aither/simple-nixos-mailserver
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
724 Commits 9 Branches 0 Tags
efebf59b137b269ee5716aa82b6d377c22580fb5
Commit Graph
70 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Weinelt efebf59b13 dovecot: configure preferred elliptic curves 2025-06-15 00:22:57 +02:00
Martin Weinelt 4fd9508d41 postfix: drop tls_random_source config 
The setting already defaults to /dev/urandom.
 2025-06-15 00:22:57 +02:00
Martin Weinelt 3828b00dea postfix: configure preferred curves and disable FFDHE 
This aligns with the intermediate configuration recommended by Mozilla.
 2025-06-15 00:22:57 +02:00
Martin Weinelt e27326d317 postfix: refactor and prune TLS settings 
- Groups settings between server and client
- Uses a range comparator for supported TLS versions
- Prune excluded primitives to what affects the supported TLS versions
 2025-06-15 00:22:57 +02:00
Martin Weinelt e0ab4eeb67 docs/setup-guide: bump example stateVersion to 2 
If you do a fresh install now you should be able to skip the first
migration step.
 2025-06-14 01:20:27 +02:00
Martin Weinelt 3b7cda8cc5 flake.lock: Update 
Flake lock file updates:

• Updated input 'git-hooks':
    'github:cachix/git-hooks.nix/dcf5072734cb576d2b0c59b2ac44f5050b5eac82' (2025-03-22)
  → 'github:cachix/git-hooks.nix/623c56286de5a3193aa38891a6991b28f9bab056' (2025-06-11)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/adaa24fbf46737f3f1b5497bf64bae750f82942e' (2025-05-13)
  → 'github:NixOS/nixpkgs/3e3afe5174c561dee0df6f2c2b2236990146329f' (2025-06-07)
• Updated input 'nixpkgs-25_05':
    'github:NixOS/nixpkgs/ca49c4304acf0973078db0a9d200fd2bae75676d' (2025-05-18)
  → 'github:NixOS/nixpkgs/fd487183437963a59ba763c0cc4f27e3447dd6dd' (2025-06-12)
 2025-06-13 04:00:52 +02:00
Martin Weinelt f1bd4b8215 postfix: remove option to toggle SMTP smuggling workarounnd 
It has been default enabled since Postfix 3.9 and can still be configured
from the NixOS option mentioned in the removal warning.

Removing the option makes our interface leaner.

Information is based on https://www.postfix.org/smtp-smuggling.html#long.
 2025-06-13 00:21:16 +02:00
Martin Weinelt f9b15192b8 postfix: allow client to select the preferred cipher 
As long as all cipher we support are considered safe we can allow clients
to select one that suits them best.
 2025-06-03 00:45:12 +02:00
Martin Weinelt 8c835feaa7 docs/migrations: Improve title scoping for LDAP home dir migration 2025-06-02 04:31:41 +02:00
Martin Weinelt c9f61e02ae docs/howto-develop: fix stateVersion assertion example 2025-05-31 13:06:29 +02:00
Martin Weinelt ea1b0f8e2b assertions: guard by enable flag and reformat 
None of these should trigger when you've not enabled mailserver.
 2025-05-30 18:28:16 +02:00
Martin Weinelt 7cb61e6e3a dovecot: respect the mailDirectory base for LDAP home directories 
This change is safe, if you have not altered the default value of the
 `mailserver.mailDirectory` setting.
 2025-05-29 23:10:33 +02:00
Martin Weinelt 233c5e1a70 dovecot: remove workaround for services.dovecot2.modules removal 2025-05-29 14:06:34 +02:00
Martin Weinelt 11bfdbf136 tests: drop dhparam default length configuration 
This has been the default value since the option was introduced back in
2018[0].

[0] https://github.com/NixOS/nixpkgs/commit/81fc2c35097f81ecb29a576148486cc1ce5a5bcc
 2025-05-29 08:49:37 +02:00
Martin Weinelt 10cccc7706 docs: fix code block syntax in migration init 2025-05-29 08:48:56 +02:00
Martin Weinelt 792225e256 Introduce stateVersion concept 
With upcoming changes to the dovecot home and maildirectories we need to
introduce a way to nudge users to inform themselves about manual
migration steps they might need to carry out.

The idea here is to allow us to safely make breaking changes and notify
the user of required migration steps at eval time, so they can make the
necessary changes in time.
 2025-05-27 23:54:15 +02:00
Martin Weinelt 51d48f1492 Release 25.11 2025-05-22 01:31:46 +02:00
Martin Weinelt b4ae17d224 Reformat release notes 2025-05-21 00:58:06 +02:00
Martin Weinelt f7a221bc69 flake.nix: expose packages for custom pre-commit hooks in devshell 2025-05-21 00:56:01 +02:00
Martin Weinelt aa8366d234 treewide: remove dead nix references 2025-05-15 16:41:30 +02:00
Martin Weinelt 9a6190ceea rspamd: remove indirection in path to runtime directory 2025-05-15 16:29:06 +02:00
Martin Weinelt 1e51a503b1 dovecot: drop unused pipe scripts 
Leftovers from d507bd9c95
 2025-05-15 16:29:05 +02:00
Martin Weinelt fce540024a docs/howto-develop: document the devshell 2025-05-15 16:29:05 +02:00
Martin Weinelt 040f07ff45 docs/howto-develop: update chat room references 2025-05-15 16:29:05 +02:00
Martin Weinelt a73982f5b4 docs: migrate wiki references to wiki.nixos.org 
This has been the official wiki platform for a while now.
 2025-05-15 16:29:05 +02:00
Martin Weinelt fbfd948535 flake.nix: remove clamav from devshell, add glab 
With glab we provide the GitLab CLI utility to interact programatically
with the platform. Useful for checking our Merge request branches for
example.
 2025-05-15 16:29:05 +02:00
Martin Weinelt 4c25278507 flake.nix: print options.md outpath during build 
Helpful for debugging the resulting options file.
 2025-05-15 16:29:05 +02:00
Martin Weinelt 3268d8b0d8 scripts/generate-options: refactor 
- Extract the md syntax part into reusable functions
- Rename variables so their purpose becomes clearer
 2025-05-15 16:29:04 +02:00
Martin Weinelt 4839fa6614 scripts: migrate format strings to f-strings 2025-05-15 16:29:04 +02:00
Martin Weinelt ddc6ce61db docs: fix linting issues 
https://github.com/sphinx-doc/sphinx/issues/3921
 2025-05-15 16:29:04 +02:00
Martin Weinelt a6eb2a8f9a README.md: reformat with markdownlint 2025-05-15 16:29:04 +02:00
Martin Weinelt a7d580b934 treewide: reformat python code 2025-05-15 16:29:04 +02:00
Martin Weinelt f9fcbe9430 scripts/generate-options: fix typing issue 2025-05-15 16:29:04 +02:00
Martin Weinelt 1615c93511 scripts/mail-check: fix typing issues 
Replaces the body payload parsing with proper handling for multipart
messages.
 2025-05-15 16:29:04 +02:00
Martin Weinelt 313f94ed8f flake.nix: create pre-commit hydra job 2025-05-15 16:29:04 +02:00
Martin Weinelt ff9087adb4 flake.nix: drop CC from devshell 
We absolutely do not need a C compiler in here.
 2025-05-15 16:29:03 +02:00
Martin Weinelt d0ac5ce64c flake.nix: annotate flake-compat usage 
It is not used within flake.nix, so add a note that it is used elsewhere.
 2025-05-15 16:29:03 +02:00
Martin Weinelt dccca0506a Provide direnv integration for flake devshell 2025-05-15 16:29:03 +02:00
Martin Weinelt 41e513da64 flake.nix: configure pre-commit 2025-05-15 16:29:03 +02:00
Martin Weinelt dd83a2c7ad dovecot: rename sieve bayes/ham learning script 
Updates the spamassasin reference to talk about rspamd.
 2025-05-15 16:16:17 +02:00
Martin Weinelt 235dba2d82 tests/external: ignore new xapian warnings 
These looks harmless.

Closes: #322
 2025-05-15 16:16:17 +02:00
Martin Weinelt edd828ca88 flake.lock: Update 
Flake lock file updates:

• Updated input 'flake-compat':
    'github:edolstra/flake-compat/0f9255e01c2351cc7d116c072cb317785dd33b33' (2023-10-04)
  → 'github:edolstra/flake-compat/9100a0f413b0c601e0533d1d94ffd501ce2e7885' (2025-05-12)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/23e89b7da85c3640bbc2173fe04f4bd114342367' (2024-11-19)
  → 'github:NixOS/nixpkgs/adaa24fbf46737f3f1b5497bf64bae750f82942e' (2025-05-13)
• Updated input 'nixpkgs-24_11':
    'github:NixOS/nixpkgs/314e12ba369ccdb9b352a4db26ff419f7c49fa84' (2024-12-13)
  → 'github:NixOS/nixpkgs/5d736263df906c5da72ab0f372427814de2f52f8' (2025-05-14)
 2025-05-15 16:16:16 +02:00
Martin Weinelt 1ce644871b flake.nix: ignore the flake registry 
There is no real benefit using it anyway.
 2025-05-15 16:16:16 +02:00
Martin Weinelt 1f82d59d67 ci: use hydra-cli from pinned nixpkgs 2025-05-10 21:18:17 +02:00
Martin Weinelt ef1e02e555 flake.nix: run tests against pinned nixpkgs 
and migrate to the new runTest, which evaluates much faster.
 2025-05-10 02:43:35 +02:00
Martin Weinelt b92870c240 treewide: drop nixops docs and examples 
This is not a deployment system we recommend using anymore in 2025.

Closes: #320
 2025-05-08 23:22:29 +02:00
Martin Weinelt a1ff289bf9 dovecot: migrate queue-status to UNIX domain socket 2025-05-07 18:00:53 +02:00
Martin Weinelt 86b48f368f tests: remove invalid escape sequences 
>>> "\@"
<stdin>:1: SyntaxWarning: invalid escape sequence '\@'
'\\@'
 2025-05-07 03:56:41 +02:00
Martin Weinelt 2e254b4b5e postfix: adjust comments around smtpd_recipient_restrictions 2025-05-07 02:52:28 +02:00
Martin Weinelt fac7efe946 postfix: Support opportunistic DANE TLS 
This migrates the security level for outgoing SMTP connections to
dane[1]. Either a server is configured for DANE or it now uses mandatory
unauthenticated TLS.

If DANE validation fails, the delivery will be tempfailed.

If DANE is invalid or unusable the connection will fall back to
unauthenticated mandatory TLS

This has been the default in various mail distributions:
- Mailcow since December 2016[2]
- mailinabox since July 2014[3]

[1] https://www.postfix.org/TLS_README.html#client_tls_dane
[2] https://github.com/mailcow/mailcow-dockerized/commit/47a5166383a4ecae780ffd6ad2081dc3f070bd45
[3] https://github.com/mail-in-a-box/mailinabox/commit/e713af5f5aeca202c2bf88be324472b3ef898dc7
 2025-05-07 02:23:32 +02:00
Martin Weinelt f6a64f713c docs/release-notes: advertise mailserver.forwards with ldap 2025-05-06 05:32:59 +02:00
Martin Weinelt 2d0b3fdeb0 README: Add automatic client configuration support to the roadmap 2025-05-06 03:37:23 +02:00
Martin Weinelt 4320259e34 README: add matrix room, reference libera connection information 2025-05-06 03:29:35 +02:00
Martin Weinelt 2520e662f7 tests/external: make DKIM signing test more explicit 2025-05-06 01:05:10 +02:00
Martin Weinelt 630b5c4fdd Use rspamd for DKIM signing, drop OpenDKIM 
OpenDKIM has not been updated in the last 7 years and failed to adopt
RFC8463, which introduces Ed25519-SHA256 signatures.

It has thereby held back the DKIM ecosystem, which relies on the DNS
system to publish its public keys. The DNS system in turn does not handle
large record sizes well (see RFC8301), which is why Ed25519 public keys
would be preferable, but I'm not sure the ecosystem has caught up, so we
stay on the conservative side with RSA for now.

Fixes: #203 #210 #279
Obsoletes: !162 !338
Supersedes: !246
 2025-05-06 01:05:10 +02:00
Martin Weinelt 8800bccab8 dovecot: fix config indent 2025-05-05 22:31:16 +02:00
Martin Weinelt 84bf0c0c07 README.md: remove mailing list information 
Has been unused since 2019, so it is not a good recommendation to
subscribe there anymore.
 2025-05-05 22:31:16 +02:00
Martin Weinelt a071813b97 README: reword feature list 
and remove the v2.0 release title.
 2025-05-05 22:31:15 +02:00
Martin Weinelt ca69f91f6b update.sh: drop 
The section it updates was removed in d460e9ff62.
 2025-05-05 21:21:58 +02:00
Martin Weineltandlewo 46fe2c25c8 dovecot: prefer client cipher list 
All ciphers in TLSv1.2/TLSv1.3 are considered secure, so we can allow the
client to choose the most performant cipher according to their hardware
and software configuration.

This is in line with general recommendations, e.g. by Mozilla[1].

[1] https://wiki.mozilla.org/Security/Server_Side_TLS
 2025-04-23 19:35:32 +00:00
Martin Weinelt ab52efd622 ci: update to nixos-24.11 2025-04-23 16:02:07 +02:00
Martin Weinelt 42651ce2d3 docs: update release notes 2025-04-20 18:00:39 +02:00
Martin Weinelt 745c6ee861 rspamd: Use redis over a unix socket by default 
Both rspamd and redis run on the same host by default, so a UNIX domain
socket is the cheapest way to facilitate that communication.

It also allows us to get rid of overly complicated IP adddress parsing
logic, that we can shift onto the user if they need it.
 2025-04-15 16:17:30 +02:00
Martin Weinelt 1873ed0908 README: Update existing and future features 
As the ecosystems around us evolve so should the NixOS mailserver
project.

DKIM signing could be improved by allowing users to treat DKIM keys like
a secret that they would commonly manage through agenix/sops/etc.

Forwarding mail these days requires SRS and possibly ARC. The latter has
already become a required feature for bulk message to iCloud[1] and
Google Mail[3]. I propose that we stay ahead of the curve by adding
support for these features.

LDAP user management was added, but one pain point is that we currently
prevent it from coexisting with declarative users.

And finally Oauth (via RFC7628[3]) is the new kid on the block that everyone
wants to try out, but most notably client support[4] for hosting this
yourself is not quite there yet.

[1] https://support.apple.com/en-us/102322
[2] https://support.google.com/a/answer/81126?hl=en#zippy=%2Crequirements-for-all-senders%2Crequirements-for-sending-or-more-messages-per-day
[3] https://www.rfc-editor.org/rfc/rfc7628.html
[4] https://bugzilla.mozilla.org/show_bug.cgi?id=1602166
 2025-04-13 22:50:19 +02:00
Martin Weinelt ed80b589d3 postfix: remove deprecated smtpd_tls_eecdh_grade 
Causes a warning that suggests to just leave it at its default.
 2024-06-03 12:34:43 +02:00
Martin Weineltandlewo 8b03ae5701 Create LDAP test 
Sets up a declaratively configured OpenLDAP instance with users alice
and bob. They each own one email address,

First we test that postfix can communicate with LDAP and do the expected
lookups using the defined maps.

Then we use doveadm to make sure it can look up the two accounts.

Next we check the binding between account and mail address, by logging
in as alice and trying to send from bob@example.com, which alice is not
allowed to do. We expect postfix to reject the sender address here.

Finally we check mail delivery between alice and bob. Alice tries to
send a mail from alice@example.com to bob@example.com and bob then
checks whether it arrived in their mailbox.
 2023-07-11 19:31:20 +00:00
Martin Weineltandlewo 42e245b069 scripts/mail-check: allow passing the smtp username 
Will be prefered over the from address when specified.
 2023-07-11 19:31:20 +00:00
Martin Weineltandlewo 08f077c5ca Add support for LDAP users 
Allow configuring lookups for users and their mail addresses from an
LDAP directory. The LDAP username will be used as an accountname as
opposed to the email address used as the `loginName` for declarative
accounts. Mailbox for LDAP users will be stored below
`/var/vmail/ldap/<account>`.

Configuring domains is out of scope, since domains require further
configuration within the NixOS mailserver construct to set up all
related services accordingly.

Aliases can already be configured using `mailserver.forwards` but could
be supported using LDAP at a later point.
 2023-07-11 19:31:20 +00:00
Martin Weineltandlewo fe36e7ae0d rspamd: allow configuring dmarc reporting 
Enabling collects DMARC results in Redis and sends out aggregated
reports (RUA) on a daily basis.
 2022-11-27 20:34:38 +00:00
Martin Weinelt 004c229ca4 Convert minimal test to python test driver 2022-07-19 23:54:04 +02:00