Merge remote-tracking branch 'cd/master'

4 files changed, 182 insertions, 0 deletions

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 8573c5a05..467cc4459 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -6,6 +6,7 @@ let
 
   out = {
     imports = [
+      ./exim-retiolum.nix
       ./github-hosts-sync.nix
       ./git.nix
       ./nginx.nix
diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix
new file mode 100644
index 000000000..09372f074
--- /dev/null
+++ b/krebs/3modules/exim-retiolum.nix
@@ -0,0 +1,142 @@
+{ config, pkgs, lib, ... }:
+
+with builtins;
+with lib;
+let
+  cfg = config.krebs.exim-retiolum;
+
+  out = {
+    options.krebs.exim-retiolum = api;
+    config =
+      # This configuration makes only sense for retiolum-enabled hosts.
+      # TODO modular configuration
+      assert config.krebs.retiolum.enable;
+      mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "krebs.exim-retiolum";
+  };
+
+  imp = {
+    services.exim = {
+      enable = true;
+      config = ''
+        primary_hostname = ${retiolumHostname}
+        domainlist local_domains    = @ : localhost
+        domainlist relay_to_domains = *.retiolum
+        hostlist   relay_from_hosts = <; 127.0.0.1 ; ::1
+
+        acl_smtp_rcpt = acl_check_rcpt
+        acl_smtp_data = acl_check_data
+
+        host_lookup = *
+        rfc1413_hosts = *
+        rfc1413_query_timeout = 5s
+
+        log_file_path = syslog
+        syslog_timestamp = false
+        syslog_duplication = false
+
+        begin acl
+
+        acl_check_rcpt:
+          accept  hosts = :
+                  control = dkim_disable_verify
+
+          deny    message       = Restricted characters in address
+                  domains       = +local_domains
+                  local_parts   = ^[.] : ^.*[@%!/|]
+
+          deny    message       = Restricted characters in address
+                  domains       = !+local_domains
+                  local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+
+          accept  local_parts   = postmaster
+                  domains       = +local_domains
+
+          #accept
+          #  hosts = *.retiolum
+          #  domains = *.retiolum
+          #  control = dkim_disable_verify
+
+          #require verify        = sender
+
+          accept  hosts         = +relay_from_hosts
+                  control       = submission
+                  control       = dkim_disable_verify
+
+          accept  authenticated = *
+                  control       = submission
+                  control       = dkim_disable_verify
+
+          require message = relay not permitted
+                  domains = +local_domains : +relay_to_domains
+
+          require verify = recipient
+
+          accept
+
+
+        acl_check_data:
+          accept
+
+
+        begin routers
+
+        retiolum:
+          driver = manualroute
+          domains = ! ${retiolumHostname} : *.retiolum
+          transport = remote_smtp
+          route_list = ^.* $0 byname
+          no_more
+
+        nonlocal:
+          debug_print = "R: nonlocal for $local_part@$domain"
+          driver = redirect
+          domains = ! +local_domains
+          allow_fail
+          data = :fail: Mailing to remote domains not supported
+          no_more
+
+        local_user:
+          # debug_print = "R: local_user for $local_part@$domain"
+          driver = accept
+          check_local_user
+        # local_part_suffix = +* : -*
+        # local_part_suffix_optional
+          transport = home_maildir
+          cannot_route_message = Unknown user
+
+
+        begin transports
+
+        remote_smtp:
+          driver = smtp
+
+        home_maildir:
+          driver = appendfile
+          maildir_format
+          directory = $home/Maildir
+          directory_mode = 0700
+          delivery_date_add
+          envelope_to_add
+          return_path_add
+        # group = mail
+        # mode = 0660
+
+        begin retry
+        *.retiolum             *           F,42d,1m
+        *                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h
+
+        begin rewrite
+
+        begin authenticators
+      '';
+    };
+  };
+
+  # TODO get the hostname from somewhere else.
+  retiolumHostname = "${config.networking.hostName}.retiolum";
+in
+out
diff --git a/krebs/5pkgs/cac.nix b/krebs/5pkgs/cac.nix
new file mode 100644
index 000000000..eff523048
--- /dev/null
+++ b/krebs/5pkgs/cac.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchgit, coreutils, curl, gnused, jq, ncurses, sshpass, ... }:
+
+stdenv.mkDerivation {
+  name = "cac";
+
+  src = fetchgit {
+    url = http://cgit.cd.retiolum/cac;
+    rev = "f4589158572ab35969b9bccf801ea07e115705e1";
+    sha256 = "9d761cd1d7ff68507392cbfd6c3f6000ddff9cc540293da2b3c4ee902321fb27";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase =
+    let
+      path = stdenv.lib.makeSearchPath "bin" [
+        coreutils
+        curl
+        gnused
+        jq
+        ncurses
+        sshpass
+      ];
+    in
+    ''
+      mkdir -p $out/bin
+
+      sed \
+        's,^\(  true) \)\(cac "$@";;\)$,\1 PATH=${path}${PATH+:$PATH} \2,' \
+        < ./cac \
+        > $out/bin/cac
+
+      chmod +x $out/bin/cac
+    '';
+}
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index 231fda797..5de84f66c 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -6,6 +6,7 @@ in
 
 pkgs //
 {
+  cac = callPackage ./cac.nix {};
   dic = callPackage ./dic.nix {};
   genid = callPackage ./genid.nix {};
   github-hosts-sync = callPackage ./github-hosts-sync.nix {};