mail: split into modules

hosts/falkenstein/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 {
   imports =
     [
@@ -29,6 +29,11 @@
     kernelPackages = pkgs.linuxPackages_latest;
   };
 
+  users.users.rouven = {
+    description = "Rouven Seifert";
+    isNormalUser = true;
+  };
+
   time.timeZone = "Europe/Berlin";
 
   i18n.defaultLocale = "en_US.UTF-8";

hosts/falkenstein/modules/mail/default.nix

@@ -1,237 +1,13 @@
-{ config, pkgs, lib, ... }:
+{ config, ... }:
-
 let
-  domain = config.networking.domain;
+  domain = "mail.${config.networking.domain}";
-  hostname = "mail.${domain}";
-  # see https://www.kuketz-blog.de/e-mail-anbieter-ip-stripping-aus-datenschutzgruenden/
-  header_cleanup = pkgs.writeText "header_cleanup_outgoing" ''
-    /^\s*(Received: from)[^\n]*(.*)/ REPLACE $1 127.0.0.1 (localhost [127.0.0.1])$2
-    /^\s*User-Agent/ IGNORE
-    /^\s*X-Enigmail/ IGNORE
-    /^\s*X-Mailer/ IGNORE
-    /^\s*X-Originating-IP/ IGNORE
-    /^\s*Mime-Version/ IGNORE
-  '';
-  login_maps = pkgs.writeText "login_maps.pcre" ''
-    # basic username => username@rfive.de
-    /^([^@+]*)(\+[^@]*)?@rfive\.de$/ ''${1}
-  '';
 in
 {
-  networking.firewall.allowedTCPPorts = [
+  imports = [
-    25 # SMTP
+    ./postfix.nix
-    465 # SUBMISSONS
+    ./dovecot2.nix
-    993 # IMAPS
+    ./rspamd.nix
-    4190 # sieve
   ];
-  users.users.rouven = {
-    description = "Rouven Seifert";
-    isNormalUser = true;
-  };
-
-  services = {
-    postfix = {
-      enable = true;
-      enableSubmission = true;
-      enableSubmissions = true;
-      recipientDelimiter = "+";
-      hostname = "${hostname}";
-      domain = "${domain}";
-      origin = "${domain}";
-      destination = [ "${hostname}" "${domain}" "localhost" ];
-      networks = [ "127.0.0.1" ];
-      sslCert = "/var/lib/acme/${hostname}/fullchain.pem";
-      sslKey = "/var/lib/acme/${hostname}/key.pem";
-      config = {
-        home_mailbox = "Maildir/";
-        smtp_helo_name = config.networking.fqdn;
-        smtpd_banner = "${config.networking.fqdn} ESMTP $mail_name";
-        smtp_use_tls = true;
-        smtpd_use_tls = true;
-        smtpd_tls_protocols = [
-          "!SSLv2"
-          "!SSLv3"
-          "!TLSv1"
-          "!TLSv1.1"
-        ];
-        smtpd_recipient_restrictions = [
-          "permit_sasl_authenticated"
-          "permit_mynetworks"
-          "reject_unauth_destination"
-          "reject_non_fqdn_sender"
-          "reject_non_fqdn_recipient"
-          "reject_unknown_sender_domain"
-          "reject_unknown_recipient_domain"
-          "reject_unauth_destination"
-          "reject_unauth_pipelining"
-          "reject_invalid_hostname"
-        ];
-        smtpd_relay_restrictions = [
-          "permit_sasl_authenticated"
-          "permit_mynetworks"
-          "reject_unauth_destination"
-        ];
-        smtpd_sender_restrictions = [
-          "reject_authenticated_sender_login_mismatch"
-        ];
-        smtpd_sender_login_maps = [ "pcre:${login_maps}" ];
-        smtp_header_checks = "pcre:${header_cleanup}";
-
-        alias_maps = [ "hash:/etc/aliases" ];
-        smtpd_sasl_auth_enable = true;
-        smtpd_sasl_path = "/var/lib/postfix/auth";
-        smtpd_sasl_type = "dovecot";
-        mailbox_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
-      };
-    };
-
-    dovecot2 = {
-      enable = true;
-      enableImap = true;
-      enableQuota = false;
-      enableLmtp = true;
-      mailLocation = "maildir:~/Maildir";
-      sslServerCert = "/var/lib/acme/${hostname}/fullchain.pem";
-      sslServerKey = "/var/lib/acme/${hostname}/key.pem";
-      protocols = [ "imap" "sieve" ];
-      mailPlugins = {
-        globally.enable = [ "listescape" ];
-        perProtocol = {
-          imap = {
-            enable = [ "imap_sieve" "imap_filter_sieve" ];
-          };
-          lmtp = {
-            enable = [ "sieve" ];
-          };
-        };
-      };
-      mailboxes = {
-        Spam = {
-          auto = "create";
-          specialUse = "Junk";
-        };
-        Sent = {
-          auto = "create";
-          specialUse = "Sent";
-        };
-        Drafts = {
-          auto = "create";
-          specialUse = "Drafts";
-        };
-        Trash = {
-          auto = "create";
-          specialUse = "Trash";
-        };
-        Archive = {
-          auto = "no";
-          specialUse = "Archive";
-        };
-      };
-      modules = [
-        pkgs.dovecot_pigeonhole
-      ];
-      sieve = {
-        # just pot something in here to prevent empty strings
-        extensions = [ "notify" ];
-        # globalExtensions = [ "+vnd.dovecot.pipe" ];
-        pipeBins = map lib.getExe [
-          (pkgs.writeShellScriptBin "learn-ham.sh" "exec ${pkgs.rspamd}/bin/rspamc learn_ham")
-          (pkgs.writeShellScriptBin "learn-spam.sh" "exec ${pkgs.rspamd}/bin/rspamc learn_spam")
-        ];
-        plugins = [
-          "sieve_imapsieve"
-          "sieve_extprograms"
-        ];
-      };
-      imapsieve.mailbox = [
-        {
-          # Spam: From elsewhere to Spam folder or flag changed in Spam folder
-          name = "Spam";
-          causes = [ "COPY" "APPEND" "FLAG" ];
-          before = ./report-spam.sieve;
-
-        }
-        {
-          # From Junk folder to elsewhere
-          name = "*";
-          from = "Spam";
-          causes = [ "COPY" ];
-          before = ./report-ham.sieve;
-        }
-      ];
-
-      extraConfig = ''
-        auth_username_format = %Ln
-        userdb {
-          driver = passwd
-          args = blocking=no
-        }
-        service auth {
-          unix_listener /var/lib/postfix/auth {
-            group = postfix
-            mode = 0660
-            user = postfix
-           }
-         }
-        service managesieve-login {
-          inet_listener sieve {
-            port = 4190
-          }
-        
-          service_count = 1
-        }
-        namespace inbox {
-          separator = /
-          inbox = yes
-        }
-        service lmtp {
-          unix_listener dovecot-lmtp {
-            group = postfix
-            mode = 0600
-            user = postfix
-          }
-          client_limit = 1
-        }
-      '';
-    };
-
-    rspamd = {
-      enable = true;
-      postfix.enable = true;
-      locals = {
-        "worker-controller.inc".text = ''
-          password = "$2$g1jh7t5cxschj11set5wksd656ixd5ie$cgwrj53hfb87xndqbh5r3ow9qfi1ejii8dxok1ihbnhamccn1rxy";
-        '';
-        "redis.conf".text = ''
-          read_servers = "/run/redis-rspamd/redis.sock";
-          write_servers = "/run/redis-rspamd/redis.sock";
-        '';
-        "milter_headers.conf".text = ''
-          use = ["x-spam-level", "x-spam-status", "x-spamd-result", "authentication-results" ];
-        '';
-        "dmarc.conf".text = ''
-          reporting {
-            enabled = true;
-            email = 'reports@${config.networking.domain}';
-            domain = '${config.networking.domain}';
-            org_name = '${config.networking.domain}';
-            from_name = 'DMARC Aggregate Report';
-          }
-        '';
-        "dkim_signing.conf".text = ''
-          selector = "rspamd";
-          allow_username_mismatch = true;
-          path = /var/lib/rspamd/dkim/$domain.key;
-        '';
-      };
-    };
-    redis = {
-      vmOverCommit = true;
-      servers.rspamd = {
-        enable = true;
-      };
-    };
-  };
   security.acme.certs."${domain}" = {
     reloadServices = [
       "postfix.service"
@@ -240,32 +16,9 @@ in
   };
 
   services.nginx.virtualHosts = {
-    "${hostname}" = {
+    "${domain}" = {
       enableACME = true;
       forceSSL = true;
     };
-    "rspamd.${config.networking.domain}" = {
-      enableACME = true;
-      forceSSL = true;
-      locations = {
-        "/" = {
-          proxyPass = "http://127.0.0.1:11334";
-          proxyWebsockets = true;
-        };
-      };
-    };
-  };
-  users.users.rspamd.extraGroups = [ "redis-rspamd" ];
-  systemd = {
-    services.rspamd-dmarc-report = {
-      description = "rspamd dmarc reporter";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.rspamd}/bin/rspamadm dmarc_report -v";
-        User = "rspamd";
-        Group = "rspamd";
-      };
-      startAt = "daily";
-    };
   };
 }

hosts/falkenstein/modules/mail/dovecot2.nix

@@ -0,0 +1,120 @@
+{ config, pkgs, lib, ... }:
+let
+  hostname = "mail.${config.networking.domain}";
+in
+{
+  networking.firewall.allowedTCPPorts = [
+    993
+    4190
+  ];
+  services = {
+    dovecot2 = {
+      enable = true;
+      enableImap = true;
+      enableQuota = false;
+      enableLmtp = true;
+      mailLocation = "maildir:~/Maildir";
+      sslServerCert = "/var/lib/acme/${hostname}/fullchain.pem";
+      sslServerKey = "/var/lib/acme/${hostname}/key.pem";
+      protocols = [ "imap" "sieve" ];
+      mailPlugins = {
+        globally.enable = [ "listescape" ];
+        perProtocol = {
+          imap = {
+            enable = [ "imap_sieve" "imap_filter_sieve" ];
+          };
+          lmtp = {
+            enable = [ "sieve" ];
+          };
+        };
+      };
+      mailboxes = {
+        Spam = {
+          auto = "create";
+          specialUse = "Junk";
+        };
+        Sent = {
+          auto = "create";
+          specialUse = "Sent";
+        };
+        Drafts = {
+          auto = "create";
+          specialUse = "Drafts";
+        };
+        Trash = {
+          auto = "create";
+          specialUse = "Trash";
+        };
+        Archive = {
+          auto = "no";
+          specialUse = "Archive";
+        };
+      };
+      modules = [
+        pkgs.dovecot_pigeonhole
+      ];
+      sieve = {
+        # just pot something in here to prevent empty strings
+        extensions = [ "notify" ];
+        # globalExtensions = [ "+vnd.dovecot.pipe" ];
+        pipeBins = map lib.getExe [
+          (pkgs.writeShellScriptBin "learn-ham.sh" "exec ${pkgs.rspamd}/bin/rspamc learn_ham")
+          (pkgs.writeShellScriptBin "learn-spam.sh" "exec ${pkgs.rspamd}/bin/rspamc learn_spam")
+        ];
+        plugins = [
+          "sieve_imapsieve"
+          "sieve_extprograms"
+        ];
+      };
+      imapsieve.mailbox = [
+        {
+          # Spam: From elsewhere to Spam folder or flag changed in Spam folder
+          name = "Spam";
+          causes = [ "COPY" "APPEND" "FLAG" ];
+          before = ./report-spam.sieve;
+
+        }
+        {
+          # From Junk folder to elsewhere
+          name = "*";
+          from = "Spam";
+          causes = [ "COPY" ];
+          before = ./report-ham.sieve;
+        }
+      ];
+      extraConfig = ''
+        auth_username_format = %Ln
+        userdb {
+          driver = passwd
+          args = blocking=no
+        }
+        service auth {
+          unix_listener /var/lib/postfix/auth {
+            group = postfix
+            mode = 0660
+            user = postfix
+           }
+         }
+        service managesieve-login {
+          inet_listener sieve {
+            port = 4190
+          }
+        
+          service_count = 1
+        }
+        namespace inbox {
+          separator = /
+          inbox = yes
+        }
+        service lmtp {
+          unix_listener dovecot-lmtp {
+            group = postfix
+            mode = 0600
+            user = postfix
+          }
+          client_limit = 1
+        }
+      '';
+    };
+  };
+}

hosts/falkenstein/modules/mail/postfix.nix

@@ -0,0 +1,81 @@
+{ config, pkgs, ... }:
+
+let
+  domain = config.networking.domain;
+  hostname = "mail.${domain}";
+  header_cleanup = pkgs.writeText "header_cleanup_outgoing" ''
+    /^\s*(Received: from)[^\n]*(.*)/ REPLACE $1 127.0.0.1 (localhost [127.0.0.1])$2
+    /^\s*User-Agent/ IGNORE
+    /^\s*X-Enigmail/ IGNORE
+    /^\s*X-Mailer/ IGNORE
+    /^\s*X-Originating-IP/ IGNORE
+    /^\s*Mime-Version/ IGNORE
+  '';
+  login_maps = pkgs.writeText "login_maps.pcre" ''
+    # basic username => username@rfive.de
+    /^([^@+]*)(\+[^@]*)?@rfive\.de$/ ''${1}
+  '';
+in
+{
+  networking.firewall.allowedTCPPorts = [
+    25 # SMTP
+    465 # SUBMISSONS
+  ];
+
+  services = {
+    postfix = {
+      enable = true;
+      enableSubmission = true;
+      enableSubmissions = true;
+      recipientDelimiter = "+";
+      hostname = "${hostname}";
+      domain = "${domain}";
+      origin = "${domain}";
+      destination = [ "${hostname}" "${domain}" "localhost" ];
+      networks = [ "127.0.0.1" ];
+      sslCert = "/var/lib/acme/${hostname}/fullchain.pem";
+      sslKey = "/var/lib/acme/${hostname}/key.pem";
+      config = {
+        home_mailbox = "Maildir/";
+        smtp_helo_name = config.networking.fqdn;
+        smtpd_banner = "${config.networking.fqdn} ESMTP $mail_name";
+        smtp_use_tls = true;
+        smtpd_use_tls = true;
+        smtpd_tls_protocols = [
+          "!SSLv2"
+          "!SSLv3"
+          "!TLSv1"
+          "!TLSv1.1"
+        ];
+        smtpd_recipient_restrictions = [
+          "permit_sasl_authenticated"
+          "permit_mynetworks"
+          "reject_unauth_destination"
+          "reject_non_fqdn_sender"
+          "reject_non_fqdn_recipient"
+          "reject_unknown_sender_domain"
+          "reject_unknown_recipient_domain"
+          "reject_unauth_destination"
+          "reject_unauth_pipelining"
+          "reject_invalid_hostname"
+        ];
+        smtpd_relay_restrictions = [
+          "permit_sasl_authenticated"
+          "permit_mynetworks"
+          "reject_unauth_destination"
+        ];
+        smtpd_sender_restrictions = [
+          "reject_authenticated_sender_login_mismatch"
+        ];
+        smtpd_sender_login_maps = [ "pcre:${login_maps}" ];
+        smtp_header_checks = "pcre:${header_cleanup}";
+
+        alias_maps = [ "hash:/etc/aliases" ];
+        smtpd_sasl_auth_enable = true;
+        smtpd_sasl_path = "/var/lib/postfix/auth";
+        smtpd_sasl_type = "dovecot";
+        mailbox_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
+      };
+    };
+  };
+}

hosts/falkenstein/modules/mail/rspamd.nix

@@ -0,0 +1,65 @@
+{ config, pkgs, ... }:
+{
+  users.users.rspamd.extraGroups = [ "redis-rspamd" ];
+  services = {
+    rspamd = {
+      enable = true;
+      postfix.enable = true;
+      locals = {
+        "worker-controller.inc".text = ''
+          password = "$2$g1jh7t5cxschj11set5wksd656ixd5ie$cgwrj53hfb87xndqbh5r3ow9qfi1ejii8dxok1ihbnhamccn1rxy";
+        '';
+        "redis.conf".text = ''
+          read_servers = "/run/redis-rspamd/redis.sock";
+          write_servers = "/run/redis-rspamd/redis.sock";
+        '';
+        "milter_headers.conf".text = ''
+          use = ["x-spam-level", "x-spam-status", "x-spamd-result", "authentication-results" ];
+        '';
+        "dmarc.conf".text = ''
+          reporting {
+            enabled = true;
+            email = 'reports@${config.networking.domain}';
+            domain = '${config.networking.domain}';
+            org_name = '${config.networking.domain}';
+            from_name = 'DMARC Aggregate Report';
+          }
+        '';
+        "dkim_signing.conf".text = ''
+          selector = "rspamd";
+          allow_username_mismatch = true;
+          path = /var/lib/rspamd/dkim/$domain.key;
+        '';
+      };
+    };
+    redis = {
+      vmOverCommit = true;
+      servers.rspamd = {
+        enable = true;
+      };
+    };
+    nginx.virtualHosts."rspamd.${config.networking.domain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations = {
+        "/" = {
+          proxyPass = "http://127.0.0.1:11334";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+  systemd = {
+    services.rspamd-dmarc-report = {
+      description = "rspamd dmarc reporter";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.rspamd}/bin/rspamadm dmarc_report -v";
+        User = "rspamd";
+        Group = "rspamd";
+      };
+      startAt = "daily";
+    };
+  };
+}
+