From 15319c9b2b25e66a66181a57379aafdb455b1f0c Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Mon, 3 Jul 2023 18:22:37 +0200 Subject: [PATCH] various fixes - fix mailman's confirmation emails not sending - introduce a stateful /etc/aliases - configure ldap for postfix --- modules/mail.nix | 29 +++++++++++++++-------------- modules/mailman.nix | 3 --- secrets/quitte.yaml | 5 +++-- 3 files changed, 18 insertions(+), 19 deletions(-) diff --git a/modules/mail.nix b/modules/mail.nix index 5d82838..d362103 100644 --- a/modules/mail.nix +++ b/modules/mail.nix @@ -3,13 +3,6 @@ let hostname = "mail.${config.fsr.domain}"; domain = config.fsr.domain; rspamd-domain = "rspamd.${config.fsr.domain}"; - # brauchen wir das überhaupt? - #ldap-aliases = pkgs.writeText "ldap-aliases.cf" '' - #server_host = ldap://localhost - #search_base = dc=ifsr, dc=de - #query_filter = (&(objectClass=posixAccount)(uid=%n)) - #result_attribute=mail - #''; dovecot-ldap-args = pkgs.writeText "ldap-args" '' uris = ldap://localhost dn = uid=search, ou=users, dc=ifsr, dc=de @@ -26,8 +19,14 @@ in { sops.secrets."rspamd-password".owner = config.users.users.rspamd.name; sops.secrets."dovecot_ldap_search".owner = config.services.dovecot2.user; + sops.secrets."postfix_ldap_aliases".owner = config.services.postfix.user; - networking.firewall.allowedTCPPorts = [ 25 465 587 993 ]; + networking.firewall.allowedTCPPorts = [ + 25 # insecure SMTP + 465 + 587 # SMTP + 993 # IMAP + ]; users.users.postfix.extraGroups = [ "opendkim" ]; services = { @@ -68,21 +67,21 @@ in config = { home_mailbox = "Maildir/"; smtp_use_tls = true; - smtp_tls_security_level = "encrypt"; + # smtp_tls_security_level = "encrypt"; smtpd_use_tls = true; - smtpd_tls_security_level = lib.mkForce "encrypt"; - smtpd_tls_auth_only = true; + # smtpd_tls_security_level = lib.mkForce "encrypt"; + # smtpd_tls_auth_only = true; smtpd_tls_protocols = [ "!SSLv2" "!SSLv3" "!TLSv1" "!TLSv1.1" ]; + # "reject_non_fqdn_hostname" smtpd_recipient_restrictions = [ "permit_sasl_authenticated" "permit_mynetworks" "reject_unauth_destination" - "reject_non_fqdn_hostname" "reject_non_fqdn_sender" "reject_non_fqdn_recipient" "reject_unknown_sender_domain" @@ -96,7 +95,9 @@ in "permit_mynetworks" "reject_unauth_destination" ]; - alias_maps = [ "hash:${../config/aliases}" ]; + # smtpd_sender_login_maps = [ "ldap:${ldap-senders}" ]; + alias_maps = [ "hash:/etc/aliases" ]; + # alias_maps = [ "hash:/etc/aliases" "ldap:${ldap-aliases}" ]; smtpd_milters = [ "local:/run/opendkim/opendkim.sock" ]; non_smtpd_milters = [ "local:/var/run/opendkim/opendkim.sock" ]; smtpd_sasl_auth_enable = true; @@ -104,7 +105,7 @@ in smtpd_sasl_type = "dovecot"; #mailman stuff transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ]; - local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ]; + local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "ldap:${config.sops.secrets."postfix_ldap_aliases".path}" ]; }; }; dovecot2 = { diff --git a/modules/mailman.nix b/modules/mailman.nix index e0cfc4c..b85fb83 100644 --- a/modules/mailman.nix +++ b/modules/mailman.nix @@ -11,9 +11,6 @@ hyperkitty.enable = true; enablePostfix = true; siteOwner = "mailman@${config.fsr.domain}"; - settings = { - mta.smtp_secure_mode = "SecureMode.STARTTLS"; - }; ldap = { enable = true; serverUri = "ldap://localhost"; diff --git a/secrets/quitte.yaml b/secrets/quitte.yaml index b26742a..3bf0826 100644 --- a/secrets/quitte.yaml +++ b/secrets/quitte.yaml @@ -15,6 +15,7 @@ mediawiki: postgres: ENC[AES256_GCM,data:XRfUc2PRMJcoILAnm5MWr2Cg5u4e/IhGMUnz/oIQSzY=,iv:8U+qlD1SQzxUyD/6QK4SdwRCDyMODK/lP0IDrLlcQ4U=,tag:2spNMj9dY2wWilOusq24yQ==,type:str] initial_admin: ENC[AES256_GCM,data:iET5rz9rygx49NDBjKwqAlRgpeS+jq5iM5zmjnoKcyk=,iv:11iDbCrpzjCdyAB22R8NknJ6vzcpVZXCXB3iWsGWXw0=,tag:1RCyg1ysOWaXKdqqdHqRrw==,type:str] ldapprovider: ENC[AES256_GCM,data:CPsrWmUviUpFIVVN/2a1lRjJCoZCWR9zrHm3T5Tv/YuXSYXStZGfBgXN96zhJUUpZcwiJq95o1sajyit+6itZCcGAPu0BTHSnNXRu1fgifonXE0ghw6rvzwkYpfBS+rfmBcG2wxX+7uZG3ulANYpvvGMxpKgM5IzQjE1sAytRDir6QeMGcFHP2gV4xQAdTNUZK2V+EKOlrcV5vTSzDSy3eXg18TVUgZqdxaQFfwnr2UN0eEEZ4Dn83G3QWsROZ0A7R3tuEmdAzmR8AdWBxfqCcOA8vZaOIOWb1AyobLCUaqQOj/SbGdgehMOQn1UcbRHpYQ2E9mvxD572uc/U5kzy/TbOLM34pkvckNrGfxwvqwbvXZrVP3gONY5CnJpk5XfVdT5Au/uwE5ZRs83ZEx31+85mpK3HecyBWRfWID0z2XS8PAU6G7ASQsXCh6sd5LFhL7zhxBQ4ENjT8pDi0OLYvw9VzPhPrdzooULeMytGitVWRtLsSzCn/D+U4x6EJLivLW6jv9SAIKg54fAjNEBYHh7GuHbr/VGtmiWKj6av2e3/BLgPOIyINzNv+X5QSsopZ2/yamPs+ARTOqAZvSyRgqereYoLZ5ZV15jIWiGc7HVfj/+Bk7cN4+VwFhzSuttp1DmvNNIWueeX69rdSqe41Y2lqKZ4ajOSIJ+YLP/dR0wvrVbd7QSP2OVRAnMugmeekbIuyIKPNsNJ183Z4y1m/ihIdRAzLnjSYuYCdWw3LXl5gM0ZTtGb7K+cIYcyJrS3fcaErDmqyI/LJoXNTo5CJI=,iv:ycKt8/awCo3HoO6Oa8H77GH9+m+xgR4kiXb7Cbf0wSY=,tag:b6pBoZs+E4CP+V9oZXrcoQ==,type:str] +postfix_ldap_aliases: ENC[AES256_GCM,data:SFCncYQAY2ZOA4d8YO58HQvUIRpevU6dX3BDv/pnB1JlvNmQH7oy4NZ4zf24/1i11EV7Z0NvPsa4sAqj8xRR++yyzeG9RQk3Pcst3AkFtA+MkNP0ueZJYsvLKyUE6G7UpzVVuLI+L5R121JrRp6+r5xqckOBNCBo73ulb7tC67hSfLA+ZNmDw+bKbshHej4l3hvM/c2sHLbcPp/+vxLXqthPR+y8lf6J/QgZ8Yzw1JxFVDO8ypaWpWZZvA3HbAzRJXxk2zxg+lpmgFsyzTXLZGhvf7NdRHUmTP9OgDFt/efhxpUvDYpDinzVOuFrYJGL/4U0LLvxtGQQaQ==,iv:dUx+BsJWaiZ6MeNB+OhrSxQf+co2USjJM5rKt7OP5GI=,tag:nOVLxEyIRSNnxGa8eHMmFQ==,type:str] sops: kms: [] gcp_kms: [] @@ -30,8 +31,8 @@ sops: NEJBTHE2end1RDlHRTNFYlZjTjhib2cKmQRHpBKZ2DbQ5CfOwcSPfZAm9fnnpxUk +LcR8haK//O3N2uNf9etDW3VsT5ipPucCdFU1m/v9L5tcN6ZP8WP+w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-04-03T21:29:19Z" - mac: ENC[AES256_GCM,data:rpUgxzTSUAHjCJKIvCXRGSiJF3G4LyTqQXL1x9yUeEe18WHEBWowllMF4S2sqKDU4WLwElCjz/vU8/W3HjrhHK8DHBRIw+7ztol7e3KZdiRJuj+3yazsxo34DkM4mMvA125llFJhhys3w+9WOrdlY9mVITv8uVfLbSYBDLZ6dAg=,iv:K7QXSE7YixdZcPAJo7vXkPvjFuOzkglIxHQefCFYHig=,tag:7gsDdVKLOvjfTQVU0orreA==,type:str] + lastmodified: "2023-07-03T16:18:44Z" + mac: ENC[AES256_GCM,data:USYbcrCkagxH2fMkkYab6kviwvaM9dC6BHd+uomsjQQwp2aSElxrz7yJZgHiiWuODwLqC6Cg+i/1NLY1JDyGy1IBehmaW/PFEjpq5RjcY4oIiHWDLBKlVBryZGMlDCc1o5Q5ispK8TksCDP567ogEV1AeFb/f/l4Lp/0lsstQlk=,iv:oyIndbLisTKyJezd0ndpuHesAur57g5d0vZb/nliGfs=,tag:K/hWbcikN1ATgJrzABWD9Q==,type:str] pgp: - created_at: "2023-04-23T17:48:54Z" enc: |