heartles/egirls-nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: heartles:38d2798bc65ac9afb802972a1291c6c4aa0ae6cd
Branches Tags
heartles:main
heartles:mail-server
..
compare: heartles:264d64526c949b40a18d671d73b0858c4470d207
Branches Tags
heartles:main
heartles:mail-server

No commits in common. "38d2798bc65ac9afb802972a1291c6c4aa0ae6cd" and "264d64526c949b40a18d671d73b0858c4470d207" have entirely different histories.
38d2798bc6 ... 264d64526c

1 changed files with 6 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

27
postfix.nix
View file

@ -1,28 +1,13 @@
{ pkgs, config, ... }:
{
# Prevent outgoing connections to email ports from users other than postfix
# unless the destination is localhost
networking.firewall.extraCommands = let
user = config.services.postfix.user;
makeRules = port:
let p = builtins.toString port;
in ''
iptables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport ${p} -j REJECT --reject-with icmp-admin-prohibited
ip6tables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport ${p} -j REJECT --reject-with icmp6-adm-prohibited
networking.firewall.extraCommands = let user = config.services.postfix.user;
in ''
iptables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport 25 -j REJECT --reject-with icmp-admin-prohibited
ip6tables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport 25 -j REJECT --reject-with icmp6-adm-prohibited
iptables -I OUTPUT -m tcp -p tcp --dport ${p} -d 127.0.0.1 -j ACCEPT
ip6tables -I OUTPUT -m tcp -p tcp --dport ${p} -d ::1 -j ACCEPT
'';
in builtins.concatStringsSep "\n"
(builtins.map makeRules [ 25 587 465 2525 ]);
# The following is necessary to prevent the above rules from being added at every nixos-rebuild switch.
# See link for more info
# https://github.com/NixOS/nixpkgs/issues/201614
# Flush the firewall rules
networking.firewall.extraStopCommands = ''
iptables -F
ip6tables -F
iptables -I OUTPUT -m tcp -p tcp --dport 25 -d 127.0.0.1 -j ACCEPT
ip6tables -I OUTPUT -m tcp -p tcp --dport 25 -d 127.0.0.1 -j ACCEPT
'';
services.postfix = {