From 616d779e1f73872deddd7c38d32f54dd006f0347 Mon Sep 17 00:00:00 2001 From: Brian Olsen Date: Sun, 13 May 2018 03:35:03 +0200 Subject: [PATCH] Move from rmilter to rspamd #25 --- default.nix | 2 +- mail-server/environment.nix | 2 +- mail-server/postfix.nix | 6 +-- mail-server/rmilter.nix | 57 --------------------------- mail-server/rspamd.nix | 78 +++++++++++++++++++++++++++++++++++++ mail-server/systemd.nix | 11 ++---- 6 files changed, 84 insertions(+), 72 deletions(-) delete mode 100644 mail-server/rmilter.nix create mode 100644 mail-server/rspamd.nix diff --git a/default.nix b/default.nix index ebeb782..376d47a 100644 --- a/default.nix +++ b/default.nix @@ -735,7 +735,7 @@ in ./mail-server/dovecot.nix ./mail-server/opendkim.nix ./mail-server/postfix.nix - ./mail-server/rmilter.nix + ./mail-server/rspamd.nix ./mail-server/nginx.nix ./mail-server/kresd.nix ./mail-server/post-upgrade-check.nix diff --git a/mail-server/environment.nix b/mail-server/environment.nix index e0c902a..cc85202 100644 --- a/mail-server/environment.nix +++ b/mail-server/environment.nix @@ -22,7 +22,7 @@ in { config = with cfg; lib.mkIf enable { environment.systemPackages = with pkgs; [ - dovecot opendkim openssh postfix rspamd rmilter + dovecot opendkim openssh postfix rspamd ] ++ (if certificateScheme == 2 then [ openssl ] else []); }; } diff --git a/mail-server/postfix.nix b/mail-server/postfix.nix index 130162d..01006ef 100644 --- a/mail-server/postfix.nix +++ b/mail-server/postfix.nix @@ -94,13 +94,9 @@ let inetSocket = addr: port: "inet:[${toString port}@${addr}]"; unixSocket = sock: "unix:${sock}"; - rmilter = config.services.rmilter; - rmilterSocket = if rmilter.bindSocket.type == "unix" then unixSocket rmilter.bindSocket.path - else inetSocket rmilter.bindSocket.address rmilter.bindSocket.port; - smtpdMilters = (lib.optional cfg.dkimSigning "unix:/run/opendkim/opendkim.sock") - ++ [ rmilterSocket ]; + ++ [ "unix:/run/rspamd/rspamd-milter.sock" ]; policyd-spf = pkgs.writeText "policyd-spf.conf" ('' TestOnly = 1 diff --git a/mail-server/rmilter.nix b/mail-server/rmilter.nix deleted file mode 100644 index 9401ece..0000000 --- a/mail-server/rmilter.nix +++ /dev/null @@ -1,57 +0,0 @@ -# nixos-mailserver: a simple mail server -# Copyright (C) 2016-2018 Robin Raymond -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see - -{ config, pkgs, lib, ... }: - -let - cfg = config.mailserver; - - clamav = if cfg.virusScanning - then - '' - clamav { - servers = /run/clamav/clamd.ctl; - }; - '' - else ""; - postfixCfg = config.services.postfix; - rmilter = config.services.rmilter; -in -{ - config = with cfg; lib.mkIf enable { - services.rspamd = { - enable = true; - }; - - services.rmilter = { - inherit debug; - enable = true; - rspamd = { - enable = true; - extraConfig = "extended_spam_headers = yes;"; - }; - extraConfig = - '' - use_redis = true; - max_size = 20M; - - ${clamav} - ''; - }; - users.extraUsers.${postfixCfg.user}.extraGroups = [ rmilter.group ]; - }; -} - diff --git a/mail-server/rspamd.nix b/mail-server/rspamd.nix new file mode 100644 index 0000000..e7e80a8 --- /dev/null +++ b/mail-server/rspamd.nix @@ -0,0 +1,78 @@ +# nixos-mailserver: a simple mail server +# Copyright (C) 2016-2018 Robin Raymond +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see + +{ config, pkgs, lib, ... }: + +let + cfg = config.mailserver; + + postfixCfg = config.services.postfix; + rspamdCfg = config.services.rspamd; + rspamdSocket = if rspamdCfg.socketActivation + then "rspamd-rspamd_proxy-1.socket" + else "rspamd.service"; +in +{ + config = with cfg; lib.mkIf enable { + services.rspamd = { + enable = true; + socketActivation = false; + extraConfig = '' + extended_spam_headers = yes; + '' + (lib.optionalString cfg.virusScanning '' + antivirus { + clamav { + action = "reject"; + symbol = "CLAM_VIRUS"; + type = "clamav"; + log_clean = true; + servers = "/run/clamav/clamd.ctl"; + } + } + ''); + + workers.rspamd_proxy = { + type = "proxy"; + bindSockets = [{ + socket = "/run/rspamd/rspamd-milter.sock"; + mode = "0664"; + }]; + count = 1; # Do not spawn too many processes of this type + extraConfig = '' + milter = yes; # Enable milter mode + timeout = 120s; # Needed for Milter usually + + upstream "local" { + default = yes; # Self-scan upstreams are always default + self_scan = yes; # Enable self-scan + } + ''; + }; + }; + systemd.services.rspamd = { + requires = (lib.optional cfg.virusScanning "clamav-daemon.service"); + after = (lib.optional cfg.virusScanning "clamav-daemon.service"); + }; + + systemd.services.postfix = { + after = [ rspamdSocket ]; + requires = [ rspamdSocket ]; + }; + + users.extraUsers.${postfixCfg.user}.extraGroups = [ rspamdCfg.group ]; + }; +} + diff --git a/mail-server/systemd.nix b/mail-server/systemd.nix index 3bc78bf..a4a9285 100644 --- a/mail-server/systemd.nix +++ b/mail-server/systemd.nix @@ -89,18 +89,13 @@ in ''; }; - # Postfix requires rmilter socket, dovecot lmtp socket, dovecot auth socket and certificate to work + # Postfix requires dovecot lmtp socket, dovecot auth socket and certificate to work systemd.services.postfix = { - after = [ "rmilter.socket" "dovecot2.service" "mailserver-certificates.target" ] + after = [ "dovecot2.service" "mailserver-certificates.target" ] ++ (lib.optional cfg.dkimSigning "opendkim.service"); wants = [ "mailserver-certificates.target" ]; - requires = [ "rmilter.socket" "dovecot2.service" ] + requires = [ "dovecot2.service" ] ++ (lib.optional cfg.dkimSigning "opendkim.service"); }; - - systemd.services.rmilter = { - requires = [ "rmilter.socket" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service"); - after = [ "rmilter.socket" ] ++ (lib.optional cfg.virusScanning "clamav-daemon.service"); - }; }; }