aither/simple-nixos-mailserver
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
673 Commits 9 Branches 0 Tags
a6eb2a8f9affab4be821956b3cb838f1d1ec871b
Commit Graph
40 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Weinelt a6eb2a8f9a README.md: reformat with markdownlint 2025-05-15 16:29:04 +02:00
Martin Weinelt a7d580b934 treewide: reformat python code 2025-05-15 16:29:04 +02:00
Martin Weinelt f9fcbe9430 scripts/generate-options: fix typing issue 2025-05-15 16:29:04 +02:00
Martin Weinelt 1615c93511 scripts/mail-check: fix typing issues 
Replaces the body payload parsing with proper handling for multipart
messages.
 2025-05-15 16:29:04 +02:00
Martin Weinelt 313f94ed8f flake.nix: create pre-commit hydra job 2025-05-15 16:29:04 +02:00
Martin Weinelt ff9087adb4 flake.nix: drop CC from devshell 
We absolutely do not need a C compiler in here.
 2025-05-15 16:29:03 +02:00
Martin Weinelt d0ac5ce64c flake.nix: annotate flake-compat usage 
It is not used within flake.nix, so add a note that it is used elsewhere.
 2025-05-15 16:29:03 +02:00
Martin Weinelt dccca0506a Provide direnv integration for flake devshell 2025-05-15 16:29:03 +02:00
Martin Weinelt 41e513da64 flake.nix: configure pre-commit 2025-05-15 16:29:03 +02:00
Martin Weinelt dd83a2c7ad dovecot: rename sieve bayes/ham learning script 
Updates the spamassasin reference to talk about rspamd.
 2025-05-15 16:16:17 +02:00
Martin Weinelt 235dba2d82 tests/external: ignore new xapian warnings 
These looks harmless.

Closes: #322
 2025-05-15 16:16:17 +02:00
Martin Weinelt edd828ca88 flake.lock: Update 
Flake lock file updates:

• Updated input 'flake-compat':
    'github:edolstra/flake-compat/0f9255e01c2351cc7d116c072cb317785dd33b33' (2023-10-04)
  → 'github:edolstra/flake-compat/9100a0f413b0c601e0533d1d94ffd501ce2e7885' (2025-05-12)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/23e89b7da85c3640bbc2173fe04f4bd114342367' (2024-11-19)
  → 'github:NixOS/nixpkgs/adaa24fbf46737f3f1b5497bf64bae750f82942e' (2025-05-13)
• Updated input 'nixpkgs-24_11':
    'github:NixOS/nixpkgs/314e12ba369ccdb9b352a4db26ff419f7c49fa84' (2024-12-13)
  → 'github:NixOS/nixpkgs/5d736263df906c5da72ab0f372427814de2f52f8' (2025-05-14)
 2025-05-15 16:16:16 +02:00
Martin Weinelt 1ce644871b flake.nix: ignore the flake registry 
There is no real benefit using it anyway.
 2025-05-15 16:16:16 +02:00
Martin Weinelt 1f82d59d67 ci: use hydra-cli from pinned nixpkgs 2025-05-10 21:18:17 +02:00
Martin Weinelt ef1e02e555 flake.nix: run tests against pinned nixpkgs 
and migrate to the new runTest, which evaluates much faster.
 2025-05-10 02:43:35 +02:00
Martin Weinelt b92870c240 treewide: drop nixops docs and examples 
This is not a deployment system we recommend using anymore in 2025.

Closes: #320
 2025-05-08 23:22:29 +02:00
Martin Weinelt a1ff289bf9 dovecot: migrate queue-status to UNIX domain socket 2025-05-07 18:00:53 +02:00
Martin Weinelt 86b48f368f tests: remove invalid escape sequences 
>>> "\@"
<stdin>:1: SyntaxWarning: invalid escape sequence '\@'
'\\@'
 2025-05-07 03:56:41 +02:00
Martin Weinelt 2e254b4b5e postfix: adjust comments around smtpd_recipient_restrictions 2025-05-07 02:52:28 +02:00
Martin Weinelt fac7efe946 postfix: Support opportunistic DANE TLS 
This migrates the security level for outgoing SMTP connections to
dane[1]. Either a server is configured for DANE or it now uses mandatory
unauthenticated TLS.

If DANE validation fails, the delivery will be tempfailed.

If DANE is invalid or unusable the connection will fall back to
unauthenticated mandatory TLS

This has been the default in various mail distributions:
- Mailcow since December 2016[2]
- mailinabox since July 2014[3]

[1] https://www.postfix.org/TLS_README.html#client_tls_dane
[2] https://github.com/mailcow/mailcow-dockerized/commit/47a5166383a4ecae780ffd6ad2081dc3f070bd45
[3] https://github.com/mail-in-a-box/mailinabox/commit/e713af5f5aeca202c2bf88be324472b3ef898dc7
 2025-05-07 02:23:32 +02:00
Martin Weinelt f6a64f713c docs/release-notes: advertise mailserver.forwards with ldap 2025-05-06 05:32:59 +02:00
Martin Weinelt 2d0b3fdeb0 README: Add automatic client configuration support to the roadmap 2025-05-06 03:37:23 +02:00
Martin Weinelt 4320259e34 README: add matrix room, reference libera connection information 2025-05-06 03:29:35 +02:00
Martin Weinelt 2520e662f7 tests/external: make DKIM signing test more explicit 2025-05-06 01:05:10 +02:00
Martin Weinelt 630b5c4fdd Use rspamd for DKIM signing, drop OpenDKIM 
OpenDKIM has not been updated in the last 7 years and failed to adopt
RFC8463, which introduces Ed25519-SHA256 signatures.

It has thereby held back the DKIM ecosystem, which relies on the DNS
system to publish its public keys. The DNS system in turn does not handle
large record sizes well (see RFC8301), which is why Ed25519 public keys
would be preferable, but I'm not sure the ecosystem has caught up, so we
stay on the conservative side with RSA for now.

Fixes: #203 #210 #279
Obsoletes: !162 !338
Supersedes: !246
 2025-05-06 01:05:10 +02:00
Martin Weinelt 8800bccab8 dovecot: fix config indent 2025-05-05 22:31:16 +02:00
Martin Weinelt 84bf0c0c07 README.md: remove mailing list information 
Has been unused since 2019, so it is not a good recommendation to
subscribe there anymore.
 2025-05-05 22:31:16 +02:00
Martin Weinelt a071813b97 README: reword feature list 
and remove the v2.0 release title.
 2025-05-05 22:31:15 +02:00
Martin Weinelt ca69f91f6b update.sh: drop 
The section it updates was removed in d460e9ff62.
 2025-05-05 21:21:58 +02:00
Martin Weineltandlewo 46fe2c25c8 dovecot: prefer client cipher list 
All ciphers in TLSv1.2/TLSv1.3 are considered secure, so we can allow the
client to choose the most performant cipher according to their hardware
and software configuration.

This is in line with general recommendations, e.g. by Mozilla[1].

[1] https://wiki.mozilla.org/Security/Server_Side_TLS
 2025-04-23 19:35:32 +00:00
Martin Weinelt ab52efd622 ci: update to nixos-24.11 2025-04-23 16:02:07 +02:00
Martin Weinelt 42651ce2d3 docs: update release notes 2025-04-20 18:00:39 +02:00
Martin Weinelt 745c6ee861 rspamd: Use redis over a unix socket by default 
Both rspamd and redis run on the same host by default, so a UNIX domain
socket is the cheapest way to facilitate that communication.

It also allows us to get rid of overly complicated IP adddress parsing
logic, that we can shift onto the user if they need it.
 2025-04-15 16:17:30 +02:00
Martin Weinelt 1873ed0908 README: Update existing and future features 
As the ecosystems around us evolve so should the NixOS mailserver
project.

DKIM signing could be improved by allowing users to treat DKIM keys like
a secret that they would commonly manage through agenix/sops/etc.

Forwarding mail these days requires SRS and possibly ARC. The latter has
already become a required feature for bulk message to iCloud[1] and
Google Mail[3]. I propose that we stay ahead of the curve by adding
support for these features.

LDAP user management was added, but one pain point is that we currently
prevent it from coexisting with declarative users.

And finally Oauth (via RFC7628[3]) is the new kid on the block that everyone
wants to try out, but most notably client support[4] for hosting this
yourself is not quite there yet.

[1] https://support.apple.com/en-us/102322
[2] https://support.google.com/a/answer/81126?hl=en#zippy=%2Crequirements-for-all-senders%2Crequirements-for-sending-or-more-messages-per-day
[3] https://www.rfc-editor.org/rfc/rfc7628.html
[4] https://bugzilla.mozilla.org/show_bug.cgi?id=1602166
 2025-04-13 22:50:19 +02:00
Martin Weinelt ed80b589d3 postfix: remove deprecated smtpd_tls_eecdh_grade 
Causes a warning that suggests to just leave it at its default.
 2024-06-03 12:34:43 +02:00
Martin Weineltandlewo 8b03ae5701 Create LDAP test 
Sets up a declaratively configured OpenLDAP instance with users alice
and bob. They each own one email address,

First we test that postfix can communicate with LDAP and do the expected
lookups using the defined maps.

Then we use doveadm to make sure it can look up the two accounts.

Next we check the binding between account and mail address, by logging
in as alice and trying to send from bob@example.com, which alice is not
allowed to do. We expect postfix to reject the sender address here.

Finally we check mail delivery between alice and bob. Alice tries to
send a mail from alice@example.com to bob@example.com and bob then
checks whether it arrived in their mailbox.
 2023-07-11 19:31:20 +00:00
Martin Weineltandlewo 42e245b069 scripts/mail-check: allow passing the smtp username 
Will be prefered over the from address when specified.
 2023-07-11 19:31:20 +00:00
Martin Weineltandlewo 08f077c5ca Add support for LDAP users 
Allow configuring lookups for users and their mail addresses from an
LDAP directory. The LDAP username will be used as an accountname as
opposed to the email address used as the `loginName` for declarative
accounts. Mailbox for LDAP users will be stored below
`/var/vmail/ldap/<account>`.

Configuring domains is out of scope, since domains require further
configuration within the NixOS mailserver construct to set up all
related services accordingly.

Aliases can already be configured using `mailserver.forwards` but could
be supported using LDAP at a later point.
 2023-07-11 19:31:20 +00:00
Martin Weineltandlewo fe36e7ae0d rspamd: allow configuring dmarc reporting 
Enabling collects DMARC results in Redis and sends out aggregated
reports (RUA) on a daily basis.
 2022-11-27 20:34:38 +00:00
Martin Weinelt 004c229ca4 Convert minimal test to python test driver 2022-07-19 23:54:04 +02:00