Fachschaft/nixConfig
6
2
Fork 2
Code Issues 10 Pull requests 2 Projects Wiki Activity

Fix DKIM config #66

Merged
Gonne merged 1 commit from Gonne/nixConfig:nyarlathotep into main 2025-03-26 13:47:26 +00:00
Conversation 2 Commits 1 Files changed 1 +3 -3
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nixos/modules/mail.nix
View file

@ -240,7 +240,7 @@ in {
private-key = "%{file:/run/secrets/dkim_rsa}%"; private-key = "%{file:/run/secrets/dkim_rsa}%";
domain = "${domain}"; domain = "${domain}";
selector = "rsa-default"; selector = "rsa-default";
headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "User-Agent" "Thread-Topic" "Thread-Index"]; # default from https://stalw.art/docs/smtp/authentication/dkim/sign#signatures headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "Thread-Topic" "Thread-Index"]; # default from https://stalw.art/docs/smtp/authentication/dkim/sign#signatures except "User-Agent" which somehow breaks
algorithm = "rsa-sha256"; algorithm = "rsa-sha256";
nerf commented 2025-03-26 13:32:58 +00:00
Outdated
Copy link

This is a strange header, it is technically not a mail header but a netnews header, which is a different format
for Internet Messages. See IANA and thus only defined in RFC 5536 3.2.13. So think it should not occur in Mail, but maybe in Messages we have to forward. (For example someone joins a newsgroup with a mathebau address). This Message format comes with it complete own set of Headers (that has some overlap with mail), but which we usually don't care to sign, like the Newsgroups header, or the Injection-Info header.

So if we agree to not care for netnews and generally only sign netnews headers if they are incidentally mail header, we should not sign User-Agent anyway.

This is a strange header, it is technically not a mail header but a netnews header, which is a different format for Internet Messages. See [IANA](https://www.iana.org/assignments/message-headers/message-headers.xhtml) and thus only defined in [RFC 5536 3.2.13](https://www.rfc-editor.org/rfc/rfc5536.html#section-3.2.13). So think it should not occur in Mail, but maybe in Messages we have to forward. (For example someone joins a newsgroup with a mathebau address). This Message format comes with it complete own set of Headers (that has some overlap with mail), but which we usually don't care to sign, like the `Newsgroups` header, or the `Injection-Info` header. So if we agree to not care for netnews and generally only sign netnews headers if they are incidentally mail header, we should not sign `User-Agent` anyway.
canonicalization = "relaxed/relaxed"; canonicalization = "relaxed/relaxed";
}; };
@ -248,13 +248,13 @@ in {
private-key = "%{file:/run/secrets/dkim_ed25519}%"; private-key = "%{file:/run/secrets/dkim_ed25519}%";
domain = "${domain}"; domain = "${domain}";
selector = "ed-default"; selector = "ed-default";
headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "User-Agent" "Thread-Topic" "Thread-Index"]; headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "Thread-Topic" "Thread-Index"]; # default from https://stalw.art/docs/smtp/authentication/dkim/sign#signatures except "User-Agent" which somehow breaks
algorithm = "ed25519-sha256"; algorithm = "ed25519-sha256";
canonicalization = "relaxed/relaxed"; canonicalization = "relaxed/relaxed";
}; };
}; };
in in
map signatureTemplate (["lists.mathebau.de"] ++ (map ({domain, ...}: domain) cfg.domains)); lib.attrsets.mergeAttrsList (map signatureTemplate (["lists.mathebau.de"] ++ (map ({domain, ...}: domain) cfg.domains)));
authentication.fallback-admin = { authentication.fallback-admin = {
user = "admin"; user = "admin";