2018-02-03 19:04:31 +01:00
|
|
|
|
{ config, options, pkgs, lib, ... }:
|
2016-01-12 10:06:46 +01:00
|
|
|
|
|
|
|
|
|
with lib;
|
|
|
|
|
|
|
|
|
|
let
|
|
|
|
|
|
|
|
|
|
cfg = config.services.rspamd;
|
2018-11-06 00:40:52 +01:00
|
|
|
|
postfixCfg = config.services.postfix;
|
2016-01-12 10:06:46 +01:00
|
|
|
|
|
2018-02-03 19:04:31 +01:00
|
|
|
|
bindSocketOpts = {options, config, ... }: {
|
|
|
|
|
options = {
|
|
|
|
|
socket = mkOption {
|
|
|
|
|
type = types.str;
|
|
|
|
|
example = "localhost:11333";
|
|
|
|
|
description = ''
|
|
|
|
|
Socket for this worker to listen on in a format acceptable by rspamd.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
mode = mkOption {
|
|
|
|
|
type = types.str;
|
|
|
|
|
default = "0644";
|
|
|
|
|
description = "Mode to set on unix socket";
|
|
|
|
|
};
|
|
|
|
|
owner = mkOption {
|
|
|
|
|
type = types.str;
|
|
|
|
|
default = "${cfg.user}";
|
|
|
|
|
description = "Owner to set on unix socket";
|
|
|
|
|
};
|
|
|
|
|
group = mkOption {
|
|
|
|
|
type = types.str;
|
|
|
|
|
default = "${cfg.group}";
|
|
|
|
|
description = "Group to set on unix socket";
|
|
|
|
|
};
|
|
|
|
|
rawEntry = mkOption {
|
|
|
|
|
type = types.str;
|
|
|
|
|
internal = true;
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
config.rawEntry = let
|
|
|
|
|
maybeOption = option:
|
|
|
|
|
optionalString options.${option}.isDefined " ${option}=${config.${option}}";
|
|
|
|
|
in
|
|
|
|
|
if (!(hasPrefix "/" config.socket)) then "${config.socket}"
|
|
|
|
|
else "${config.socket}${maybeOption "mode"}${maybeOption "owner"}${maybeOption "group"}";
|
|
|
|
|
};
|
2016-03-25 15:12:59 +01:00
|
|
|
|
|
2018-11-25 06:10:30 +01:00
|
|
|
|
traceWarning = w: x: builtins.trace "[1;31mwarning: ${w}[0m" x;
|
|
|
|
|
|
|
|
|
|
workerOpts = { name, options, ... }: {
|
2018-02-03 19:04:31 +01:00
|
|
|
|
options = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
type = types.nullOr types.bool;
|
|
|
|
|
default = null;
|
|
|
|
|
description = "Whether to run the rspamd worker.";
|
|
|
|
|
};
|
|
|
|
|
name = mkOption {
|
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
|
default = name;
|
|
|
|
|
description = "Name of the worker";
|
|
|
|
|
};
|
|
|
|
|
type = mkOption {
|
|
|
|
|
type = types.nullOr (types.enum [
|
2019-11-18 13:56:56 +01:00
|
|
|
|
"normal" "controller" "fuzzy" "rspamd_proxy" "lua" "proxy"
|
2018-02-03 19:04:31 +01:00
|
|
|
|
]);
|
2018-11-25 06:10:30 +01:00
|
|
|
|
description = ''
|
|
|
|
|
The type of this worker. The type <literal>proxy</literal> is
|
|
|
|
|
deprecated and only kept for backwards compatibility and should be
|
|
|
|
|
replaced with <literal>rspamd_proxy</literal>.
|
|
|
|
|
'';
|
|
|
|
|
apply = let
|
2019-09-17 01:40:32 +02:00
|
|
|
|
from = "services.rspamd.workers.\"${name}\".type";
|
2018-11-25 06:10:30 +01:00
|
|
|
|
files = options.type.files;
|
|
|
|
|
warning = "The option `${from}` defined in ${showFiles files} has enum value `proxy` which has been renamed to `rspamd_proxy`";
|
|
|
|
|
in x: if x == "proxy" then traceWarning warning "rspamd_proxy" else x;
|
2018-02-03 19:04:31 +01:00
|
|
|
|
};
|
|
|
|
|
bindSockets = mkOption {
|
|
|
|
|
type = types.listOf (types.either types.str (types.submodule bindSocketOpts));
|
|
|
|
|
default = [];
|
|
|
|
|
description = ''
|
|
|
|
|
List of sockets to listen, in format acceptable by rspamd
|
|
|
|
|
'';
|
|
|
|
|
example = [{
|
|
|
|
|
socket = "/run/rspamd.sock";
|
|
|
|
|
mode = "0666";
|
|
|
|
|
owner = "rspamd";
|
|
|
|
|
} "*:11333"];
|
|
|
|
|
apply = value: map (each: if (isString each)
|
|
|
|
|
then if (isUnixSocket each)
|
|
|
|
|
then {socket = each; owner = cfg.user; group = cfg.group; mode = "0644"; rawEntry = "${each}";}
|
|
|
|
|
else {socket = each; rawEntry = "${each}";}
|
|
|
|
|
else each) value;
|
|
|
|
|
};
|
|
|
|
|
count = mkOption {
|
|
|
|
|
type = types.nullOr types.int;
|
|
|
|
|
default = null;
|
|
|
|
|
description = ''
|
|
|
|
|
Number of worker instances to run
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
includes = mkOption {
|
|
|
|
|
type = types.listOf types.str;
|
|
|
|
|
default = [];
|
|
|
|
|
description = ''
|
|
|
|
|
List of files to include in configuration
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
extraConfig = mkOption {
|
|
|
|
|
type = types.lines;
|
|
|
|
|
default = "";
|
|
|
|
|
description = "Additional entries to put verbatim into worker section of rspamd config file.";
|
|
|
|
|
};
|
|
|
|
|
};
|
2018-11-06 00:32:14 +01:00
|
|
|
|
config = mkIf (name == "normal" || name == "controller" || name == "fuzzy" || name == "rspamd_proxy") {
|
2018-02-03 19:04:31 +01:00
|
|
|
|
type = mkDefault name;
|
2018-11-06 00:32:14 +01:00
|
|
|
|
includes = mkDefault [ "$CONFDIR/worker-${if name == "rspamd_proxy" then "proxy" else name}.inc" ];
|
|
|
|
|
bindSockets =
|
|
|
|
|
let
|
|
|
|
|
unixSocket = name: {
|
|
|
|
|
mode = "0660";
|
|
|
|
|
socket = "/run/rspamd/${name}.sock";
|
|
|
|
|
owner = cfg.user;
|
|
|
|
|
group = cfg.group;
|
|
|
|
|
};
|
|
|
|
|
in mkDefault (if name == "normal" then [(unixSocket "rspamd")]
|
|
|
|
|
else if name == "controller" then [ "localhost:11334" ]
|
|
|
|
|
else if name == "rspamd_proxy" then [ (unixSocket "proxy") ]
|
|
|
|
|
else [] );
|
2018-02-03 19:04:31 +01:00
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
isUnixSocket = socket: hasPrefix "/" (if (isString socket) then socket else socket.socket);
|
2018-09-28 04:00:24 +02:00
|
|
|
|
|
|
|
|
|
mkBindSockets = enabled: socks: concatStringsSep "\n "
|
|
|
|
|
(flatten (map (each: "bind_socket = \"${each.rawEntry}\";") socks));
|
2018-02-03 19:04:31 +01:00
|
|
|
|
|
|
|
|
|
rspamdConfFile = pkgs.writeText "rspamd.conf"
|
2016-03-25 15:12:59 +01:00
|
|
|
|
''
|
|
|
|
|
.include "$CONFDIR/common.conf"
|
|
|
|
|
|
|
|
|
|
options {
|
|
|
|
|
pidfile = "$RUNDIR/rspamd.pid";
|
|
|
|
|
.include "$CONFDIR/options.inc"
|
2018-11-01 23:55:44 +01:00
|
|
|
|
.include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/options.inc"
|
|
|
|
|
.include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/options.inc"
|
2016-03-25 15:12:59 +01:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
logging {
|
2016-07-28 06:03:38 +02:00
|
|
|
|
type = "syslog";
|
2016-03-25 15:12:59 +01:00
|
|
|
|
.include "$CONFDIR/logging.inc"
|
2018-11-01 23:55:44 +01:00
|
|
|
|
.include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/logging.inc"
|
|
|
|
|
.include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/logging.inc"
|
2016-03-25 15:12:59 +01:00
|
|
|
|
}
|
|
|
|
|
|
2018-11-06 00:34:23 +01:00
|
|
|
|
${concatStringsSep "\n" (mapAttrsToList (name: value: let
|
|
|
|
|
includeName = if name == "rspamd_proxy" then "proxy" else name;
|
2020-10-14 01:46:17 +02:00
|
|
|
|
tryOverride = boolToString (value.extraConfig == "");
|
2018-11-06 00:34:23 +01:00
|
|
|
|
in ''
|
2018-11-06 00:26:55 +01:00
|
|
|
|
worker "${value.type}" {
|
2018-02-03 19:04:31 +01:00
|
|
|
|
type = "${value.type}";
|
|
|
|
|
${optionalString (value.enable != null)
|
|
|
|
|
"enabled = ${if value.enable != false then "yes" else "no"};"}
|
|
|
|
|
${mkBindSockets value.enable value.bindSockets}
|
|
|
|
|
${optionalString (value.count != null) "count = ${toString value.count};"}
|
|
|
|
|
${concatStringsSep "\n " (map (each: ".include \"${each}\"") value.includes)}
|
2018-11-06 00:34:23 +01:00
|
|
|
|
.include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/worker-${includeName}.inc"
|
|
|
|
|
.include(try=${tryOverride}; priority=10) "$LOCAL_CONFDIR/override.d/worker-${includeName}.inc"
|
2018-02-03 19:04:31 +01:00
|
|
|
|
}
|
|
|
|
|
'') cfg.workers)}
|
2017-12-31 16:11:15 +01:00
|
|
|
|
|
2018-11-06 00:34:23 +01:00
|
|
|
|
${optionalString (cfg.extraConfig != "") ''
|
|
|
|
|
.include(priority=10) "$LOCAL_CONFDIR/override.d/extra-config.inc"
|
|
|
|
|
''}
|
2016-03-25 15:12:59 +01:00
|
|
|
|
'';
|
|
|
|
|
|
2018-11-05 17:50:34 +01:00
|
|
|
|
filterFiles = files: filterAttrs (n: v: v.enable) files;
|
2018-11-01 23:55:44 +01:00
|
|
|
|
rspamdDir = pkgs.linkFarm "etc-rspamd-dir" (
|
2018-11-05 17:50:34 +01:00
|
|
|
|
(mapAttrsToList (name: file: { name = "local.d/${name}"; path = file.source; }) (filterFiles cfg.locals)) ++
|
|
|
|
|
(mapAttrsToList (name: file: { name = "override.d/${name}"; path = file.source; }) (filterFiles cfg.overrides)) ++
|
2018-11-01 23:55:44 +01:00
|
|
|
|
(optional (cfg.localLuaRules != null) { name = "rspamd.local.lua"; path = cfg.localLuaRules; }) ++
|
|
|
|
|
[ { name = "rspamd.conf"; path = rspamdConfFile; } ]
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
configFileModule = prefix: { name, config, ... }: {
|
|
|
|
|
options = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = true;
|
|
|
|
|
description = ''
|
|
|
|
|
Whether this file ${prefix} should be generated. This
|
|
|
|
|
option allows specific ${prefix} files to be disabled.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
text = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = types.nullOr types.lines;
|
|
|
|
|
description = "Text of the file.";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
source = mkOption {
|
|
|
|
|
type = types.path;
|
|
|
|
|
description = "Path of the source file.";
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
config = {
|
|
|
|
|
source = mkIf (config.text != null) (
|
|
|
|
|
let name' = "rspamd-${prefix}-" + baseNameOf name;
|
|
|
|
|
in mkDefault (pkgs.writeText name' config.text));
|
|
|
|
|
};
|
|
|
|
|
};
|
2018-11-06 00:34:23 +01:00
|
|
|
|
|
|
|
|
|
configOverrides =
|
|
|
|
|
(mapAttrs' (n: v: nameValuePair "worker-${if n == "rspamd_proxy" then "proxy" else n}.inc" {
|
|
|
|
|
text = v.extraConfig;
|
|
|
|
|
})
|
|
|
|
|
(filterAttrs (n: v: v.extraConfig != "") cfg.workers))
|
|
|
|
|
// (if cfg.extraConfig == "" then {} else {
|
|
|
|
|
"extra-config.inc".text = cfg.extraConfig;
|
|
|
|
|
});
|
2016-01-12 10:06:46 +01:00
|
|
|
|
in
|
|
|
|
|
|
|
|
|
|
{
|
|
|
|
|
###### interface
|
|
|
|
|
|
|
|
|
|
options = {
|
|
|
|
|
|
|
|
|
|
services.rspamd = {
|
|
|
|
|
|
2018-10-05 08:14:45 +02:00
|
|
|
|
enable = mkEnableOption "rspamd, the Rapid spam filtering system";
|
2016-01-12 10:06:46 +01:00
|
|
|
|
|
|
|
|
|
debug = mkOption {
|
2018-02-03 19:04:31 +01:00
|
|
|
|
type = types.bool;
|
2016-01-12 10:06:46 +01:00
|
|
|
|
default = false;
|
|
|
|
|
description = "Whether to run the rspamd daemon in debug mode.";
|
|
|
|
|
};
|
|
|
|
|
|
2018-11-01 23:55:44 +01:00
|
|
|
|
locals = mkOption {
|
2018-11-05 17:50:34 +01:00
|
|
|
|
type = with types; attrsOf (submodule (configFileModule "locals"));
|
2018-11-01 23:55:44 +01:00
|
|
|
|
default = {};
|
|
|
|
|
description = ''
|
|
|
|
|
Local configuration files, written into <filename>/etc/rspamd/local.d/{name}</filename>.
|
|
|
|
|
'';
|
|
|
|
|
example = literalExample ''
|
|
|
|
|
{ "redis.conf".source = "/nix/store/.../etc/dir/redis.conf";
|
|
|
|
|
"arc.conf".text = "allow_envfrom_empty = true;";
|
|
|
|
|
}
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
overrides = mkOption {
|
2018-11-05 17:50:34 +01:00
|
|
|
|
type = with types; attrsOf (submodule (configFileModule "overrides"));
|
2018-11-01 23:55:44 +01:00
|
|
|
|
default = {};
|
|
|
|
|
description = ''
|
|
|
|
|
Overridden configuration files, written into <filename>/etc/rspamd/override.d/{name}</filename>.
|
|
|
|
|
'';
|
|
|
|
|
example = literalExample ''
|
|
|
|
|
{ "redis.conf".source = "/nix/store/.../etc/dir/redis.conf";
|
|
|
|
|
"arc.conf".text = "allow_envfrom_empty = true;";
|
|
|
|
|
}
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
localLuaRules = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = types.nullOr types.path;
|
|
|
|
|
description = ''
|
|
|
|
|
Path of file to link to <filename>/etc/rspamd/rspamd.local.lua</filename> for local
|
|
|
|
|
rules written in Lua
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2018-02-03 19:04:31 +01:00
|
|
|
|
workers = mkOption {
|
|
|
|
|
type = with types; attrsOf (submodule workerOpts);
|
2016-03-25 15:12:59 +01:00
|
|
|
|
description = ''
|
2018-02-03 19:04:31 +01:00
|
|
|
|
Attribute set of workers to start.
|
|
|
|
|
'';
|
|
|
|
|
default = {
|
|
|
|
|
normal = {};
|
|
|
|
|
controller = {};
|
|
|
|
|
};
|
|
|
|
|
example = literalExample ''
|
|
|
|
|
{
|
|
|
|
|
normal = {
|
|
|
|
|
includes = [ "$CONFDIR/worker-normal.inc" ];
|
|
|
|
|
bindSockets = [{
|
|
|
|
|
socket = "/run/rspamd/rspamd.sock";
|
|
|
|
|
mode = "0660";
|
|
|
|
|
owner = "${cfg.user}";
|
|
|
|
|
group = "${cfg.group}";
|
|
|
|
|
}];
|
|
|
|
|
};
|
|
|
|
|
controller = {
|
|
|
|
|
includes = [ "$CONFDIR/worker-controller.inc" ];
|
|
|
|
|
bindSockets = [ "[::1]:11334" ];
|
|
|
|
|
};
|
|
|
|
|
}
|
2016-03-25 15:12:59 +01:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2017-12-31 16:11:15 +01:00
|
|
|
|
extraConfig = mkOption {
|
|
|
|
|
type = types.lines;
|
|
|
|
|
default = "";
|
|
|
|
|
description = ''
|
|
|
|
|
Extra configuration to add at the end of the rspamd configuration
|
|
|
|
|
file.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2016-01-12 10:06:46 +01:00
|
|
|
|
user = mkOption {
|
2019-08-08 22:48:27 +02:00
|
|
|
|
type = types.str;
|
2016-01-12 10:06:46 +01:00
|
|
|
|
default = "rspamd";
|
|
|
|
|
description = ''
|
|
|
|
|
User to use when no root privileges are required.
|
|
|
|
|
'';
|
2018-11-06 00:32:14 +01:00
|
|
|
|
};
|
2016-01-12 10:06:46 +01:00
|
|
|
|
|
|
|
|
|
group = mkOption {
|
2019-08-08 22:48:27 +02:00
|
|
|
|
type = types.str;
|
2016-01-12 10:06:46 +01:00
|
|
|
|
default = "rspamd";
|
|
|
|
|
description = ''
|
|
|
|
|
Group to use when no root privileges are required.
|
|
|
|
|
'';
|
2018-11-06 00:40:52 +01:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
postfix = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = false;
|
|
|
|
|
description = "Add rspamd milter to postfix main.conf";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
config = mkOption {
|
2019-08-08 23:35:52 +02:00
|
|
|
|
type = with types; attrsOf (oneOf [ bool str (listOf str) ]);
|
2018-11-06 00:40:52 +01:00
|
|
|
|
description = ''
|
|
|
|
|
Addon to postfix configuration
|
|
|
|
|
'';
|
|
|
|
|
default = {
|
|
|
|
|
smtpd_milters = ["unix:/run/rspamd/rspamd-milter.sock"];
|
|
|
|
|
non_smtpd_milters = ["unix:/run/rspamd/rspamd-milter.sock"];
|
|
|
|
|
};
|
|
|
|
|
example = {
|
|
|
|
|
smtpd_milters = ["unix:/run/rspamd/rspamd-milter.sock"];
|
|
|
|
|
non_smtpd_milters = ["unix:/run/rspamd/rspamd-milter.sock"];
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
};
|
2016-01-12 10:06:46 +01:00
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
###### implementation
|
|
|
|
|
|
|
|
|
|
config = mkIf cfg.enable {
|
2018-11-06 00:34:23 +01:00
|
|
|
|
services.rspamd.overrides = configOverrides;
|
2018-11-06 00:40:52 +01:00
|
|
|
|
services.rspamd.workers = mkIf cfg.postfix.enable {
|
|
|
|
|
controller = {};
|
|
|
|
|
rspamd_proxy = {
|
|
|
|
|
bindSockets = [ {
|
|
|
|
|
mode = "0660";
|
|
|
|
|
socket = "/run/rspamd/rspamd-milter.sock";
|
|
|
|
|
owner = cfg.user;
|
|
|
|
|
group = postfixCfg.group;
|
|
|
|
|
} ];
|
|
|
|
|
extraConfig = ''
|
|
|
|
|
upstream "local" {
|
|
|
|
|
default = yes; # Self-scan upstreams are always default
|
|
|
|
|
self_scan = yes; # Enable self-scan
|
|
|
|
|
}
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
services.postfix.config = mkIf cfg.postfix.enable cfg.postfix.config;
|
2016-01-12 10:06:46 +01:00
|
|
|
|
|
2021-08-22 03:05:43 +02:00
|
|
|
|
systemd.services.postfix = mkIf cfg.postfix.enable {
|
|
|
|
|
serviceConfig.SupplementaryGroups = [ postfixCfg.group ];
|
|
|
|
|
};
|
2020-11-29 12:51:53 +01:00
|
|
|
|
|
2016-01-12 10:06:46 +01:00
|
|
|
|
# Allow users to run 'rspamc' and 'rspamadm'.
|
|
|
|
|
environment.systemPackages = [ pkgs.rspamd ];
|
|
|
|
|
|
2019-09-14 19:51:29 +02:00
|
|
|
|
users.users.${cfg.user} = {
|
2016-01-12 10:06:46 +01:00
|
|
|
|
description = "rspamd daemon";
|
|
|
|
|
uid = config.ids.uids.rspamd;
|
|
|
|
|
group = cfg.group;
|
|
|
|
|
};
|
|
|
|
|
|
2019-09-14 19:51:29 +02:00
|
|
|
|
users.groups.${cfg.group} = {
|
2016-03-25 15:12:59 +01:00
|
|
|
|
gid = config.ids.gids.rspamd;
|
2016-01-12 10:06:46 +01:00
|
|
|
|
};
|
|
|
|
|
|
2019-08-13 23:52:01 +02:00
|
|
|
|
environment.etc.rspamd.source = rspamdDir;
|
2018-02-03 19:04:31 +01:00
|
|
|
|
|
2016-01-12 10:06:46 +01:00
|
|
|
|
systemd.services.rspamd = {
|
|
|
|
|
description = "Rspamd Service";
|
|
|
|
|
|
2018-09-28 04:00:24 +02:00
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
|
after = [ "network.target" ];
|
2018-11-01 23:55:44 +01:00
|
|
|
|
restartTriggers = [ rspamdDir ];
|
2016-01-12 10:06:46 +01:00
|
|
|
|
|
|
|
|
|
serviceConfig = {
|
2020-07-16 04:15:44 +02:00
|
|
|
|
ExecStart = "${pkgs.rspamd}/bin/rspamd ${optionalString cfg.debug "-d"} -c /etc/rspamd/rspamd.conf -f";
|
2016-01-12 10:06:46 +01:00
|
|
|
|
Restart = "always";
|
2020-07-16 04:15:44 +02:00
|
|
|
|
|
|
|
|
|
User = "${cfg.user}";
|
|
|
|
|
Group = "${cfg.group}";
|
2020-11-29 12:51:53 +01:00
|
|
|
|
SupplementaryGroups = mkIf cfg.postfix.enable [ postfixCfg.group ];
|
2020-07-16 04:15:44 +02:00
|
|
|
|
|
2016-07-28 06:03:38 +02:00
|
|
|
|
RuntimeDirectory = "rspamd";
|
2020-07-16 04:15:44 +02:00
|
|
|
|
RuntimeDirectoryMode = "0755";
|
|
|
|
|
StateDirectory = "rspamd";
|
|
|
|
|
StateDirectoryMode = "0700";
|
|
|
|
|
|
2020-07-18 12:25:07 +02:00
|
|
|
|
AmbientCapabilities = [];
|
2021-04-25 20:26:22 +02:00
|
|
|
|
CapabilityBoundingSet = "";
|
2020-07-16 04:15:44 +02:00
|
|
|
|
DevicePolicy = "closed";
|
|
|
|
|
LockPersonality = true;
|
|
|
|
|
NoNewPrivileges = true;
|
|
|
|
|
PrivateDevices = true;
|
|
|
|
|
PrivateMounts = true;
|
2016-07-28 06:03:38 +02:00
|
|
|
|
PrivateTmp = true;
|
2020-11-29 12:51:53 +01:00
|
|
|
|
# we need to chown socket to rspamd-milter
|
|
|
|
|
PrivateUsers = !cfg.postfix.enable;
|
2020-07-16 04:15:44 +02:00
|
|
|
|
ProtectClock = true;
|
|
|
|
|
ProtectControlGroups = true;
|
|
|
|
|
ProtectHome = true;
|
|
|
|
|
ProtectHostname = true;
|
|
|
|
|
ProtectKernelLogs = true;
|
|
|
|
|
ProtectKernelModules = true;
|
|
|
|
|
ProtectKernelTunables = true;
|
|
|
|
|
ProtectSystem = "strict";
|
|
|
|
|
RemoveIPC = true;
|
2020-07-18 12:25:07 +02:00
|
|
|
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
2020-07-16 04:15:44 +02:00
|
|
|
|
RestrictNamespaces = true;
|
|
|
|
|
RestrictRealtime = true;
|
|
|
|
|
RestrictSUIDSGID = true;
|
|
|
|
|
SystemCallArchitectures = "native";
|
|
|
|
|
SystemCallFilter = "@system-service";
|
|
|
|
|
UMask = "0077";
|
2016-01-12 10:06:46 +01:00
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
};
|
2018-02-03 19:04:31 +01:00
|
|
|
|
imports = [
|
2018-09-28 04:00:24 +02:00
|
|
|
|
(mkRemovedOptionModule [ "services" "rspamd" "socketActivation" ]
|
2020-11-22 08:23:53 +01:00
|
|
|
|
"Socket activation never worked correctly and could at this time not be fixed and so was removed")
|
2018-02-03 19:04:31 +01:00
|
|
|
|
(mkRenamedOptionModule [ "services" "rspamd" "bindSocket" ] [ "services" "rspamd" "workers" "normal" "bindSockets" ])
|
|
|
|
|
(mkRenamedOptionModule [ "services" "rspamd" "bindUISocket" ] [ "services" "rspamd" "workers" "controller" "bindSockets" ])
|
2019-12-10 02:51:19 +01:00
|
|
|
|
(mkRemovedOptionModule [ "services" "rmilter" ] "Use services.rspamd.* instead to set up milter service")
|
2018-02-03 19:04:31 +01:00
|
|
|
|
];
|
2016-01-12 10:06:46 +01:00
|
|
|
|
}
|