mail-server: replace downstream srs implementation
Martin Weinelt committed
Nov 26, 2025 at 19:08 UTC
1b5ba8ad3dd30bf902b8d799304609550fa6ed71
2 files changed
+21
-40
non-critical-infra/modules/mailserver/default.nix
+21
-1
@@ -9,7 +9,6 @@
9
imports = [
10
inputs.simple-nixos-mailserver.nixosModule
11
./mailing-lists.nix
12
- ./postsrsd.nix
12
./freescout.nix
13
];
14
@@ -27,6 +26,8 @@
26
"nixcon.org"
27
"nixos.org"
28
];
29
+
30
+ srs.enable = true;
31
};
32
33
# https://nixos-mailserver.readthedocs.io/en/latest/backup-guide.html
@@ -114,4 +115,23 @@
115
The mail system
116
EOF
117
''}";
118
+
119
+ services.postsrsd.secretsFile = config.sops.secrets.postsrsd-secret.path;
120
+
121
+ # ```
122
+ # How to generate:
123
+ #
124
+ # ```console
125
+ # cd non-critical-infra
126
+ # SECRET_PATH=secrets/postsrsd-secret.umbriel
127
+ # dd if=/dev/random bs=18 count=1 status=none | base64 > "$SECRET_PATH"
128
+ # sops encrypt --in-place "$SECRET_PATH"
129
+ # ```
130
+ sops.secrets.postsrsd-secret = {
131
+ format = "binary";
132
+ owner = config.services.postsrsd.user;
133
+ group = config.services.postsrsd.group;
134
+ sopsFile = ../../secrets/postsrsd-secret.umbriel;
135
+ restartUnits = [ "postsrsd.service" ];
136
+ };
137
}
non-critical-infra/modules/mailserver/postsrsd.nix
deleted
-39
@@ -1,39 +0,0 @@
1
-{ config, ... }:
2
-# We use `postsrsd` to enable Sender Rewriting Scheme (SRS) so mail we forward
3
-# to another domain does not fail SPF. See
4
-# https://github.com/NixOS/infra/issues/485#issuecomment-2787490679 for
5
-# details.
6
-{
7
- services.postsrsd = {
8
- enable = true;
9
- domains = [ "nixos.org" ];
10
- secretsFile = config.sops.secrets.postsrsd-secret.path;
11
- };
12
-
13
- # Configure postfix as per
14
- # https://github.com/roehling/postsrsd?tab=readme-ov-file#postfix-setup
15
- services.postfix.config = {
16
- sender_canonical_maps = "socketmap:unix:${config.services.postsrsd.socketPath}:forward";
17
- sender_canonical_classes = "envelope_sender";
18
-
19
- recipient_canonical_maps = "socketmap:unix:${config.services.postsrsd.socketPath}:reverse";
20
- recipient_canonical_classes = "envelope_recipient, header_recipient";
21
- };
22
-
23
- # ```
24
- # How to generate:
25
- #
26
- # ```console
27
- # cd non-critical-infra
28
- # SECRET_PATH=secrets/postsrsd-secret.umbriel
29
- # dd if=/dev/random bs=18 count=1 status=none | base64 > "$SECRET_PATH"
30
- # sops encrypt --in-place "$SECRET_PATH"
31
- # ```
32
- sops.secrets.postsrsd-secret = {
33
- format = "binary";
34
- owner = config.services.postsrsd.user;
35
- group = config.services.postsrsd.group;
36
- sopsFile = ../../secrets/postsrsd-secret.umbriel;
37
- restartUnits = [ "postsrsd.service" ];
38
- };
39
-}