misc_nixos-mailserver/mail-server/postfix.nix

95 lines
3.1 KiB
Nix
Raw Normal View History

2016-07-25 15:48:40 +00:00
# nixos-mailserver: a simple mail server
# Copyright (C) 2016-2017 Robin Raymond
2016-07-25 15:48:40 +00:00
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{ mail_dir, domain, valiases, cert, key }:
let
# valiasToString :: { from = "..."; to = "..." } -> String
valiasToString = x: "${x.from}@${domain} ${x.to}@${domain}\n";
# valiases_postfix :: [ String ]
valiases_postfix = map valiasToString valiases;
# concatString :: [ String ] -> String
concatString = l: if l == []
then ""
else (builtins.head l) + (concatString (builtins.tail l));
# valiases_file :: Path
valiases_file = builtins.toFile "valias" (concatString valiases_postfix);
# vhosts_file :: Path
vhosts_file = builtins.toFile "vhosts" domain;
2017-08-12 16:27:22 +00:00
2017-08-13 12:05:40 +00:00
# vaccounts_file :: Path
# see
# https://blog.grimneko.de/2011/12/24/a-bunch-of-tips-for-improving-your-postfix-setup/
# for details on how this file looks. By using the same file as valiases,
# every alias is owned (uniquely) by its user.
vaccounts_file = valiases_file;
in
2016-07-25 15:48:40 +00:00
{
enable = true;
networksStyle = "host";
mapFiles."valias" = valiases_file;
2017-08-13 12:05:40 +00:00
mapFiles."vaccounts" = vaccounts_file;
2017-08-12 16:27:22 +00:00
sslCert = cert;
sslKey = key;
2017-08-13 12:05:40 +00:00
enableSubmission = true;
extraConfig =
''
# Extra Config
smtpd_banner = $myhostname ESMTP NO UCE
smtpd_tls_auth_only = yes
disable_vrfy_command = yes
message_size_limit = 20971520
milter_rcpt_macros = i {rcpt_addr}
# virtual mail system
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_mailbox_base = ${mail_dir}
virtual_mailbox_domains = ${vhosts_file}
virtual_alias_maps = hash:/var/lib/postfix/conf/valias
virtual_transport = lmtp:unix:private/dovecot-lmtp
# sasl with dovecot
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
'';
2017-08-13 12:05:40 +00:00
submissionOptions =
{
smtpd_tls_security_level = "encrypt";
smtpd_sasl_auth_enable = "yes";
smtpd_sasl_type = "dovecot";
smtpd_sasl_path = "private/auth";
smtpd_sasl_security_options = "noanonymous";
smtpd_sasl_local_domain = "$myhostname";
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
smtpd_sender_restrictions = "reject_sender_login_mismatch";
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
};
2016-07-25 15:48:40 +00:00
}