From 1f9431801f5262a09c9dbb113d52beb0d668eabd Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 27 Jul 2025 17:34:13 +0200 Subject: [PATCH 1/3] nixos/tlsrpt: fix default postfix sendmail path It is not in the PATH for the reportd, since it is a SUID wrapper. --- nixos/modules/services/mail/tlsrpt.nix | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/mail/tlsrpt.nix b/nixos/modules/services/mail/tlsrpt.nix index 83b219443fd0..4692f0cdd2ff 100644 --- a/nixos/modules/services/mail/tlsrpt.nix +++ b/nixos/modules/services/mail/tlsrpt.nix @@ -229,9 +229,16 @@ in sendmail_script = mkOption { type = with types; nullOr str; - default = if config.services.postfix.enable then "sendmail" else null; + default = + if config.services.postfix.enable && config.services.postfix.setSendmail then + "/run/wrappers/bin/sendmail -i -t" + else + null; defaultText = lib.literalExpression '' - if any [ config.services.postfix.enable ] then "sendmail" else null + if config.services.postfix.enable && config.services.postfix.setSendmail then + "/run/wrappers/bin/sendmail -i -t" + else + null ''; description = '' Path to a sendmail-compatible executable for delivery reports. From c3c5a3bfd080e898b92f2f4b30326ba72439a703 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 27 Jul 2025 17:36:00 +0200 Subject: [PATCH 2/3] nixos/tlsrpt: fix restart trigger Triggering on a symlink target does not work. --- nixos/modules/services/mail/tlsrpt.nix | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/nixos/modules/services/mail/tlsrpt.nix b/nixos/modules/services/mail/tlsrpt.nix index 4692f0cdd2ff..05d8377514c0 100644 --- a/nixos/modules/services/mail/tlsrpt.nix +++ b/nixos/modules/services/mail/tlsrpt.nix @@ -50,6 +50,15 @@ let ]; }; + collectdConfigFile = format.generate "tlsrpt-collectd.cfg" { + tlsrpt_collectd = dropNullValues cfg.collectd.settings; + }; + fetcherConfigFile = format.generate "tlsrpt-fetcher.cfg" { + tlsrpt_fetcher = dropNullValues cfg.fetcher.settings; + }; + reportdConfigFile = format.generate "tlsrpt-reportd.cfg" { + tlsrpt_reportd = dropNullValues cfg.reportd.settings; + }; in { @@ -266,15 +275,9 @@ in config = mkIf cfg.enable { environment.etc = { - "tlsrpt/collectd.cfg".source = format.generate "tlsrpt-collectd.cfg" { - tlsrpt_collectd = dropNullValues cfg.collectd.settings; - }; - "tlsrpt/fetcher.cfg".source = format.generate "tlsrpt-fetcher.cfg" { - tlsrpt_fetcher = dropNullValues cfg.fetcher.settings; - }; - "tlsrpt/reportd.cfg".source = format.generate "tlsrpt-reportd.cfg" { - tlsrpt_reportd = dropNullValues cfg.reportd.settings; - }; + "tlsrpt/collectd.cfg".source = collectdConfigFile; + "tlsrpt/fetcher.cfg".source = fetcherConfigFile; + "tlsrpt/reportd.cfg".source = reportdConfigFile; }; users.users.tlsrpt = { @@ -295,7 +298,7 @@ in wantedBy = [ "multi-user.target" ]; - restartTriggers = [ "/etc/tlsrpt/collectd.cfg" ]; + restartTriggers = [ collectdConfigFile ]; serviceConfig = commonServiceSettings // { ExecStart = toString ( @@ -319,7 +322,7 @@ in wantedBy = [ "multi-user.target" ]; - restartTriggers = [ "/etc/tlsrpt/reportd.cfg" ]; + restartTriggers = [ reportdConfigFile ]; serviceConfig = commonServiceSettings // { ExecStart = toString ( From b438f32b2a8d2b9374644289725ffaf05101970c Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 28 Jul 2025 02:16:08 +0200 Subject: [PATCH 3/3] nixos/tlsrpt: fix permissions to execute postdrop Calling to sendmail without AF_NETLINK causes: > sendmail: fatal: inet_addr_local[getifaddrs]: getifaddrs: Address family not supported by protocol and without AF_INET/AF_INET6: > sendmail: warning: inet_protocols: disabling IPv6 name/address support: Address family not supported by protocol > sendmail: warning: inet_protocols: disabling IPv4 name/address support: Address family not supported by protocol Move the configurePostfix option one level up, since it now also reconfigures the reportd systemd unit. --- nixos/modules/services/mail/tlsrpt.nix | 29 ++++++++++++++------------ 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/nixos/modules/services/mail/tlsrpt.nix b/nixos/modules/services/mail/tlsrpt.nix index 05d8377514c0..309ce400462c 100644 --- a/nixos/modules/services/mail/tlsrpt.nix +++ b/nixos/modules/services/mail/tlsrpt.nix @@ -59,6 +59,8 @@ let reportdConfigFile = format.generate "tlsrpt-reportd.cfg" { tlsrpt_reportd = dropNullValues cfg.reportd.settings; }; + + withPostfix = config.services.postfix.enable && cfg.configurePostfix; in { @@ -126,14 +128,6 @@ in See {manpage}`tlsrpt-collectd(1)` for possible flags. ''; }; - - configurePostfix = mkOption { - type = types.bool; - default = true; - description = '' - Whether to modify the local Postfix service to grant access to the collectd socket. - ''; - }; }; fetcher = { @@ -271,6 +265,14 @@ in ''; }; }; + + configurePostfix = mkOption { + type = types.bool; + default = true; + description = '' + Whether to configure permissions to allow integration with Postfix. + ''; + }; }; config = mkIf cfg.enable { @@ -286,11 +288,9 @@ in }; users.groups.tlsrpt = { }; - users.users.postfix.extraGroups = - lib.mkIf (config.services.postfix.enable && cfg.collectd.configurePostfix) - [ - "tlsrpt" - ]; + users.users.postfix.extraGroups = lib.mkIf withPostfix [ + "tlsrpt" + ]; systemd.services.tlsrpt-collectd = { description = "TLSRPT datagram collector"; @@ -334,7 +334,10 @@ in RestrictAddressFamilies = [ "AF_INET" "AF_INET6" + "AF_NETLINK" ]; + ReadWritePaths = lib.optionals withPostfix [ "/var/lib/postfix/queue/maildrop" ]; + SupplementaryGroups = lib.optionals withPostfix [ "postdrop" ]; UMask = "0077"; }; };