mail.scm
1 | ;;; Tyreunom's system administration and configuration tools. |
2 | ;;; |
3 | ;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu> |
4 | ;;; |
5 | ;;; This program is free software: you can redistribute it and/or modify |
6 | ;;; it under the terms of the GNU General Public License as published by |
7 | ;;; the Free Software Foundation, either version 3 of the License, or |
8 | ;;; (at your option) any later version. |
9 | ;;; |
10 | ;;; This program is distributed in the hope that it will be useful, |
11 | ;;; but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
13 | ;;; GNU General Public License for more details. |
14 | ;;; |
15 | ;;; You should have received a copy of the GNU General Public License |
16 | ;;; along with this program. If not, see <http://www.gnu.org/licenses/>. |
17 | |
18 | ;; |
19 | ;; Email configuration |
20 | ;; |
21 | |
22 | (define-module (config mail) |
23 | #:use-module (data dns) |
24 | #:use-module (gnu packages mail) |
25 | #:use-module (gnu services) |
26 | #:use-module (gnu services mail) |
27 | #:use-module (guix gexp) |
28 | #:use-module (services mail) |
29 | #:export (lepiller-mail-services)) |
30 | |
31 | (define aliases-file |
32 | (plain-file "aliases" "postmaster root |
33 | |
34 | @ tyreunom |
35 | ")) |
36 | |
37 | (define relays-file |
38 | (plain-file "other-relays" |
39 | (string-append ene-ip4 "\n" hermes-ip4 "\n" hermes-ip6 "\n" ))) |
40 | |
41 | (define blacklist-file |
42 | (plain-file "blacklist" " |
43 | @yahoo.com.cn |
44 | @qq.com |
45 | @fnac.com")) |
46 | |
47 | (define (opensmtpd-conf interface domain) |
48 | (mixed-text-file "smtpd.conf" " |
49 | # This is the smtpd server system-wide configuration file. |
50 | # See smtpd.conf(5) for more information. |
51 | |
52 | # My TLS certificate and key |
53 | pki lepiller.eu certificate \"/etc/letsencrypt/live/" domain "/fullchain.pem\" |
54 | pki lepiller.eu key \"/etc/letsencrypt/live/" domain "/privkey.pem\" |
55 | |
56 | # Edit this file to add more virtual users (passwords are read in that file |
57 | # instead of /etc/passwd. |
58 | table passwd file:/etc/mail/passwd |
59 | |
60 | # port 25 is used only for receiving from external servers, and they may start a |
61 | # TLS session if the want. |
62 | listen on " interface " port 25 tls pki lepiller.eu |
63 | # For sending messages from outside of this server, you need to authenticate and |
64 | # use TLS. |
65 | listen on " interface " port 587 tls-require pki lepiller.eu mask-source auth <passwd> |
66 | # On this server, you only need to authenticate on one of the available ports, |
67 | # and you may use TLS. |
68 | listen on lo port 25 tls pki lepiller.eu mask-source auth <passwd> |
69 | listen on lo port 587 tls pki lepiller.eu mask-source auth <passwd> |
70 | listen on lo port 10028 tag DKIM_OUT # DKIMproxy |
71 | |
72 | # Maybe it'll work better if we connect to gmail only with v4? |
73 | limit mta for domain gmail.com inet4 |
74 | |
75 | # TODO: manage these files directly in the configuration? |
76 | # If you edit the file, you have to run \"smtpctl update table aliases\" |
77 | table aliases file:" aliases-file " |
78 | |
79 | table other-relays file:" relays-file " |
80 | table blacklist file:" blacklist-file " |
81 | |
82 | # We accept to relay any mail from authenticated users |
83 | accept for any authenticated relay via smtp://127.0.0.1:10027 |
84 | accept tagged DKIM_OUT for any relay |
85 | |
86 | # Then, we reject on some other conditions: |
87 | |
88 | # If the mail tries to impersonate us |
89 | reject from ! source <other-relays> sender \"@lepiller.eu\" for any |
90 | # If it comes from someone on the blacklist |
91 | reject from any sender <blacklist> for any |
92 | |
93 | # Finaly, if we accept incoming messages |
94 | accept from any for domain \"lepiller.eu\" virtual <aliases> deliver to maildir |
95 | accept for local alias <aliases> deliver to maildir |
96 | ")) |
97 | |
98 | (define (lepiller-imap-service domain) |
99 | (service dovecot-service-type |
100 | (dovecot-configuration |
101 | (mail-location "maildir:~/Maildir") |
102 | (ssl-cert (string-append |
103 | "</etc/letsencrypt/live/" domain "/fullchain.pem")) |
104 | (ssl-key (string-append |
105 | "</etc/letsencrypt/live/" domain "/privkey.pem"))))) |
106 | |
107 | (define (lepiller-smtp-service interface domain) |
108 | (service opensmtpd-service-type |
109 | (opensmtpd-configuration |
110 | (package opensmtpd-next) |
111 | (config-file (opensmtpd-conf interface domain))))) |
112 | |
113 | (define (lepiller-dkim-service domain) |
114 | (service dkimproxy-out-service-type |
115 | (dkimproxy-out-configuration |
116 | (listen "127.0.0.1:10027") |
117 | (relay "127.0.0.1:10028") |
118 | (sender-map |
119 | `((,domain |
120 | (,(dkimproxy-out-signature-configuration |
121 | (type 'dkim) |
122 | (key "/etc/mail/dkim/private.key") |
123 | (method "relaxed") |
124 | (selector "dkim")) |
125 | ,(dkimproxy-out-signature-configuration |
126 | (type 'domainkeys) |
127 | (method "nofws"))))))))) |
128 | |
129 | (define* (lepiller-mail-services #:key interface domain) |
130 | (list |
131 | (lepiller-smtp-service interface domain) |
132 | (lepiller-imap-service domain) |
133 | (lepiller-dkim-service domain))) |
134 | |
135 |