commit ffe481d03b085c5ff2fcd8a10b1e3eb08ac85d84
parent b68745626dc70679de417bf1ab61334bf00b530e
Author: vin <vin@vineetk.net>
Date: Mon, 3 Mar 2025 01:09:58 -0500
saklas: switch mail.nix to use agenix
Diffstat:
7 files changed, 89 insertions(+), 72 deletions(-)
diff --git a/flake.nix b/flake.nix
@@ -21,7 +21,7 @@
agenix.url = "github:ryantm/agenix";
};
- outputs = { self, home-manager, nixpkgs, nixpkgs-stable, everblush-gtk, simple-nixos-mailserver, agenix, ... }@inputs: {
+ outputs = { self, home-manager, nixpkgs, nixpkgs-stable, everblush-gtk, agenix, simple-nixos-mailserver, ... }@inputs: {
# TODO: deduplicate this
nixosConfigurations = {
demiurge = nixpkgs.lib.nixosSystem {
@@ -48,6 +48,7 @@
specialArgs = inputs;
modules = [
./hosts/lappy
+ agenix.nixosModules.default
home-manager.nixosModules.home-manager {
home-manager.extraSpecialArgs = {
@@ -66,7 +67,8 @@
specialArgs = inputs;
modules = [
./hosts/saklas
- simple-nixos-mailserver.nixosModules.default ./hosts/saklas/mail.nix
+ agenix.nixosModules.default
+ simple-nixos-mailserver.nixosModule
];
};
};
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
@@ -7,6 +7,10 @@
# decrypt agenix secrets
age.secrets = {
+ email_vinbiz.file = ../../secrets/email_vinbiz.age;
+ email_vineetk.file = ../../secrets/email_vineetk.age;
+ email_13f0.file = ../../secrets/email_13f0.age;
+
hetzner_dns = {
file = ../../secrets/hetzner_dns.age;
owner = "root";
@@ -18,14 +22,13 @@
owner = "radicale";
};
- tailscale_demiurge = {
+ tailscale_saklas = {
file = ../../secrets/tailscale_saklas.age;
owner = "root";
group = "root";
};
};
-
# disable wifi and open some ports
networking = {
hostName = "saklas";
@@ -36,7 +39,7 @@
firewall = {
allowedTCPPorts = [ 22 80 443 ];
- allowedUDPPorts = [ 3478 41641 51820 ];
+ allowedUDPPorts = [ 3478 51820 ];
};
};
@@ -158,7 +161,7 @@
tailscale = {
enable = true;
- authKeyFile = config.age.secrets.tailscale_demiurge.path;
+ authKeyFile = config.age.secrets.tailscale_saklas.path;
extraDaemonFlags = [ "--no-logs-no-support" ];
extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
openFirewall = true;
@@ -232,7 +235,7 @@
server.hosts = [ "127.0.0.1:5232" ];
auth = {
type = "htpasswd";
- htpasswd_filename = "/etc/radicale/users";
+ htpasswd_filename = config.age.secrets.radicale_users.path;
htpasswd_encryption = "bcrypt";
};
};
@@ -269,6 +272,66 @@
};
};
+ # email via simple-nixos-mailserver
+ mailserver = {
+ enable = true;
+ fqdn = "mail.vineetk.net";
+ domains = [ "vineetk.net" "vinbiz.ca" "13f0.net" ];
+
+ # A list of all login accounts. To create the password hashes, use
+ # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+ loginAccounts = {
+ "vineet@vineetk.net" = {
+ hashedPasswordFile = config.age.secrets.email_vineetk.path;
+ aliases = ["@vineetk.net"];
+ };
+
+ "kar@13f0.net" = {
+ hashedPasswordFile = config.age.secrets.email_13f0.path;
+ aliases = ["@13f0.net"];
+ sieveScript = ''
+require [ "fileinto", "mailbox" ];
+
+if address :matches [ "to", "cc" ] "announce@openbsd.org" {
+ fileinto :create "openbsd_announce";
+ stop;
+}
+if address :matches [ "to", "cc" ] "arm@openbsd.org" {
+ fileinto :create "openbsd_arm";
+ stop;
+}
+if address :matches [ "to", "cc" ] "misc@openbsd.org" {
+ fileinto :create "openbsd_misc";
+ stop;
+}
+if address :matches [ "to", "cc" ] "misc@opensmtpd.org" {
+ fileinto :create "opensmtpd_misc";
+ stop;
+}
+if address :matches [ "to", "cc" ] "oss-security@lists.openwall.com" {
+ fileinto :create "oss_security";
+ stop;
+}
+if address :matches [ "to", "cc" ] "tuhs@tuhs.org" {
+ fileinto :create "tuhs";
+ stop;
+}
+ '';
+ };
+
+ "vineet@vinbiz.ca" = {
+ hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+ aliases = ["postmaster@vinbiz.ca"];
+ };
+ "suresh@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+ "revathy@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+ "suren@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+ };
+
+ acmeCertificateName = "vineetk.net";
+ certificateScheme = "acme";
+ };
+
# create caches and use mandoc
documentation.man = {
enable = true;
diff --git a/hosts/saklas/mail.nix b/hosts/saklas/mail.nix
@@ -1,60 +0,0 @@
-{
- mailserver = {
- enable = true;
- fqdn = "mail.vineetk.net";
- domains = [ "vineetk.net" "vinbiz.ca" "13f0.net" ];
-
- # A list of all login accounts. To create the password hashes, use
- # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
- loginAccounts = {
- "vineet@vineetk.net" = {
- hashedPassword = "$2b$05$7chAoNcCtw8ajVQYjmb7T.JLcOjtlVsS/LipIvc3LY4/qUPrFTP/.";
- aliases = ["@vineetk.net"];
- };
-
- "kar@13f0.net" = {
- hashedPassword = "$2b$05$w0rQk32VTQ8YMPQa.Mb28eX8zmYpDqI9FMPShQ7o2tYVzpbtvEyPq";
- aliases = ["@13f0.net"];
- sieveScript = ''
-require [ "fileinto", "mailbox" ];
-
-if address :matches [ "to", "cc" ] "announce@openbsd.org" {
- fileinto :create "openbsd_announce";
- stop;
-}
-if address :matches [ "to", "cc" ] "arm@openbsd.org" {
- fileinto :create "openbsd_arm";
- stop;
-}
-if address :matches [ "to", "cc" ] "misc@openbsd.org" {
- fileinto :create "openbsd_misc";
- stop;
-}
-if address :matches [ "to", "cc" ] "misc@opensmtpd.org" {
- fileinto :create "opensmtpd_misc";
- stop;
-}
-if address :matches [ "to", "cc" ] "oss-security@lists.openwall.com" {
- fileinto :create "oss_security";
- stop;
-}
-if address :matches [ "to", "cc" ] "tuhs@tuhs.org" {
- fileinto :create "tuhs";
- stop;
-}
- '';
- };
-
- "vineet@vinbiz.ca" = {
- hashedPassword = "$2b$05$lyCFvoxfoJX8jtI3FsePLenhcIn.hqN53twq/zJ316f4WHQJeUji6";
- aliases = ["postmaster@vinbiz.ca"];
- };
- "suresh@vinbiz.ca".hashedPassword = "$2b$05$Vpqk62qIbRsFQipSd2aA0.EqL011nSmhA6VD.YjjfoYbO3zZVybDS";
- "revathy@vinbiz.ca".hashedPassword = "$2b$05$RkABB76JTCNa0cotOfS28..mJME7a/A4gaTRpZnSdTJi3wr2X3t.C";
- "suren@vinbiz.ca".hashedPassword = "$2b$05$.VTHKaBu0JQf2MpLNa7GXeliyZxOdXms59VslMmEjnu.IOzjVgHzy";
- };
-
- acmeCertificateName = "vineetk.net";
- certificateScheme = "acme";
- };
-}
diff --git a/secrets/email_13f0.age b/secrets/email_13f0.age
Binary files differ.
diff --git a/secrets/email_vinbiz.age b/secrets/email_vinbiz.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ XcNpUXvbz6PsCgeEZMf1+yMrjIipzsesAKO+EssReTw
+EcDIICNjeS3KKev0qK/0v7V/86QdOWYNaTyFDFE435I
+-> ssh-ed25519 hc2ELA rO5kM81Uk4G5bowyCzGUZdBvqxvcNctjdrD1+Tfk8VY
+1ef+BiIAJFFKpNAPb2QHHzrxTAyNyj7Hc/nArculdsc
+--- TrgPJhsRCmQuOl9m51XUHnhV+pBlbj0iYgzXUojgjTw
+cm/(,{W}yxAՙT^\# W-ČO4dϑd [Ce0 .v\ q&
+\ No newline at end of file
diff --git a/secrets/email_vineetk.age b/secrets/email_vineetk.age
Binary files differ.
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -7,9 +7,13 @@ let
systems = [ demiurge saklas ];
in
{
- "hetzner_dns.age".publicKeys = users ++ systems;
- "radicale_users.age".publicKeys = users ++ systems;
- "smallstep.age".publicKeys = users ++ systems;
- "tailscale_demiurge.age".publicKeys = users ++ systems;
- "tailscale_saklas.age".publicKeys = users ++ systems;
+ "email_vinbiz.age".publicKeys = users ++ [ saklas ];
+ "email_vineetk.age".publicKeys = users ++ [ saklas ];
+ "email_13f0.age".publicKeys = users ++ [ saklas ];
+
+ "hetzner_dns.age".publicKeys = users ++ [ saklas ];
+ "radicale_users.age".publicKeys = users ++ [ saklas ];
+ "smallstep.age".publicKeys = users ++ [ demiurge ];
+ "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
+ "tailscale_saklas.age".publicKeys = users ++ [ saklas ];
}
