wurzel/fruitbasket
9
1
Fork 0
Code Issues 5 Pull requests Packages Projects Releases Wiki Activity

mail: better ldap query and port fixes

Browse source
This commit is contained in:
Rouven Seifert 2023-02-24 17:11:53 +01:00
parent 0ed90c8122
commit eee6282d69
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
1 changed files with 27 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
modules/mail.nix
View file

@ -3,10 +3,13 @@ let
hostname = "mail.${config.fsr.domain}"; hostname = "mail.${config.fsr.domain}";
domain = config.fsr.domain; domain = config.fsr.domain;
rspamd-domain = "rspamd.${config.fsr.domain}"; rspamd-domain = "rspamd.${config.fsr.domain}";
dkim-selector = "quitte";
# brauchen wir das überhaupt? # brauchen wir das überhaupt?
#ldap-aliases = pkgs.writeText "ldap-aliases.cf" '' #ldap-aliases = pkgs.writeText "ldap-aliases.cf" ''
#server_host = ldap://localhost #server_host = ldap://localhost
#search_base = ou=mail, dc=ifsr, dc=de #search_base = dc=ifsr, dc=de
#query_filter = (&(objectClass=posixAccount)(uid=%n))
#result_attribute=mail
#''; #'';
dovecot-ldap-args = pkgs.writeText "ldap-args" '' dovecot-ldap-args = pkgs.writeText "ldap-args" ''
uris = ldap://localhost uris = ldap://localhost
@ -17,8 +20,8 @@ let
ldap_version = 3 ldap_version = 3
scope = subtree scope = subtree
base = dc=ifsr, dc=de base = dc=ifsr, dc=de
user_filter = (&(objectClass=posixAccount)(uid=%n)) user_filter = (&(objectClass=posixAccount)(mail=%u))
pass_filter = (&(objectClass=posixAccount)(uid=%n)) pass_filter = (&(objectClass=posixAccount)(mail=%u))
''; '';
in in
{ {
@ -30,22 +33,30 @@ in
services = { services = {
postfix = { postfix = {
enable = true; enable = true;
enableSubmissions = true;
hostname = "${hostname}"; hostname = "${hostname}";
domain = "${domain}"; domain = "${domain}";
relayHost = "";
origin = "${domain}"; origin = "${domain}";
destination = [ "${hostname}" "${domain}" "localhost" ]; destination = [ "${hostname}" "${domain}" "localhost" ];
networks = [ "127.0.0.1" "141.30.30.169" ];
sslCert = "/var/lib/acme/${hostname}/fullchain.pem"; sslCert = "/var/lib/acme/${hostname}/fullchain.pem";
sslKey = "/var/lib/acme/${hostname}/key.pem"; sslKey = "/var/lib/acme/${hostname}/key.pem";
config = { config = {
smtpd_recipient_restrictions = [ smtpd_recipient_restrictions = [
"reject_unauth_destination"
"permit_sasl_authenticated" "permit_sasl_authenticated"
"permit_mynetworks" "permit_mynetworks"
"reject_unauth_destination"
];
smtpd_relay_restrictions = [
"permit_sasl_authenticated"
"permit_mynetworks"
"reject_unauth_destination"
]; ];
#alias_maps = [ "ldap:${ldap-aliases}" ]; #alias_maps = [ "ldap:${ldap-aliases}" ];
smtpd_sasl_auth_enable = true; smtpd_sasl_auth_enable = true;
smtpd_sasl_path = "/var/lib/postfix/auth"; smtpd_sasl_path = "/var/lib/postfix/auth";
smtpd_sasl_type = "dovecot";
#mailbox_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
virtual_mailbox_base = "/var/mail"; virtual_mailbox_base = "/var/mail";
}; };
}; };
@ -53,6 +64,7 @@ in
enable = true; enable = true;
enableImap = true; enableImap = true;
enableQuota = false; enableQuota = false;
#enableLmtp = true;
sslServerCert = "/var/lib/acme/${hostname}/fullchain.pem"; sslServerCert = "/var/lib/acme/${hostname}/fullchain.pem";
sslServerKey = "/var/lib/acme/${hostname}/key.pem"; sslServerKey = "/var/lib/acme/${hostname}/key.pem";
mailboxes = { mailboxes = {
@ -74,7 +86,7 @@ in
}; };
}; };
extraConfig = '' extraConfig = ''
mail_location = maildir:/var/mail/%u mail_location = maildir:/var/mail/%n
passdb { passdb {
driver = ldap driver = ldap
args = ${dovecot-ldap-args} args = ${dovecot-ldap-args}
@ -90,6 +102,13 @@ in
user = postfix user = postfix
} }
} }
# service lmtp {
# unix_listener dovecot-lmtp {
# group = postfix
# mode = 0660
# user = postfix
# }
# }
''; '';
}; };
rspamd = { rspamd = {
@ -102,8 +121,8 @@ in
write_servers = "127.0.0.1"; write_servers = "127.0.0.1";
''; '';
"dkim_signing.conf".text = '' "dkim_signing.conf".text = ''
path = "/var/lib/rspamd/dkim/$domain.$selector.key"; path = "/var/lib/rspamd/dkim/${domain}.${dkim-selector}.key";
selector = "quitte"; selector = ${dkim-selector};
sign_authenticated = true; sign_authenticated = true;
use_domain = "header"; use_domain = "header";
''; '';
@ -140,27 +159,3 @@ in
}; };
}; };
} }