88 lines
2.4 KiB
Nix
88 lines
2.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
with (import ./common.nix {inherit config;}); let
|
|
cfg = config.mailsystem;
|
|
nginxcfg = config.services.nginx;
|
|
postfixCfg = config.services.postfix;
|
|
redisCfg = config.services.redis.servers.rspamd;
|
|
rspamdCfg = config.services.rspamd;
|
|
|
|
genSystemdSocketCfg = name: socketPath: additionalUser: {
|
|
description = "rspamd ${name} worker socket";
|
|
listenStreams = [socketPath];
|
|
requiredBy = ["rspamd.service"];
|
|
socketConfig = {
|
|
Service = "rspamd.service";
|
|
SocketUser = rspamdCfg.user;
|
|
SocketMode = 0600;
|
|
ExecStartPost =
|
|
lib.mkIf (additionalUser != "")
|
|
''${pkgs.acl.bin}/bin/setfacl -m "u:${additionalUser}:rw" "${socketPath}"'';
|
|
};
|
|
};
|
|
in {
|
|
config = lib.mkIf cfg.enable {
|
|
services.rspamd = {
|
|
enable = true;
|
|
overrides = {
|
|
"classifier-bayes.conf" = {
|
|
text = ''
|
|
autolearn {
|
|
spam_threshold = 6.0 # When to learn spam (score >= threshold)
|
|
ham_threshold = -2.0 # When to learn ham (score <= threshold)
|
|
}
|
|
'';
|
|
};
|
|
"milter_headers.conf" = {
|
|
text = ''
|
|
# Add headers related to spam-detection
|
|
extended_spam_headers = true;
|
|
'';
|
|
};
|
|
"redis.conf" = {
|
|
text = ''
|
|
servers = "${redisCfg.unixSocket}";
|
|
'';
|
|
};
|
|
};
|
|
|
|
workers = {
|
|
rspamd_proxy = {
|
|
bindSockets = ["systemd:rspamd-proxy.socket"];
|
|
count = 1; # Do not spawn too many processes of this type
|
|
extraConfig = ''
|
|
milter = yes; # Enable milter mode
|
|
timeout = 120s; # Needed for Milter usually
|
|
|
|
upstream "local" {
|
|
default = yes; # Self-scan upstreams are always default
|
|
self_scan = yes; # Enable self-scan
|
|
}
|
|
'';
|
|
};
|
|
|
|
controller = {
|
|
count = 1;
|
|
bindSockets = ["systemd:rspamd-controller.socket"];
|
|
extraConfig = ''
|
|
static_dir = "''${WWWDIR}"; # Serve the web UI static assets
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.sockets = {
|
|
rspamd-proxy = genSystemdSocketCfg "proxy" rspamdProxySocket postfixCfg.user;
|
|
rspamd-controller = genSystemdSocketCfg "controller" rspamdControllerSocket "";
|
|
};
|
|
|
|
systemd.services.rspamd = {
|
|
requires = ["redis-rspamd.service"];
|
|
after = ["redis-rspamd.service"];
|
|
};
|
|
};
|
|
}
|