Skynet/misc_nixos-mailserver
7
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

complete module rewrite

Browse source
This commit is contained in:
Robin Raymond 2017-09-03 11:13:34 +02:00
parent 3eb363fc71
commit 28225fb1d6
5 changed files with 144 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

96
mail-server/postfix.nix
View file

@ -14,21 +14,25 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{ lib, mailDirectory, domain, virtualAliases, cert, key }:
{ config, pkgs, lib, ... }:
with (import ./common.nix { inherit config; });
let
cfg = config.mailserver;
# valiases_postfix :: [ String ]
valiases_postfix = map
(from:
let to = virtualAliases.${from};
in "${from}@${domain} ${to}@${domain}")
(builtins.attrNames virtualAliases);
let to = cfg.virtualAliases.${from};
in "${from}@${cfg.domain} ${to}@${cfg.domain}")
(builtins.attrNames cfg.virtualAliases);
# valiases_file :: Path
valiases_file = builtins.toFile "valias" (lib.concatStringsSep "\n" valiases_postfix);
# vhosts_file :: Path
vhosts_file = builtins.toFile "vhosts" domain;
vhosts_file = builtins.toFile "vhosts" cfg.domain;
# vaccounts_file :: Path
# see
@ -39,50 +43,54 @@ let
in
{
enable = true;
networksStyle = "host";
mapFiles."valias" = valiases_file;
mapFiles."vaccounts" = vaccounts_file;
sslCert = cert;
sslKey = key;
enableSubmission = true;
config = with cfg; lib.mkIf enable {
extraConfig =
''
services.postfix = {
enable = true;
networksStyle = "host";
mapFiles."valias" = valiases_file;
mapFiles."vaccounts" = vaccounts_file;
sslCert = certificatePath;
sslKey = keyPath;
enableSubmission = true;
# Extra Config
extraConfig =
''
# Extra Config
smtpd_banner = $myhostname ESMTP NO UCE
smtpd_tls_auth_only = yes
disable_vrfy_command = yes
message_size_limit = 20971520
smtpd_banner = $myhostname ESMTP NO UCE
smtpd_tls_auth_only = yes
disable_vrfy_command = yes
message_size_limit = 20971520
# virtual mail system
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_mailbox_base = ${mailDirectory}
virtual_mailbox_domains = ${vhosts_file}
virtual_alias_maps = hash:/var/lib/postfix/conf/valias
virtual_transport = lmtp:unix:private/dovecot-lmtp
# virtual mail system
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_mailbox_base = ${mailDirectory}
virtual_mailbox_domains = ${vhosts_file}
virtual_alias_maps = hash:/var/lib/postfix/conf/valias
virtual_transport = lmtp:unix:private/dovecot-lmtp
# sasl with dovecot
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
'';
# sasl with dovecot
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
'';
submissionOptions =
{
smtpd_tls_security_level = "encrypt";
smtpd_sasl_auth_enable = "yes";
smtpd_sasl_type = "dovecot";
smtpd_sasl_path = "private/auth";
smtpd_sasl_security_options = "noanonymous";
smtpd_sasl_local_domain = "$myhostname";
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
smtpd_sender_restrictions = "reject_sender_login_mismatch";
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
submissionOptions =
{
smtpd_tls_security_level = "encrypt";
smtpd_sasl_auth_enable = "yes";
smtpd_sasl_type = "dovecot";
smtpd_sasl_path = "private/auth";
smtpd_sasl_security_options = "noanonymous";
smtpd_sasl_local_domain = "$myhostname";
smtpd_client_restrictions = "permit_sasl_authenticated,reject";
smtpd_sender_login_maps = "hash:/etc/postfix/vaccounts";
smtpd_sender_restrictions = "reject_sender_login_mismatch";
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
};
};
};
}