ForkMaster/nixos-mailserver
1
0
Fork 0
mirror of https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git synced 2025-05-04 17:50:51 +05:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'domain-dkim-selector' into 'master'

Browse Source 
Draft: Allow per domain DKIM selectors

See merge request simple-nixos-mailserver/nixos-mailserver!378
This commit is contained in:
Michael Lohmann 2025-05-03 16:03:43 +00:00
commit 0f817fbb2c
4 changed files with 36 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
README.md
View File

@ -65,7 +65,6 @@ can stay up to date with bug fixes and updates.
### In the future
* DKIM Signing
- [ ] Allow per domain selectors
- [ ] Allow passing DKIM signing keys
* Improve the Forwarding Experience
- [ ] Support [ARC](https://en.wikipedia.org/wiki/Authenticated_Received_Chain) signing with [Rspamd](https://rspamd.com/doc/modules/arc.html)

11
default.nix
View File

@ -787,10 +787,17 @@ in
};
dkimSelector = mkOption {
type = types.str;
type = with types; let
mapStrToDomains = (selector:
builtins.listToAttrs (map (domain: {
name = domain;
value = selector;
}) cfg.domains));
in coercedTo str mapStrToDomains (attrsOf str);
default = "mail";
description = ''
The DKIM selector.
The DKIM selectors. If you provide a string, it is applied to all
domains. Otherwise you can provide it per domain.
'';
};

26
mail-server/assertions.nix
View File

@ -1,22 +1,32 @@
{ config, lib, pkgs, ... }:
{
assertions = lib.optionals config.mailserver.ldap.enable [
let
cfg = config.mailserver;
in {
assertions = lib.optionals cfg.ldap.enable [
{
assertion = config.mailserver.loginAccounts == {};
assertion = cfg.loginAccounts == {};
message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.loginAccounts";
}
{
assertion = config.mailserver.extraVirtualAliases == {};
assertion = cfg.extraVirtualAliases == {};
message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.extraVirtualAliases";
}
{
assertion = config.mailserver.forwards == {};
assertion = cfg.forwards == {};
message = "When the LDAP support is enable (mailserver.ldap.enable = true), it is not possible to define mailserver.forwards";
}
] ++ lib.optionals (config.mailserver.enable && config.mailserver.certificateScheme != "acme") [
] ++ lib.optionals (cfg.enable && cfg.certificateScheme != "acme") [
{
assertion = config.mailserver.acmeCertificateName == config.mailserver.fqdn;
assertion = cfg.acmeCertificateName == cfg.fqdn;
message = "When the certificate scheme is not 'acme' (mailserver.certificateScheme != \"acme\"), it is not possible to define mailserver.acmeCertificateName";
}
];
] ++ lib.optionals cfg.dkimSigning (
let
missingDomains = builtins.filter (d: !(cfg.dkimSelector ? "${d}")) cfg.domains;
in [
{
assertion = missingDomains == [];
message = "Missing DKIM selector for domains: ${builtins.concatStringsSep ", " missingDomains}";
}
]);
}

17
mail-server/opendkim.nix
View File

@ -25,27 +25,28 @@ let
createDomainDkimCert = dom:
let
dkim_key = "${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.key";
dkim_txt = "${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.txt";
dkim_selector = cfg.dkimSelector[dom];
dkim_key = "${cfg.dkimKeyDirectory}/${dom}.${dkim_selector}.key";
dkim_txt = "${cfg.dkimKeyDirectory}/${dom}.${dkim_selector}.txt";
in
''
if [ ! -f "${dkim_key}" ]
then
${pkgs.opendkim}/bin/opendkim-genkey -s "${cfg.dkimSelector}" \
${pkgs.opendkim}/bin/opendkim-genkey -s "${dkim_selector}" \
-d "${dom}" \
--bits="${toString cfg.dkimKeyBits}" \
--directory="${cfg.dkimKeyDirectory}"
mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.private" "${dkim_key}"
mv "${cfg.dkimKeyDirectory}/${cfg.dkimSelector}.txt" "${dkim_txt}"
mv "${cfg.dkimKeyDirectory}/${dkim_selector}.private" "${dkim_key}"
mv "${cfg.dkimKeyDirectory}/${dkim_selector}.txt" "${dkim_txt}"
chmod 644 "${dkim_txt}"
echo "Generated key for domain ${dom} selector ${cfg.dkimSelector}"
echo "Generated key for domain ${dom} selector ${dkim_selector}"
fi
'';
createAllCerts = lib.concatStringsSep "\n" (map createDomainDkimCert cfg.domains);
keyTable = pkgs.writeText "opendkim-KeyTable"
(lib.concatStringsSep "\n" (lib.flip map cfg.domains
(dom: "${dom} ${dom}:${cfg.dkimSelector}:${cfg.dkimKeyDirectory}/${dom}.${cfg.dkimSelector}.key")));
(dom: "${dom} ${dom}:${dkim_selector}:${cfg.dkimKeyDirectory}/${dom}.${dkim_selector}.key")));
signingTable = pkgs.writeText "opendkim-SigningTable"
(lib.concatStringsSep "\n" (lib.flip map cfg.domains (dom: "${dom} ${dom}")));
@ -56,7 +57,7 @@ in
config = mkIf (cfg.dkimSigning && cfg.enable) {
services.opendkim = {
enable = true;
selector = cfg.dkimSelector;
selector = cfg.dkimSelector; # FIXME: opendkim can only handle a single selector. Figure out how to do this…
keyPath = cfg.dkimKeyDirectory;
domains = "csl:${builtins.concatStringsSep "," cfg.domains}";
configFile = pkgs.writeText "opendkim.conf" (''