Set & use Redis password

rspamd.nix

@@ -37,6 +37,11 @@ in {
         description = "Port at which to reach ClamAV";
       };
     };
+
+    redis.password-file = {
+      type = str;
+      description = "Password with which to connect to Redis.";
+    };
   };
 
   config = mkIf cfg.enable {
@@ -46,7 +51,8 @@ in {
       port = cfg.ports.metrics;
     };
 
-    services.rspamd = {
+    services.rspamd = let redisPasswd = readFile cfg.redis.password-file;
+    in {
       enable = true;
 
       locals = {
@@ -59,6 +65,7 @@ in {
             type = "clamav";
             log_clean = true;
             servers = "${cfg.antivirus.host}:${toString cfg.antivirus.port}";
+            password = "${redisPasswd}";
             scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all
           }
         '';
@@ -79,6 +86,7 @@ in {
         "dmark.conf".text = ''
           dmarc = {
             servers = "redis";
+            password = "${redisPasswd}";
           }
         '';
 
@@ -86,6 +94,7 @@ in {
           enabled = true;
 
           servers = "redis";
+          password = "${redisPasswd}";
 
           timeout = 10.0;
 
@@ -102,6 +111,7 @@ in {
               }
               backend "redis" {
                 servers = "redis";
+                password = "${redisPasswd}";
               }
 
               symbol = "IP_REPUTATION";
@@ -111,6 +121,7 @@ in {
               }
               backend "redis" {
                 servers = "redis";
+                password = "${redisPasswd}";
               }
 
               symbol = "SPF_REPUTATION";
@@ -120,6 +131,7 @@ in {
               }
               backend "redis" {
                 servers = "redis";
+                password = "${redisPasswd}";
               }
 
               symbol = "DKIM_REPUTATION"; # Also adjusts scores for DKIM_ALLOW, DKIM_REJECT
@@ -130,6 +142,7 @@ in {
               }
               backend "redis" {
                 servers = "redis";
+                password = "${redisPasswd}";
               }
 
               symbol = "GENERIC_REPUTATION";