guixsd-config

commit c810b4587f88055a2793de0f40c3b155eb160117
parent f0ca500f274a41cf21b5966be82bf7892ce70c16
Author: Vineet Kumar <git@vineetk.net>
Date:   Sun,  1 Feb 2026 22:09:33 -0500

saklas: add smtpd

Diffstat:
M
epistemia/systems/saklas.scm
 | 
40
++++++++++++++++++++++++++++++++++++++--

1 file changed, 38 insertions(+), 2 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
@@ -4,6 +4,7 @@
   #:use-module (gnu packages emacs)
   #:use-module (gnu packages golang-crypto)
   #:use-module (gnu packages linux)
+  #:use-module (gnu packages mail)
   #:use-module (gnu packages messaging)
   #:use-module (gnu packages version-control)
   #:use-module (gnu services certbot)
@@ -11,6 +12,7 @@
   #:use-module (gnu services dns)
   #:use-module (gnu services file-sharing)
   #:use-module (gnu services linux)
+  #:use-module (gnu services mail)
   #:use-module (gnu services messaging)
   #:use-module (gnu services networking)
   #:use-module (gnu services security)
@@ -29,7 +31,8 @@
   #:use-module (epistemia systems linux-initrd)
   #:use-module (epistemia services age-secret)
   #:use-module (epistemia services zfs)
-  #:use-module (epistemia packages zfs))
+  #:use-module (epistemia packages zfs)
+  #:use-module (ice-9 format))
 
 (define %nginx-badboi
   (plain-file "nginx-badboi.conf"
@@ -46,6 +49,36 @@ if ($bad_boi = 1) {
 }
 "))
 
+(define %opensmtpd-config
+  (mixed-text-file "opensmtpd.conf"
+		   "table domains { vineetk.net, 13f0.net, vinbiz.ca }\n"
+		   "table virtuals file:/run/secrets/saklas_smtpd_virtuals\n"
+		   "table passwd file:/run/secrets/saklas_smtpd_passwd\n"
+		   "\n"
+		   "pki mail.vineetk.net cert \"/etc/certs/vineetk.net/fullchain.pem\"\n"
+		   "pki mail.vineetk.net key \"/etc/certs/vineetk.net/privkey.pem\"\n"
+		   "\n"
+		   "filter check_dyndns phase connect match rdns regex { '.*\\.dyn\\..*', '.*\\.dsl\\..*' } disconnect \"550 no residential connections\"\n"
+		   "filter check_rdns phase connect match !rdns disconnect \"550 no connections without an rDNS\"\n"
+		   "filter check_fcrdns phase connect match !fcrdns disconnect \"550 no connections without an FCrDNS\"\n"
+		   "#filter sendscore proc-exec \"filter-sendscore -blockBelow 10 -junkBelow 70 -slowFactor 5000\"\n"
+		   "filter dkimsign_rsa proc-exec \""
+                   (file-append opensmtpd-filter-dkimsign "/libexec/opensmtpd/filter-dkimsign")
+                   " -d 13f0.net -d vinbiz.ca -d vineetk.net -s mail -k /run/secrets/saklas_smtpd_dkim\""
+                   " user smtpd group nogroup\n"
+		   "\n"
+		   "listen on socket\n"
+		   "listen on eth0 port 25 tls pki mail.vineetk.net filter { check_dyndns, check_rdns, check_fcrdns }\n"
+		   "listen on eth0 port 465 smtps pki mail.vineetk.net auth <passwd> filter dkimsign_rsa\n"
+		   "\n"
+		   "action \"inbound\" lmtp \"/var/dovecot/lmtp\" rcpt-to virtual <virtuals>\n"
+		   "action \"outbound\" relay helo mail.vineetk.net\n"
+		   "\n"
+		   "match from local for local action \"inbound\"\n"
+		   "match from any for domain <domains> action \"inbound\"\n"
+		   "match from local for any action \"outbound\"\n"
+		   "match from any auth for any action \"outbound\"\n"))
+
 ;; adapted from my pf.conf
 (define %nftables-ruleset
   (plain-file "nftables.conf" "\
@@ -492,7 +525,10 @@ rpz:
 						      (virtualhosts
 						       (list
 							(virtualhost-configuration
-							  (domain "vineetk.net")))))))
+							  (domain "vineetk.net"))))))
+					   (service opensmtpd-service-type
+						    (opensmtpd-configuration
+						      (config-file %opensmtpd-config))))
 				     %base-services)
 	      (guix-service-type config =>
 				 (guix-configuration