saklas: switch mail.nix to use agenix

2 files changed, 68 insertions, 65 deletions

diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
index 8948ed4..0a3e91c 100644
--- a/hosts/saklas/default.nix
+++ b/hosts/saklas/default.nix
@@ -7,6 +7,10 @@
 
   # decrypt agenix secrets
   age.secrets = {
+    email_vinbiz.file = ../../secrets/email_vinbiz.age;
+    email_vineetk.file = ../../secrets/email_vineetk.age;
+    email_13f0.file = ../../secrets/email_13f0.age;
+
     hetzner_dns = {
       file = ../../secrets/hetzner_dns.age;
       owner = "root";
@@ -18,14 +22,13 @@
       owner = "radicale";
     };
 
-    tailscale_demiurge = {
+    tailscale_saklas = {
       file = ../../secrets/tailscale_saklas.age;
       owner = "root";
       group = "root";
     };
   };
 
-
   # disable wifi and open some ports
   networking = {
     hostName = "saklas";
@@ -36,7 +39,7 @@
 
     firewall = {
       allowedTCPPorts = [ 22 80 443 ];
-      allowedUDPPorts = [ 3478 41641 51820 ];
+      allowedUDPPorts = [ 3478 51820 ];
     };
   };
 
@@ -158,7 +161,7 @@
 
     tailscale = {
       enable = true;
-      authKeyFile = config.age.secrets.tailscale_demiurge.path;
+      authKeyFile = config.age.secrets.tailscale_saklas.path;
       extraDaemonFlags = [ "--no-logs-no-support" ];
       extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
       openFirewall = true;
@@ -232,7 +235,7 @@
         server.hosts = [ "127.0.0.1:5232" ];
         auth = {
           type = "htpasswd";
-          htpasswd_filename = "/etc/radicale/users";
+          htpasswd_filename = config.age.secrets.radicale_users.path;
           htpasswd_encryption = "bcrypt";
         };
       };
@@ -269,6 +272,66 @@
     };
   };
 
+  # email via simple-nixos-mailserver
+  mailserver = {
+    enable = true;
+    fqdn = "mail.vineetk.net";
+    domains = [ "vineetk.net" "vinbiz.ca" "13f0.net" ];
+
+    # A list of all login accounts. To create the password hashes, use
+    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+    loginAccounts = {
+      "vineet@vineetk.net" = {
+        hashedPasswordFile = config.age.secrets.email_vineetk.path;
+        aliases = ["@vineetk.net"];
+      };
+
+      "kar@13f0.net" = {
+        hashedPasswordFile = config.age.secrets.email_13f0.path;
+        aliases = ["@13f0.net"];
+        sieveScript = ''
+require [ "fileinto", "mailbox" ];
+
+if address :matches [ "to", "cc" ] "announce@openbsd.org" {
+        fileinto :create "openbsd_announce";
+        stop;
+}
+if address :matches [ "to", "cc" ] "arm@openbsd.org" {
+        fileinto :create "openbsd_arm";
+        stop;
+}
+if address :matches [ "to", "cc" ] "misc@openbsd.org" {
+        fileinto :create "openbsd_misc";
+        stop;
+}
+if address :matches [ "to", "cc" ] "misc@opensmtpd.org" {
+        fileinto :create "opensmtpd_misc";
+        stop;
+}
+if address :matches [ "to", "cc" ] "oss-security@lists.openwall.com" {
+        fileinto :create "oss_security";
+        stop;
+}
+if address :matches [ "to", "cc" ] "tuhs@tuhs.org" {
+        fileinto :create "tuhs";
+        stop;
+}
+        '';
+      };
+
+      "vineet@vinbiz.ca" = {
+        hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+        aliases = ["postmaster@vinbiz.ca"];
+      };
+      "suresh@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+      "revathy@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+      "suren@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+    };
+
+    acmeCertificateName = "vineetk.net";
+    certificateScheme = "acme";
+  };
+
   # create caches and use mandoc
   documentation.man = {
     enable = true;
diff --git a/hosts/saklas/mail.nix b/hosts/saklas/mail.nix
deleted file mode 100644
index a43f194..0000000
--- a/hosts/saklas/mail.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  mailserver = {
-    enable = true;
-    fqdn = "mail.vineetk.net";
-    domains = [ "vineetk.net" "vinbiz.ca" "13f0.net" ];
-
-    # A list of all login accounts. To create the password hashes, use
-    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
-    loginAccounts = {
-      "vineet@vineetk.net" = {
-        hashedPassword = "$2b$05$7chAoNcCtw8ajVQYjmb7T.JLcOjtlVsS/LipIvc3LY4/qUPrFTP/.";
-        aliases = ["@vineetk.net"];
-      };
-
-      "kar@13f0.net" = {
-        hashedPassword = "$2b$05$w0rQk32VTQ8YMPQa.Mb28eX8zmYpDqI9FMPShQ7o2tYVzpbtvEyPq";
-        aliases = ["@13f0.net"];
-        sieveScript = ''
-require [ "fileinto", "mailbox" ];
-
-if address :matches [ "to", "cc" ] "announce@openbsd.org" {
-        fileinto :create "openbsd_announce";
-        stop;
-}
-if address :matches [ "to", "cc" ] "arm@openbsd.org" {
-        fileinto :create "openbsd_arm";
-        stop;
-}
-if address :matches [ "to", "cc" ] "misc@openbsd.org" {
-        fileinto :create "openbsd_misc";
-        stop;
-}
-if address :matches [ "to", "cc" ] "misc@opensmtpd.org" {
-        fileinto :create "opensmtpd_misc";
-        stop;
-}
-if address :matches [ "to", "cc" ] "oss-security@lists.openwall.com" {
-        fileinto :create "oss_security";
-        stop;
-}
-if address :matches [ "to", "cc" ] "tuhs@tuhs.org" {
-        fileinto :create "tuhs";
-        stop;
-}
-        '';
-      };
-
-      "vineet@vinbiz.ca" = {
-        hashedPassword = "$2b$05$lyCFvoxfoJX8jtI3FsePLenhcIn.hqN53twq/zJ316f4WHQJeUji6";
-        aliases = ["postmaster@vinbiz.ca"];
-      };
-      "suresh@vinbiz.ca".hashedPassword = "$2b$05$Vpqk62qIbRsFQipSd2aA0.EqL011nSmhA6VD.YjjfoYbO3zZVybDS";
-      "revathy@vinbiz.ca".hashedPassword = "$2b$05$RkABB76JTCNa0cotOfS28..mJME7a/A4gaTRpZnSdTJi3wr2X3t.C";
-      "suren@vinbiz.ca".hashedPassword = "$2b$05$.VTHKaBu0JQf2MpLNa7GXeliyZxOdXms59VslMmEjnu.IOzjVgHzy";
-    };
-
-    acmeCertificateName = "vineetk.net";
-    certificateScheme = "acme";
-  };
-}