From be529429a8dfc3d6960e97723387dc8916006c3f Mon Sep 17 00:00:00 2001
From: Lilac <lilac@grasswren.net>
Date: Sat, 26 Sep 2026 16:59:53 -0400
Subject: [PATCH] mail works

---
 hosts/vps.nix       |  2 +-
 modules/mail.nix    | 26 ++++++++++++++------------
 modules/secrets.nix |  2 +-
 3 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/hosts/vps.nix b/hosts/vps.nix
index 56b44c1..c7dd50f 100644
--- a/hosts/vps.nix
+++ b/hosts/vps.nix
@@ -44,7 +44,7 @@
         content = ''
           chain prerouting {
             type nat hook prerouting priority dstnat; policy accept;
-            iifname "enp1s0" tcp dport { 25, 80, 443 } dnat to 10.0.0.2
+            iifname "enp1s0" tcp dport { 25, 80, 443, 993 } dnat to 10.0.0.2
           }
           chain postrouting {
             type nat hook postrouting priority srcnat; policy accept;
diff --git a/modules/mail.nix b/modules/mail.nix
index 11ead8b..87105c4 100644
--- a/modules/mail.nix
+++ b/modules/mail.nix
@@ -12,6 +12,7 @@
     tls = {
       loader = "acme";
       extraConfig = ''
+        hostname $(hostname)
         email lilac@grasswren.net
         agreed
         challenge dns-01
@@ -21,18 +22,19 @@
       '';
     };
 
-    config = ''
-      hostname grasswren.net
+    primaryDomain = "grasswren.net";
+    hostname = "grasswren.net";
 
-      auth.pass_table authdb {
-          table sql_table {
-              driver sqlite3
-              table_name passwords
-              dsn auth.db
-          }
+    config = ''
+      auth.pass_table local_authdb {
+        table sql_table {
+          driver sqlite3
+          table_name passwords
+          dsn auth.db
+        }
       }
 
-      storage.imapsql mailbox {
+      storage.imapsql local_mailboxes {
         driver sqlite3
         dsn mailbox.db
       }
@@ -43,7 +45,7 @@
             modify {
               replace_rcpt regexp ".*" "lilac@grasswren.net"
             }
-            deliver_to &mailbox
+            deliver_to &local_mailboxes
           }
           default_destination {
             reject 550 5.1.1 "No Such User"
@@ -52,8 +54,8 @@
       }
 
       imap tls://0.0.0.0:993 {
-        auth &authdb
-        storage &mailbox
+        auth &local_authdb
+        storage &local_mailboxes
       }
     '';
   };
diff --git a/modules/secrets.nix b/modules/secrets.nix
index 892d15d..8bf67e6 100644
--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 {
-  sops.defaultSopsFile = "../secrets.yaml";
+  sops.defaultSopsFile = ../secrets.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   sops.secrets.cftoken = {