M-Labs/it-infra
M-Labs
/
it-infra
8
0
Fork 6
Code Issues 10 Pull Requests Releases Wiki Activity

Use postfix options for routing mails through tunnel #45

Closed
esavkin wants to merge 15 commits from enable-mail-proxy-and-tunnel into master
pull from: enable-mail-proxy-and-tunnel
merge into: M-Labs:master
Conversation 7 Commits 15 Files Changed 1 +33 -1
1 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 3959250f0b - Show all commits

34
nixbld-etc-nixos/configuration.nix
View File

@ -1251,6 +1251,32 @@ in
ExecStart = "${pkgs.bash}/bin/bash -c 'PATH=${pkgs.rt}/bin HOME=/tmp ${pkgs.fetchmail}/bin/fetchmail -f /etc/nixos/secret/rt_fetchmailrc'"; ExecStart = "${pkgs.bash}/bin/bash -c 'PATH=${pkgs.rt}/bin HOME=/tmp ${pkgs.fetchmail}/bin/fetchmail -f /etc/nixos/secret/rt_fetchmailrc'";
}; };
}; };
systemd.services.ssh-tunnel-intl = {
description = "SSH Tunnel to Intl";
wantedBy = [ "multi-user.target" ];
after = [ "sockets.service" ];
serviceConfig = {
Restart = "on-failure";
User = "hydra-queue-runner"; # TODO needs new user both here and there
Group = "hydra";
ExecStart = "${pkgs.openssh}/bin/ssh -N -L 127.0.0.1:1587:5.78.86.156:1587 zolaupd@5.78.86.156";
};
};
sb10q marked this conversation as resolved Outdated
sb10q commented 2024-10-08 16:24:39 +08:00
Outdated
Review
Copy Link

"smtptun" is quite a confusing name. You'd think it's some postfix internal option. Make it more specific and explicit.

"smtptun" is quite a confusing name. You'd think it's some postfix internal option. Make it more specific and explicit.
environment.etc."postfix/sender_relay".text = ''
@m-labs-intl.com [localhost]:1587
sb10q commented 2024-10-15 21:14:08 +08:00
Outdated
Review
Copy Link

In https://www.postfix.org/transport.5.html I don't see the syntax @domain. Just domain. What is going on?

In https://www.postfix.org/transport.5.html I don't see the syntax ``@domain``. Just ``domain``. What is going on?
esavkin commented 2024-10-16 10:20:36 +08:00
Outdated
Review
Copy Link

I checked previously and it just didn't work until I used @domain

I checked previously and it just didn't work until I used `@domain`
sb10q commented 2024-10-16 11:11:13 +08:00
Outdated
Review
Copy Link

Why the apparent discrepancy with the documentation? How carefully did you check?

Why the apparent discrepancy with the documentation? How carefully did you check?
@m-labs.hk :
sb10q marked this conversation as resolved Outdated
sb10q commented 2024-10-14 14:15:04 +08:00
Outdated
Review
Copy Link

Is this really required? I would expect NixOS to deal by itself with services.postfix.mapFiles without requiring any additional user-defined systemd services.

Is this really required? I would expect NixOS to deal by itself with ``services.postfix.mapFiles`` without requiring any additional user-defined systemd services.
sb10q commented 2024-10-14 14:19:05 +08:00
Outdated
Review
Copy Link

https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/mail/postfix.nix#L752-L755

Does this not work for some reason, or is it your usual sloppiness?

https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/mail/postfix.nix#L752-L755 Does this not work for some reason, or is it your usual sloppiness?
@m-labs.ph :
sb10q commented 2024-10-15 21:20:54 +08:00
Outdated
Review
Copy Link

Is the line * : needed?

Is the line ``* :`` needed?
@193thz.com :
@malloctech.fr :
'';
systemd.services.postfix-rebuild-sender-relay = {
description = "Postfix Rebuild Sender Dependent Relayhost Maps";
serviceConfig = {
ExecStart = "${pkgs.postfix}/sbin/postmap /etc/postfix/sender_relay";
};
wantedBy = [ "multi-user.target" ];
};
sb10q commented 2024-10-15 21:14:25 +08:00
Outdated
Review
Copy Link

Is inet_protocols=ipv4 still needed?

Is inet_protocols=ipv4 still needed?
esavkin commented 2024-10-16 10:16:39 +08:00
Outdated
Review
Copy Link

Yes, otherwise it tries to use ipv6

Yes, otherwise it tries to use ipv6
sb10q commented 2024-10-16 11:01:25 +08:00
Outdated
Review
Copy Link

Despite net_interfaces=10.47.3.1 ?

Despite net_interfaces=10.47.3.1 ?
esavkin commented 2024-10-17 10:57:52 +08:00
Outdated
Review
Copy Link

Yes

Yes
mailserver = { mailserver = {
sb10q marked this conversation as resolved Outdated
sb10q commented 2024-10-14 14:26:43 +08:00
Outdated
Review
Copy Link

I have not looked into it, but considering your sloppy code above, this looks suspicious and I recommend you review this and double check that this is the right way of doing it.

I have not looked into it, but considering your sloppy code above, this looks suspicious and I recommend you review this and double check that this is the right way of doing it.
enable = true; enable = true;
@ -1260,8 +1286,14 @@ in
enablePop3 = true; enablePop3 = true;
enablePop3Ssl = true; enablePop3Ssl = true;
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
policydSPFExtraConfig = "skip_addresses = 5.78.86.156,2a01:4ff:1f0:83de::1";
} // (import /etc/nixos/secret/email_settings.nix); } // (import /etc/nixos/secret/email_settings.nix);
sb10q commented 2024-10-14 14:27:27 +08:00
Outdated
Review
Copy Link

Are the last two lines necessary, considering the first line?

Are the last two lines necessary, considering the first line?
services.postfix = {
config = {
sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
postscreen_upstream_proxy_protocol = "haproxy";
postscreen_upstream_proxy_timeout = "5s";
};
};
services.roundcube = { services.roundcube = {
enable = true; enable = true;
hostName = "mail.m-labs.hk"; hostName = "mail.m-labs.hk";