M-Labs/it-infra
M-Labs
/
it-infra
8
0
Fork 6
Code Issues 10 Pull Requests Releases Wiki Activity

Use postfix options for routing mails through tunnel #45

Closed
esavkin wants to merge 15 commits from enable-mail-proxy-and-tunnel into master
pull from: enable-mail-proxy-and-tunnel
merge into: M-Labs:master
Conversation 7 Commits 15 Files Changed 1 +18 -1
1 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
nixbld-etc-nixos/configuration.nix
View File

@ -1260,8 +1260,25 @@ in
enablePop3 = true;
enablePop3Ssl = true;
certificateScheme = "acme-nginx";
policydSPFExtraConfig = "skip_addresses = 5.78.86.156,2a01:4ff:1f0:83de::1";
} // (import /etc/nixos/secret/email_settings.nix);
services.postfix = {
sb10q marked this conversation as resolved Outdated
sb10q commented 2024-10-08 16:24:39 +08:00
Outdated
Review
Copy Link

"smtptun" is quite a confusing name. You'd think it's some postfix internal option. Make it more specific and explicit.

"smtptun" is quite a confusing name. You'd think it's some postfix internal option. Make it more specific and explicit.
mapFiles.sender_transport = pkgs.writeText "sender_transport" ''
@m-labs-intl.com intltunnel:
'';
sb10q commented 2024-10-15 21:14:08 +08:00
Outdated
Review
Copy Link

In https://www.postfix.org/transport.5.html I don't see the syntax @domain. Just domain. What is going on?

In https://www.postfix.org/transport.5.html I don't see the syntax ``@domain``. Just ``domain``. What is going on?
esavkin commented 2024-10-16 10:20:36 +08:00
Outdated
Review
Copy Link

I checked previously and it just didn't work until I used @domain

I checked previously and it just didn't work until I used `@domain`
sb10q commented 2024-10-16 11:11:13 +08:00
Outdated
Review
Copy Link

Why the apparent discrepancy with the documentation? How carefully did you check?

Why the apparent discrepancy with the documentation? How carefully did you check?
config = {
sb10q marked this conversation as resolved Outdated
sb10q commented 2024-10-14 14:15:04 +08:00
Outdated
Review
Copy Link

Is this really required? I would expect NixOS to deal by itself with services.postfix.mapFiles without requiring any additional user-defined systemd services.

Is this really required? I would expect NixOS to deal by itself with ``services.postfix.mapFiles`` without requiring any additional user-defined systemd services.
sb10q commented 2024-10-14 14:19:05 +08:00
Outdated
Review
Copy Link

https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/mail/postfix.nix#L752-L755

Does this not work for some reason, or is it your usual sloppiness?

https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/mail/postfix.nix#L752-L755 Does this not work for some reason, or is it your usual sloppiness?
sender_dependent_default_transport_maps = "hash:/var/lib/postfix/conf/sender_transport";
sb10q commented 2024-10-15 21:20:54 +08:00
Outdated
Review
Copy Link

Is the line * : needed?

Is the line ``* :`` needed?
};
masterConfig."intltunnel" = {
type = "unix";
command = "smtp";
args = [
"-o" "inet_interfaces=10.47.3.1"
"-o" "smtp_helo_name=mail.m-labs-intl.com"
"-o" "inet_protocols=ipv4"
];
};
sb10q commented 2024-10-15 21:14:25 +08:00
Outdated
Review
Copy Link

Is inet_protocols=ipv4 still needed?

Is inet_protocols=ipv4 still needed?
esavkin commented 2024-10-16 10:16:39 +08:00
Outdated
Review
Copy Link

Yes, otherwise it tries to use ipv6

Yes, otherwise it tries to use ipv6
sb10q commented 2024-10-16 11:01:25 +08:00
Outdated
Review
Copy Link

Despite net_interfaces=10.47.3.1 ?

Despite net_interfaces=10.47.3.1 ?
esavkin commented 2024-10-17 10:57:52 +08:00
Outdated
Review
Copy Link

Yes

Yes
};
sb10q marked this conversation as resolved Outdated
sb10q commented 2024-10-14 14:26:43 +08:00
Outdated
Review
Copy Link

I have not looked into it, but considering your sloppy code above, this looks suspicious and I recommend you review this and double check that this is the right way of doing it.

I have not looked into it, but considering your sloppy code above, this looks suspicious and I recommend you review this and double check that this is the right way of doing it.
services.roundcube = {
enable = true;
hostName = "mail.m-labs.hk";