Merge branch 'rspamd-dmarc-exclude' into 'master'

mail-server: add `dmarcReporting.excludeDomains` See merge request simple-nixos-mailserver/nixos-mailserver!297
Remove the support of 23.05 and 23.11
2025-01-13 07:46:54 +01:00 · 2024-03-15 09:33:58 +00:00 · 2024-03-14 21:51:05 +01:00 · 2024-03-14 21:51:05 +01:00 · 2024-03-14 21:50:46 +01:00 · 2024-03-09 23:23:17 +01:00
5 changed files with 73 additions and 84 deletions
--- a/default.nix
+++ b/default.nix
@ -868,6 +868,14 @@ in
          The sender name for DMARC reports. Defaults to the organization name.
        '';
      };
+
+      excludeDomains = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          List of domains or eSLDs to be excluded from DMARC reports.
+        '';
+      };
    };

    debug = mkOption {
--- a/flake.lock
+++ b/flake.lock
@ -19,11 +19,11 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1668681692,
-        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
        "type": "github"
      },
      "original": {
@ -34,11 +34,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1705856552,
-        "narHash": "sha256-JXfnuEf5Yd6bhMs/uvM67/joxYKoysyE3M2k6T3eWbg=",
+        "lastModified": 1709703039,
+        "narHash": "sha256-6hqgQ8OK6gsMu1VtcGKBxKQInRLHtzulDo9Z5jxHEFY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "612f97239e2cc474c13c9dafa0df378058c5ad8d",
+        "rev": "9df3e30ce24fd28c7b3e2de0d986769db5d6225d",
        "type": "github"
      },
      "original": {
@ -47,53 +47,39 @@
        "type": "indirect"
      }
    },
-    "nixpkgs-23_05": {
-      "locked": {
-        "lastModified": 1704290814,
-        "narHash": "sha256-LWvKHp7kGxk/GEtlrGYV68qIvPHkU9iToomNFGagixU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "70bdadeb94ffc8806c0570eb5c2695ad29f0e421",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-23.05",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs-23_11": {
-      "locked": {
-        "lastModified": 1706098335,
-        "narHash": "sha256-r3dWjT8P9/Ah5m5ul4WqIWD8muj5F+/gbCdjiNVBKmU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a77ab169a83a4175169d78684ddd2e54486ac651",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-23.11",
-        "type": "indirect"
-      }
-    },
    "root": {
      "inputs": {
        "blobs": "blobs",
        "flake-compat": "flake-compat",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-23_05": "nixpkgs-23_05",
-        "nixpkgs-23_11": "nixpkgs-23_11",
        "utils": "utils"
      }
    },
-    "utils": {
+    "systems": {
      "locked": {
-        "lastModified": 1605370193,
-        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -8,15 +8,13 @@
    };
    utils.url = "github:numtide/flake-utils";
    nixpkgs.url = "flake:nixpkgs/nixos-unstable";
-    nixpkgs-23_05.url = "flake:nixpkgs/nixos-23.05";
-    nixpkgs-23_11.url = "flake:nixpkgs/nixos-23.11";
    blobs = {
      url = "gitlab:simple-nixos-mailserver/blobs";
      flake = false;
    };
  };

-  outputs = { self, utils, blobs, nixpkgs, nixpkgs-23_05, nixpkgs-23_11, ... }: let
+  outputs = { self, utils, blobs, nixpkgs, ... }: let
    lib = nixpkgs.lib;
    system = "x86_64-linux";
    pkgs = nixpkgs.legacyPackages.${system};
@ -25,14 +23,6 @@
        name = "unstable";
        pkgs = nixpkgs.legacyPackages.${system};
      }
-      {
-        name = "23.05";
-        pkgs = nixpkgs-23_05.legacyPackages.${system};
-      }
-      {
-        name = "23.11";
-        pkgs = nixpkgs-23_11.legacyPackages.${system};
-      }
    ];
    testNames = [
      "internal"
--- a/mail-server/dovecot.nix
+++ b/mail-server/dovecot.nix
@ -175,8 +175,18 @@ in
      mailPlugins.globally.enable = lib.optionals cfg.fullTextSearch.enable [ "fts" "fts_xapian" ];
      protocols = lib.optional cfg.enableManageSieve "sieve";

-      sieveScripts = {
-        after = builtins.toFile "spam.sieve" ''
+      pluginSettings = {
+        sieve = "file:${cfg.sieveDirectory}/%u/scripts;active=${cfg.sieveDirectory}/%u/active.sieve";
+        sieve_default = "file:${cfg.sieveDirectory}/%u/default.sieve";
+        sieve_default_name = "default";
+      };
+
+      sieve = {
+        extensions = [
+          "fileinto"
+        ];
+
+        scripts.after = builtins.toFile "spam.sieve" ''
          require "fileinto";

          if header :is "X-Spam" "Yes" {
@ -184,8 +194,29 @@ in
              stop;
          }
        '';
+
+        pipeBins = map lib.getExe [
+          (pkgs.writeShellScriptBin "sa-learn-ham.sh"
+            "exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/worker-controller.sock learn_ham")
+          (pkgs.writeShellScriptBin "sa-learn-spam.sh"
+            "exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/worker-controller.sock learn_spam")
+        ];
      };

+      imapsieve.mailbox = [
+        {
+          name = junkMailboxName;
+          causes = [ "COPY" "APPEND" ];
+          before = ./dovecot/imap_sieve/report-spam.sieve;
+        }
+        {
+          name = "*";
+          from = junkMailboxName;
+          causes = [ "COPY" ];
+          before = ./dovecot/imap_sieve/report-ham.sieve;
+        }
+      ];
+
      mailboxes = cfg.mailboxes;

      extraConfig = ''
@ -307,28 +338,6 @@ in
          inbox = yes
        }

-        plugin {
-          sieve_plugins = sieve_imapsieve sieve_extprograms
-          sieve = file:${cfg.sieveDirectory}/%u/scripts;active=${cfg.sieveDirectory}/%u/active.sieve
-          sieve_default = file:${cfg.sieveDirectory}/%u/default.sieve
-          sieve_default_name = default
-
-          # From elsewhere to Spam folder
-          imapsieve_mailbox1_name = ${junkMailboxName}
-          imapsieve_mailbox1_causes = COPY,APPEND
-          imapsieve_mailbox1_before = file:${stateDir}/imap_sieve/report-spam.sieve
-
-          # From Spam folder to elsewhere
-          imapsieve_mailbox2_name = *
-          imapsieve_mailbox2_from = ${junkMailboxName}
-          imapsieve_mailbox2_causes = COPY
-          imapsieve_mailbox2_before = file:${stateDir}/imap_sieve/report-ham.sieve
-
-          sieve_pipe_bin_dir = ${pipeBin}/pipe/bin
-
-          sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
-        }
-
        ${lib.optionalString cfg.fullTextSearch.enable ''
        plugin {
          plugin = fts fts_xapian
@ -357,13 +366,6 @@ in
    systemd.services.dovecot2 = {
      preStart = ''
        ${genPasswdScript}
-        rm -rf '${stateDir}/imap_sieve'
-        mkdir '${stateDir}/imap_sieve'
-        cp -p "${./dovecot/imap_sieve}"/*.sieve '${stateDir}/imap_sieve/'
-        for k in "${stateDir}/imap_sieve"/*.sieve ; do
-          ${pkgs.dovecot_pigeonhole}/bin/sievec "$k"
-        done
-        chown -R '${dovecot2Cfg.mailUser}:${dovecot2Cfg.mailGroup}' '${stateDir}/imap_sieve'
      '' + (lib.optionalString cfg.ldap.enable setPwdInLdapConfFile);
    };

--- a/mail-server/rspamd.nix
+++ b/mail-server/rspamd.nix
@ -65,6 +65,9 @@ in
                org_name = "${cfg.dmarcReporting.organizationName}";
                from_name = "${cfg.dmarcReporting.fromName}";
                msgid_from = "dmarc-rua";
+                ${lib.optionalString (cfg.dmarcReporting.excludeDomains != []) ''
+                  exclude_domains = ${builtins.toJSON cfg.dmarcReporting.excludeDomains};
+                ''}
              }''}
          ''; };
      };
Author	SHA1	Message	Date
Maximilian Bosch	876e691685	Merge branch 'rspamd-dmarc-exclude' into 'master' mail-server: add `dmarcReporting.excludeDomains` See merge request simple-nixos-mailserver/nixos-mailserver!297	2024-03-15 09:33:58 +00:00
Antoine Eiche	79c8cfcd58	Remove the support of 23.05 and 23.11 This is because SNM now supports the new sieve nixpkgs interface, which is not backward compatible with previous releases.	2024-03-14 21:51:05 +01:00
Gaetan Lepage	799fe34c12	Update nixpkgs	2024-03-14 21:51:05 +01:00
Gaetan Lepage	d507bd9c95	dovecot: no longer need to copy sieve scripts	2024-03-14 21:50:46 +01:00
Raito Bezarius	fe6d325397	dovecot: support new `sieve` API in nixpkgs Since https://github.com/NixOS/nixpkgs/pull/275031 things have became more structured when it comes to the sieve plugin. Relies on https://github.com/NixOS/nixpkgs/pull/281001 for full features.	2024-03-09 23:23:17 +01:00
Maximilian Bosch	8fe94ec0c6	mail-server: add `dmarcReporting.excludeDomains` The option `exclude_domains` for dmarc reporting in `rspamd`[1] allows to configure a list of domains and/or eSLDs (external effective second level domain) to be excluded from dmarc reports. Helpful because e.g. dmarc reports to hotmail.com always fail for me with the following undeliverable notification: The recipient's mailbox is full and can't accept messages now. [1] https://www.rspamd.com/doc/modules/dmarc.html	2023-08-21 19:07:25 +02:00