nixos/postsrsd: integrate with postfix by default

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -120,6 +120,8 @@
 
 - `services.ntpd-rs` now performs configuration validation.
 
+- `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
+
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
 
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).

nixos/modules/services/mail/postsrsd.nix

@@ -211,6 +211,14 @@ in
         '';
       };
 
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to configure the required settings to use postsrsd in the local Postfix instance.
+        '';
+      };
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "postsrsd";
@@ -225,103 +233,67 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkMerge [
-    users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
+    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
-      postsrsd = {
+      services.postfix.config = {
-        group = cfg.group;
+        # https://github.com/roehling/postsrsd#configuration
-        uid = config.ids.uids.postsrsd;
+        sender_canonical_maps = "socketmap:${cfg.settings.socketmap}:forward";
-      };
+        sender_canonical_classes = "envelope_sender";
-    };
+        recipient_canonical_maps = "socketmap:${cfg.settings.socketmap}:reverse";
-
+        recipient_canonical_classes = [
-    users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
+          "envelope_recipient"
-      postsrsd.gid = config.ids.gids.postsrsd;
+          "header_recipient"
-    };
-
-    systemd.services.postsrsd-generate-secrets = {
-      path = [ pkgs.coreutils ];
-      script = ''
-        if [ -e "${cfg.secretsFile}" ]; then
-          echo "Secrets file exists. Nothing to do!"
-        else
-          echo "WARNING: secrets file not found, autogenerating!"
-          DIR="$(dirname "${cfg.secretsFile}")"
-          install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
-          install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
-        fi
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-      };
-    };
-
-    environment.etc."postsrsd.conf".source = configFile;
-
-    systemd.services.postsrsd = {
-      description = "PostSRSd SRS rewriting server";
-      after = [
-        "network.target"
-        "postsrsd-generate-secrets.service"
-      ];
-      before = [ "postfix.service" ];
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postsrsd-generate-secrets.service" ];
-      restartTriggers = [ configFile ];
-
-      serviceConfig = {
-        ExecStart = toString [
-          (lib.getExe pkgs.postsrsd)
-          "-C"
-          "/etc/postsrsd.conf"
         ];
-        User = cfg.user;
+      };
-        Group = cfg.group;
-        RuntimeDirectory = "postsrsd";
-        RuntimeDirectoryMode = "0750";
-        LoadCredential = "secrets-file:${cfg.secretsFile}";
 
-        CapabilityBoundingSet = [ "" ];
+      users.users.postfix.extraGroups = [ cfg.group ];
-        LockPersonality = true;
+    })
-        MemoryDenyWriteExecute = true;
+
-        NoNewPrivileges = true;
+    (lib.mkIf cfg.enable {
-        PrivateDevices = true;
+      users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
-        PrivateMounts = true;
+        postsrsd = {
-        PrivateNetwork = lib.hasPrefix "unix:" cfg.settings.socketmap;
+          group = cfg.group;
-        PrivateTmp = true;
+          uid = config.ids.uids.postsrsd;
-        PrivateUsers = true;
+        };
-        ProtectControlGroups = true;
+      };
-        ProtectHome = true;
+
-        ProtectHostname = true;
+      users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
-        ProtectKernelLogs = true;
+        postsrsd.gid = config.ids.gids.postsrsd;
-        ProtectKernelModules = true;
+      };
-        ProtectKernelTunables = true;
+
-        ProtectSystem = "strict";
+      systemd.services.postsrsd-generate-secrets = {
-        ProtectProc = "invisible";
+        path = [ pkgs.coreutils ];
-        ProcSubset = "pid";
+        script = ''
-        RemoveIPC = true;
+          if [ -e "${cfg.secretsFile}" ]; then
-        RestrictAddressFamilies =
+            echo "Secrets file exists. Nothing to do!"
-          if lib.hasPrefix "unix:" cfg.settings.socketmap then
-            [ "AF_UNIX" ]
           else
-            [
+            echo "WARNING: secrets file not found, autogenerating!"
-              "AF_INET"
+            DIR="$(dirname "${cfg.secretsFile}")"
-              "AF_INET6"
+            install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
-            ];
+            install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
-        RestrictNamespaces = true;
+          fi
-        RestrictRealtime = true;
+        '';
-        RestrictSUIDSGID = true;
+        serviceConfig = {
-        SystemCallArchitectures = "native";
+          Type = "oneshot";
-        SystemCallFilter = [
+        };
-          "@system-service"
+      };
-          "~@privileged @resources"
+
+      environment.etc."postsrsd.conf".source = configFile;
+
+      systemd.services.postsrsd = {
+        description = "PostSRSd SRS rewriting server";
+        after = [
+          "network.target"
+          "postsrsd-generate-secrets.service"
         ];
-        UMask = "0027";
         before = [ "postfix.service" ];
         wantedBy = [ "multi-user.target" ];
         requires = [ "postsrsd-generate-secrets.service" ];
         restartTriggers = [ configFile ];
+
         serviceConfig = {
           ExecStart = utils.escapeSystemdExecArgs [
-            (lib.getExe cfg.package)
+            (lib.getExe pkgs.postsrsd)
             "-C"
             "/etc/postsrsd.conf"
           ];
@@ -369,6 +341,6 @@ in
           UMask = "0027";
         };
       };
-    };
+    })
-  };
+  ];
 }