stockholm/krebs/3modules/exim-retiolum.nix

160 lines
4.3 KiB
Nix
Raw Normal View History

2015-08-13 09:46:09 +00:00
{ config, pkgs, lib, ... }:
2016-02-14 15:43:44 +00:00
with config.krebs.lib;
2015-08-13 09:46:09 +00:00
let
cfg = config.krebs.exim-retiolum;
out = {
options.krebs.exim-retiolum = api;
2016-02-14 15:43:44 +00:00
config = lib.mkIf cfg.enable imp;
2015-08-13 09:46:09 +00:00
};
api = {
enable = mkEnableOption "krebs.exim-retiolum";
2016-02-21 20:51:11 +00:00
local_domains = mkOption {
type = with types; listOf hostname;
default = ["localhost"] ++ config.krebs.build.host.nets.retiolum.aliases;
};
primary_hostname = mkOption {
type = types.str;
default = let x = "${config.krebs.build.host.name}.r"; in
assert elem x config.krebs.build.host.nets.retiolum.aliases;
x;
};
relay_to_domains = mkOption {
# TODO hostname with wildcards
type = with types; listOf str;
default = [
"*.r"
"*.retiolum"
];
};
2015-08-13 09:46:09 +00:00
};
imp = {
krebs.exim = {
enable = true;
config =
# This configuration makes only sense for retiolum-enabled hosts.
# TODO modular configuration
assert (lib.hasAttr "retiolum" config.krebs.tinc);
''
keep_environment =
2016-02-21 20:51:11 +00:00
primary_hostname = ${cfg.primary_hostname}
domainlist local_domains = ${concatStringsSep ":" cfg.local_domains}
domainlist relay_to_domains = ${concatStringsSep ":" cfg.relay_to_domains}
hostlist relay_from_hosts = <; 127.0.0.1 ; ::1
2015-08-13 09:46:09 +00:00
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
2015-08-13 09:46:09 +00:00
host_lookup = *
rfc1413_hosts = *
rfc1413_query_timeout = 5s
2015-08-13 09:46:09 +00:00
log_file_path = syslog
syslog_timestamp = false
syslog_duplication = false
2015-08-13 09:46:09 +00:00
2016-05-24 18:58:19 +00:00
tls_advertise_hosts =
begin acl
2015-08-13 09:46:09 +00:00
acl_check_rcpt:
accept hosts = :
control = dkim_disable_verify
2015-08-13 09:46:09 +00:00
deny message = Restricted characters in address
domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]
2015-08-13 09:46:09 +00:00
deny message = Restricted characters in address
domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
2015-08-13 09:46:09 +00:00
accept local_parts = postmaster
domains = +local_domains
2015-08-13 09:46:09 +00:00
#accept
# hosts = *.retiolum
# domains = *.retiolum
# control = dkim_disable_verify
2015-08-13 09:46:09 +00:00
#require verify = sender
2015-08-13 09:46:09 +00:00
accept hosts = +relay_from_hosts
control = submission
control = dkim_disable_verify
2015-08-13 09:46:09 +00:00
accept authenticated = *
control = submission
control = dkim_disable_verify
2015-08-13 09:46:09 +00:00
require message = relay not permitted
domains = +local_domains : +relay_to_domains
2015-08-13 09:46:09 +00:00
require verify = recipient
2015-08-13 09:46:09 +00:00
accept
2015-08-13 09:46:09 +00:00
acl_check_data:
accept
2015-08-13 09:46:09 +00:00
begin routers
2015-08-13 09:46:09 +00:00
retiolum:
driver = manualroute
2016-02-21 20:51:11 +00:00
domains = ! +local_domains : +relay_to_domains
transport = remote_smtp
route_list = ^.* $0 byname
no_more
2015-08-13 09:46:09 +00:00
nonlocal:
debug_print = "R: nonlocal for $local_part@$domain"
driver = redirect
domains = ! +local_domains
allow_fail
data = :fail: Mailing to remote domains not supported
no_more
2015-08-13 09:46:09 +00:00
local_user:
# debug_print = "R: local_user for $local_part@$domain"
driver = accept
check_local_user
# local_part_suffix = +* : -*
# local_part_suffix_optional
transport = home_maildir
cannot_route_message = Unknown user
2015-08-13 09:46:09 +00:00
begin transports
2015-08-13 09:46:09 +00:00
remote_smtp:
driver = smtp
2015-08-13 09:46:09 +00:00
home_maildir:
driver = appendfile
maildir_format
directory = $home/Maildir
directory_mode = 0700
delivery_date_add
envelope_to_add
return_path_add
# group = mail
# mode = 0660
2015-08-13 09:46:09 +00:00
begin retry
2016-02-21 20:51:11 +00:00
${concatMapStringsSep "\n" (k: "${k} * F,42d,1m") cfg.relay_to_domains}
* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
2015-08-13 09:46:09 +00:00
begin rewrite
2015-08-13 09:46:09 +00:00
begin authenticators
'';
};
2015-08-13 09:46:09 +00:00
};
2016-02-21 20:51:11 +00:00
in out