1 files changed, 76 insertions, 14 deletions

diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index 404e9e4b..947aa328 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -21,6 +21,8 @@ let
   };
 
   spmDomains = ["bouncy.email"];
+
+  spm = pkgs.callPackage ./spm {};
 in {
   config = {
     nixpkgs.overlays = [
@@ -115,6 +117,8 @@ in {
           "reject_unknown_recipient_domain"
           "reject_unverified_recipient"
         ];
+        unverified_recipient_reject_code = "550";
+        unverified_recipient_reject_reason = "Recipient address rejected: undeliverable address";
 
         smtpd_relay_restrictions = [
           "permit_mynetworks"
@@ -177,6 +181,9 @@ in {
             "-o" "smtpd_tls_req_ccert=yes"
             "-o" "smtpd_client_restrictions=permit_tls_all_clientcerts,reject"
             "-o" "smtpd_relay_restrictions=permit_tls_all_clientcerts,reject"
+            "-o" "smtpd_sender_restrictions=reject_unknown_sender_domain,reject_unverified_sender"
+            "-o" "unverified_sender_reject_code=550"
+            "-o" "unverified_sender_reject_reason={Sender address rejected: undeliverable address}"
             "-o" "smtpd_recipient_restrictions=reject_unauth_pipelining,reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_tls_all_clientcerts,reject"
             "-o" "milter_macro_daemon_name=surtr.yggdrasil.li"
             "-o" ''smtpd_milters=${config.services.opendkim.socket}''
@@ -600,24 +607,79 @@ in {
       };
     };
 
-    services.nginx.virtualHosts = listToAttrs (map (domain: nameValuePair "spm.${domain}" {
-      forceSSL = true;
-      sslCertificate = "/run/credentials/nginx.service/spm.${domain}.pem";
-      sslCertificateKey = "/run/credentials/nginx.service/spm.${domain}.key.pem";
-      extraConfig = ''
-        ssl_stapling off;
-        ssl_verify_client on;
-        ssl_client_certificate ${toString ./ca/ca.crt};
-      '';
-      locations."/".extraConfig = ''
-        default_type text/plain;
-        return 200 "$ssl_client_verify $ssl_client_s_dn ${domain}";
-      '';
-    }) spmDomains);
+    services.nginx = {
+      upstreams.spm = {
+        servers = {
+          "unix:/run/spm/server.sock" = {};
+        };
+      };
+
+      virtualHosts = listToAttrs (map (domain: nameValuePair "spm.${domain}" {
+        forceSSL = true;
+        sslCertificate = "/run/credentials/nginx.service/spm.${domain}.pem";
+        sslCertificateKey = "/run/credentials/nginx.service/spm.${domain}.key.pem";
+        extraConfig = ''
+          ssl_stapling off;
+          ssl_verify_client on;
+          ssl_client_certificate ${toString ./ca/ca.crt};
+        '';
+        locations."/" = {
+          proxyPass = "http://spm";
+
+          extraConfig = ''
+            proxy_set_header SSL-CLIENT-VERIFY $ssl_client_verify;
+            proxy_set_header SSL-CLIENT-S-DN $ssl_client_s_dn;
+            proxy_set_header SPM-DOMAIN "${domain}";
+          '';
+        };
+      }) spmDomains);
+    };
 
     systemd.services.nginx.serviceConfig.LoadCredential = concatMap (domain: [
       "spm.${domain}.key.pem:${config.security.acme.certs."spm.${domain}".directory}/key.pem"
       "spm.${domain}.pem:${config.security.acme.certs."spm.${domain}".directory}/fullchain.pem"
     ]) spmDomains;
+
+    systemd.services.spm = {
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = "${spm}/bin/spm-server";
+        User = "spm";
+        Group = "spm";
+
+        Environment = [
+          "SPM_INSTANCE=ed1c0e1d-7be4-4dd5-b51a-291bad3ac9c9"
+          "PGCONNSTR=dbname=email"
+        ];
+
+        LoadCredential = [
+          "spm-keys.json:${config.sops.secrets."spm-keys.json".path}"
+        ];
+      };
+    };
+    systemd.sockets.spm = {
+      wantedBy = [ "nginx.service" ];
+      
+      socketConfig = {
+        ListenStream = "/run/spm/server.sock";
+        SocketUser = "spm";
+        SocketGroup = "spm";
+        SocketMode = 0660;
+      };
+    };
+
+    users.users.spm = {
+      isSystemUser = true;
+      group = "spm";
+    };
+
+    users.groups.spm = {
+      members = [ config.services.nginx.user ];
+    };
+
+    sops.secrets."spm-keys.json" = {
+      format = "binary";
+      sopsFile = ./spm-keys.json;
+    };
   };
 }