Merge pull request #21866 from pjones/pjones/rmilter

rmilter: Fix a couple of bugs

nixos/doc/manual/release-notes/rl-1703.xml

@@ -237,6 +237,18 @@ following incompatible changes:</para>
     </para>
   </listitem>
 
+  <listitem>
+    <para>
+      The socket handling of the <literal>services.rmilter</literal> module
+      has been fixed and refactored. As rmilter doesn't support binding to
+      more than one socket, the options <literal>bindUnixSockets</literal>
+      and <literal>bindInetSockets</literal> have been replaced by
+      <literal>services.rmilter.bindSocket.*</literal>. The default is still
+      a unix socket in <literal>/run/rmilter/rmilter.sock</literal>. Refer to
+      the options documentation for more information.
+    </para>
+  </listitem>
+
 </itemizedlist>
 
 

nixos/modules/rename.nix

@@ -35,6 +35,9 @@ with lib;
     (mkRemovedOptionModule [ "security" "setuidOwners" ] "Use security.wrappers instead")
     (mkRemovedOptionModule [ "security" "setuidPrograms" ] "Use security.wrappers instead")
 
+    (mkRemovedOptionModule [ "services" "rmilter" "bindInetSockets" ] "Use services.rmilter.bindSocket.* instead")
+    (mkRemovedOptionModule [ "services" "rmilter" "bindUnixSockets" ] "Use services.rmilter.bindSocket.* instead")
+
     # Old Grub-related options.
     (mkRenamedOptionModule [ "boot" "initrd" "extraKernelModules" ] [ "boot" "initrd" "kernelModules" ])
     (mkRenamedOptionModule [ "boot" "extraKernelParams" ] [ "boot" "kernelParams" ])

nixos/modules/services/mail/rmilter.nix

@@ -5,20 +5,23 @@ with lib;
 let
 
   rspamdCfg = config.services.rspamd;
+  postfixCfg = config.services.postfix;
   cfg = config.services.rmilter;
 
-  inetSockets = map (sock: let s = stringSplit ":" sock; in "inet:${last s}:${head s}") cfg.bindInetSockets;
+  inetSocket = addr: port: "inet:[${toString port}@${addr}]";
-  unixSockets = map (sock: "unix:${sock}") cfg.bindUnixSockets;
+  unixSocket = sock: "unix:${sock}";
 
-  allSockets = unixSockets ++ inetSockets;
+  systemdSocket = if cfg.bindSocket.type == "unix" then cfg.bindSocket.path
+    else "${cfg.bindSocket.address}:${toString cfg.bindSocket.port}";
+  rmilterSocket = if cfg.bindSocket.type == "unix" then unixSocket cfg.bindSocket.path
+    else inetSocket cfg.bindSocket.address cfg.bindSocket.port;
 
   rmilterConf = ''
-pidfile = /run/rmilter/rmilter.pid;
+    pidfile = /run/rmilter/rmilter.pid;
-bind_socket = ${if cfg.socketActivation then "fd:3" else concatStringsSep ", " allSockets};
+    bind_socket = ${if cfg.socketActivation then "fd:3" else rmilterSocket};
-tempdir = /tmp;
+    tempdir = /tmp;
-
   '' + (with cfg.rspamd; if enable then ''
-spamd {
+    spamd {
       servers = ${concatStringsSep ", " servers};
       connect_timeout = 1s;
       results_timeout = 20s;
@@ -32,7 +35,7 @@ spamd {
       # Default: "default"
       rspamd_metric = "default";
       ${extraConfig}
-};
+    };
   '' else "") + cfg.extraConfig;
 
   rmilterConfigFile = pkgs.writeText "rmilter.conf" rmilterConf;
@@ -48,11 +51,13 @@ in
     services.rmilter = {
 
       enable = mkOption {
+        type = types.bool;
         default = cfg.rspamd.enable;
         description = "Whether to run the rmilter daemon.";
       };
 
       debug = mkOption {
+        type = types.bool;
         default = false;
         description = "Whether to run the rmilter daemon in debug mode.";
       };
@@ -73,25 +78,37 @@ in
         '';
        };
 
-      bindUnixSockets =  mkOption {
+      bindSocket.type = mkOption {
-        type = types.listOf types.str;
+        type = types.enum [ "unix" "inet" ];
-        default = ["/run/rmilter/rmilter.sock"];
+        default = "unix";
         description = ''
-          Unix domain sockets to listen for MTA requests.
+          What kind of socket rmilter should listen on. Either "unix"
-        '';
+          for an Unix domain socket or "inet" for a TCP socket.
-        example = ''
-            [ "/run/rmilter.sock"]
         '';
       };
 
-      bindInetSockets = mkOption {
+      bindSocket.path = mkOption {
-        type = types.listOf types.str;
+       type = types.str;
-        default = [];
+       default = "/run/rmilter/rmilter.sock";
        description = ''
-          Inet addresses to listen (in format accepted by systemd.socket)
+          Path to Unix domain socket to listen on.
         '';
-        example = ''
+      };
-            ["127.0.0.1:11990"]
+
+      bindSocket.address = mkOption {
+        type = types.str;
+        default = "::1";
+        example = "0.0.0.0";
+        description = ''
+          Inet address to listen on.
+        '';
+      };
+
+      bindSocket.port = mkOption {
+        type = types.int;
+        default = 11990;
+        description = ''
+          Inet port to listen on.
         '';
       };
 
@@ -100,14 +117,16 @@ in
         default = true;
         description = ''
           Enable systemd socket activation for rmilter.
-          (disabling socket activation not recommended
+
-          when unix socket used, and follow to wrong
+          Disabling socket activation is not recommended when a Unix
-          permissions on unix domain socket.)
+          domain socket is used and could lead to incorrect
+          permissions.
         '';
       };
 
       rspamd = {
         enable = mkOption {
+          type = types.bool;
           default = rspamdCfg.enable;
           description = "Whether to use rspamd to filter mails";
         };
@@ -157,13 +176,9 @@ in
           type = types.str;
           description = "Addon to postfix configuration";
           default = ''
-smtpd_milters = ${head allSockets}
+            smtpd_milters = ${rmilterSocket}
-# or for TCP socket
+            milter_protocol = 6
-# # smtpd_milters = inet:localhost:9900
+            milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
-milter_protocol = 6
-milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
-# skip mail without checks if milter will die
-milter_default_action = accept
           '';
         };
       };
@@ -175,11 +190,13 @@ milter_default_action = accept
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = mkMerge [
+
+    (mkIf cfg.enable {
 
       users.extraUsers = singleton {
         name = cfg.user;
-      description = "rspamd daemon";
+        description = "rmilter daemon";
         uid = config.ids.uids.rmilter;
         group = cfg.group;
       };
@@ -203,7 +220,7 @@ milter_default_action = accept
           PermissionsStartOnly = true;
           Restart = "always";
           RuntimeDirectory = "rmilter";
-        RuntimeDirectoryMode = "0755";
+          RuntimeDirectoryMode = "0750";
         };
 
       };
@@ -212,15 +229,21 @@ milter_default_action = accept
         description = "Rmilter service socket";
         wantedBy = [ "sockets.target" ];
         socketConfig = {
-        ListenStream = cfg.bindUnixSockets ++ cfg.bindInetSockets;
+          ListenStream = systemdSocket;
           SocketUser = cfg.user;
           SocketGroup = cfg.group;
-        SocketMode = "0666";
+          SocketMode = "0660";
         };
       };
+    })
 
-    services.postfix.extraConfig = optionalString cfg.postfix.enable cfg.postfix.configFragment;
+    (mkIf (cfg.enable && cfg.rspamd.enable && rspamdCfg.enable) {
-    users.users.postfix.extraGroups = [ cfg.group ];
+      users.extraUsers.${cfg.user}.extraGroups = [ rspamdCfg.group ];
-  };
+    })
 
+    (mkIf (cfg.enable && cfg.postfix.enable) {
+      services.postfix.extraConfig = cfg.postfix.configFragment;
+      users.extraUsers.${postfixCfg.user}.extraGroups = [ cfg.group ];
+    })
+  ];
 }

nixos/modules/services/mail/rspamd.nix

@@ -53,8 +53,11 @@ in
       bindSocket = mkOption {
         type = types.listOf types.str;
         default = [
-          "/run/rspamd/rspamd.sock mode=0666 owner=${cfg.user}"
+          "/run/rspamd/rspamd.sock mode=0660 owner=${cfg.user} group=${cfg.group}"
         ];
+        defaultText = ''[
+          "/run/rspamd/rspamd.sock mode=0660 owner=${cfg.user} group=${cfg.group}"
+        ]'';
         description = ''
           List of sockets to listen, in format acceptable by rspamd
         '';