From ec9335aec0efe50fb53bae66bd3638fac9e213ed Mon Sep 17 00:00:00 2001 From: Lilac Date: Fri, 25 Sep 2026 14:32:09 -0400 Subject: [PATCH] add sops and mail --- flake.lock | 23 +++++++++++++++++- flake.nix | 7 +++++- hosts/desktop.nix | 2 +- hosts/laptop.nix | 2 ++ hosts/vps.nix | 2 +- modules/mail.nix | 57 ++++++++++++++++++++++++++++++++++++++++++++- modules/secrets.nix | 20 ++++++++++++++++ secrets.yaml | 26 +++++++++++++++++++++ 8 files changed, 134 insertions(+), 5 deletions(-) create mode 100644 modules/secrets.nix create mode 100644 secrets.yaml diff --git a/flake.lock b/flake.lock index 40696d0..dc1a363 100644 --- a/flake.lock +++ b/flake.lock @@ -97,7 +97,28 @@ "deploy-rs": "deploy-rs", "grasswren": "grasswren", "home-manager": "home-manager", - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1790247521, + "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" } }, "systems": { diff --git a/flake.nix b/flake.nix index 4c514aa..9e8c7c9 100644 --- a/flake.nix +++ b/flake.nix @@ -7,12 +7,15 @@ home-manager.url = "github:nix-community/home-manager/release-26.05"; home-manager.inputs.nixpkgs.follows = "nixpkgs"; + + sops-nix.url = "github:Mic92/sops-nix"; + sops-nix.inputs.nixpkgs.follows = "nixpkgs"; grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main"; grasswren.flake = false; }; - outputs = inputs@{ self, nixpkgs, deploy-rs, home-manager, grasswren, ... }: + outputs = inputs@{ self, nixpkgs, deploy-rs, home-manager, sops-nix, grasswren, ... }: { nixosConfigurations = { laptop = nixpkgs.lib.nixosSystem { @@ -20,6 +23,7 @@ specialArgs = { inherit inputs; }; modules = [ home-manager.nixosModules.home-manager + sops-nix.nixosModules.sops ./hosts/laptop.nix ]; }; @@ -29,6 +33,7 @@ specialArgs = { inherit inputs; }; modules = [ home-manager.nixosModules.home-manager + sops-nix.nixosModules.sops ./hosts/desktop.nix ]; }; diff --git a/hosts/desktop.nix b/hosts/desktop.nix index 3f85fd9..7890e05 100644 --- a/hosts/desktop.nix +++ b/hosts/desktop.nix @@ -9,12 +9,12 @@ ../modules/mail.nix ../modules/music.nix ../modules/photo.nix + ../modules/secrets.nix ../modules/ssh.nix ../modules/vault.nix ../lilac.nix ]; - environment.systemPackages = with pkgs; [ whipper restic diff --git a/hosts/laptop.nix b/hosts/laptop.nix index 745d988..cff4e30 100644 --- a/hosts/laptop.nix +++ b/hosts/laptop.nix @@ -44,6 +44,8 @@ hardware.graphics.enable32Bit = true; hardware.enableRedistributableFirmware = true; + virtualisation.docker.enable = true; + nix.settings.experimental-features = [ "nix-command" "flakes" ]; nixpkgs.config.allowUnfree = true; system.stateVersion = "26.05"; diff --git a/hosts/vps.nix b/hosts/vps.nix index ebe8115..56b44c1 100644 --- a/hosts/vps.nix +++ b/hosts/vps.nix @@ -44,7 +44,7 @@ content = '' chain prerouting { type nat hook prerouting priority dstnat; policy accept; - iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2 + iifname "enp1s0" tcp dport { 25, 80, 443 } dnat to 10.0.0.2 } chain postrouting { type nat hook postrouting priority srcnat; policy accept; diff --git a/modules/mail.nix b/modules/mail.nix index 9f23b5d..11ead8b 100644 --- a/modules/mail.nix +++ b/modules/mail.nix @@ -1,5 +1,60 @@ { config, lib, pkgs, ... }: { - + services.maddy = { + enable = true; + + ensureAccounts = [ "lilac@grasswren.net" ]; + ensureCredentials."lilac@grasswren.net".passwordFile = config.sops.secrets.mxpass.path; + + secrets = [ config.sops.secrets.cftoken.path ]; + + tls = { + loader = "acme"; + extraConfig = '' + email lilac@grasswren.net + agreed + challenge dns-01 + dns cloudflare { + api_token "{env:CFTOKEN}" + } + ''; + }; + + config = '' + hostname grasswren.net + + auth.pass_table authdb { + table sql_table { + driver sqlite3 + table_name passwords + dsn auth.db + } + } + + storage.imapsql mailbox { + driver sqlite3 + dsn mailbox.db + } + + smtp tcp://0.0.0.0:25 { + default_source { + destination grasswren.net { + modify { + replace_rcpt regexp ".*" "lilac@grasswren.net" + } + deliver_to &mailbox + } + default_destination { + reject 550 5.1.1 "No Such User" + } + } + } + + imap tls://0.0.0.0:993 { + auth &authdb + storage &mailbox + } + ''; + }; } diff --git a/modules/secrets.nix b/modules/secrets.nix new file mode 100644 index 0000000..892d15d --- /dev/null +++ b/modules/secrets.nix @@ -0,0 +1,20 @@ +{ config, lib, pkgs, ... }: + +{ + sops.defaultSopsFile = "../secrets.yaml"; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets.cftoken = { + owner = "maddy"; + group = "maddy"; + mode = "0440"; + restartUnits = [ "maddy.service" ]; + }; + + sops.secrets.mxpass = { + owner = "maddy"; + group = "maddy"; + mode = "0440"; + restartUnits = [ "maddy.service" ]; + }; +} diff --git a/secrets.yaml b/secrets.yaml new file mode 100644 index 0000000..8733048 --- /dev/null +++ b/secrets.yaml @@ -0,0 +1,26 @@ +cftoken: ENC[AES256_GCM,data:nxIZzGDkznGwf3FFDojSM740RMcNqv6FCUvY2h54eAFUB3/z34UIJCESauRsZMV+SpXy7AJc0XXujE7yHg==,iv:/8sQH4wJJOQGhSc8QkhrxVuMTqBRzULebCauVaL5fzY=,tag:skTdCNMTFAutaWl9fh+y4Q==,type:str] +mxpass: ENC[AES256_GCM,data:dDTNmIfc378Kv4JL/id3b3+/v61cMEYX0QtA6p2+EIk=,iv:W0EO+Ft63q8GYCmqd442oTeeaBKWWQqCoY8jhqfKfFE=,tag:GNCj/FUOk7G0DTvrYBZurw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYY3VCSURaZElwT1IwRG1m + S3M3NGJ0UjZNVE95V1ZaSVhiSm51NTgvVlRvCkhyRUdOVTZlM2ZhQzRVMG10bld3 + cFZ1UUtPTWtYTlQ2MUdBOVFjSjJ4ODAKLS0tIFhoWUFFdHJWdGJ5N1A2Y0dNcEo3 + SkxMTVdpeVFzcEkrK01NTmErbHJ1aUkK1tOGJIZWI3skWiabHi0CtA6UqRNsPfmu + WOb2j6ypZBNxMP9q+zZGtgbU4knG2yKlEn1w9riR/pWloXUoI8xkKA== + -----END AGE ENCRYPTED FILE----- + recipient: age1fmzahr59j39krdq5etg5kktje2jel3sga8qs52hhj7t24scz2fhs2fkd4w + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMWk5UG1JR2hrTFhWdGpP + b1owdWZRMlc2Vkh4S0R6cDBqYXdvTW5ISWp3CnVUajRjS1RSTHZGaVRqN3VUelo3 + Z1pkSG1oaXptNm9sYko2bXNSb2lubEkKLS0tIDNqR2FPMnA5RmxwY3IyOTFJTmZt + VWh4QktmVEhUVlV4WW4yNVhoSDhENUEKi+cGeGczZ6exocdQz3PBgvMi2Zl3vZLT + hf9QRDmVWjp9NEStovhWRfjUxJyHNHMOB5XNBjcFcDKrYNaYoz4i3w== + -----END AGE ENCRYPTED FILE----- + recipient: age1ttmws269mrs30f65qwky5rzkwuq0dcfgrhgegxr7u9x9ty2nqfxq9v8dwu + lastmodified: "2026-09-25T18:29:05Z" + mac: ENC[AES256_GCM,data:ogyYh/cu3aAQhOzuQ6fbN9UeWOR7IKAQWcDhfKEo7gr4shpQwxRSUx0kLjj/buJfa8+l0cO0TodH23CfQE++xjFAy7m6lgIPTrAX0OQ/6QAaFCB0HV4ifwZ+l3yod4CCD3MEx6E5irsb1xyrz4lEQdlywyWIp6Zc3XKuSEpdOdg=,iv:EiZvFZhQgmJgAA+RBC+/0QPkp3ssbzbWaQ+lfrPhJPo=,tag:SFGlHRfsgc6zev3dDXxBow==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3