rspamd_proxy from ymir on yggdrasil

1 files changed, 28 insertions, 1 deletions

diff --git a/ymir.nix b/ymir.nix
index 417850f2..dc759c51 100644
--- a/ymir.nix
+++ b/ymir.nix
@@ -195,6 +195,10 @@ in rec {
                              ];
       allowedUDPPortRanges = [ { from = 60000; to = 61000; } # mosh
                              ];
+
+      interfaces.yggdrasil.allowedTCPPorts =
+        [ 11332 # rspamd
+        ];
     };
     enableIPv6 = true;
     interfaces."ens3" = {
@@ -1084,7 +1088,8 @@ in rec {
     enable = true;
     workers = {
       controller = {};
-      rspamd_proxy = {
+      external = {
+        type = "rspamd_proxy";
         bindSockets = [
           { mode = "0660";
             socket = "/var/lib/postfix/queue/private/rspamd";
@@ -1099,6 +1104,19 @@ in rec {
           }
         '';
       };
+      internal = {
+        type = "rspamd_proxy";
+        bindSockets = [
+          "ymir.niflheim.yggdrasil:11332"
+        ];
+        extraConfig = ''
+          upstream "local" {
+            default = yes;
+            self_scan = yes;
+            id = "internal";
+          }
+        '';
+      };
     };
     locals = {
       "milter_headers.conf".text = ''
@@ -1149,6 +1167,15 @@ in rec {
             spam = true;
         }
       '';
+      "settings.conf".text = ''
+        internal {
+          apply {
+            actions {
+              add_header = 10;
+            }
+          }
+        }
+      '';
     };
   };