stalwart-mail: Fix spam-filter missing from /etc

[norpol]

Things done

• add norpol to nixpkgs maintainers
• chore work with nixpkgs style preferences in other sub packages
• The current nix unstable package doesn't contain the spamfilter.toml anylonger. This pull requests packages the spam-filter as an additional package.

$ find /nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/bin
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/bin/stalwart-cli
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/bin/stalwart
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/lib
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/lib/systemd
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/lib/systemd/system
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/lib/systemd/system/stalwart-mail.service
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/etc
/nix/store/jwznrq528mx0z844ka6j4rfqk5bhj463-stalwart-mail-0.12.4/etc/stalwart

Note: Stalwart will still download additional data through the spam-filter.toml. I don't think this has changed across the releases. I don't see that the ASN IPs, geolite, domains_mx, free_email_providers, ... are feasible to package into nixpkgs. So I'm not even sure whether it is advisable to not pull the spam-filters automatically from GitHub as well (so staying with the upstream config).

Also I'm unsure whether the auto-update flag has only an impact on the filter rules or also the http URLs downloaded through the filters.

$ grep 'https://'  /nix/store/ij1msx3awgpajyk4ci3zws3pyyixawkf-spam-filter-2.0.3/spam-filter.toml
asn = [ "https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv4.csv",
        "https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv6.csv" ]
geo = [ "https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-geo-whois-asn-country/geolite2-geo-whois-asn-country-ipv4.csv",
        "https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-geo-whois-asn-country/geolite2-geo-whois-asn-country-ipv4.csv" ]
url = "https://openphish.com/feed.txt"
url = "https://disposable.github.io/disposable-email-domains/domains_mx.txt"
url = "https://gist.githubusercontent.com/okutbay/5b4974b70673dfdcc21c517632c1f984/raw/993a35930a8d24a1faab1b988d19d38d92afbba4/free_email_provider_domains.txt"

built generates the same result

sha256sum /nix/store/ij1msx3awgpajyk4ci3zws3pyyixawkf-spam-filter-2.0.3/spam-filter.toml <(curl -qs -L -o - https://github.com/stalwartlabs/spam-filter/releases/download/v2.0.3/spam-filter.toml)
1b614bc004284116f6c98b5dfb2ce663872b5f60a0a8782c06ded9dcf3da2cd2  /nix/store/ij1msx3awgpajyk4ci3zws3pyyixawkf-spam-filter-2.0.3/spam-filter.toml
1b614bc004284116f6c98b5dfb2ce663872b5f60a0a8782c06ded9dcf3da2cd2  /proc/self/fd/11

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• Nixpkgs 25.11 Release Notes (or backporting 25.05 Nixpkgs Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
• NixOS 25.11 Release Notes (or backporting 25.05 NixOS Release notes)
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other contributing documentation in corresponding paths.

---

Add a 👍 reaction to pull requests you find important.

[norpol]

FYI: @diogotcorreia I've seen you've adjusted the spam-filter topic in #412054. I can't pin-point the exact commit, but stalwart isn't shipping the rules through the Rust build any longer.

(CC also @provokateurin)

[norpol]

not sure whether this is advisable, I don't know how stalwart is downloading the https:// URLs inside the file itself.

[norpol]

stalwartlabs/stalwart#1770

I've asked a question in the discussion channel.

[diogotcorreia]

This is already disabled by default, so explicitly setting it shouldn't make a difference. From https://stalw.art/docs/spamfilter/settings/general/#automatic-updates :

Stalwart can be configured to automatically update the spam-filter rules on startup. This feature is disabled by default and can be enabled by setting the spam-filter.auto-update key to true.

As for downloading the https:// URLs inside, I believe stalwart downloads them anyway. That setting seems to only affect this whether rules are reloaded on startup or not: https://github.com/stalwartlabs/stalwart/blob/b2f05254232a16873f260c527f327b9d3623b7f2/crates/common/src/manager/boot.rs#L413-L425

On a related note, it might make sense to set this option to true instead, so that it always refreshes the rules (and also the webadmin) from the specified files. Otherwise I think it only updates when a user clicks the button on the admin panel (?). I would like some input from nixpkgs stalwart maintainers on this one @happysalada @onny @oddlama @Pandapip1

[diogotcorreia]

@norpol Seems to have been changed in this commit upstream: stalwartlabs/stalwart@38fa029 (0.11.0)

[norpol]

This line only creates an empty directory now:

nixpkgs/pkgs/by-name/st/stalwart-mail/package.nix

Line 71 in a967b2f

mkdir -p $out/etc/stalwart

Safe bet would be to keep it for compatibility reasons, but practically it shouldn't be needed any longer.

[diogotcorreia]

This is already disabled by default, so explicitly setting it shouldn't make a difference. From https://stalw.art/docs/spamfilter/settings/general/#automatic-updates :

Stalwart can be configured to automatically update the spam-filter rules on startup. This feature is disabled by default and can be enabled by setting the spam-filter.auto-update key to true.

As for downloading the https:// URLs inside, I believe stalwart downloads them anyway. That setting seems to only affect this whether rules are reloaded on startup or not: https://github.com/stalwartlabs/stalwart/blob/b2f05254232a16873f260c527f327b9d3623b7f2/crates/common/src/manager/boot.rs#L413-L425

On a related note, it might make sense to set this option to true instead, so that it always refreshes the rules (and also the webadmin) from the specified files. Otherwise I think it only updates when a user clicks the button on the admin panel (?). I would like some input from nixpkgs stalwart maintainers on this one @happysalada @onny @oddlama @Pandapip1

[diogotcorreia]

Any reason for including the update to 0.12.5 here instead of on a separate PR?
As for the enterprise feature problem, we should definitely not enable the feature by default, and should instead apply a patch with this commit: stalwartlabs/stalwart@861471f

Edit: there are already open PRs that would update those packages:

• stalwart-mail: stalwart-mail-enterprise: 0.12.4 -> 0.12.5 #420056
• webadmin: stalwart-mail-webadmin: 0.1.27 -> 0.1.28 #420360

[norpol]

@diogotcorreia Just wanted to give the build a try, since there is plenty of feedback on the current PR I've switched it back to a draft since I'd expect more rounds. From the GitHub PRs in general it's not uncommon that one PR is addressing multiple things - although that makes back-porting sometimes harder. Just added the .patch with the upstream fix to see how it goes.

[diogotcorreia]

A few more nitpicks:

• add "Closes " for both the existing PRs that update stalwart (make sure to add "Closes" before both, otherwise they won't be closed)
• you probably should squash some of the commits (e.g., the ones fixing the spam-filter package should just be merged into the first some)
• the commit adding yourself to maintainer-list.nix should come first

Otherwise, LGTM I think

[norpol]

Hey @diogotcorreia I've rebased and incoroporated your suggestions.

• webmail was already upgrade merged stalwart-mail-webadmin: 0.1.27 -> 0.1.28 #420360 (I'm not sure if the webmail version on nixpkgs master is compatible with the previous stalwart-mail release that wasn't bumped yet)
• stalwart itself will receive a new release "this week" 🚀: New release including 861471f stalwartlabs/stalwart#1760 (comment) so I've dropped the upgrade commits again
• I've dropped spam-filter.auto-update = lib.mkDefault false; again as you've pointed out is already a default and if you just enable this option through the config users would see this warning https://stalw.art/docs/configuration/overview/#local-and-database-settings - maybe there are some things for future improvements to the modules that would optionally automatically expand the config.local-keys or maybe these options are most advisable managed through something else?
• commits are squashed, reorganized, ...

[diogotcorreia]

Sorry it took so long, I was busy for the past few days
LGTM!

[norpol]

Thanks @diogotcorreia. I've created a separate PR for #425489 in the meanwhile.

[norpol]

There was a reply concerning asn.urls, file:/// URLs are supported, so technically if people prefer that they can also use nix to pull the ASN IPs. As these are not under free licenses usually, we of course put them into the default package.
Maybe I'll add in a follow up PR the option for people to use file:/// links inside the filter list that is shipped by nix, but I think for this PR we are good as is (as it's only repairing the previous state)

stalwartlabs/stalwart#1770 (comment)