Fachschaft/nixConfig
6
2
Fork 2
Code Issues 10 Pull requests 2 Projects Wiki Activity

Compare commits

base: Fachschaft:d7f4598be3075f6a8b700db5fae6db6422b64bac
Branches Tags
Fachschaft:main
..
compare: Fachschaft:b3ac11ddc91d4536165ac321917615602887f9f4
Branches Tags
Fachschaft:main

4 commits
d7f4598be3 ... b3ac11ddc9

Author SHA1 Message Date
Gonne
b3ac11ddc9 Group config parameters 2025-03-02 14:05:28 +01:00
Gonne
654922c40a Enable DKIM signing 2025-03-02 14:03:36 +01:00
Gonne
a486d42e1c Filter out catch-all addresses of the form "@domain.tld" from the allowlist that are not intended for HRZ 2025-03-02 14:03:36 +01:00
Gonne
74e5df98b1 Set sender and increase redirect limit for our alias file 2025-03-02 14:03:32 +01:00
1 changed files with 15 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nixos/modules/mail.nix
View file

@ -113,7 +113,7 @@ in {
dkim.sign = [ dkim.sign = [
{ {
"if" = "is_local_domain('', sender_domain) || sender_domain == 'lists.mathebau.de'"; "if" = "is_local_domain('', sender_domain) || sender_domain == 'lists.mathebau.de'";
"then" = "['rsa_' + sender_domain, 'ed25519_' + sender_domain]"; "then" = "['rsa-' + sender_domain, 'ed25519-' + sender_domain]";
} }
{"else" = false;} {"else" = false;}
]; ];
@ -214,14 +214,14 @@ in {
++ ["sieve.trusted.*"]; #for macros to be able to include our redirection script ++ ["sieve.trusted.*"]; #for macros to be able to include our redirection script
sieve.trusted = { sieve.trusted = {
scripts.redirects.contents = "%{file:/tmp/virt_aliases}%"; # generated redirect script scripts.redirects.contents = "%{file:/tmp/virt_aliases}%"; # generated redirect script
from-addr = "sender"; # set the from-address to the original sender as specified in the MAIL FROM. trusted.from-addr = "sender"; # set the from-address to the original sender as specified in the MAIL FROM.
from-namo = "sender"; from-name = "sender";
return-path = "sender"; return-path = "sender";
# If we are the sender, we sign the message with DKIM. Else we leave it alone. # If we are the sender, we sign the message with DKIM. Else we leave it alone.
sign = [ sign = [
{ {
"if" = "is_local_domain('', sender_domain) || sender_domain == 'lists.mathebau.de'"; "if" = "is_local_domain('', sender_domain) || sender_domain == 'lists.mathebau.de'";
"then" = "['rsa_' + sender_domain, 'ed25519_' + sender_domain]"; "then" = "['rsa-' + sender_domain, 'ed25519-' + sender_domain]";
} }
{"else" = false;} {"else" = false;}
]; ];
@ -230,12 +230,11 @@ in {
out-messages = 50; out-messages = 50;
}; };
}; };
# See https://stalw.art/docs/smtp/authentication/dkim/sign # See https://stalw.art/docs/smtp/authentication/dkim/sign
# We need two blocks per domain because the domain setting in the blocks does not accept variables like `sender_domain`. # We need two blocks per domain because the domain setting in the blocks does not accept variables like `sender_domain`.
signature = let signature = let
signatureTemplate = domain: { signatureTemplate = domain: {
"rsa_${domain}" = { "rsa-${domain}" = {
private-key = "%{file:/run/secrets/dkim_rsa}%"; private-key = "%{file:/run/secrets/dkim_rsa}%";
domain = "${domain}"; domain = "${domain}";
selector = "rsa-default"; selector = "rsa-default";
@ -243,7 +242,7 @@ in {
algorithm = "rsa-sha256"; algorithm = "rsa-sha256";
canonicalization = "relaxed/relaxed"; canonicalization = "relaxed/relaxed";
}; };
"ed25519_${domain}" = { "ed25519-${domain}" = {
private-key = "%{file:/run/secrets/dkim_ed25519}%"; private-key = "%{file:/run/secrets/dkim_ed25519}%";
domain = "${domain}"; domain = "${domain}";
selector = "ed-default"; selector = "ed-default";
@ -255,6 +254,15 @@ in {
in in
map signatureTemplate (["lists.mathebau.de"] ++ (map ({domain, ...}: domain) cfg.domains)); map signatureTemplate (["lists.mathebau.de"] ++ (map ({domain, ...}: domain) cfg.domains));
# Sign *our* outgoing mails with the configured signatures.
auth.dkim.sign = [
{
"if" = "is_local_domain('', sender_domain) || sender_domain == 'lists.mathebau.de'";
"then" = "['rsa-' + sender_domain, 'ed25519-' + sender_domain]";
}
{"else" = false;}
];
authentication.fallback-admin = { authentication.fallback-admin = {
user = "admin"; user = "admin";
# see passwd on azathoth for plaintext or machine secret in encoded format for HTTP Basic AUTH # see passwd on azathoth for plaintext or machine secret in encoded format for HTTP Basic AUTH