public
/
mail-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Submission wants strings, smtpd doesn't

This commit is contained in:
niten 2023-09-26 14:48:11 -07:00
parent e12515764d
commit 1ae9012454
1 changed files with 14 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
postfix.nix
View File

@ -232,10 +232,7 @@ in {
pcreFile = name: "pcre:/var/lib/postfix/conf/${name}"; pcreFile = name: "pcre:/var/lib/postfix/conf/${name}";
mappedFile = name: "hash:/var/lib/postfix/conf/${name}"; mappedFile = name: "hash:/var/lib/postfix/conf/${name}";
makeRestrictionsList = lst: sender-restrictions = [
concatStringsSep "\n" (map (line: " ${line}" lst));
sender-restrictions = ([
"check_sender_access ${mappedFile "reject_senders"}" "check_sender_access ${mappedFile "reject_senders"}"
"reject_sender_login_mismatch" "reject_sender_login_mismatch"
"reject_non_fqdn_sender" "reject_non_fqdn_sender"
@ -243,9 +240,9 @@ in {
"permit_mynetworks" "permit_mynetworks"
"permit_sasl_authenticated" "permit_sasl_authenticated"
] ++ (map (blacklist: "reject_rbl_client ${blacklist}") ] ++ (map (blacklist: "reject_rbl_client ${blacklist}")
cfg.blacklist.dns) ++ [ "reject" ]); cfg.blacklist.dns) ++ [ "reject" ];
relay-restrictions = ([ relay-restrictions = [
"reject_unauth_destination" "reject_unauth_destination"
"reject_unauth_pipelining" "reject_unauth_pipelining"
"reject_unauth_destination" "reject_unauth_destination"
@ -253,9 +250,9 @@ in {
"permit_mynetworks" "permit_mynetworks"
"permit_sasl_authenticated" "permit_sasl_authenticated"
] ++ (map (blacklist: "reject_rbl_client ${blacklist}") ] ++ (map (blacklist: "reject_rbl_client ${blacklist}")
cfg.blacklist.dns) ++ [ "reject" ]); cfg.blacklist.dns) ++ [ "reject" ];
recipient-restrictions = ([ recipient-restrictions = [
"check_sender_access ${mappedFile "reject_recipients"}" "check_sender_access ${mappedFile "reject_recipients"}"
"reject_unknown_sender_domain" "reject_unknown_sender_domain"
"reject_unknown_recipient_domain" "reject_unknown_recipient_domain"
@ -268,18 +265,18 @@ in {
"check_policy_service unix:private/policy-spf" "check_policy_service unix:private/policy-spf"
] ++ (map (blacklist: "reject_rbl_client ${blacklist}") ] ++ (map (blacklist: "reject_rbl_client ${blacklist}")
cfg.blacklist.dns) cfg.blacklist.dns)
++ [ "permit_mynetworks" "permit_sasl_authenticated" "reject" ]); ++ [ "permit_mynetworks" "permit_sasl_authenticated" "reject" ];
client-restrictions = client-restrictions =
[ "permit_sasl_authenticated" "permit_mynetworks" "reject" ]; [ "permit_sasl_authenticated" "permit_mynetworks" "reject" ];
helo-restrictions = ([ helo-restrictions = [
"permit_mynetworks" "permit_mynetworks"
"reject_invalid_hostname" "reject_invalid_hostname"
"reject_non_fqdn_helo_hostname" "reject_non_fqdn_helo_hostname"
"reject_unknown_helo_hostname" "reject_unknown_helo_hostname"
] ++ (map (blacklist: "reject_rbl_client ${blacklist}") ] ++ (map (blacklist: "reject_rbl_client ${blacklist}")
cfg.blacklist.dns) ++ [ "permit" ]); cfg.blacklist.dns) ++ [ "permit" ];
in { in {
enable = true; enable = true;
@ -436,16 +433,18 @@ in {
tls_random_source = "dev:/dev/urandom"; tls_random_source = "dev:/dev/urandom";
}; };
submissionOptions = { submissionOptions = let makeRestrictionsList = concatStringsSep ",";
in {
smtpd_tls_security_level = "encrypt"; smtpd_tls_security_level = "encrypt";
smtpd_sasl_auth_enable = "yes"; smtpd_sasl_auth_enable = "yes";
smtpd_sasl_type = "dovecot"; smtpd_sasl_type = "dovecot";
smtpd_sasl_path = "/run/dovecot2/auth"; smtpd_sasl_path = "/run/dovecot2/auth";
smtpd_sasl_security_options = "noanonymous"; smtpd_sasl_security_options = "noanonymous";
smtpd_sasl_local_domain = cfg.domain; smtpd_sasl_local_domain = cfg.domain;
smtpd_client_restrictions = client-restrictions; smtpd_client_restrictions = makeRestrictionsList client-restrictions;
smtpd_sender_restrictions = sender-restrictions; smtpd_sender_restrictions = makeRestrictionsList sender-restrictions;
smtpd_recipient_restrictions = recipient-restrictions; smtpd_recipient_restrictions =
makeRestrictionsList recipient-restrictions;
cleanup_service_name = "submission-header-cleanup"; cleanup_service_name = "submission-header-cleanup";
}; };