mailsystem: Use newly added 'mailnix' package to generate postfix/dovecot files
This commit is contained in:
parent
955a0ec8ba
commit
c1b19d6e33
9 changed files with 52 additions and 85 deletions
|
|
@ -1,4 +1,8 @@
|
|||
{config, ...}: let
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
cfg = config.mailsystem;
|
||||
in rec {
|
||||
certificateDirectory = "/var/certs";
|
||||
|
|
@ -17,6 +21,11 @@ in rec {
|
|||
then ["acme-finished-${cfg.fqdn}.target"]
|
||||
else ["mailsystem-selfsigned-certificate.service"];
|
||||
|
||||
mailnixCfgFile = pkgs.writeText "mailnix-public.json" (builtins.toJSON {
|
||||
inherit (cfg) accounts domains;
|
||||
aliases = cfg.virtualAliases;
|
||||
});
|
||||
|
||||
dovecotDynamicStateDir = "/var/lib/dovecot";
|
||||
dovecotDynamicPasswdFile = "${dovecotDynamicStateDir}/passwd";
|
||||
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
pkgs,
|
||||
...
|
||||
}:
|
||||
with (import ./common.nix {inherit config;}); let
|
||||
with (import ./common.nix {inherit config pkgs;}); let
|
||||
cfg = config.mailsystem;
|
||||
postfixCfg = config.services.postfix;
|
||||
dovecot2Cfg = config.services.dovecot2;
|
||||
|
|
@ -39,43 +39,11 @@ with (import ./common.nix {inherit config;}); let
|
|||
# Ensure passwd files are not world-readable at any time
|
||||
umask 077
|
||||
|
||||
# Ensure we have a file for every user's (initial) password hash.
|
||||
for f in ${builtins.toString (lib.mapAttrsToList (user: value: value.hashedPasswordFile) cfg.accounts)}; do
|
||||
if [ ! -f "$f" ]; then
|
||||
echo "Expected password hash file $f does not exist!"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
# Prepare static passwd-file for system users
|
||||
cat <<EOF > "${staticPasswdFile}"
|
||||
${lib.concatStringsSep "\n" (lib.mapAttrsToList genPasswdEntry systemUsers)}
|
||||
EOF
|
||||
${pkgs.mailnix}/bin/mailnix ${mailnixCfgFile} generate-static-passdb > "${staticPasswdFile}"
|
||||
|
||||
# Prepare initial passwd-file for dynamic users
|
||||
# (used for lookup during actual passwd-file generation)
|
||||
cat <<EOF > "${initialPasswdFile}"
|
||||
${lib.concatStringsSep "\n" (lib.mapAttrsToList genPasswdEntry normalUsers)}
|
||||
EOF
|
||||
|
||||
# Check for existence of dynamic passwd-file
|
||||
touch "${dovecotDynamicPasswdFile}"
|
||||
if (! test -f "${dovecotDynamicPasswdFile}"); then
|
||||
echo "${dovecotDynamicPasswdFile} exists and is no regular file"
|
||||
exit 1
|
||||
fi
|
||||
# Ensure that only configured users are actually present and remove any others
|
||||
truncate -s 0 "${dovecotDynamicPasswdFile}-filtered"
|
||||
for u in ${builtins.toString (lib.mapAttrsToList (user: value: value.name) normalUsers)}; do
|
||||
if grep -q "^$u:" "${dovecotDynamicPasswdFile}"; then
|
||||
# User already has some password set -> Keep currently set password
|
||||
grep "^$u:" "${dovecotDynamicPasswdFile}" >> "${dovecotDynamicPasswdFile}-filtered"
|
||||
else
|
||||
# User has no password set, yet -> Take password from initialPasswdFile
|
||||
grep "^$u:" "${initialPasswdFile}" >> "${dovecotDynamicPasswdFile}-filtered"
|
||||
fi
|
||||
done
|
||||
mv "${dovecotDynamicPasswdFile}-filtered" "${dovecotDynamicPasswdFile}"
|
||||
# Prepare/Update passwd-file for dynamic users
|
||||
${pkgs.mailnix}/bin/mailnix ${mailnixCfgFile} update-dynamic-passdb ${dovecotDynamicPasswdFile} > "${dovecotDynamicPasswdFile}"
|
||||
|
||||
${lib.optionalString cfg.roundcube.enable ''
|
||||
# Ensure roundcube has access to dynamic passwd file
|
||||
|
|
@ -83,12 +51,10 @@ with (import ./common.nix {inherit config;}); let
|
|||
''}
|
||||
|
||||
# Prepare userdb-file
|
||||
cat <<EOF > "${userdbFile}"
|
||||
${lib.concatStringsSep "\n" (lib.mapAttrsToList genUserdbEntry cfg.accounts)}
|
||||
EOF
|
||||
${pkgs.mailnix}/bin/mailnix ${mailnixCfgFile} generate-userdb > "${userdbFile}"
|
||||
'';
|
||||
|
||||
genMaildir = pkgs.writeScript "generate-maildir" ''
|
||||
genMaildirScript = pkgs.writeScript "generate-maildir" ''
|
||||
#!${pkgs.stdenv.shell}
|
||||
|
||||
# Create mail directory and set permissions accordingly.
|
||||
|
|
@ -295,7 +261,7 @@ in {
|
|||
systemd.services.dovecot2 = {
|
||||
preStart = ''
|
||||
${genAuthDbsScript}
|
||||
${genMaildir}
|
||||
${genMaildirScript}
|
||||
'';
|
||||
wants = sslCertService;
|
||||
after = sslCertService;
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
lib,
|
||||
...
|
||||
}:
|
||||
with (import ./common.nix {inherit config;}); let
|
||||
with (import ./common.nix {inherit config pkgs;}); let
|
||||
cfg = config.mailsystem;
|
||||
in {
|
||||
config =
|
||||
|
|
|
|||
|
|
@ -4,42 +4,29 @@
|
|||
pkgs,
|
||||
...
|
||||
}:
|
||||
with (import ./common.nix {inherit config;}); let
|
||||
with (import ./common.nix {inherit config pkgs;}); let
|
||||
cfg = config.mailsystem;
|
||||
|
||||
mappedFile = name: "hash:/var/lib/postfix/conf/${name}";
|
||||
|
||||
attrsToLookupTable = aliases: let
|
||||
lookupTables = lib.mapAttrsToList (from: to: {"${from}" = to;}) aliases;
|
||||
in
|
||||
mergeLookupTables lookupTables;
|
||||
runtimeDir = "/run/postfix";
|
||||
aliases_file = "${runtimeDir}/virtual_aliases";
|
||||
virtual_domains_file = "${runtimeDir}/virtual_domains";
|
||||
denied_recipients_file = "${runtimeDir}/denied_recipients";
|
||||
|
||||
lookupTableToString = attrs: let
|
||||
isDomain = value: !(lib.hasInfix "@" value);
|
||||
valueToString = value:
|
||||
if (isDomain value)
|
||||
then "@${value}"
|
||||
else value;
|
||||
listToString = list: lib.concatStringsSep ", " (map valueToString list);
|
||||
in
|
||||
lib.concatStringsSep "\n" (lib.mapAttrsToList (name: list: "${valueToString name} ${listToString list}") attrs);
|
||||
genPostmapsScript = pkgs.writeScript "generate-postfix-postmaps" ''
|
||||
#!${pkgs.stdenv.shell}
|
||||
set -euo pipefail
|
||||
|
||||
mergeLookupTables = tables: lib.zipAttrsWith (n: v: lib.flatten v) tables;
|
||||
if (! test -d "${runtimeDir}"); then
|
||||
mkdir "${runtimeDir}"
|
||||
chmod 755 "${runtimeDir}"
|
||||
fi
|
||||
|
||||
virtual_accounts = mergeLookupTables (lib.map (name: {"${name}" = name;}) (lib.attrNames cfg.accounts));
|
||||
virtual_aliases = attrsToLookupTable cfg.virtualAliases;
|
||||
all_virtual_aliases = mergeLookupTables [virtual_accounts virtual_aliases];
|
||||
|
||||
# File containing all mappings of aliases/authenticated accounts and their sender mail addresses.
|
||||
aliases_file = let
|
||||
content = lookupTableToString all_virtual_aliases;
|
||||
in
|
||||
builtins.toFile "virtual_aliases" content;
|
||||
|
||||
virtual_domains_file = builtins.toFile "virtual_domains" (lib.concatStringsSep "\n" cfg.domains);
|
||||
|
||||
denied_recipients = map (account: "${account.name} REJECT ${account.rejectMessage}") (lib.filter (account: account.isSystemUser) (lib.attrValues cfg.accounts));
|
||||
denied_recipients_file = builtins.toFile "denied_recipients" (lib.concatStringsSep "\n" denied_recipients);
|
||||
${pkgs.mailnix}/bin/mailnix "${mailnixCfgFile}" "generate-aliases" > "${aliases_file}"
|
||||
${pkgs.mailnix}/bin/mailnix "${mailnixCfgFile}" "generate-domains" > "${virtual_domains_file}"
|
||||
${pkgs.mailnix}/bin/mailnix "${mailnixCfgFile}" "generate-denied-recipients" > "${denied_recipients_file}"
|
||||
'';
|
||||
|
||||
submission_header_cleanup_rules = pkgs.writeText "submission_header_cleanup_rules" ''
|
||||
# Removes sensitive headers from mails handed in via the submission port.
|
||||
|
|
@ -83,7 +70,6 @@ in {
|
|||
|
||||
mapFiles."virtual_aliases" = aliases_file;
|
||||
mapFiles."denied_recipients" = denied_recipients_file;
|
||||
virtual = lookupTableToString all_virtual_aliases;
|
||||
|
||||
submissionsOptions = {
|
||||
smtpd_tls_security_level = "encrypt";
|
||||
|
|
@ -110,6 +96,9 @@ in {
|
|||
virtual_gid_maps = "static:${toString cfg.vmailUID}";
|
||||
virtual_mailbox_base = cfg.mailDirectory;
|
||||
virtual_mailbox_domains = virtual_domains_file;
|
||||
virtual_alias_maps = [
|
||||
(mappedFile "virtual_aliases")
|
||||
];
|
||||
virtual_mailbox_maps = [
|
||||
(mappedFile "virtual_aliases")
|
||||
];
|
||||
|
|
@ -193,6 +182,11 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
systemd.services.postfix-setup = {
|
||||
preStart = ''
|
||||
${genPostmapsScript}
|
||||
'';
|
||||
};
|
||||
systemd.services.postfix = {
|
||||
wants = sslCertService;
|
||||
after =
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
pkgs,
|
||||
...
|
||||
}:
|
||||
with (import ./common.nix {inherit config;}); let
|
||||
with (import ./common.nix {inherit config pkgs;}); let
|
||||
cfg = config.mailsystem;
|
||||
roundcubeCfg = config.mailsystem.roundcube;
|
||||
in {
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
pkgs,
|
||||
...
|
||||
}:
|
||||
with (import ./common.nix {inherit config;}); let
|
||||
with (import ./common.nix {inherit config pkgs;}); let
|
||||
cfg = config.mailsystem;
|
||||
nginxCfg = config.services.nginx;
|
||||
postfixCfg = config.services.postfix;
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
lib,
|
||||
...
|
||||
}:
|
||||
with (import ./common.nix {inherit config;}); let
|
||||
with (import ./common.nix {inherit config pkgs;}); let
|
||||
cfg = config.mailsystem;
|
||||
in {
|
||||
config = lib.mkIf (cfg.enable && cfg.certificateScheme == "selfsigned") {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue