dotfiles/nixng/containers/email/postfix/default.nix

{inputs, ...}: {
  flake.nixngConfigurations.postfix = inputs.nixng.nglib.makeSystem {
    system = "x86_64-linux";
    name = "nixng-postfix";
    inherit
      (inputs)
      nixpkgs
      ;
    config = {
      pkgs,
      config,
      ...
    }: {
      config = {
        dumb-init = {
          enable = true;
          type.services = {};
        };
        init.services.postfix = {
          shutdownOnExit = true;
        };
        services.postfix = {
          enable = true;

          masterConfig = import ./master_config.nix;
          mainConfig = {
            smptd_banner = ["$myhostname" "ESMTP" "$mail_name" "(Ubuntu)"];
            biff = "no";

            # delay_warning_time = "4h";

            append_dot_mydomain = "no";

            readme_directory = "no";

            compatibility_level = 2;

            smtpd_tls_cert_file = "/etc/letsencrypt/live/example.com/fullchain.pem";
            smtpd_tls_key_file = "/etc/letsencrypt/live/example.com/privkey.pem";
            smtpd_use_tls = "yes";
            smtpd_tls_auth_only = "yes";
            smtp_tls_security_level = "may";
            smtpd_tls_security_level = "may";
            smtpd_sasl_security_options = ["noanonymous" "noplaintext"];
            smtpd_sasl_tls_security_options = "noanonymous";

            smtpd_sasl_type = "dovecot";
            smtpd_sasl_path = "private/auth";
            smtpd_sals_auth_enable = "yes";

            smtpd_helo_restrictions = [
              "permit_mynetworks"
              "permit_sals_authenticated"
              "reject_invalid_helo_hostname"
              "reject_non_fqdn_helo_hostname"
            ];
            smtpd_recipient_restrictions = [
              "permit_mynetworks"
              "permit_sasl_authenticated"
              "reject_non_fqdn_recipient"
              "reject_unknown_recipient_domain"
              "reject_unlisted_recipient"
              "reject_unauth_destination"
            ];
            smtpd_sender_restrictions = [
              "permit_mynetworks"
              "permit_sasl_authenticated"
              "reject_non_fqdn_sender"
              "reject_unknown_sender_domain"
            ];
            smtpd_relay_restrictions = [
              "permit_mynetworks"
              "permit_sasl_authenticated"
              "defer_unauth_destination"
            ];

            myhostname = "example.org";
            alias_maps = "hash:/etc/aliases";
            alias_database = "hash:/etc/aliases";
            mydoamin = "example.org";
            myorigin = "$mydomain";
            mydestination = "localhost";
            relayhost = "";
            mynetworks = [
              "127.0.0.0/8"
              "[::ffff:127.0.0.0]/104"
              "[::1]/128"
            ];
            mailbox_size_limit = 0;
            recipient_delimiter = "+";
            inet_interfaces = "all";
            inet_protocols = "all";

            virtual_transport = "lmtp:unix:private/dovecot-lmtp";

            virtual_mailbox_domains = "mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf";
            virtual_mailbox_maps = "mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf";
            virtual_alias_maps = [
              "mysql:/etc/postfix/mysql-virtual-alias-maps.cf"
              "mysql:/etc/postfix/mysql-virtual-email2email.cf"
            ];

            disable_vrfy_command = "yes";
            strict_rfc821_envelopes = "yes";
            # smtpd_etrn_restrictions = "yes";
            # smtpd_reject_unlisted_sender = "yes";
            # smtpd_reject_unlisted_recipient = "yes";
            smtpd_delay_reject = "yes";
            smtpd_helo_required = "yes";
            smtp_always_send_ehlo = "yes";
            # smtpd_hard_error_limit = 1;
            smtpd_timeout = "30s";
            smtp_helo_timeout = "15s";
            smtp_rcpt_timeout = "15s";
            smtpd_recipient_limit = "15s";
            minimal_backoff_time = "180s";
            maximal_backoff_time = "3h";

            invalid_hostname_reject_code = 550;
            non_fqdn_reject_code = 550;
            unknown_address_reject_code = 550;
            unknown_client_reject_code = 550;
            unknown_hostname_reject_code = 550;
            unverified_recipent_reject_code = 550;
            unverified_sender_reject_code = 550;
          };
        };
      };
    };
  };
}