2017-12-31 03:09:23 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
cfg = config.services.clamsmtp;
|
|
|
|
clamdSocket = "/run/clamav/clamd.ctl"; # See services/security/clamav.nix
|
|
|
|
in
|
|
|
|
{
|
|
|
|
##### interface
|
|
|
|
options = {
|
|
|
|
services.clamsmtp = {
|
|
|
|
enable = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = "Whether to enable clamsmtp.";
|
2017-12-31 03:09:23 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
instances = mkOption {
|
2024-04-13 12:54:15 +00:00
|
|
|
description = "Instances of clamsmtp to run.";
|
2017-12-31 03:09:23 +00:00
|
|
|
type = types.listOf (types.submodule { options = {
|
|
|
|
action = mkOption {
|
|
|
|
type = types.enum [ "bounce" "drop" "pass" ];
|
|
|
|
default = "drop";
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
Action to take when a virus is detected.
|
|
|
|
|
|
|
|
Note that viruses often spoof sender addresses, so bouncing is
|
|
|
|
in most cases not a good idea.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
header = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
default = "";
|
|
|
|
example = "X-Virus-Scanned: ClamAV using ClamSMTP";
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
A header to add to scanned messages. See clamsmtpd.conf(5) for
|
|
|
|
more details. Empty means no header.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
keepAlives = mkOption {
|
|
|
|
type = types.int;
|
|
|
|
default = 0;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
Number of seconds to wait between each NOOP sent to the sending
|
|
|
|
server. 0 to disable.
|
|
|
|
|
|
|
|
This is meant for slow servers where the sending MTA times out
|
|
|
|
waiting for clamd to scan the file.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
listen = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
example = "127.0.0.1:10025";
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
Address to wait for incoming SMTP connections on. See
|
|
|
|
clamsmtpd.conf(5) for more details.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
quarantine = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
Whether to quarantine files that contain viruses by leaving them
|
|
|
|
in the temporary directory.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
maxConnections = mkOption {
|
|
|
|
type = types.int;
|
|
|
|
default = 64;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = "Maximum number of connections to accept at once.";
|
2017-12-31 03:09:23 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
outAddress = mkOption {
|
|
|
|
type = types.str;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
Address of the SMTP server to send email to once it has been
|
|
|
|
scanned.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
tempDirectory = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
default = "/tmp";
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
Temporary directory that needs to be accessible to both clamd
|
|
|
|
and clamsmtpd.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
timeout = mkOption {
|
|
|
|
type = types.int;
|
|
|
|
default = 180;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = "Time-out for network connections.";
|
2017-12-31 03:09:23 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
transparentProxy = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = "Enable clamsmtp's transparent proxy support.";
|
2017-12-31 03:09:23 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
virusAction = mkOption {
|
|
|
|
type = with types; nullOr path;
|
|
|
|
default = null;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
Command to run when a virus is found. Please see VIRUS ACTION in
|
|
|
|
clamsmtpd(8) for a discussion of this option and its safe use.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
xClient = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
2024-04-13 12:54:15 +00:00
|
|
|
description = ''
|
2017-12-31 03:09:23 +00:00
|
|
|
Send the XCLIENT command to the receiving server, for forwarding
|
|
|
|
client addresses and connection information if the receiving
|
|
|
|
server supports this feature.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};});
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
##### implementation
|
|
|
|
config = let
|
|
|
|
configfile = conf: pkgs.writeText "clamsmtpd.conf"
|
|
|
|
''
|
|
|
|
Action: ${conf.action}
|
|
|
|
ClamAddress: ${clamdSocket}
|
|
|
|
Header: ${conf.header}
|
|
|
|
KeepAlives: ${toString conf.keepAlives}
|
|
|
|
Listen: ${conf.listen}
|
|
|
|
Quarantine: ${if conf.quarantine then "on" else "off"}
|
|
|
|
MaxConnections: ${toString conf.maxConnections}
|
|
|
|
OutAddress: ${conf.outAddress}
|
|
|
|
TempDirectory: ${conf.tempDirectory}
|
|
|
|
TimeOut: ${toString conf.timeout}
|
|
|
|
TransparentProxy: ${if conf.transparentProxy then "on" else "off"}
|
|
|
|
User: clamav
|
|
|
|
${optionalString (conf.virusAction != null) "VirusAction: ${conf.virusAction}"}
|
|
|
|
XClient: ${if conf.xClient then "on" else "off"}
|
|
|
|
'';
|
|
|
|
in
|
|
|
|
mkIf cfg.enable {
|
|
|
|
assertions = [
|
|
|
|
{ assertion = config.services.clamav.daemon.enable;
|
|
|
|
message = "clamsmtp requires clamav to be enabled";
|
|
|
|
}
|
|
|
|
];
|
|
|
|
|
|
|
|
systemd.services = listToAttrs (imap1 (i: conf:
|
|
|
|
nameValuePair "clamsmtp-${toString i}" {
|
|
|
|
description = "ClamSMTP instance ${toString i}";
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
script = "exec ${pkgs.clamsmtp}/bin/clamsmtpd -f ${configfile conf}";
|
|
|
|
after = [ "clamav-daemon.service" ];
|
|
|
|
requires = [ "clamav-daemon.service" ];
|
|
|
|
serviceConfig.Type = "forking";
|
|
|
|
serviceConfig.PrivateTmp = "yes";
|
|
|
|
unitConfig.JoinsNamespaceOf = "clamav-daemon.service";
|
|
|
|
}
|
|
|
|
) cfg.instances);
|
|
|
|
};
|
2018-10-30 16:05:49 +00:00
|
|
|
|
|
|
|
meta.maintainers = with lib.maintainers; [ ekleog ];
|
2017-12-31 03:09:23 +00:00
|
|
|
}
|