71 lines
2.1 KiB
Nix
71 lines
2.1 KiB
Nix
|
{ config, lib, ... }:
|
|||
|
|
let
|
|||
|
|
cfg = config.sbruder.mailserver;
|
|||
|
|
in
|
|||
|
|
{
|
|||
|
|
options.sbruder.mailserver.spam = {
|
|||
|
|
enable = (lib.mkEnableOption "spam filtering") // { default = true; };
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
config = lib.mkIf (cfg.enable && cfg.spam.enable) {
|
|||
|
|
sops.secrets.rspamd-worker-controller = {
|
|||
|
|
owner = config.users.users.rspamd.name;
|
|||
|
|
sopsFile = ../../machines + "/${config.networking.hostName}/secrets.yaml";
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
services.rspamd = {
|
|||
|
|
enable = true;
|
|||
|
|
postfix.enable = true;
|
|||
|
|
workers = {
|
|||
|
|
normal = {
|
|||
|
|
includes = [ "$CONFDIR/worker-normal.inc" ];
|
|||
|
|
bindSockets = lib.singleton {
|
|||
|
|
socket = "/run/rspamd/rspamd.sock";
|
|||
|
|
mode = "0660";
|
|||
|
|
owner = "${config.services.rspamd.user}";
|
|||
|
|
group = "${config.services.rspamd.group}";
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
controller = {
|
|||
|
|
includes = [ "$CONFDIR/worker-controller.inc" ];
|
|||
|
|
bindSockets = [ "127.0.0.1:11334" ] ++ lib.optional config.sbruder.wireguard.home.enable "${config.sbruder.wireguard.home.address}:11334";
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
locals = {
|
|||
|
|
"dkim_signing.conf".text = ''
|
|||
|
|
enabled = false;
|
|||
|
|
'';
|
|||
|
|
"logging.inc".text = ''
|
|||
|
|
# starts at info, drops to notice once started up
|
|||
|
|
level = "silent";
|
|||
|
|
'';
|
|||
|
|
"milter_headers.conf".text = ''
|
|||
|
|
extended_spam_headers = true;
|
|||
|
|
'';
|
|||
|
|
"multimap.conf".text = ''
|
|||
|
|
SENDER_DOMAIN_BLOCKED {
|
|||
|
|
type = "from";
|
|||
|
|
filter = "email:domain:tld";
|
|||
|
|
map = "/var/lib/rspamd/blocked_sender_domains.map";
|
|||
|
|
symbol = "SENDER_DOMAIN_BLOCKED";
|
|||
|
|
description = "Sender’s effective second level domain is manually blocked";
|
|||
|
|
score = 8.0;
|
|||
|
|
}
|
|||
|
|
'';
|
|||
|
|
"redis.conf".text = ''
|
|||
|
|
servers = "127.0.0.1:${toString config.services.redis.servers.rspamd.port}"
|
|||
|
|
'';
|
|||
|
|
"worker-controller.inc".source = config.sops.secrets.rspamd-worker-controller.path; # includes password
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
services.redis = {
|
|||
|
|
vmOverCommit = true;
|
|||
|
|
servers.rspamd = {
|
|||
|
|
enable = true;
|
|||
|
|
port = 6379;
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
}
|