modules/postfix-mta-sts-resolver.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

{ config, pkgs, lib, ... }:

with lib;

let
  cfg = config.services.postfix-mta-sts-resolver;
in {
  options = {
    services.postfix-mta-sts-resolver = {
      enable = mkEnableOption "mta-sts-daemon";
      package = mkPackageOption pkgs "postfix-mta-sts-resolver";

      redis = mkEnableOption "redis cache" // { default = true; example = false; };

      loglevel = mkOption {
        type = types.enum ["debug" "info" "warn" "error" "fatal"];
        default = "info";
      };

      settings = mkOption {
        type = types.attrs;
      };
    };
  };

  config = mkIf cfg.enable {
    services.postfix-mta-sts-resolver.settings = {
      path = "/run/postfix-mta-sts-resolver/map.sock";
      mode = 432; # 0o0660
    } // (optionalAttrs cfg.redis { cache.redis.url = "unix://${toString config.services.redis.servers.postfix-mta-sts-resolver.unixSocket}"; });

    services.redis.servers.postfix-mta-sts-resolver = mkIf cfg.redis {
      enable = true;
    };

    users.users.postfix-mta-sts-resolver = {
      isSystemUser = true;
      group = "postfix-mta-sts-resolver";
    };
    users.groups.postfix-mta-sts-resolver = {
      members = ["postfix"];
    };

    systemd.services."postfix-mta-sts-resolver" = {
      wantedBy = ["postfix.service"];
      before = ["postfix.service"];

      serviceConfig = {
        ExecStart = "${pkgs.postfix-mta-sts-resolver}/bin/mta-sts-daemon -v ${cfg.loglevel} -c ${pkgs.writeText "mta-sts-daemon.yml" (generators.toYAML {} cfg.settings)}";
        SupplementaryGroups = mkIf cfg.redis config.services.redis.servers.postfix-mta-sts-resolver.user;
        RuntimeDirectory = "postfix-mta-sts-resolver";

        User = "postfix-mta-sts-resolver";
        Group = "postfix-mta-sts-resolver";

        RemoveIPC = true;
        PrivateTmp = true;
        NoNewPrivileges = true;
        RestrictSUIDSGID = true;
        ProtectSystem = "strict";
        ProtectHome = "read-only";
        ReadWritePaths = mkIf cfg.redis ["/run/redis-postfix-mta-sts-resolver"];
      };
    };
  };
}