M-Labs/it-infra
M-Labs
/
it-infra
8
0
Fork 6
Code Issues 10 Pull Requests Releases Wiki Activity

Use postfix options for routing mails through tunnel #45

Closed
esavkin wants to merge 15 commits from enable-mail-proxy-and-tunnel into master
pull from: enable-mail-proxy-and-tunnel
merge into: M-Labs:master
Conversation 7 Commits 15 Files Changed 1 +16 -7
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 6832725535 - Show all commits

23
nixbld-etc-nixos/configuration.nix
View File

@ -1257,9 +1257,9 @@ in
after = [ "sockets.service" ]; after = [ "sockets.service" ];
serviceConfig = { serviceConfig = {
Restart = "on-failure"; Restart = "on-failure";
User = "hydra-queue-runner"; # TODO needs new user both here and there User = "hydra-queue-runner"; # TODO needs new user here
Group = "hydra"; Group = "hydra";
ExecStart = "${pkgs.openssh}/bin/ssh -N -D 127.0.0.1:1587 zolaupd@5.78.86.156"; ExecStart = "${pkgs.openssh}/bin/ssh -N -D 127.0.0.1:1587 ssh_tunnel@5.78.86.156";
}; };
}; };
sb10q marked this conversation as resolved Outdated
sb10q commented 2024-10-08 16:24:39 +08:00
Outdated
Review
Copy Link

"smtptun" is quite a confusing name. You'd think it's some postfix internal option. Make it more specific and explicit.

"smtptun" is quite a confusing name. You'd think it's some postfix internal option. Make it more specific and explicit.
@ -1267,10 +1267,6 @@ in
m-labs-intl.com socks: m-labs-intl.com socks:
sb10q commented 2024-10-15 21:14:08 +08:00
Outdated
Review
Copy Link

In https://www.postfix.org/transport.5.html I don't see the syntax @domain. Just domain. What is going on?

In https://www.postfix.org/transport.5.html I don't see the syntax ``@domain``. Just ``domain``. What is going on?
esavkin commented 2024-10-16 10:20:36 +08:00
Outdated
Review
Copy Link

I checked previously and it just didn't work until I used @domain

I checked previously and it just didn't work until I used `@domain`
sb10q commented 2024-10-16 11:11:13 +08:00
Outdated
Review
Copy Link

Why the apparent discrepancy with the documentation? How carefully did you check?

Why the apparent discrepancy with the documentation? How carefully did you check?
* : * :
sb10q marked this conversation as resolved Outdated
sb10q commented 2024-10-14 14:15:04 +08:00
Outdated
Review
Copy Link

Is this really required? I would expect NixOS to deal by itself with services.postfix.mapFiles without requiring any additional user-defined systemd services.

Is this really required? I would expect NixOS to deal by itself with ``services.postfix.mapFiles`` without requiring any additional user-defined systemd services.
sb10q commented 2024-10-14 14:19:05 +08:00
Outdated
Review
Copy Link

https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/mail/postfix.nix#L752-L755

Does this not work for some reason, or is it your usual sloppiness?

https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/mail/postfix.nix#L752-L755 Does this not work for some reason, or is it your usual sloppiness?
''; '';
sb10q commented 2024-10-15 21:20:54 +08:00
Outdated
Review
Copy Link

Is the line * : needed?

Is the line ``* :`` needed?
environment.etc."tsocks.conf".text = ''
server = 127.0.0.1
server_port = 1587
'';
systemd.services.postfix-rebuild-sender-relay = { systemd.services.postfix-rebuild-sender-relay = {
description = "Postfix Rebuild Sender Dependent Relayhost Maps"; description = "Postfix Rebuild Sender Dependent Relayhost Maps";
serviceConfig = { serviceConfig = {
@ -1288,6 +1284,19 @@ in
enablePop3Ssl = true; enablePop3Ssl = true;
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
} // (import /etc/nixos/secret/email_settings.nix); } // (import /etc/nixos/secret/email_settings.nix);
ssh_proxy_conf = builtins.toFile "proxychains.conf" ''
strict_chain
tcp_read_time_out 15000
sb10q commented 2024-10-14 14:27:27 +08:00
Outdated
Review
Copy Link

Are the last two lines necessary, considering the first line?

Are the last two lines necessary, considering the first line?
tcp_connect_time_out 8000
localnet 192.168.1.0/255.255.255.0
localnet 127.0.0.0/255.0.0.0
localnet ::1/128
localnet 94.190.212.123/255.255.255.255
localnet 202.77.7.238/255.255.255.255
localnet 2001:470:18:390::2/255.255.255.255
[ProxyList]
socks5 127.0.0.1 1587
'';
services.postfix = { services.postfix = {
config = { config = {
sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay"; sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
@ -1296,7 +1305,7 @@ in
masterConfig.socks = { masterConfig.socks = {
type = "unix"; type = "unix";
command = "pipe"; command = "pipe";
args = "flags=R user=nobody argv=${pkgs.tsocks}/bin/tsocks ${pkgs.postfix}/bin/sendmail -oi -f $sender $recipient"; args = "flags=R user=nobody argv=${pkgs.proxychains-ng}/bin/proxychains4 -f ${config.ssh_proxy_conf} ${pkgs.postfix}/bin/sendmail -oi -f $sender $recipient";
}; };
}; };
}; };