From 00b60a8c61e1cfe14928c737d579d81323711d0d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 21:38:12 +0200
Subject: [PATCH 1/2] postfix-tlspol: 1.10.0 -> 1.11.0

https://github.com/Zuplu/postfix-tlspol/releases/tag/v1.11.0
---
 pkgs/by-name/po/postfix-tlspol/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/postfix-tlspol/package.nix b/pkgs/by-name/po/postfix-tlspol/package.nix
index 1bebfcd69880..de7673b07874 100644
--- a/pkgs/by-name/po/postfix-tlspol/package.nix
+++ b/pkgs/by-name/po/postfix-tlspol/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "postfix-tlspol";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "Zuplu";
     repo = "postfix-tlspol";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JwggXJM8FDMG4oGRcVjVw1J/toTzc/kxrjdENFT9oGs=";
+    hash = "sha256-mdnCa0xrexkKWHdtCeSXxwMnx9xNKAdkZlHIhqxD/P4=";
   };
 
   vendorHash = null;

From f547405d8893a59a46d599a9c2612f1a3ac5eb10 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Jul 2026 22:01:22 +0200
Subject: [PATCH 2/2] nixos/postfix-tlspol: migrate to socket activation

Allows further confining the service. Socket activation is not supported
for the metrics-address.
---
 .../modules/services/mail/postfix-tlspol.nix  | 20 ++++++++++++++-----
 nixos/tests/postfix-tlspol.nix                | 15 +++++++++++---
 2 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/services/mail/postfix-tlspol.nix b/nixos/modules/services/mail/postfix-tlspol.nix
index 23753897b229..f49a17991842 100644
--- a/nixos/modules/services/mail/postfix-tlspol.nix
+++ b/nixos/modules/services/mail/postfix-tlspol.nix
@@ -164,6 +164,20 @@ in
       };
       users.groups.postfix-tlspol = { };
 
+      systemd.sockets.postfix-tlspol = {
+        wantedBy = [ "sockets.target" ];
+        socketConfig = {
+          Accept = false;
+          ListenStream = [
+            (lib.removePrefix "unix:" cfg.settings.server.address)
+          ];
+          SocketUser = "postfix-tlspol";
+          SocketGroup = "postfix-tlspol";
+          SocketMode = cfg.settings.server.socket-permissions;
+          DirectoryMode = "0755";
+        };
+      };
+
       systemd.services.postfix-tlspol = {
         after = [
           "nss-lookup.target"
@@ -173,7 +187,6 @@ in
           "nss-lookup.target"
           "network-online.target"
         ];
-        wantedBy = [ "multi-user.target" ];
 
         description = "Postfix DANE/MTA-STS TLS policy socketmap service";
         documentation = [ "https://github.com/Zuplu/postfix-tlspol" ];
@@ -217,9 +230,6 @@ in
           RestrictAddressFamilies = [
             "AF_INET"
             "AF_INET6"
-          ]
-          ++ lib.optionals (lib.hasPrefix "unix:" cfg.settings.server.address) [
-            "AF_UNIX"
           ];
           RestrictNamespaces = true;
           RestrictRealtime = true;
@@ -237,7 +247,7 @@ in
           RuntimeDirectory = "postfix-tlspol";
           RuntimeDirectoryMode = "1750";
           WorkingDirectory = "/var/cache/postfix-tlspol";
-          UMask = "0117";
+          UMask = "0077";
         };
       };
     })
diff --git a/nixos/tests/postfix-tlspol.nix b/nixos/tests/postfix-tlspol.nix
index d1af9877adb3..76a99b920c75 100644
--- a/nixos/tests/postfix-tlspol.nix
+++ b/nixos/tests/postfix-tlspol.nix
@@ -9,7 +9,10 @@
 
   containers.machine = {
     services.postfix.enable = true;
-    services.postfix-tlspol.enable = true;
+    services.postfix-tlspol = {
+      enable = true;
+      settings.server.metrics-address = "127.0.0.1:8642";
+    };
 
     services.dnsmasq = {
       enable = true;
@@ -26,13 +29,19 @@
     with subtest("Interact with the service"):
       machine.succeed("postfix-tlspol -purge")
 
-      response = json.loads((machine.succeed("postfix-tlspol -query localhost")))
+      response = machine.log(machine.succeed("postfix-tlspol -query localhost"))
+      response = json.loads(machine.succeed("postfix-tlspol -query localhost"))
       machine.log(json.dumps(response, indent=2))
 
       assert response["dane"]["policy"] == "", f"Unexpected DANE policy for localhost: {response["dane"]["policy"]}"
       assert response["mta-sts"]["policy"] == "TEMP", f"Unexpected MTA-STS policy for localhost: {response["mta-sts"]["policy"]}"
 
-    machine.log(machine.execute("systemd-analyze security postfix-tlspol.service | grep -v ✓")[1])
+    with subtest("Metrics listener"):
+      machine.log(machine.succeed("curl --silent --fail http://localhost:8642/metrics | grep --quiet postfix_tlspol_queries_total"))
+
+
+    with subtest("Hardening"):
+      machine.log(machine.execute("systemd-analyze security postfix-tlspol.service | grep -v ✓")[1])
   '';
 
 }