mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-12-05 03:53:41 +00:00
227 lines
5.8 KiB
Nix
227 lines
5.8 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
rspamdCfg = config.services.rspamd;
|
|
cfg = config.services.rmilter;
|
|
|
|
inetSockets = map (sock: let s = stringSplit ":" sock; in "inet:${last s}:${head s}") cfg.bindInetSockets;
|
|
unixSockets = map (sock: "unix:${sock}") cfg.bindUnixSockets;
|
|
|
|
allSockets = unixSockets ++ inetSockets;
|
|
|
|
rmilterConf = ''
|
|
pidfile = /run/rmilter/rmilter.pid;
|
|
bind_socket = ${if cfg.socketActivation then "fd:3" else concatStringsSep ", " allSockets};
|
|
tempdir = /tmp;
|
|
|
|
'' + (with cfg.rspamd; if enable then ''
|
|
spamd {
|
|
servers = ${concatStringsSep ", " servers};
|
|
connect_timeout = 1s;
|
|
results_timeout = 20s;
|
|
error_time = 10;
|
|
dead_time = 300;
|
|
maxerrors = 10;
|
|
reject_message = "${rejectMessage}";
|
|
${optionalString (length whitelist != 0) "whitelist = ${concatStringsSep ", " whitelist};"}
|
|
|
|
# rspamd_metric - metric for using with rspamd
|
|
# Default: "default"
|
|
rspamd_metric = "default";
|
|
${extraConfig}
|
|
};
|
|
'' else "") + cfg.extraConfig;
|
|
|
|
rmilterConfigFile = pkgs.writeText "rmilter.conf" rmilterConf;
|
|
|
|
in
|
|
|
|
{
|
|
|
|
###### interface
|
|
|
|
options = {
|
|
|
|
services.rmilter = {
|
|
|
|
enable = mkOption {
|
|
default = cfg.rspamd.enable;
|
|
description = "Whether to run the rmilter daemon.";
|
|
};
|
|
|
|
debug = mkOption {
|
|
default = false;
|
|
description = "Whether to run the rmilter daemon in debug mode.";
|
|
};
|
|
|
|
user = mkOption {
|
|
type = types.string;
|
|
default = "rmilter";
|
|
description = ''
|
|
User to use when no root privileges are required.
|
|
'';
|
|
};
|
|
|
|
group = mkOption {
|
|
type = types.string;
|
|
default = "rmilter";
|
|
description = ''
|
|
Group to use when no root privileges are required.
|
|
'';
|
|
};
|
|
|
|
bindUnixSockets = mkOption {
|
|
type = types.listOf types.str;
|
|
default = ["/run/rmilter.sock"];
|
|
description = ''
|
|
Unix domain sockets to listen for MTA requests.
|
|
'';
|
|
example = ''
|
|
[ "/run/rmilter.sock"]
|
|
'';
|
|
};
|
|
|
|
bindInetSockets = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
description = ''
|
|
Inet addresses to listen (in format accepted by systemd.socket)
|
|
'';
|
|
example = ''
|
|
["127.0.0.1:11990"]
|
|
'';
|
|
};
|
|
|
|
socketActivation = mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
description = ''
|
|
Enable systemd socket activation for rmilter.
|
|
(disabling socket activation not recommended
|
|
when unix socket used, and follow to wrong
|
|
permissions on unix domain socket.)
|
|
'';
|
|
};
|
|
|
|
rspamd = {
|
|
enable = mkOption {
|
|
default = rspamdCfg.enable;
|
|
description = "Whether to use rspamd to filter mails";
|
|
};
|
|
|
|
servers = mkOption {
|
|
type = types.listOf types.str;
|
|
default = ["r:/run/rspamd.sock"];
|
|
description = ''
|
|
Spamd socket definitions.
|
|
Is server name is prefixed with r: it is rspamd server.
|
|
'';
|
|
};
|
|
|
|
whitelist = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ ];
|
|
description = "list of ips or nets that should be not checked with spamd";
|
|
};
|
|
|
|
rejectMessage = mkOption {
|
|
type = types.str;
|
|
default = "Spam message rejected; If this is not spam contact abuse";
|
|
description = "reject message for spam";
|
|
};
|
|
|
|
extraConfig = mkOption {
|
|
type = types.lines;
|
|
default = "";
|
|
description = "Custom snippet to append to end of `spamd' section";
|
|
};
|
|
};
|
|
|
|
extraConfig = mkOption {
|
|
type = types.lines;
|
|
default = "";
|
|
description = "Custom snippet to append to rmilter config";
|
|
};
|
|
|
|
postfix = {
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Add rmilter to postfix main.conf";
|
|
};
|
|
|
|
configFragment = mkOption {
|
|
type = types.str;
|
|
description = "Addon to postfix configuration";
|
|
default = ''
|
|
smtpd_milters = ${head allSockets}
|
|
# or for TCP socket
|
|
# # smtpd_milters = inet:localhost:9900
|
|
milter_protocol = 6
|
|
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
|
|
# skip mail without checks if milter will die
|
|
milter_default_action = accept
|
|
'';
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable {
|
|
|
|
users.extraUsers = singleton {
|
|
name = cfg.user;
|
|
description = "rspamd daemon";
|
|
uid = config.ids.uids.rmilter;
|
|
group = cfg.group;
|
|
};
|
|
|
|
users.extraGroups = singleton {
|
|
name = cfg.group;
|
|
gid = config.ids.gids.rmilter;
|
|
};
|
|
|
|
systemd.services.rmilter = {
|
|
description = "Rmilter Service";
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
|
|
serviceConfig = {
|
|
ExecStart = "${pkgs.rmilter}/bin/rmilter ${optionalString cfg.debug "-d"} -n -c ${rmilterConfigFile}";
|
|
ExecReload = "/bin/kill -USR1 $MAINPID";
|
|
User = cfg.user;
|
|
Group = cfg.group;
|
|
PermissionsStartOnly = true;
|
|
Restart = "always";
|
|
RuntimeDirectory = "rmilter";
|
|
RuntimeDirectoryPermissions="0755";
|
|
};
|
|
|
|
};
|
|
|
|
systemd.sockets.rmilter = mkIf cfg.socketActivation {
|
|
description = "Rmilter service socket";
|
|
wantedBy = [ "sockets.target" ];
|
|
socketConfig = {
|
|
ListenStream = cfg.bindUnixSockets ++ cfg.bindInetSockets;
|
|
SocketUser = cfg.user;
|
|
SocketGroup = cfg.group;
|
|
SocketMode = "0660";
|
|
};
|
|
};
|
|
|
|
services.postfix.extraConfig = optionalString cfg.postfix.enable cfg.postfix.configFragment;
|
|
users.users.postfix.extraGroups = [ cfg.group ];
|
|
};
|
|
|
|
}
|