This repository has no description
3.2 kB
150 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 to = lib.concatStringsSep "," [
11 "lass@green.r"
12 "bot"
13 ];
14
15 # Keep a minimal alias list for the ACL; the catchall router handles the rest
16 mails = [
17 "lassulus@lassul.us"
18 ];
19
20in
21{
22 imports = [
23 self.inputs.stockholm.nixosModules.exim-smarthost
24 ];
25
26 clan.core.vars.generators."lassul.us-dkim" = {
27 files."lassul.us.dkim.priv" = { };
28 files."lassul.us.dkim.pub".secret = false;
29 migrateFact = "lassul.us-dkim";
30 runtimeInputs = with pkgs; [
31 coreutils
32 openssl
33 ];
34 script = ''
35 openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
36 openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
37 '';
38 };
39
40 krebs.exim-smarthost = {
41 enable = true;
42 dkim = [
43 {
44 domain = "lassul.us";
45 private_key = config.clan.core.vars.generators."lassul.us-dkim".files."lassul.us.dkim.priv".path;
46 }
47 ];
48 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
49 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
50 primary_hostname = "lassul.us";
51 sender_domains = [
52 "lassul.us"
53 ];
54 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
55 config.krebs.hosts.aergia
56 config.krebs.hosts.ignavia
57 config.krebs.hosts.coaxmetal
58 config.krebs.hosts.green
59 config.krebs.hosts.mors
60 ];
61 internet-aliases = map (from: { inherit from to; }) mails ++ [
62 ];
63
64 # Catchall: redirect any unmatched @lassul.us mail
65 # This runs after internet_aliases (which handles the explicit list)
66 # and after system_aliases, but before local_user would reject unknown users.
67 extraRouters = ''
68 catchall_lassulus:
69 debug_print = "R: catchall for $local_part@$domain"
70 driver = redirect
71 domains = lassul.us
72 data = ${to}
73 no_more
74 '';
75
76 system-aliases = [
77 {
78 from = "mailer-daemon";
79 to = "postmaster";
80 }
81 {
82 from = "postmaster";
83 to = "root";
84 }
85 {
86 from = "nobody";
87 to = "root";
88 }
89 {
90 from = "hostmaster";
91 to = "root";
92 }
93 {
94 from = "usenet";
95 to = "root";
96 }
97 {
98 from = "news";
99 to = "root";
100 }
101 {
102 from = "webmaster";
103 to = "root";
104 }
105 {
106 from = "www";
107 to = "root";
108 }
109 {
110 from = "ftp";
111 to = "root";
112 }
113 {
114 from = "abuse";
115 to = "root";
116 }
117 {
118 from = "noc";
119 to = "root";
120 }
121 {
122 from = "security";
123 to = "root";
124 }
125 {
126 from = "root";
127 to = "lass";
128 }
129 ];
130 };
131 # msmtp for local submission via SSH (connects to localhost:25)
132 environment.systemPackages = [ pkgs.msmtp ];
133
134 krebs.iptables.tables.filter.INPUT.rules = [
135 {
136 predicate = "-p tcp --dport smtp";
137 target = "ACCEPT";
138 }
139 ];
140
141 security.acme.certs."mail.lassul.us" = {
142 group = "lasscert";
143 webroot = "/var/lib/acme/acme-challenge";
144 };
145 users.groups.lasscert.members = [
146 "dovecot2"
147 "exim"
148 "nginx"
149 ];
150}