Add declarative SNM mail stack on mx1 with DNS-01, DANE, MTA-STS
mx1 runs Simple NixOS Mailserver (Postfix/Dovecot/Rspamd/OpenDKIM) for cnx.email. The TLS cert is obtained via ACME DNS-01 using a dedicated, scoped TSIG key (acme_mx1) that ns1 authorizes for only _acme-challenge.mx1 and _acme-challenge.mta-sts on the cnx.email zone, so the credential can write nothing else. Mailbox passwords are auto-minted by a clan vars generator (four-word passphrase + number). DANE TLSA (3 1 1) is published for _25._tcp.mx1; --reuse-key keeps the key digest stable across renewals. MTA-STS is enforced via a Caddy vhost serving the policy on :443 from the same cert (mta-sts SAN). Firewall opens 25/587/465/143/993/443; 80 stays closed.
This commit is contained in:
Berwn
@@ -0,0 +1,19 @@
|
||||
# Shared TSIG secret for the dedicated acme_mx1 key.
|
||||
#
|
||||
# This key lets mx1 — and only mx1 — write _acme-challenge.mx1.cnx.email TXT
|
||||
# records on ns1 to obtain its mail TLS cert via ACME DNS-01. ns1 scopes it with
|
||||
# acl_acme_mx1 (attached only to the cnx.email zone) so the credential can touch
|
||||
# nothing else. ns1 renders this secret into a Knot key file; mx1 into a lego
|
||||
# rfc2136 env file; both must carry the same secret, hence one shared generator
|
||||
# with a per-host renderer that depends on it. Imported by ns1 and (via mail.nix)
|
||||
# mx1.
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
clan.core.vars.generators.dns-acme-mx1-secret = {
|
||||
share = true;
|
||||
files."secret".secret = true;
|
||||
runtimeInputs = [ pkgs.openssl ];
|
||||
# 32 random bytes, base64 — a valid hmac-sha256 TSIG secret.
|
||||
script = ''openssl rand -base64 32 | tr -d '\n' > "$out"/secret'';
|
||||
};
|
||||
}
|
||||
@@ -13,6 +13,27 @@ $TTL 3600
|
||||
|
||||
; ---- Mail ----
|
||||
mx1 IN A 5.223.65.38
|
||||
mx1 IN AAAA 2a01:4ff:2f0:1963::1
|
||||
@ IN MX 10 mx1.cnx.email.
|
||||
@ IN TXT "v=spf1 mx -all"
|
||||
_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@cnx.email"
|
||||
|
||||
; ---- DANE / TLSA ----
|
||||
; "3 1 1" = DANE-EE, SPKI, SHA-256: the digest of mx1's certificate public key.
|
||||
; Valid because the zone is DNSSEC-signed and the lego cert uses --reuse-key, so
|
||||
; the key (and thus this digest) is stable across renewals. Compute it AFTER the
|
||||
; first issuance and paste the hex below:
|
||||
; ssh mx1 'openssl x509 -in /var/lib/acme/mx1.cnx.email/cert.pem -noout -pubkey \
|
||||
; | openssl pkey -pubin -outform DER | openssl dgst -sha256 -binary | xxd -p -c256'
|
||||
_25._tcp.mx1 IN TLSA 3 1 1 bd9a51f60b6d2dd20f18b3553d2795053ac52f87567a46bc892006bb58506404
|
||||
|
||||
; ---- MTA-STS ----
|
||||
; Policy host (A/AAAA point at mx1); the _mta-sts TXT id MUST be bumped whenever
|
||||
; the policy file in modules/mail.nix changes, or senders keep the cached policy.
|
||||
mta-sts IN A 5.223.65.38
|
||||
mta-sts IN AAAA 2a01:4ff:2f0:1963::1
|
||||
_mta-sts IN TXT "v=STSv1; id=2026061801"
|
||||
mail._domainkey IN TXT ( "v=DKIM1; k=rsa; "
|
||||
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr9QxTs5dLtY76bo156+Tp0GUoE554rMwIooIYa2MMYHNs8zPb0thFmaCKGAINdHKNIq2phXAlk51iBTfdqXjx7gVWSrs+ftykqO3b5hUjgImsgqPWGUTzy5/bUgcDELiD9KKEyKYD3+ebZEw6d0uvBvEsA6a1CPzOsufoCDtyKjByCuQzkCBrK25TUHFolGvEYcZexR0LSF+8hMss"
|
||||
"xyw9NYiPpTXVCWQJnrZZpuOBiX0K2l5CAXVyuT/B5RcBXlAUhBTp3390VEhL0wAZMTOnvtvBYK3NnsTIh96fkh6MfWmre7Fi9hEq//xGf40N5/aomMjJrJdqFZJLZpDotb/XwIDAQAB"
|
||||
)
|
||||
|
||||
@@ -24,16 +24,25 @@ let
|
||||
description = "ICMP (ping / PMTUD)";
|
||||
};
|
||||
|
||||
# Inbound mail only. mx1 is the MX for cnx.email, so other servers deliver on
|
||||
# 25. Submission (587/465) and IMAP (993) stay closed until the mail stack and
|
||||
# mailboxes exist — admin access rides the mesh, same as the other hosts.
|
||||
smtp = {
|
||||
# Public mail ports for mx1 (MX for cnx.email). 25 is server-to-server
|
||||
# delivery; 587/465 are client submission; 143/993 are IMAP. 443 serves only the
|
||||
# MTA-STS policy (https://mta-sts.cnx.email/.well-known/mta-sts.txt); the cert
|
||||
# itself uses ACME DNS-01 so port 80 stays closed. Admin still rides the mesh.
|
||||
mailPort = port: description: {
|
||||
direction = "in";
|
||||
protocol = "tcp";
|
||||
port = "25";
|
||||
inherit port;
|
||||
source_ips = world;
|
||||
description = "SMTP (inbound mail)";
|
||||
inherit description;
|
||||
};
|
||||
mailRules = [
|
||||
(mailPort "25" "SMTP (inbound mail)")
|
||||
(mailPort "587" "Submission (STARTTLS)")
|
||||
(mailPort "465" "Submission (implicit TLS)")
|
||||
(mailPort "143" "IMAP (STARTTLS)")
|
||||
(mailPort "993" "IMAP (implicit TLS)")
|
||||
(mailPort "443" "MTA-STS policy (HTTPS)")
|
||||
];
|
||||
|
||||
dnsRules = [
|
||||
{
|
||||
@@ -61,8 +70,7 @@ in
|
||||
];
|
||||
"clan-ns1" = dnsRules;
|
||||
"clan-ns2" = dnsRules;
|
||||
"clan-mx1" = [
|
||||
smtp
|
||||
"clan-mx1" = mailRules ++ [
|
||||
zerotier
|
||||
ping
|
||||
];
|
||||
|
||||
@@ -0,0 +1,139 @@
|
||||
# Declarative mail stack for mx1 (Simple NixOS Mailserver: Postfix + Dovecot +
|
||||
# Rspamd + OpenDKIM). Imported by machines/mx1 alongside the SNM flake module.
|
||||
#
|
||||
# Mailboxes are virtual (not system users): each address below is a login account
|
||||
# whose password is auto-generated by a clan vars generator as a four-word
|
||||
# passphrase with a trailing number (e.g. otter-lantern-cobalt-driftwood-42). The
|
||||
# generator stores both the passphrase and its sha-512 hash. To add a mailbox:
|
||||
# append the address to `accounts`, run `clan vars generate mx1`, redeploy mx1,
|
||||
# then hand the passphrase to the user:
|
||||
# clan vars get mx1 mail-passwd-<addr>/passphrase
|
||||
# (addr with @ and . replaced by -at- and -, e.g. mail-passwd-postmaster-at-cnx-email)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
hosts = import ./hosts.nix;
|
||||
fqdn = "mx1.cnx.email";
|
||||
mtaStsHost = "mta-sts.cnx.email";
|
||||
|
||||
# MTA-STS policy served at https://mta-sts.cnx.email/.well-known/mta-sts.txt.
|
||||
# enforce = a sending MTA that fetched this must use a valid, MX-matching TLS
|
||||
# cert or refuse to deliver. Bump the _mta-sts TXT id (in the zone) whenever
|
||||
# this changes.
|
||||
mtaStsPolicy = pkgs.writeText "mta-sts.txt" ''
|
||||
version: STSv1
|
||||
mode: enforce
|
||||
mx: ${fqdn}
|
||||
max_age: 604800
|
||||
'';
|
||||
|
||||
# The mailboxes mx1 serves. postmaster is required by RFC 5321.
|
||||
accounts = [
|
||||
"postmaster@cnx.email"
|
||||
];
|
||||
|
||||
genName = addr: "mail-passwd-" + lib.replaceStrings [ "@" "." ] [ "-at-" "-" ] addr;
|
||||
|
||||
passwdGenerators = lib.listToAttrs (
|
||||
map (addr: {
|
||||
name = genName addr;
|
||||
value = {
|
||||
files."passphrase".secret = true; # retrievable to hand to the user
|
||||
files."hash".secret = true; # consumed by SNM's hashedPasswordFile
|
||||
runtimeInputs = [
|
||||
pkgs.xkcdpass
|
||||
pkgs.mkpasswd
|
||||
];
|
||||
script = ''
|
||||
pass="$(xkcdpass --numwords=4 --delimiter=- --case=lower)-$((RANDOM % 90 + 10))"
|
||||
printf '%s' "$pass" > "$out"/passphrase
|
||||
printf '%s' "$pass" | mkpasswd -s -m sha-512 > "$out"/hash
|
||||
'';
|
||||
};
|
||||
}) accounts
|
||||
);
|
||||
|
||||
loginAccounts = lib.listToAttrs (
|
||||
map (addr: {
|
||||
name = addr;
|
||||
value.hashedPasswordFile = config.clan.core.vars.generators.${genName addr}.files."hash".path;
|
||||
}) accounts
|
||||
);
|
||||
in
|
||||
{
|
||||
imports = [ ./dns/acme-mx1-secret.nix ];
|
||||
|
||||
clan.core.vars.generators = passwdGenerators // {
|
||||
# Render the shared acme_mx1 TSIG secret into a lego rfc2136 env file. lego
|
||||
# (via security.acme below) uses it to write the _acme-challenge.mx1.cnx.email
|
||||
# TXT record to ns1, which authorizes the acme_mx1 key for exactly that owner.
|
||||
dns-acme-rfc2136 = {
|
||||
files."rfc2136.env".secret = true; # root-owned; systemd reads it as root
|
||||
dependencies = [ "dns-acme-mx1-secret" ];
|
||||
script = ''
|
||||
printf 'RFC2136_NAMESERVER=${hosts.ns1.ipv4}:53\nRFC2136_TSIG_ALGORITHM=hmac-sha256.\nRFC2136_TSIG_KEY=acme_mx1\nRFC2136_TSIG_SECRET=%s\n' \
|
||||
"$(cat "$in"/dns-acme-mx1-secret/secret)" > "$out"/rfc2136.env
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
mailserver = {
|
||||
enable = true;
|
||||
# Fresh install: declare the latest layout the nixos-25.11 branch ships (3),
|
||||
# so SNM uses the current dovecot mail directory layout with nothing to migrate.
|
||||
stateVersion = 3;
|
||||
inherit fqdn;
|
||||
domains = [ "cnx.email" ];
|
||||
inherit loginAccounts;
|
||||
|
||||
# Consume a security.acme cert we obtain ourselves via DNS-01 (below); no
|
||||
# web server and no inbound HTTP needed, so port 80 stays closed. Add the
|
||||
# MTA-STS host as a SAN so the one cert also covers the policy endpoint.
|
||||
certificateScheme = "acme";
|
||||
certificateDomains = [ mtaStsHost ];
|
||||
|
||||
dkimSelector = "mail";
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "postmaster@cnx.email";
|
||||
certs.${fqdn} = {
|
||||
dnsProvider = "rfc2136";
|
||||
environmentFile = config.clan.core.vars.generators.dns-acme-rfc2136.files."rfc2136.env".path;
|
||||
# ns1 is the only nameserver that accepts the acme_mx1 UPDATE; check
|
||||
# propagation against it directly rather than a public resolver.
|
||||
dnsResolver = "${hosts.ns1.ipv4}:53";
|
||||
# Keep the private key fixed across renewals so the DANE TLSA "3 1 1"
|
||||
# record (public-key digest, published in the zone) stays valid.
|
||||
extraLegoRenewFlags = [ "--reuse-key" ];
|
||||
};
|
||||
};
|
||||
|
||||
# The mail cert is owned group=acme (SNM adds postfix/dovecot); Caddy serves the
|
||||
# MTA-STS endpoint from the same cert, so it needs to read the key too.
|
||||
users.users.caddy.extraGroups = [ "acme" ];
|
||||
|
||||
# MTA-STS policy endpoint, served by Caddy (same web server as control's docs).
|
||||
# The explicit `tls cert key` points at the lego-issued mail cert (which carries
|
||||
# mta-sts.cnx.email as a SAN) and disables Caddy's automatic ACME, so no extra
|
||||
# issuance happens and the DANE TLSA key stays stable. Only :443 is opened.
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts.${mtaStsHost}.extraConfig = ''
|
||||
tls /var/lib/acme/${fqdn}/cert.pem /var/lib/acme/${fqdn}/key.pem
|
||||
root * ${pkgs.writeTextDir ".well-known/mta-sts.txt" (builtins.readFile mtaStsPolicy)}
|
||||
file_server
|
||||
'';
|
||||
};
|
||||
|
||||
# DKIM private keys are generated on first start under this dir. They're
|
||||
# regenerable (rotate + republish the TXT), but declaring the path as clan
|
||||
# state lets a borg client back it up to avoid a needless DNS round-trip on
|
||||
# restore. Wiring mx1 into the borgbackup instance is a separate step.
|
||||
clan.core.state.mail-dkim.folders = [ config.mailserver.dkimKeyDirectory ];
|
||||
}
|
||||
Reference in New Issue
Block a user