nix/machines
1
0
Fork 0
Code Issues Releases Packages Activity Actions

Attempt to unify mailserver setup
Some checks failed
/ dev-shell (push) Successful in 1m14s
Details
/ rust-packages (push) Successful in 4m16s
Details
/ check (push) Failing after 8m22s
Details
/ terraform-providers (push) Successful in 8m47s
Details
/ systems (push) Successful in 30m22s
Details

Browse source 
Committing here as I want to try to use another
mailserver instead.
This commit is contained in:
Kaare Hoff Skovgaard 2025-07-26 11:22:07 +02:00
parent 32e827f82c
commit 3d81e585db
Signed by: khs
GPG key ID: C7D890804F01E9F0
11 changed files with 503 additions and 243 deletions
Download patch file Download diff file Expand all files Collapse all files

198
nix/modules/nixos/infrastructure/mailserver/dkim.nix Normal file
View file

@ -0,0 +1,198 @@
{
pkgs,
lib,
config,
...
}:
let
cfg = config.khscodes.infrastructure.mailserver;
publicKeyBegin = ''"-----BEGIN PUBLIC KEY-----\n"'';
publicKeyEnd = ''"-----END PUBLIC KEY-----\n"'';
rsaKeyPath = domain: "/run/secret/dkim/${domain}.snm_rsa.key";
ed25519KeyPath = domain: "/run/secret/dkim/${domain}.snm_ed25519.key";
domainKeyPaths = lib.lists.flatten (
lib.lists.map (domain: [
(rsaKeyPath domain)
(ed25519KeyPath domain)
]) cfg.domains
);
# Currently (2025-07-25) I canot get rspamd to sign with ed25519 key,
# it appears it attempts to parse it as an RSA key
# {
# path: "${ed25519KeyPath domain}";
# selector: "snm_ed25519";
# }
dkimSigningForDomain = domain: ''
${domain} {
selectors [
{
path: "${rsaKeyPath domain}";
selector: "snm_rsa";
}
]
}
'';
dkimPublicKey =
tls_key:
''''${ replace(trimprefix(trimsuffix(${tls_key}.public_key_pem, ${publicKeyEnd}), ${publicKeyBegin}), "\n", "") }'';
in
{
options.khscodes.infrastructure.mailserver.dkim = {
vault = {
mount = lib.mkOption {
type = lib.types.str;
};
mountExpr = lib.mkOption {
type = lib.types.str;
default = "\${ vault_mount.${lib.khscodes.sanitize-terraform-name cfg.dkim.vault.mount}.path }";
};
prefixPath = lib.mkOption {
type = lib.types.str;
};
};
};
config = lib.mkIf (cfg.enable) {
mailserver = {
dkimSigning = false;
};
services.rspamd.locals."dkim_signing.conf" = lib.mkForce {
text = ''
enabled = true;
domain {
${lib.strings.concatStringsSep "\n " (lib.lists.map dkimSigningForDomain cfg.domains)}
}
'';
};
systemd.services.rspamd = {
unitConfig = {
ConditionPathExists = domainKeyPaths;
};
};
systemd.services.postfix = {
unitConfig = {
ConditionPathExists = domainKeyPaths;
};
};
khscodes.infrastructure.vault-server-approle.policy = {
"${cfg.dkim.vault.mount}/data/${cfg.dkim.vault.prefixPath}/*" = {
capabilities = [ "read" ];
};
};
khscodes.infrastructure.provisioning.pre.modules = [
(
{ config, ... }:
{
terraform.required_providers.tls = {
source = "hashicorp/tls";
version = "4.1.0";
};
provider.tls = { };
khscodes.cloudflare.enable = true;
resource.tls_private_key =
(lib.listToAttrs (
lib.lists.map (domain: {
name = "${lib.khscodes.sanitize-terraform-name domain}_dkim_rsa";
value = {
algorithm = "RSA";
rsa_bits = 2048;
};
}) cfg.domains
))
// (lib.listToAttrs (
lib.lists.map (domain: {
name = "${lib.khscodes.sanitize-terraform-name domain}_dkim_ed25519";
value = {
algorithm = "ED25519";
};
}) cfg.domains
));
khscodes.cloudflare.dns.txtRecords =
(lib.lists.map (domain: {
fqdn = "snm_rsa._domainkey.${domain}";
content = ''"''${ join("\" \"", regexall(".{1,255}", "v=DKIM1;k=rsa;p=${dkimPublicKey "tls_private_key.${lib.khscodes.sanitize-terraform-name domain}_dkim_rsa"}" )) }"'';
ttl = 600;
}) cfg.domains)
++ (lib.lists.map (domain: {
fqdn = "snm_ed25519._domainkey.${domain}";
content = ''"''${ join("\" \"", regexall(".{1,255}", "v=DKIM1;k=ed25519;p=${dkimPublicKey "tls_private_key.${lib.khscodes.sanitize-terraform-name domain}_dkim_ed25519"}" )) }"'';
ttl = 600;
}) cfg.domains)
++ (lib.lists.map (domain: {
fqdn = domain;
# TODO: Use something here that doesn't require knowing the IP, such that we don't tie this down to hcloud instances.
content = ''"v=spf1 ip4:${config.khscodes.hcloud.output.server.compute.ipv4_address} ip6:${config.khscodes.hcloud.output.server.compute.ipv6_address} -all"'';
ttl = 600;
}) cfg.domains)
++ (lib.lists.map (domain: {
fqdn = "_dmarc.${domain}";
content = ''"v=DMARC1; p=reject; adkim=s; aspf=s;"'';
ttl = 600;
}) cfg.domains);
resource.vault_kv_secret_v2 =
(lib.listToAttrs (
lib.lists.map (domain: {
name = "${lib.khscodes.sanitize-terraform-name domain}_dkim_rsa";
value = {
mount = cfg.dkim.vault.mountExpr;
name = cfg.dkim.vault.prefixPath + "/${domain}/rsa";
data_json = ''
{ "dkim_private_key": ''${ jsonencode(resource.tls_private_key.${lib.khscodes.sanitize-terraform-name domain}_dkim_rsa.private_key_pem) } }
'';
};
}) cfg.domains
))
// (lib.listToAttrs (
lib.lists.map (domain: {
name = "${lib.khscodes.sanitize-terraform-name domain}_dkim_ed25519";
value = {
mount = cfg.dkim.vault.mountExpr;
name = cfg.dkim.vault.prefixPath + "/${domain}/ed25519";
data_json = ''
{ "dkim_private_key": ''${ jsonencode(resource.tls_private_key.${lib.khscodes.sanitize-terraform-name domain}_dkim_ed25519.private_key_pem) } }
'';
};
}) cfg.domains
));
}
)
];
khscodes.services.vault-agent.templates = lib.lists.flatten (
lib.lists.map (domain: [
{
contents = ''
{{- with secret "${cfg.dkim.vault.mount}/data/${cfg.dkim.vault.prefixPath}/${domain}/rsa" -}}
{{ .Data.data.dkim_private_key }}
{{- end -}}
'';
destination = rsaKeyPath domain;
perms = "0600";
owner = "rspamd";
group = "rspamd";
restartUnits = [
"rspamd.service"
"postfix.service"
];
}
{
contents = ''
{{- with secret "${cfg.dkim.vault.mount}/data/${cfg.dkim.vault.prefixPath}/${domain}/ed25519" -}}
{{ .Data.data.dkim_private_key }}
{{- end -}}
'';
destination = ed25519KeyPath domain;
perms = "0600";
owner = "rspamd";
group = "rspamd";
restartUnits = [
"rspamd.service"
"postfix.service"
];
}
]) cfg.domains
);
};
}