add sops and mail

modules/mail.nix

@@ -1,5 +1,60 @@
 { config, lib, pkgs, ... }:
 
 {
-  
+  services.maddy = {
+    enable = true;
+
+    ensureAccounts = [ "lilac@grasswren.net" ];
+    ensureCredentials."lilac@grasswren.net".passwordFile = config.sops.secrets.mxpass.path;
+
+    secrets = [ config.sops.secrets.cftoken.path ];
+
+    tls = {
+      loader = "acme";
+      extraConfig = ''
+        email lilac@grasswren.net
+        agreed
+        challenge dns-01
+        dns cloudflare {
+          api_token "{env:CFTOKEN}"
+        }
+      '';
+    };
+
+    config = ''
+      hostname grasswren.net
+
+      auth.pass_table authdb {
+          table sql_table {
+              driver sqlite3
+              table_name passwords
+              dsn auth.db
+          }
+      }
+
+      storage.imapsql mailbox {
+        driver sqlite3
+        dsn mailbox.db
+      }
+
+      smtp tcp://0.0.0.0:25 {
+        default_source {
+          destination grasswren.net {
+            modify {
+              replace_rcpt regexp ".*" "lilac@grasswren.net"
+            }
+            deliver_to &mailbox
+          }
+          default_destination {
+            reject 550 5.1.1 "No Such User"
+          }
+        }
+      }
+
+      imap tls://0.0.0.0:993 {
+        auth &authdb
+        storage &mailbox
+      }
+    '';
+  };
 }

modules/secrets.nix

@@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+
+{
+  sops.defaultSopsFile = "../secrets.yaml";
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets.cftoken = {
+    owner = "maddy";
+    group = "maddy";
+    mode = "0440";
+    restartUnits = [ "maddy.service" ];
+  };
+
+  sops.secrets.mxpass = {
+    owner = "maddy";
+    group = "maddy";
+    mode = "0440";
+    restartUnits = [ "maddy.service" ];
+  };
+}