diff options
author | Jörg Thalheim <joerg@thalheim.io> | 2020-11-29 12:51:53 +0100 |
---|---|---|
committer | Jörg Thalheim <joerg@thalheim.io> | 2020-11-30 07:29:32 +0100 |
commit | 3b6ef967f3ff3f9c86ac0b406f2b1513f7b56c5c (patch) | |
tree | f655b1988e69ea2d8cc348cff2b73eb9c3ee574f | |
parent | 9cca2eb4c80eb5e41d67349fab8bffdd38d577fc (diff) | |
download | nixpkgs-3b6ef967f3ff3f9c86ac0b406f2b1513f7b56c5c.tar nixpkgs-3b6ef967f3ff3f9c86ac0b406f2b1513f7b56c5c.tar.gz nixpkgs-3b6ef967f3ff3f9c86ac0b406f2b1513f7b56c5c.tar.bz2 nixpkgs-3b6ef967f3ff3f9c86ac0b406f2b1513f7b56c5c.tar.lz nixpkgs-3b6ef967f3ff3f9c86ac0b406f2b1513f7b56c5c.tar.xz nixpkgs-3b6ef967f3ff3f9c86ac0b406f2b1513f7b56c5c.tar.zst nixpkgs-3b6ef967f3ff3f9c86ac0b406f2b1513f7b56c5c.zip |
nixos/rspamd: fix postfix integration
-rw-r--r-- | nixos/modules/services/mail/rspamd.nix | 7 | ||||
-rw-r--r-- | nixos/tests/rspamd.nix | 58 |
2 files changed, 38 insertions, 27 deletions
diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix index 07ef5461d05..515e2880056 100644 --- a/nixos/modules/services/mail/rspamd.nix +++ b/nixos/modules/services/mail/rspamd.nix @@ -371,6 +371,9 @@ in }; services.postfix.config = mkIf cfg.postfix.enable cfg.postfix.config; + systemd.services.postfix.serviceConfig.SupplementaryGroups = + mkIf cfg.postfix.enable [ postfixCfg.group ]; + # Allow users to run 'rspamc' and 'rspamadm'. environment.systemPackages = [ pkgs.rspamd ]; @@ -399,6 +402,7 @@ in User = "${cfg.user}"; Group = "${cfg.group}"; + SupplementaryGroups = mkIf cfg.postfix.enable [ postfixCfg.group ]; RuntimeDirectory = "rspamd"; RuntimeDirectoryMode = "0755"; @@ -413,7 +417,8 @@ in PrivateDevices = true; PrivateMounts = true; PrivateTmp = true; - PrivateUsers = true; + # we need to chown socket to rspamd-milter + PrivateUsers = !cfg.postfix.enable; ProtectClock = true; ProtectControlGroups = true; ProtectHome = true; diff --git a/nixos/tests/rspamd.nix b/nixos/tests/rspamd.nix index bf3f0de6204..e461fc834a8 100644 --- a/nixos/tests/rspamd.nix +++ b/nixos/tests/rspamd.nix @@ -13,10 +13,12 @@ let machine.succeed("id rspamd >/dev/null") ''; checkSocket = socket: user: group: mode: '' - machine.succeed("ls ${socket} >/dev/null") - machine.succeed('[[ "$(stat -c %U ${socket})" == "${user}" ]]') - machine.succeed('[[ "$(stat -c %G ${socket})" == "${group}" ]]') - machine.succeed('[[ "$(stat -c %a ${socket})" == "${mode}" ]]') + machine.succeed( + "ls ${socket} >/dev/null", + '[[ "$(stat -c %U ${socket})" == "${user}" ]]', + '[[ "$(stat -c %G ${socket})" == "${group}" ]]', + '[[ "$(stat -c %a ${socket})" == "${mode}" ]]', + ) ''; simple = name: enableIPv6: makeTest { name = "rspamd-${name}"; @@ -54,33 +56,35 @@ in services.rspamd = { enable = true; workers.normal.bindSockets = [{ - socket = "/run/rspamd.sock"; + socket = "/run/rspamd/rspamd.sock"; mode = "0600"; - owner = "root"; - group = "root"; + owner = "rspamd"; + group = "rspamd"; }]; workers.controller.bindSockets = [{ - socket = "/run/rspamd-worker.sock"; + socket = "/run/rspamd/rspamd-worker.sock"; mode = "0666"; - owner = "root"; - group = "root"; + owner = "rspamd"; + group = "rspamd"; }]; }; }; testScript = '' ${initMachine} - machine.wait_for_file("/run/rspamd.sock") - ${checkSocket "/run/rspamd.sock" "root" "root" "600" } - ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" } + machine.wait_for_file("/run/rspamd/rspamd.sock") + ${checkSocket "/run/rspamd/rspamd.sock" "rspamd" "rspamd" "600" } + ${checkSocket "/run/rspamd/rspamd-worker.sock" "rspamd" "rspamd" "666" } machine.log(machine.succeed("cat /etc/rspamd/rspamd.conf")) machine.log( machine.succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf") ) machine.log(machine.succeed("grep 'CONFDIR/worker-normal.inc' /etc/rspamd/rspamd.conf")) - machine.log(machine.succeed("rspamc -h /run/rspamd-worker.sock stat")) + machine.log(machine.succeed("rspamc -h /run/rspamd/rspamd-worker.sock stat")) machine.log( - machine.succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping") + machine.succeed( + "curl --unix-socket /run/rspamd/rspamd-worker.sock http://localhost/ping" + ) ) ''; }; @@ -91,16 +95,16 @@ in services.rspamd = { enable = true; workers.normal.bindSockets = [{ - socket = "/run/rspamd.sock"; + socket = "/run/rspamd/rspamd.sock"; mode = "0600"; - owner = "root"; - group = "root"; + owner = "rspamd"; + group = "rspamd"; }]; workers.controller.bindSockets = [{ - socket = "/run/rspamd-worker.sock"; + socket = "/run/rspamd/rspamd-worker.sock"; mode = "0666"; - owner = "root"; - group = "root"; + owner = "rspamd"; + group = "rspamd"; }]; workers.controller2 = { type = "controller"; @@ -116,9 +120,9 @@ in testScript = '' ${initMachine} - machine.wait_for_file("/run/rspamd.sock") - ${checkSocket "/run/rspamd.sock" "root" "root" "600" } - ${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" } + machine.wait_for_file("/run/rspamd/rspamd.sock") + ${checkSocket "/run/rspamd/rspamd.sock" "rspamd" "rspamd" "600" } + ${checkSocket "/run/rspamd/rspamd-worker.sock" "rspamd" "rspamd" "666" } machine.log(machine.succeed("cat /etc/rspamd/rspamd.conf")) machine.log( machine.succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf") @@ -137,9 +141,11 @@ in machine.wait_until_succeeds( "journalctl -u rspamd | grep -i 'starting controller process' >&2" ) - machine.log(machine.succeed("rspamc -h /run/rspamd-worker.sock stat")) + machine.log(machine.succeed("rspamc -h /run/rspamd/rspamd-worker.sock stat")) machine.log( - machine.succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping") + machine.succeed( + "curl --unix-socket /run/rspamd/rspamd-worker.sock http://localhost/ping" + ) ) machine.log(machine.succeed("curl http://localhost:11335/ping")) ''; |