blob: fcbd9390ca72653433b3695ae2a10dbe817abcad (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
{ config, pkgs, lib, ... }:
with lib;
let
cfg = config.services.postfix-mta-sts-resolver;
in {
options = {
services.postfix-mta-sts-resolver = {
enable = mkEnableOption "mta-sts-daemon";
package = mkPackageOption pkgs "postfix-mta-sts-resolver";
redis = mkEnableOption "redis cache" // { default = true; example = false; };
proactive-policy-fetching = mkEnableOption "proactive policy fetching" // { default = true; example = false; };
loglevel = mkOption {
type = types.enum ["debug" "info" "warn" "error" "fatal"];
default = "info";
};
settings = mkOption {
type = types.attrs;
};
};
};
config = mkIf cfg.enable {
services.postfix-mta-sts-resolver.settings = {
path = "/run/postfix-mta-sts-resolver/map.sock";
mode = 432; # 0o0660
} // (optionalAttrs cfg.redis {
cache = {
type = "redis";
options.url = "unix://${toString config.services.redis.servers.postfix-mta-sts-resolver.unixSocket}";
};
})
// (optionalAttrs cfg.proactive-policy-fetching {
proactive_policy_fetching.enabled = true;
});
services.redis.servers.postfix-mta-sts-resolver = mkIf cfg.redis {
enable = true;
};
users.users.postfix-mta-sts-resolver = {
isSystemUser = true;
group = "postfix-mta-sts-resolver";
};
users.groups.postfix-mta-sts-resolver = {
members = ["postfix"];
};
systemd.services."postfix-mta-sts-resolver" = {
wantedBy = ["postfix.service"];
before = ["postfix.service"];
wants = mkIf cfg.redis [ "redis-postfix-mta-sts-resolver.service" ];
after = mkIf cfg.redis [ "redis-postfix-mta-sts-resolver.service" ];
serviceConfig = {
Type = "notify";
ExecStart = "${pkgs.postfix-mta-sts-resolver}/bin/mta-sts-daemon -v ${cfg.loglevel} -c ${pkgs.writeText "mta-sts-daemon.yml" (generators.toYAML {} cfg.settings)}";
Restart = "always";
KillMode = "process";
TimeoutStartSec = 10;
TimeoutStopSec = 30;
RuntimeDirectory = "postfix-mta-sts-resolver";
User = "postfix-mta-sts-resolver";
Group = "postfix-mta-sts-resolver";
SupplementaryGroups = mkIf cfg.redis config.services.redis.servers.postfix-mta-sts-resolver.user;
RemoveIPC = true;
PrivateTmp = true;
NoNewPrivileges = true;
RestrictSUIDSGID = true;
ProtectSystem = "strict";
ProtectHome = "read-only";
ReadWritePaths = mkIf cfg.redis ["/run/redis-postfix-mta-sts-resolver"];
};
};
};
}
|
