85 lines
2.1 KiB
Nix
85 lines
2.1 KiB
Nix
{ pkgs
|
|
, config
|
|
, ...
|
|
}:
|
|
let
|
|
domain = "amz.at";
|
|
selector = "amzebs-01";
|
|
|
|
localConfig = pkgs.writeText "local.conf" ''
|
|
logging {
|
|
level = "notice";
|
|
}
|
|
|
|
# DKIM signing configuration with host-specific selector
|
|
dkim_signing {
|
|
path = "/var/lib/rspamd/dkim/${domain}.${selector}.key";
|
|
selector = "${selector}";
|
|
allow_username_mismatch = true;
|
|
}
|
|
|
|
# ARC signing (Authenticated Received Chain)
|
|
arc {
|
|
path = "/var/lib/rspamd/dkim/${domain}.${selector}.key";
|
|
selector = "${selector}";
|
|
allow_username_mismatch = true;
|
|
}
|
|
|
|
# Add authentication results to headers
|
|
milter_headers {
|
|
use = ["authentication-results"];
|
|
authenticated_headers = ["authentication-results"];
|
|
}
|
|
'';
|
|
in
|
|
{
|
|
services.rspamd = {
|
|
enable = true;
|
|
extraConfig = ''
|
|
.include(priority=1,duplicate=merge) "${localConfig}"
|
|
'';
|
|
|
|
# Enable Postfix milter integration
|
|
postfix.enable = true;
|
|
};
|
|
|
|
# Copy DKIM key from sops secret to rspamd directory
|
|
systemd.services.rspamd-dkim-setup = {
|
|
description = "Setup DKIM key from sops secret for ${domain}";
|
|
wantedBy = [ "multi-user.target" ];
|
|
before = [ "rspamd.service" ];
|
|
after = [ "sops-nix.service" ];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
|
|
script = ''
|
|
DKIM_DIR="/var/lib/rspamd/dkim"
|
|
DKIM_KEY="$DKIM_DIR/${domain}.${selector}.key"
|
|
|
|
# Create directory if it doesn't exist
|
|
mkdir -p "$DKIM_DIR"
|
|
|
|
# Copy key from sops secret
|
|
if [ -f "${config.sops.secrets.rspamd-dkim-key.path}" ]; then
|
|
cp "${config.sops.secrets.rspamd-dkim-key.path}" "$DKIM_KEY"
|
|
chown rspamd:rspamd "$DKIM_KEY"
|
|
chmod 600 "$DKIM_KEY"
|
|
echo "DKIM key deployed successfully from sops secret"
|
|
else
|
|
echo "ERROR: DKIM key not found in sops secrets!"
|
|
echo "Please ensure rspamd-dkim-key is defined in secrets.yaml"
|
|
exit 1
|
|
fi
|
|
'';
|
|
};
|
|
|
|
sops.secrets.rspamd-dkim-key = {
|
|
owner = "rspamd";
|
|
group = "rspamd";
|
|
mode = "0400";
|
|
};
|
|
}
|