| 1 | { config, pkgs, ... }: |
| 2 | |
| 3 | { |
| 4 | sops.secrets.opendkim-private-key = { |
| 5 | sopsFile = ../secrets/opendkim-private-key.caliban; |
| 6 | format = "binary"; |
| 7 | owner = config.services.postfix.user; |
| 8 | }; |
| 9 | services.opendkim = { |
| 10 | enable = true; |
| 11 | domains = config.networking.fqdn; |
| 12 | selector = "mail"; |
| 13 | inherit (config.services.postfix) user group; |
| 14 | keyPath = "/run/opendkim-keys"; |
| 15 | }; |
| 16 | |
| 17 | # Permitted as long as we're only signing and not validating |
| 18 | nixpkgs.config.permittedInsecurePackages = [ |
| 19 | "opendkim-2.11.0-Beta2" |
| 20 | ]; |
| 21 | |
| 22 | systemd.services.opendkim.serviceConfig = { |
| 23 | ExecStartPre = [ |
| 24 | "+${pkgs.writeShellScript "opendkim-keys" '' |
| 25 | install -o ${config.services.postfix.user} -g ${config.services.postfix.group} -D -m0700 ${config.sops.secrets.opendkim-private-key.path} /run/opendkim-keys/${config.services.opendkim.selector}.private |
| 26 | ''}" |
| 27 | ]; |
| 28 | }; |
| 29 | |
| 30 | services.postfix = { |
| 31 | enable = true; |
| 32 | settings.main = { |
| 33 | myhostname = config.networking.fqdn; |
| 34 | mydomain = config.networking.fqdn; |
| 35 | smtp_tls_note_starttls_offer = "yes"; |
| 36 | smtp_tls_security_level = "may"; |
| 37 | tls_medium_cipherlist = "AES128+EECDH:AES128+EDH"; |
| 38 | smtpd_relay_restrictions = "permit_mynetworks permit_sasl_authenticated defer_unauth_destination"; |
| 39 | mydestination = "localhost.$mydomain, localhost, $myhostname"; |
| 40 | myorigin = "$mydomain"; |
| 41 | milter_default_action = "accept"; |
| 42 | milter_protocol = "6"; |
| 43 | smtpd_milters = "unix:/run/opendkim/opendkim.sock"; |
| 44 | non_smtpd_milters = "unix:/run/opendkim/opendkim.sock"; |
| 45 | inet_interfaces = "loopback-only"; |
| 46 | inet_protocols = "all"; |
| 47 | }; |
| 48 | }; |
| 49 | |
| 50 | } |