Berwn
60db8c60b0
Deliver cnx.email DMARC aggregate/forensic reports to a dedicated dmarc@cnx.email mailbox on mx1 and analyze them with parsedmarc on control, storing parsed reports in a local loopback Elasticsearch and visualizing via the auto-provisioned Grafana dashboard. parsedmarc fetches the mailbox over IMAPS across the mesh (mx1.cnx.email pinned to its mesh address so TLS still validates), using a shared mail-dmarc-cred clan var so mx1's mailserver and control see the same password.
61 lines
2.2 KiB
Nix
61 lines
2.2 KiB
Nix
# DMARC report analyzer, imported by control only. parsedmarc fetches the
|
|
# aggregate/forensic reports that land in the dmarc@cnx.email mailbox on mx1,
|
|
# parses the XML, and stores results in a local Elasticsearch; the official
|
|
# parsedmarc dashboard + an Elasticsearch datasource are auto-provisioned into
|
|
# the Grafana instance that server.nix already runs on this host.
|
|
#
|
|
# IMAP runs over the ZeroTier mesh, not the public net: we pin mx1.cnx.email to
|
|
# its mesh address in /etc/hosts so TLS still validates against the public
|
|
# Let's Encrypt cert (primary domain mx1.cnx.email) while the bytes stay on the
|
|
# overlay. The mailbox passphrase is the shared mail-dmarc-cred secret; parsedmarc
|
|
# reads it as root in its ExecStartPre, so root-owned (clan default) is fine.
|
|
{ config, lib, ... }:
|
|
let
|
|
mesh = import ../mesh-hosts.nix { inherit config lib; };
|
|
in
|
|
{
|
|
imports = [ ../mail-dmarc-cred.nix ];
|
|
|
|
# Elasticsearch 7.x is under the (unfree) Elastic License; allow just this one
|
|
# package rather than opening allowUnfree globally.
|
|
nixpkgs.config.allowUnfreePredicate = pkg: lib.getName pkg == "elasticsearch";
|
|
|
|
# Keep mx1's IMAP traffic on the mesh while presenting the public cert name.
|
|
networking.hosts.${mesh.hosts.mx1} = [ "mx1.cnx.email" ];
|
|
|
|
services.parsedmarc = {
|
|
enable = true;
|
|
provision = {
|
|
# Local Elasticsearch on 127.0.0.1:9200 (loopback; no firewall change).
|
|
# datasource + dashboard default to true once ES and Grafana are both on.
|
|
elasticsearch = true;
|
|
# GeoIP needs a MaxMind account/license key; skip it (reports still parse,
|
|
# just without source-IP geolocation).
|
|
geoIp = false;
|
|
grafana = {
|
|
datasource = true;
|
|
dashboard = true;
|
|
};
|
|
};
|
|
settings = {
|
|
imap = {
|
|
host = "mx1.cnx.email";
|
|
port = 993;
|
|
ssl = true;
|
|
user = "dmarc@cnx.email";
|
|
password = {
|
|
_secret = config.clan.core.vars.generators.mail-dmarc-cred.files."passphrase".path;
|
|
};
|
|
};
|
|
mailbox = {
|
|
watch = true; # IMAP IDLE: process reports as they arrive
|
|
delete = false; # archive processed reports, don't delete
|
|
};
|
|
general = {
|
|
save_aggregate = true;
|
|
save_forensic = true;
|
|
};
|
|
};
|
|
};
|
|
}
|