tests/simple-nixos-mailserver: Init

These two tests kinda cover our email infrastructure.
Importantly, all new mail gets classified as spam, which is why the
tests do not really cover `rspamd`. As such things like dkim signing,
correct DNS records and so on are not actually covered.

5 files changed, 250 insertions, 0 deletions

diff --git a/tests/common/email/dkim/mail.server1/private.age b/tests/common/email/dkim/mail.server1/private.age
new file mode 100644
index 0000000..a97c70b
--- /dev/null
+++ b/tests/common/email/dkim/mail.server1/private.age
@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSBndElV
+WFFTcEZpTGwrTUg5WHk1MElLSU5ZZWp1NU5ocit4VGtnM09KZFNBCjNvaWVPR3Zt
+RG14N2E3b0RwK21IUzBZZmg1UzFwakMwTVVOdDgrTTd4U1UKLT4geD9OYm0tZ3Jl
+YXNlIDwgcjkKQUJtaDlVbzk3Slk3S1ozNS9STGwrdzhvWTlodWgxNVd1WVRadTV5
+VmFVUmRmSTV3ckIzYmpQYUFsMUxkdGNzUgo1UXozYzBCK3UxU1BPSnlvVVVxQjI2
+QVdWY0tBbUg1R3p5NmNaZ2RiVGNlL3pWN3FHZU5QOEN2VVdraDBzM1R2CgotLS0g
+TElGejJDYUk4WlhxajdXekI4S0tUMVlrNmdxelpjUnBUa1VCU2krSFloawpUfMj8
+iqVP45yV8fON6fDUur6q/UYqTaaHhCW07LTsBZQpReG8LA+PiOhHw1TmPSJlc/JH
+yEkwLachwvLGCGEO2yoFUFhYwoNhl3vrBsuDLXpqfNuoPrg3wcFXBdrg9zBjZ5Pc
+C/rdzpysjW/52gKRCdGgFj2WyTW2wO2yVmmUk1RWhMabmdd+XLkKhynaMtWsBF0j
+NQ3F
+-----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/mail.server1/public b/tests/common/email/dkim/mail.server1/public
new file mode 100644
index 0000000..6c9e653
--- /dev/null
+++ b/tests/common/email/dkim/mail.server1/public
@@ -0,0 +1 @@
+3/bsVrnWag3eMCuj78VpsHDQSONi97fIzY+WPKvAYWM=
\ No newline at end of file
diff --git a/tests/common/email/dkim/mail.server2/private.age b/tests/common/email/dkim/mail.server2/private.age
new file mode 100644
index 0000000..fbd88fc
--- /dev/null
+++ b/tests/common/email/dkim/mail.server2/private.age
@@ -0,0 +1,11 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSBTcktS
+L0ovODhxd2tyWFdINWRtbXNNYksyNzl6RUxRcTU2T251eVNhQlg4CjVzTVpnc0FC
+eHBNaUtEQnJVRXVpTjg2c3gxcC90VXJ3cUJVaHZJY1pnb00KLT4gKDEkKS1ncmVh
+c2UgYnYqQSBAVSU+CnVRbkRhdUhRS0Z6NGIybll1WVdmSmxzS0lxYlAwSXp0TnA4
+anRDSmQKLS0tIGxxSXRaM0lKeXRoeHFxWW9qN3Y1OE55b1FBVGJTZzB2RmFmZVk5
+eW94aW8KleHhm6fKalehWR0IfHYiC+0bsm0SeYjnJeA60hePdwikmr0QQv5D2xCX
+Nf2QRuai/BpsiJpnvKUiP1uwkm5x6a2Zgwa7t8BwJ7SHqD4oJ+VgCsWMffLs55uC
+A1pKLRmAI26cNt7oibVxNSCCuxZRWeCn+xAsQ393jVCUuDW2FkgyDsKFYHvKRpnC
+BNfwDWWHJ+pifPPrqg==
+-----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/mail.server2/public b/tests/common/email/dkim/mail.server2/public
new file mode 100644
index 0000000..40b6ff7
--- /dev/null
+++ b/tests/common/email/dkim/mail.server2/public
@@ -0,0 +1 @@
+QmbJbp/b671OCOQa0Qx1XGl7c1jzFuASuzBr1f5ATpE=
\ No newline at end of file
diff --git a/tests/common/email/functions.nix b/tests/common/email/functions.nix
new file mode 100644
index 0000000..7be1bfa
--- /dev/null
+++ b/tests/common/email/functions.nix
@@ -0,0 +1,224 @@
+{
+  pkgs,
+  vhackPackages,
+}: {
+  scripts = {
+    expectNoNewMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --verbose >&2 || [ "$?" -eq 1 ] || {
+        echo "Mail was not empty" >&2
+        exit 1
+      }
+    '';
+    expectNewMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --verbose >&2 || [ "$?" -ne 1 ] || {
+        echo "No new mail" >&2
+        exit 1
+      }
+    '';
+    expectNewSpamMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --folder JUNK --verbose >&2 || [ "$?" -ne 1 ] || {
+        echo "No new spam mail" >&2
+        exit 1
+      }
+    '';
+  };
+
+  mkMailServer = serverName: userName: {
+    config,
+    lib,
+    nodes,
+    ...
+  }: {
+    age.identityPaths = ["${../../common/email/hostKey}"];
+
+    systemd.tmpfiles.rules = [
+      #-      path                     mode user group - content
+      "f     /passwords/${userName}    777  root root  - ${userName}-password"
+    ];
+
+    age.secrets = {
+      "mailDkim" = {
+        file = ../../common/email/dkim + "/${serverName}/private.age";
+        mode = "600";
+        owner = "rspamd";
+        group = "rspamd";
+      };
+    };
+
+    # Disable rspamd. rspamd can't do the dns lookups in the sandbox for
+    # determining if something is spam or not. Therefore it just rejects every mail with
+    # 'Try again later.'.
+    # services.rspamd.enable = lib.mkForce false;
+    # users.users.rspamd.group = "rspamd";
+    # users.groups.rspamd = {};
+    #
+    # services.postfix.settings.main = {
+    #   smtpd_milters = lib.mkForce [];
+    #   non_smtpd_milters = lib.mkForce [];
+    # };
+    # mailserver.dkim.enable = false;
+    services = {
+      rspamd = {
+        locals = {
+          "asn.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+          "rbl.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+          "greylist.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+        };
+      };
+    };
+
+    # This DNS resolver is only there for rspamd (and apparently not even needed). But it
+    # also removes our own name server changes, so the test node could no longer find
+    # e.g. `acme.test` and so on.
+    # See: https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/work_items/100
+    mailserver.localDnsResolver = false;
+
+    vhack = {
+      mail = {
+        enable = true;
+        fqdn = serverName;
+        domains = [
+          serverName
+        ];
+
+        security.dkimKeys."${serverName}" = {
+          dkimPrivateKeyPath = config.age.secrets."mailDkim".path;
+          dkimPublicKey =
+            builtins.readFile (../../common/email/dkim + "/${serverName}/public");
+          keyAlgorithm = "rsa-sha-256";
+        };
+
+        accounts = {
+          "${userName}@${serverName}" = {
+            passwordFile = "/passwords/${userName}";
+          };
+        };
+      };
+    };
+  };
+
+  mkDnsZone = serverName: {config, ...}: let
+    cfg = config.vhack.mail;
+
+    keyAlgoToKeyType = keyAlgo:
+      if keyAlgo == "ed25519-sha256"
+      then "ed25519"
+      else if keyAlgo == "rsa-sha-256" || keyAlgo == "rsa-sha-1"
+      then "rsa"
+      else builtins.throw "Impossible";
+  in {
+    "${serverName}" = {
+      MX = [
+        {
+          preference = 10;
+          exchange = "${serverName}.";
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.1
+      # https://www.rfc-editor.org/rfc/rfc6376.html#section-7.5
+      DKIM = [
+        {
+          selector = "mail";
+          k = keyAlgoToKeyType cfg.security.dkimKeys."${serverName}".keyAlgorithm;
+          p = cfg.security.dkimKeys."${serverName}".dkimPublicKey;
+          s = ["email"];
+          t = ["s"];
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc7489.html#section-6.3
+      DMARC = [
+        {
+          adkim = "strict";
+          aspf = "strict";
+          fo = ["0" "1" "d" "s"];
+          p = "quarantine";
+          rua = "admin@vhack.eu";
+          ruf = ["admin@vhack.eu"];
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc7208.html
+      # NOTE(@bpeetz): This server might not be directly sending mail, but it is still required for
+      # the SMTP EHLO check. <2025-02-25>
+      TXT = [
+        (builtins.concatStringsSep " "
+          [
+            "v=spf1" # The version.
+            "+mx" # Allow mail from this domain MX record.
+            "-all" # Reject all other emails if the previous mechanism did not match.
+          ])
+      ];
+    };
+  };
+
+  mkUser = user: mailServer: {nodes, ...}: {
+    environment.systemPackages = [
+      vhackPackages.fetchmail-common-name
+      pkgs.msmtp
+      pkgs.procmail
+    ];
+
+    users.users."${user}" = {isNormalUser = true;};
+
+    systemd.tmpfiles.rules = [
+      "d /home/${user}/mail         0700 ${user} users - -"
+      "L /home/${user}/.fetchmailrc -    -       -     - /etc/homeSetup/.fetchmailrc"
+      "L /home/${user}/.procmailrc  -    -       -     - /etc/homeSetup/.procmailrc"
+      "L /home/${user}/.msmtprc     -    -       -     - /etc/homeSetup/.msmtprc"
+    ];
+
+    environment.etc = {
+      "homeSetup/.fetchmailrc" = {
+        text = ''
+          poll "${mailServer}" protocol IMAP
+            username "${user}@${mailServer}"
+            password "${user}-password"
+            ssl
+            mda procmail;
+        '';
+        mode = "0600";
+        inherit user;
+      };
+      "homeSetup/.procmailrc" = {
+        text = ''
+          DEFAULT=$HOME/mail
+        '';
+        mode = "0600";
+        inherit user;
+      };
+      "homeSetup/.msmtprc" = {
+        text = ''
+          account        ${user}
+          host           ${mailServer}
+          domain         ${mailServer}
+          port           465
+          from           ${user}@${mailServer}
+          user           ${user}@${mailServer}
+          password       ${user}-password
+          auth           on
+          tls            on
+          tls_starttls   off
+        '';
+        mode = "0600";
+        inherit user;
+      };
+    };
+  };
+}