infra/non-critical-infra/modules/mailserver/default.nix at fe14527cb1dec78ef05b1852ad03e155060b7234 · NixOS/infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
{ config, pkgs, ... }:

let
  arc = {
    selector = "arc-2025";
  };
in

{
  imports = [
    ./mailing-lists.nix
    ./postsrsd.nix
  ];

  mailserver = {
    enable = true;
    certificateScheme = "acme-nginx";

    fqdn = config.networking.fqdn;

    domains = [ "nixos.org" ];
  };

  sops.secrets."nixos.org.mail.key" = {
    format = "binary";
    owner = "opendkim";
    group = "opendkim";
    mode = "0600";

    # How to generate:
    #
    # ```console
    # cd non-critical-infra
    # DOMAIN=nixos.org
    # SELECTOR=mail
    # PRIVATE_KEY_PATH=secrets/$DOMAIN.$SELECTOR.key.umbriel
    # nix shell nixpkgs#opendkim --command opendkim-genkey --selector="$SELECTOR" --domain="$DOMAIN" --bits=1024
    # mv mail.private "$PRIVATE_KEY_PATH"
    # sops encrypt --in-place "$PRIVATE_KEY_PATH"
    # ```
    #
    # Next, look at `mail.txt` and update DNS accordingly.
    sopsFile = ../../secrets/nixos.org.mail.key.umbriel;

    # Ensure the file gets symlinked to where Simple NixOS Mailserver expects
    # to find it.
    path = "${config.mailserver.dkimKeyDirectory}/nixos.org.mail.key";
  };

  sops.secrets."nixos.org.${arc.selector}.key" = {
    format = "binary";
    owner = "rspamd";
    group = "rpsamd";
    mode = "0400";
    # rspamadm dkim_keygen --selector arc-2025 --domain nixos.org --type rsa --bits 2048
    sopsFile = ../../secrets/nixos.org-${arc.selector}-private-key.umbriel;
    path = "/var/lib/rspamd/arc/nixos.org.${arc.selector}.key";
  };

  services.rspamd = {
    overrides."arc.conf".text = ''
      domain {
        nixos.org {
          selector = "${arc.selector}";
          allow_username_mismatch = true;
        }
      }
    '';
  };

  services.postfix.config.bounce_template_file = "${pkgs.writeText "bounce-template.cf" ''
    failure_template = <<EOF
    Charset: us-ascii
    From: MAILER-DAEMON (Mail Delivery System)
    Subject: Undelivered Mail Returned to Sender
    Postmaster-Subject: Postmaster Copy: Undelivered Mail

    This is the mail system at host $myhostname.

    I'm sorry to have to inform you that your message could not
    be delivered to one or more recipients. It's attached below.

    For further assistance, please file an issue at
    https://github.com/NixOS/infra/issues/new. Please anonymize any personal
    email addresses in your report.

    If you do so, please include this problem report. You can
    delete your own text from the attached returned message.

                  The mail system
    EOF

    delay_template = <<EOF
    Charset: us-ascii
    From: MAILER-DAEMON (Mail Delivery System)
    Subject: Delayed Mail (still being retried)
    Postmaster-Subject: Postmaster Warning: Delayed Mail

    This is the mail system at host $myhostname.

    ####################################################################
    # THIS IS A WARNING ONLY.  YOU DO NOT NEED TO RESEND YOUR MESSAGE. #
    ####################################################################

    Your message could not be delivered for more than $delay_warning_time_hours hour(s).
    It will be retried until it is $maximal_queue_lifetime_days day(s) old.

    For further assistance, please file an issue at
    https://github.com/NixOS/infra/issues/new. Please anonymize any personal
    email addresses in your report.

    If you do so, please include this problem report. You can
    delete your own text from the attached returned message.

                       The mail system
    EOF
  ''}";
}