7 files changed, 88 insertions, 72 deletions

diff --git a/flake.nix b/flake.nix
index 6215a8c..e9a6e57 100644
--- a/flake.nix
+++ b/flake.nix
@@ -21,7 +21,7 @@
     agenix.url = "github:ryantm/agenix";
         };
 
-        outputs = { self, home-manager, nixpkgs, nixpkgs-stable, everblush-gtk, simple-nixos-mailserver, agenix, ... }@inputs: {
+        outputs = { self, home-manager, nixpkgs, nixpkgs-stable, everblush-gtk, agenix, simple-nixos-mailserver, ... }@inputs: {
                 # TODO: deduplicate this
                 nixosConfigurations = {
                         demiurge = nixpkgs.lib.nixosSystem {
@@ -48,6 +48,7 @@
                                 specialArgs = inputs;
                                 modules = [
                                         ./hosts/lappy
+          agenix.nixosModules.default
 
                                         home-manager.nixosModules.home-manager {
                                                 home-manager.extraSpecialArgs = {
@@ -66,7 +67,8 @@
                                 specialArgs = inputs;
                                 modules = [
                                         ./hosts/saklas
-          simple-nixos-mailserver.nixosModules.default ./hosts/saklas/mail.nix
+          agenix.nixosModules.default
+          simple-nixos-mailserver.nixosModule
                                 ];
                         };
                 };
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
index 8948ed4..0a3e91c 100644
--- a/hosts/saklas/default.nix
+++ b/hosts/saklas/default.nix
@@ -7,6 +7,10 @@
 
   # decrypt agenix secrets
   age.secrets = {
+    email_vinbiz.file = ../../secrets/email_vinbiz.age;
+    email_vineetk.file = ../../secrets/email_vineetk.age;
+    email_13f0.file = ../../secrets/email_13f0.age;
+
     hetzner_dns = {
       file = ../../secrets/hetzner_dns.age;
       owner = "root";
@@ -18,14 +22,13 @@
       owner = "radicale";
     };
 
-    tailscale_demiurge = {
+    tailscale_saklas = {
       file = ../../secrets/tailscale_saklas.age;
       owner = "root";
       group = "root";
     };
   };
 
-
   # disable wifi and open some ports
   networking = {
     hostName = "saklas";
@@ -36,7 +39,7 @@
 
     firewall = {
       allowedTCPPorts = [ 22 80 443 ];
-      allowedUDPPorts = [ 3478 41641 51820 ];
+      allowedUDPPorts = [ 3478 51820 ];
     };
   };
 
@@ -158,7 +161,7 @@
 
     tailscale = {
       enable = true;
-      authKeyFile = config.age.secrets.tailscale_demiurge.path;
+      authKeyFile = config.age.secrets.tailscale_saklas.path;
       extraDaemonFlags = [ "--no-logs-no-support" ];
       extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
       openFirewall = true;
@@ -232,7 +235,7 @@
         server.hosts = [ "127.0.0.1:5232" ];
         auth = {
           type = "htpasswd";
-          htpasswd_filename = "/etc/radicale/users";
+          htpasswd_filename = config.age.secrets.radicale_users.path;
           htpasswd_encryption = "bcrypt";
         };
       };
@@ -269,6 +272,66 @@
     };
   };
 
+  # email via simple-nixos-mailserver
+  mailserver = {
+    enable = true;
+    fqdn = "mail.vineetk.net";
+    domains = [ "vineetk.net" "vinbiz.ca" "13f0.net" ];
+
+    # A list of all login accounts. To create the password hashes, use
+    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+    loginAccounts = {
+      "vineet@vineetk.net" = {
+        hashedPasswordFile = config.age.secrets.email_vineetk.path;
+        aliases = ["@vineetk.net"];
+      };
+
+      "kar@13f0.net" = {
+        hashedPasswordFile = config.age.secrets.email_13f0.path;
+        aliases = ["@13f0.net"];
+        sieveScript = ''
+require [ "fileinto", "mailbox" ];
+
+if address :matches [ "to", "cc" ] "announce@openbsd.org" {
+        fileinto :create "openbsd_announce";
+        stop;
+}
+if address :matches [ "to", "cc" ] "arm@openbsd.org" {
+        fileinto :create "openbsd_arm";
+        stop;
+}
+if address :matches [ "to", "cc" ] "misc@openbsd.org" {
+        fileinto :create "openbsd_misc";
+        stop;
+}
+if address :matches [ "to", "cc" ] "misc@opensmtpd.org" {
+        fileinto :create "opensmtpd_misc";
+        stop;
+}
+if address :matches [ "to", "cc" ] "oss-security@lists.openwall.com" {
+        fileinto :create "oss_security";
+        stop;
+}
+if address :matches [ "to", "cc" ] "tuhs@tuhs.org" {
+        fileinto :create "tuhs";
+        stop;
+}
+        '';
+      };
+
+      "vineet@vinbiz.ca" = {
+        hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+        aliases = ["postmaster@vinbiz.ca"];
+      };
+      "suresh@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+      "revathy@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+      "suren@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
+    };
+
+    acmeCertificateName = "vineetk.net";
+    certificateScheme = "acme";
+  };
+
   # create caches and use mandoc
   documentation.man = {
     enable = true;
diff --git a/hosts/saklas/mail.nix b/hosts/saklas/mail.nix
deleted file mode 100644
index a43f194..0000000
--- a/hosts/saklas/mail.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  mailserver = {
-    enable = true;
-    fqdn = "mail.vineetk.net";
-    domains = [ "vineetk.net" "vinbiz.ca" "13f0.net" ];
-
-    # A list of all login accounts. To create the password hashes, use
-    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
-    loginAccounts = {
-      "vineet@vineetk.net" = {
-        hashedPassword = "$2b$05$7chAoNcCtw8ajVQYjmb7T.JLcOjtlVsS/LipIvc3LY4/qUPrFTP/.";
-        aliases = ["@vineetk.net"];
-      };
-
-      "kar@13f0.net" = {
-        hashedPassword = "$2b$05$w0rQk32VTQ8YMPQa.Mb28eX8zmYpDqI9FMPShQ7o2tYVzpbtvEyPq";
-        aliases = ["@13f0.net"];
-        sieveScript = ''
-require [ "fileinto", "mailbox" ];
-
-if address :matches [ "to", "cc" ] "announce@openbsd.org" {
-        fileinto :create "openbsd_announce";
-        stop;
-}
-if address :matches [ "to", "cc" ] "arm@openbsd.org" {
-        fileinto :create "openbsd_arm";
-        stop;
-}
-if address :matches [ "to", "cc" ] "misc@openbsd.org" {
-        fileinto :create "openbsd_misc";
-        stop;
-}
-if address :matches [ "to", "cc" ] "misc@opensmtpd.org" {
-        fileinto :create "opensmtpd_misc";
-        stop;
-}
-if address :matches [ "to", "cc" ] "oss-security@lists.openwall.com" {
-        fileinto :create "oss_security";
-        stop;
-}
-if address :matches [ "to", "cc" ] "tuhs@tuhs.org" {
-        fileinto :create "tuhs";
-        stop;
-}
-        '';
-      };
-
-      "vineet@vinbiz.ca" = {
-        hashedPassword = "$2b$05$lyCFvoxfoJX8jtI3FsePLenhcIn.hqN53twq/zJ316f4WHQJeUji6";
-        aliases = ["postmaster@vinbiz.ca"];
-      };
-      "suresh@vinbiz.ca".hashedPassword = "$2b$05$Vpqk62qIbRsFQipSd2aA0.EqL011nSmhA6VD.YjjfoYbO3zZVybDS";
-      "revathy@vinbiz.ca".hashedPassword = "$2b$05$RkABB76JTCNa0cotOfS28..mJME7a/A4gaTRpZnSdTJi3wr2X3t.C";
-      "suren@vinbiz.ca".hashedPassword = "$2b$05$.VTHKaBu0JQf2MpLNa7GXeliyZxOdXms59VslMmEjnu.IOzjVgHzy";
-    };
-
-    acmeCertificateName = "vineetk.net";
-    certificateScheme = "acme";
-  };
-}
diff --git a/secrets/email_13f0.age b/secrets/email_13f0.age
new file mode 100644
index 0000000..7fb7410
--- /dev/null
+++ b/secrets/email_13f0.age
diff --git a/secrets/email_vinbiz.age b/secrets/email_vinbiz.age
new file mode 100644
index 0000000..041f2e9
--- /dev/null
+++ b/secrets/email_vinbiz.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ XcNpUXvbz6PsCgeEZMf1+yMrjIipzsesAKO+EssReTw
+EcDIICNjeS3KKev0qK/0v7V/86QdOWYNaTyFDFE435I
+-> ssh-ed25519 hc2ELA rO5kM81Uk4G5bowyCzGUZdBvqxvcNctjdrD1+Tfk8VY
+1ef+BiIAJFFKpNAPb2QHHzrxTAyNyj7Hc/nArculdsc
+--- TrgPJhsRCmQuOl9m51XUHnhV+pBlbj0iYgzXUojgjTw
+
cm�/���(,{��W��}��yx�AՙT��^��
\�#��W�-���Č�O4dϑ�d�[��C���e
�0 �
.��v�\�q&����
\ No newline at end of file
diff --git a/secrets/email_vineetk.age b/secrets/email_vineetk.age
new file mode 100644
index 0000000..c42b4a6
--- /dev/null
+++ b/secrets/email_vineetk.age
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index ff90585..69036d5 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -7,9 +7,13 @@ let
   systems = [ demiurge saklas ];
 in
 {
-  "hetzner_dns.age".publicKeys = users ++ systems;
-  "radicale_users.age".publicKeys = users ++ systems;
-  "smallstep.age".publicKeys = users ++ systems;
-  "tailscale_demiurge.age".publicKeys = users ++ systems;
-  "tailscale_saklas.age".publicKeys = users ++ systems;
+  "email_vinbiz.age".publicKeys = users ++ [ saklas ];
+  "email_vineetk.age".publicKeys = users ++ [ saklas ];
+  "email_13f0.age".publicKeys = users ++ [ saklas ];
+
+  "hetzner_dns.age".publicKeys = users ++ [ saklas ];
+  "radicale_users.age".publicKeys = users ++ [ saklas ];
+  "smallstep.age".publicKeys = users ++ [ demiurge ];
+  "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
+  "tailscale_saklas.age".publicKeys = users ++ [ saklas ];
 }