists.afra"; }
77
-
elsif header :contains "List-Id" "soundlab" { fileinto :create "Lists.soundlab"; }
78
-
elsif header :contains "List-Id" "nixos" { fileinto :create "Lists.nixos"; }
79
-
elsif header :contains "List-Id" "shack" { fileinto :create "Lists.shack"; }
80
-
elsif header :contains "List-Id" "dezentrale" { fileinto :create "Lists.dezentrale"; }
81
-
elsif header :contains "List-Id" "dn42" { fileinto :create "Lists.dn42"; }
82
-
elsif header :contains "List-Id" "tinc" { fileinto :create "Lists.tinc"; }
83
-
elsif header :contains "List-Id" "wireguard" { fileinto :create "Lists.wireguard"; }
84
-
elsif header :contains "List-Id" "retiolum" { fileinto :create "Lists.retiolum"; }
85
-
else { fileinto :create "Lists.other"; }
86
-
stop;
87
-
}
88
-
89
-
# Billing/receipts
90
-
if anyof (
91
-
address :domain "From" "paypal.de",
92
-
address :domain "From" "paypal.com",
93
-
address :domain "From" "steuerberaten.de",
94
-
address :domain "From" "patreon.com",
95
-
address :domain "From" "dhl.de",
96
-
address :domain "From" "eloop.app",
97
-
header :contains "Subject" "Rechnung",
98
-
header :contains "Subject" "Invoice",
99
-
header :contains "Subject" "receipt"
100
-
) {
101
-
fileinto :create "Billing";
102
-
stop;
103
-
}
104
-
105
-
# Newsletters (has unsubscribe but no List-Id)
106
-
if allof (
107
-
header :contains "List-Unsubscribe" "http",
108
-
not exists "List-Id"
109
-
) {
110
-
fileinto :create "Newsletters";
111
-
stop;
112
-
}
113
-
114
-
# Everything else -> INBOX
115
-
keep;
116
-
'';
117
46
};
118
47
"bot@lassul.us" = {
119
48
hashedPasswordFile =
···
127
56
# DKIM — auto-managed by module
128
57
dkimSigning = true;
129
58
dkimSelector = "mail";
59
+
60
+
# ManageSieve: lets mail clients manage sieve rules dynamically (port 4190)
61
+
enableManageSieve = true;
130
62
131
63
# Full-text search for IMAP clients
132
64
fullTextSearch = {
···
186
118
"nginx"
187
119
];
188
120
189
-
# Firewall rules (krebs.iptables pattern, INPUT policy is DROP)
190
-
krebs.iptables.tables.filter.INPUT.rules = [
191
-
{
192
-
predicate = "-p tcp --dport smtp";
193
-
target = "ACCEPT";
194
-
}
195
-
{
196
-
predicate = "-p tcp --dport submissions";
197
-
target = "ACCEPT";
198
-
}
199
-
{
200
-
predicate = "-p tcp --dport submission";
201
-
target = "ACCEPT";
202
-
}
203
-
{
204
-
predicate = "-p tcp --dport imaps";
205
-
target = "ACCEPT";
206
-
}
121
+
# Firewall: SMTP(25), submission(587), submissions(465), IMAPS(993), ManageSieve(4190)
122
+
networking.firewall.allowedTCPPorts = [
123
+
25
124
+
587
125
+
465
126
+
993
127
+
4190
207
128
];
208
129
209
130
# msmtp for local submission via SSH