diff options
| -rw-r--r-- | krebs/3modules/default.nix | 1 | ||||
| -rw-r--r-- | krebs/3modules/exim.nix | 157 |
2 files changed, 64 insertions, 94 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 9dac50d55..e87b33600 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -13,6 +13,7 @@ let ./buildbot/slave.nix ./build.nix ./current.nix + ./exim.nix ./exim-retiolum.nix ./exim-smarthost.nix ./fetchWallpaper.nix diff --git a/krebs/3modules/exim.nix b/krebs/3modules/exim.nix index e0890d96a..16a2a37b6 100644 --- a/krebs/3modules/exim.nix +++ b/krebs/3modules/exim.nix @@ -1,111 +1,80 @@ -{ config, lib, pkgs, ... }: - -let - inherit (lib) mkIf mkOption singleton types; - inherit (pkgs) coreutils exim; - cfg = config.services.exim; -in - -{ - - ###### interface - - options = { - - services.exim = { - - enable = mkOption { - type = types.bool; - default = false; - description = "Whether to enable the Exim mail transfer agent."; - }; - - config = mkOption { - type = types.string; - default = ""; - description = '' - Verbatim Exim configuration. This should not contain exim_user, - exim_group, exim_path, or spool_directory. - ''; - }; - - user = mkOption { - type = types.string; - default = "exim"; - description = '' - User to use when no root privileges are required. - In particular, this applies when receiving messages and when doing - remote deliveries. (Local deliveries run as various non-root users, - typically as the owner of a local mailbox.) Specifying this value - as root is not supported. - ''; - }; - - group = mkOption { - type = types.string; - default = "exim"; - description = '' - Group to use when no root privileges are required. - ''; +{ config, lib, pkgs, ... }: with config.krebs.lib; let + cfg = config.krebs.exim; +in { + options.krebs.exim = { + enable = mkEnableOption "krebs.exim"; + config = mkOption { + type = types.str; + default = ""; + description = '' + Verbatim Exim configuration. This should not contain exim_user, + exim_group, exim_path, or spool_directory. + ''; + }; + user = mkOption { + type = types.user; + default = { + name = "exim"; + home = "/var/spool/exim"; }; - - spoolDir = mkOption { - type = types.string; - default = "/var/spool/exim"; - description = '' - Location of the spool directory of exim. - ''; + description = '' + User to use when no root privileges are required. + In particular, this applies when receiving messages and when doing + remote deliveries. (Local deliveries run as various non-root users, + typically as the owner of a local mailbox.) Specifying this value + as root is not supported. + ''; + }; + group = mkOption { + type = types.group; + default = { + name = "exim"; }; - + description = '' + Group to use when no root privileges are required. + ''; }; - }; - - - ###### implementation - - config = mkIf cfg.enable { - + config = lib.mkIf cfg.enable { environment = { etc."exim.conf".text = '' - exim_user = ${cfg.user} - exim_group = ${cfg.group} + exim_user = ${cfg.user.name} + exim_group = ${cfg.group.name} exim_path = /var/setuid-wrappers/exim - spool_directory = ${cfg.spoolDir} + spool_directory = ${cfg.user.home} ${cfg.config} ''; - systemPackages = [ exim ]; - }; - - users.extraUsers = singleton { - name = cfg.user; - description = "Exim mail transfer agent user"; - uid = config.ids.uids.exim; - group = cfg.group; + systemPackages = [ pkgs.exim ]; }; - - users.extraGroups = singleton { - name = cfg.group; - gid = config.ids.gids.exim; + krebs.setuid = { + exim = { + filename = "${pkgs.exim}/bin/exim"; + mode = "4111"; + }; + sendmail = { + filename = "${pkgs.exim}/bin/exim"; + mode = "4111"; + }; }; - - security.setuidPrograms = [ "exim" ]; - systemd.services.exim = { - description = "Exim Mail Daemon"; - wantedBy = [ "multi-user.target" ]; + restartTriggers = [ + config.environment.etc."exim.conf".source + ]; serviceConfig = { - ExecStart = "${exim}/bin/exim -bdf -q30m"; - ExecReload = "${coreutils}/bin/kill -HUP $MAINPID"; + ExecStart = "${pkgs.exim}/bin/exim -bdf -q30m"; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + }; + wantedBy = [ "multi-user.target" ]; + }; + users = { + groups.${cfg.group.name} = { + inherit (cfg.group) name gid; + }; + users.${cfg.user.name} = { + inherit (cfg.user) home name uid; + createHome = true; + group = cfg.group.name; }; - preStart = '' - if ! test -d ${cfg.spoolDir}; then - ${coreutils}/bin/mkdir -p ${cfg.spoolDir} - ${coreutils}/bin/chown ${cfg.user}:${cfg.group} ${cfg.spoolDir} - fi - ''; }; - }; - } |