From b2be0d99ea0f88b8251f7133218a77bfe38dc8f1 Mon Sep 17 00:00:00 2001 From: Bart Oostveen Date: Wed, 3 Jun 2026 20:23:09 +0200 Subject: [PATCH 1/2] mail-tlsa-check-exporter: init at 0-unstable-2025-06-12 --- .../ma/mail-tlsa-check-exporter/package.nix | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix diff --git a/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix b/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix new file mode 100644 index 000000000000..05aebe64bae1 --- /dev/null +++ b/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix @@ -0,0 +1,52 @@ +{ + lib, + stdenv, + fetchFromGitHub, + nix-update-script, + makeWrapper, + nodejs, +}: + +stdenv.mkDerivation (finalAttrs: { + pname = "mail-tlsa-check-exporter"; + version = "0-unstable-2025-06-12"; + + __structuredAttrs = true; + strictDeps = true; + + src = fetchFromGitHub { + owner = "ietf-tools"; + repo = "mail-tlsa-check-exporter"; + rev = "9843bf85971fbe130e8cd32e6fcf0dfcee92e929"; + hash = "sha256-5c3epExz3tv6gRiIfpDyV1pkfcRVWjtNpl93LWsYKdk="; + }; + + nativeBuildInputs = [ + makeWrapper + ]; + + installPhase = '' + runHook preInstall + + mkdir -p $out/libexec + cp $src/index.mjs $out/libexec + + makeWrapper ${lib.getExe nodejs} $out/bin/mail-tlsa-check-exporter \ + --append-flag $out/libexec/index.mjs + + runHook postInstall + ''; + + passthru.updateScript = nix-update-script { + extraArgs = [ "--version=branch=main" ]; + }; + + meta = { + description = "Validate SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter"; + homepage = "https://github.com/ietf-tools/mail-tlsa-check-exporter"; + license = lib.licenses.bsd3; + maintainers = with lib.maintainers; [ bartoostveen ]; + mainProgram = "mail-tlsa-check-exporter"; + platforms = lib.platforms.all; + }; +}) From cd65877bf57c0f6ba19da1578aa1371197990f54 Mon Sep 17 00:00:00 2001 From: Bart Oostveen Date: Wed, 3 Jun 2026 20:23:27 +0200 Subject: [PATCH 2/2] nixos/prometheus-exporters/mail-tlsa-check: init --- .../manual/release-notes/rl-2611.section.md | 2 + .../monitoring/prometheus/exporters.nix | 1 + .../prometheus/exporters/mail-tlsa-check.nix | 164 ++++++++++++++++++ 3 files changed, 167 insertions(+) create mode 100644 nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index 314044b1b2c6..02bd3893ea4b 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -16,6 +16,8 @@ - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable). +- [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable). + - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices. - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable). diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix index 96ab896356f6..b1d7f62b582e 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters.nix @@ -86,6 +86,7 @@ let "lnd" "mail" "mailman3" + "mail-tlsa-check" "mikrotik" "modemmanager" "mongodb" diff --git a/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix b/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix new file mode 100644 index 000000000000..aa66a45daee2 --- /dev/null +++ b/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix @@ -0,0 +1,164 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.prometheus.exporters.mail-tlsa-check; + + inherit (lib) + boolToString + collect + concatStringsSep + getExe + isBool + isList + isString + listToAttrs + mapAttrsRecursive + mkForce + mkOption + mkPackageOption + optionalAttrs + pipe + toUpper + types + ; + + environment = pipe cfg.settings [ + (mapAttrsRecursive ( + path: value: + optionalAttrs (value != null) { + name = toUpper "MTCE_${concatStringsSep "_" path}"; + value = + if isList value then + concatStringsSep "," value + else if isBool value then + boolToString value + else + toString value; + } + )) + (collect (x: isString x.name or false && isString x.value or false)) + listToAttrs + ]; +in +{ + port = 19309; + extraOpts = { + package = mkPackageOption pkgs "mail-tlsa-check-exporter" { }; + settings = mkOption { + description = "Settings for the mail-tlsa-check-exporter"; + type = types.submodule { + freeformType = types.attrs; + + options = { + tlsa.record = mkOption { + description = "The TLSA record to monitor"; + type = types.str; + example = "_25._tcp.smtp.example.org"; + }; + check.timeout = mkOption { + description = "Timeout for validation checks to complete before giving up, in milliseconds (e.g. 15000 for 15 seconds)"; + type = types.ints.positive; + default = 15000; + example = 10000; + }; + ipv4.enabled = mkOption { + description = "Whether to enable monitoring over IPv4"; + type = types.bool; + default = true; + example = false; + }; + ipv6.enabled = mkOption { + description = "Whether to enable monitoring over IPv6"; + type = types.bool; + default = true; + example = false; + }; + server.port = mkOption { + description = '' + The port that the exporter listens on. + + ::: {.note} + This is a read-only option that is read from {option}`services.prometheus.exporters.mail-tlsa-check.port`. + ::: + ''; + type = types.port; + default = cfg.port; + defaultText = lib.literalExpression "config.services.prometheus.exporters.mail-tlsa-check.port"; + readOnly = true; + }; + smtp = { + hostname = mkOption { + description = "The SMTP hostname to monitor"; + type = types.nullOr types.str; + default = null; + example = "smtp.example.org"; + }; + port = mkOption { + description = '' + The SMTP port to monitor + + ::: {.note} + The exporter currently only supports explicit TLS (StartTLS), see + ::: + ''; + type = types.port; + default = 587; + example = 465; + }; + client = mkOption { + description = "The host to send in the SMTP EHLO command (name/domain/IP address)"; + type = types.str; + default = "tlsa-smtp-synthetics-probe"; + example = "tlsa-exporter"; + }; + }; + imap = { + hostname = mkOption { + description = "The IMAP hostname to monitor"; + type = types.nullOr types.str; + default = null; + example = "imap.example.org"; + }; + port = mkOption { + description = '' + The IMAP port to monitor + + ::: {.note} + The exporter currently only supports explicit TLS (StartTLS), see + ::: + ''; + type = types.port; + default = 143; + }; + }; + }; + }; + }; + }; + + assertions = [ + { + assertion = cfg.settings.ipv4.enabled || cfg.ipv6.enabled; + message = "Both IPv4 and IPv6 are disabled, this is not possible as it won't monitor anything"; + } + { + assertion = cfg.settings.smtp.hostname != null || cfg.settings.imap.hostname != null; + message = "Both SMTP and IMAP are disabled, this is not possible as it won't monitor anything"; + } + ]; + + serviceOpts = { + inherit environment; + + serviceConfig = { + ExecStart = getExe cfg.package; + MemoryDenyWriteExecute = mkForce false; # because v8 won't start otherwise + Restart = "always"; # because apparently, this service crashes and is intended to do so, see the upstream systemd unit + }; + }; +}