guixsd-config

GuixSD configs for my systems
Log | Files | Refs
commit bb3b5407db3c579825a138d3649356340246bf73
parent c810b4587f88055a2793de0f40c3b155eb160117
Author: Vineet Kumar <git@vineetk.net>
Date:   Sun,  1 Feb 2026 23:10:15 -0500

saklas: add dovecot

Diffstat:

Mepistemia/secrets/email_13f0.age | 15+++++++--------


Mepistemia/secrets/email_vinbiz.age | 14+++++++-------


Mepistemia/secrets/email_vineetk.age | 14+++++++-------


Mepistemia/secrets/saklas_smtpd_dkim.age | 0


Mepistemia/secrets/saklas_smtpd_passwd.age | 0


Mepistemia/secrets/saklas_smtpd_virtuals.age | 0


Mepistemia/secrets/wg0_demiurge.age | 0


Mepistemia/secrets/wg0_hastur.age | 14+++++++-------


Mepistemia/secrets/wg1_demiurge.age | 14+++++++-------


Mepistemia/secrets/wg1_hastur.age | 14+++++++-------


Mepistemia/secrets/wg1_saklas.age | 0


Mepistemia/secrets/wpa_supplicant.age | 0


Mepistemia/systems/saklas.scm | 64++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----


13 files changed, 102 insertions(+), 47 deletions(-)

diff --git a/epistemia/secrets/email_13f0.age b/epistemia/secrets/email_13f0.age
@@ -1,8 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 KXd7pg +F2yXhae5yj0NLsNOiW1uO7pivHOHBs/mB+gyoJMeyc
-BKlidch3PDLCGyP9XhVGtNf4KIdf2/hogpB2pMA+td4
--> ssh-ed25519 AaF/mQ XY8cQjrBInYxxvE5WOulENM01ON8r0rMJTDLjV5b+x0
-5qIebghkQsO/fJpFAC8LGj3uNGKoKxDzRPg1XYJC/NE
---- yN9TRJeI9kDxjDQX7VT3U1fmlcmhKyOmQFwB9fErhoA
-G'm!yDzJjSB`B\ԾFl{
-L%=et-]1u_T,xBq
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg NsEAz8RAC8vRX0Z9o+YiEDbcXybs59ZwGVVpMkiBWV4
+qbkdpIBFIVV/tAJcMopa+qYarxh42WzdZaTflS+U+kI
+-> ssh-ed25519 AaF/mQ dVspchX6p6BTGZ5pFtcUPey4uvS3nRshHjneWawdpw8
+JP6lWPR2H7PO6LPs9I83rkNaeDojRH/Ih1HIMMLYgxA
+--- 6wxlSPczjwDsgfKYV+5IjFDp8Z6lM36dDKSn1ciUdlI
+3m%˔Nt#6ѮH'b!×`h=5C̸1dCQb"?ѺWSgRQ:e/Qx_Ce
+\ No newline at end of file
diff --git a/epistemia/secrets/email_vinbiz.age b/epistemia/secrets/email_vinbiz.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 KXd7pg tUohFOSCPlfHTBOKGtiMtzzsKECiGZTWFfvZDgC77xc
-lSJPK6pIzYrX7SOdNKLMNckjQcdNt51XdD1mwSPNNAE
--> ssh-ed25519 AaF/mQ 3VNOi3vM4l7GArgCG257ysdBRoNKlxo1WlMt3X343nw
-SRKfvfM4LyGzPUKG5O5xAtsuUdXiA/xo4BBTk6qz+Gk
---- Q6rWlMQRuHZmFr7Ijx1h4NYdBmdI6R/q2jRnxxiC7tM
-&k^H̩Z]ծJedVm$_ʭUO"ڃ>87+S[F{/=a_y'R:ɦ
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg 4wu3er0YRZ7bKHgSvOPobaaYRnu5uw1IuRkyYnyv604
+4Jyb/SFwrfCsIvml5n7qZdmVUBRYc15gDkiAHifEOiE
+-> ssh-ed25519 AaF/mQ eMons5xjB7cyHlwLfhOZpitUm7RITVRSlflPun4iJF0
++3vsb0GFdwsL73K5LzHk8wGRqapgLjGctpDjE7ebEuU
+--- Y5Wp0Wn97gEWsWrP+2dTcfk52ig97VFrCtnsAj+qcNc
+VCFd{x0K(Dg'{"qfSi>헥`٪![;O+,ޡ9EԈ :.)DY=H!I:
+\ No newline at end of file
diff --git a/epistemia/secrets/email_vineetk.age b/epistemia/secrets/email_vineetk.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 KXd7pg R5+p2kMgSxnMdpi8IS3nW/9xLSuu1qjsqz4yijKtC1A
-2hdmKFZYX/S55tg2dQjNPRBPsmlkwNwjCr931LojORA
--> ssh-ed25519 AaF/mQ S3RPT19vbkgu/jFnhb9pcivTv5zVvqOxY5akt2AMU2k
-WcSSP5XciN9bs5/mpR/ze+ofuTMDqF/cQ2fJjs0l2gM
---- WzqudkfQGAKINq39mpndXRJvDCGP32rGprE87V5WmqQ
-ICf,CAsOL%77W08[w!Vb	foRB#o//֨Q)7T0aLMSHj5Qi2jc
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg VYtavY/HfPDlbJ3v6rPaagot99/3Uzmus+oAD/1OZSQ
+dpZgD7P1LD8E99CuCsCjQvywmDet5gQb8m7lfnTvJFs
+-> ssh-ed25519 AaF/mQ MFd8jVk6c7JMugxA/IWKj+dliuyCHStIrWek/0O+jBw
+/YtO4GuajtlAmmUGZMs8y3IXENx9wcKx4xXYPx5Xplk
+--- bwV9bL2EQNv2A17Ey091CSg0aZfClQKr61vLxLx0wHA
+0+ӎHDΗݢ.sC,[3SWg$"/pm$DX~z#6Z5m~я>ByeܾAFx)FF
+\ No newline at end of file
diff --git a/epistemia/secrets/saklas_smtpd_dkim.age b/epistemia/secrets/saklas_smtpd_dkim.age
Binary files differ.
diff --git a/epistemia/secrets/saklas_smtpd_passwd.age b/epistemia/secrets/saklas_smtpd_passwd.age
Binary files differ.
diff --git a/epistemia/secrets/saklas_smtpd_virtuals.age b/epistemia/secrets/saklas_smtpd_virtuals.age
Binary files differ.
diff --git a/epistemia/secrets/wg0_demiurge.age b/epistemia/secrets/wg0_demiurge.age
Binary files differ.
diff --git a/epistemia/secrets/wg0_hastur.age b/epistemia/secrets/wg0_hastur.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 u1jj0Q MGIN6ROiC3rE7ZErJhRH7t4oVLV4VFxRDS0xCY5oB10
-srGbsuqsdyu//8XPbiAaCUJT58l+7IN+ARkFqlkIV6s
--> ssh-ed25519 AaF/mQ iqyIyroyukF/SWbgztW3+NArH0f1R9Aj79m9Xf3ZT08
-xqjJHiv/GYAohv4gpraGf2EOsFyoWsQ1/TObi04vFJI
---- dLDpm8m28K0XbsCYr80NCRqu0grE97WfAUocmC/XylE
-M>1JCƯ<@Am`h$5)m=T\_sK@և/L~24Ŋ!	
-\ No newline at end of file
+-> ssh-ed25519 u1jj0Q 2IQPNtOnCiEHhY/ThbScCclZQCrj92JwuDKhE2+3bEI
+BfohuGYFs1TN43CqUIx6Ny5VExbVjnblvExicKd/3ik
+-> ssh-ed25519 AaF/mQ ILk0l28YKjUo1fypmQY1T8mzpZWlI419kqNR6IWMOk0
+QKYKDUEgAeFqNBm8z3TgBL2kMk85zvL+ChUQcZwp6SM
+--- flzdOWmFM5qgiFysFitNULLoScJ3mBVbPCUzh/QRmMw
+ēBk8FЬrd$!wz5VC7+N[#2bQRw?FW7i떵A7HkU/b
+\ No newline at end of file
diff --git a/epistemia/secrets/wg1_demiurge.age b/epistemia/secrets/wg1_demiurge.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 947m3A wSP66asmzFEKBI3ZW6Qj04EQer77GbP65G8Jn2ipbFY
-Uwrhu8BdmHa1Qj4dsY2OP88zR0R+CG6K8UPRtDRWYUc
--> ssh-ed25519 AaF/mQ VN8rH287lfy2TGK1xVPA5EUknHJAU0AMIjM7lq5OwV4
-UthVsZ8EkKBRkqS8evwQ4JipkMK+XaaeMWEV0C0x+lY
---- p+XFc58iBH/vM/R1HXGE0NfWNE6DdDBsQmqKFAUehKs
-E{Pq1XQLx[|[w8;qƘSPІi*.pnXаkjL1Eɩwr0Nc
-\ No newline at end of file
+-> ssh-ed25519 947m3A GidCIex8pJSyxNKifg1uxJMnKFIgUOy9o4YJSy7B1hA
+swaZaQmF7qzaJYCpC5z1EXlSz367xfmB4hQHu6QGkuU
+-> ssh-ed25519 AaF/mQ ikNI5JNEGtY1RKH0rEBQhJgwyAh6LQdgTOXF4L7OGFE
+xppu3dxpwSUHOCMAnvEwcGlJYoekAYcCuW45JoovZX0
+--- FtUgZ6j8wGmM2yXswauXF8q79S31Pcvtq1vnIXqMUro
+t_vvԫ#brwH1cmBQٱд1gŴ|(;<='K&L
+\ No newline at end of file
diff --git a/epistemia/secrets/wg1_hastur.age b/epistemia/secrets/wg1_hastur.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 u1jj0Q Pyp2wAZl+sOCwkmOnZpO/dvSn5iHgKe5aYKw2pSe2D8
-OeU8Fb99Im82dq7QPV/LgrWHXUkZJddIGYUSoFXKBgs
--> ssh-ed25519 AaF/mQ /0u55zKnbUjBjdwzTsoSzEvuQbIhs47yMaIitlTO8Tk
-6O1V+F7O6p6oHcm96sna2YkCl1T3Dk86R61Gzm37A6s
---- CcJPTC6ff7N1NRIj7SoeojxJETF6BQp3FL6TaNp/4rA
-'W}@Pڲϥ^$I.L&;!k6UeVU5WЉ
-\ No newline at end of file
+-> ssh-ed25519 u1jj0Q nOzsdn1psHMgyOwrrP70FxG85ES07ZLhs3PJzUfYuzA
+NPA15tRDEx+eHxHWTIOiiEDP1ou4f08ctKIvehhCd/k
+-> ssh-ed25519 AaF/mQ 6oY9OEjd8gCE56cr3Oge11QGFf5Yk3qNe8jlGmBM8T4
+fAAQzwKPV6NFkOrj8vyZbjwkGFaSaDppKAFtE9TP+7U
+--- Rpgfr8niONdo6V7Fd7UqjZc+O2tBAks3vW9EJDoOz5I
+Q8%%F'<WswB4!_TJbA9pXI|
+\ No newline at end of file
diff --git a/epistemia/secrets/wg1_saklas.age b/epistemia/secrets/wg1_saklas.age
Binary files differ.
diff --git a/epistemia/secrets/wpa_supplicant.age b/epistemia/secrets/wpa_supplicant.age
Binary files differ.
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
@@ -71,7 +71,7 @@ if ($bad_boi = 1) {
 		   "listen on eth0 port 25 tls pki mail.vineetk.net filter { check_dyndns, check_rdns, check_fcrdns }\n"
 		   "listen on eth0 port 465 smtps pki mail.vineetk.net auth <passwd> filter dkimsign_rsa\n"
 		   "\n"
-		   "action \"inbound\" lmtp \"/var/dovecot/lmtp\" rcpt-to virtual <virtuals>\n"
+		   "action \"inbound\" lmtp \"/var/run/dovecot/lmtp\" rcpt-to virtual <virtuals>\n"
 		   "action \"outbound\" relay helo mail.vineetk.net\n"
 		   "\n"
 		   "match from local for local action \"inbound\"\n"
@@ -201,10 +201,19 @@ table inet filter {
 		 (shell (file-append git "/bin/git-shell"))
 		 (group "git")
 		 (home-directory "/data/src/bare")
-		 (system? #f))
+		 (system? #t))
+	       (user-account
+		 (name "vmail")
+		 (comment "virtual mail account")
+		 (group "vmail")
+		 (shell "/dev/null")
+		 (home-directory "/var/vmail")
+		 (system? #t))
 	       %base-user-accounts))
   (groups (cons* (user-group
 		   (name "git"))
+		 (user-group
+		   (name "vmail"))
 		 %base-groups))
 
   (kernel linux-6.17)
@@ -432,7 +441,7 @@ rpz:
 									     (system* prosodyctl "--root" "cert" "import" "/etc/certs")))))
 							 (domains '("vineetk.net"
 								    "git.vineetk.net"
-					;"mail.vineetk.net"
+								    "mail.vineetk.net"
 								    "u.vineetk.net"
 								    "xmpp.vineetk.net"
 								    )))
@@ -528,7 +537,54 @@ rpz:
 							  (domain "vineetk.net"))))))
 					   (service opensmtpd-service-type
 						    (opensmtpd-configuration
-						      (config-file %opensmtpd-config))))
+						      (config-file %opensmtpd-config)))
+					   (service dovecot-service-type
+						    (dovecot-configuration
+						      (listen '("*" "::"))
+						      (mail-location "maildir:/var/vmail/%d/%n")
+						      (mail-uid "vmail")
+						      (mail-gid "vmail")
+						      (ssl? "required")
+						      (ssl-cert "</etc/certs/vineetk.net/fullchain.pem")
+						      (ssl-key "</etc/certs/vineetk.net/privkey.pem")
+						      (namespaces
+						       (list (namespace-configuration
+							       (name "inbox")
+							       (inbox? #t)
+							       (location "")
+							       (prefix "")
+							       (mailboxes
+								(list (mailbox-configuration
+									(name "Drafts")
+									(special-use '("\\Drafts")))
+								      (mailbox-configuration
+									(name "Junk")
+									(special-use '("\\Junk")))
+								      (mailbox-configuration
+									(name "Sent")
+									(special-use '("\\Sent")))
+								      (mailbox-configuration
+									(name "Trash")
+									(special-use '("\\Trash"))))))))
+						      (passdbs
+						       (list (passdb-configuration
+							       (driver "passwd-file")
+							       (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd")))))
+						      (userdbs
+						       (list (userdb-configuration
+							       (driver "static")
+							       (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n")))))
+						      (protocols
+						       (list (protocol-configuration (name "imap"))
+							     (protocol-configuration (name "lmtp"))))
+						      (services
+						       (list (service-configuration
+							       (kind "lmtp")
+							       (listeners
+								(list (unix-listener-configuration
+									(path "lmtp")
+									(group "vmail")
+									(user "vmail"))))))))))
 				     %base-services)
 	      (guix-service-type config =>
 				 (guix-configuration