Lilac/Chickadee
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add sops and mail

Browse Source
This commit is contained in:
Lilac
2026-09-25 14:32:09 -04:00
parent bab3cf7a5d
commit ec9335aec0
8 changed files with 134 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.lock
Generated
+22 -1
View File
@@ -97,7 +97,28 @@
"deploy-rs": "deploy-rs",
"grasswren": "grasswren",
"home-manager": "home-manager",
"nixpkgs": "nixpkgs"
"nixpkgs": "nixpkgs",
"sops-nix": "sops-nix"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1790247521,
"narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
},
"systems": {
flake.nix
+6 -1
View File
@@ -8,11 +8,14 @@
home-manager.url = "github:nix-community/home-manager/release-26.05";
home-manager.inputs.nixpkgs.follows = "nixpkgs";
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main";
grasswren.flake = false;
};
outputs = inputs@{ self, nixpkgs, deploy-rs, home-manager, grasswren, ... }:
outputs = inputs@{ self, nixpkgs, deploy-rs, home-manager, sops-nix, grasswren, ... }:
{
nixosConfigurations = {
laptop = nixpkgs.lib.nixosSystem {
@@ -20,6 +23,7 @@
specialArgs = { inherit inputs; };
modules = [
home-manager.nixosModules.home-manager
sops-nix.nixosModules.sops
./hosts/laptop.nix
];
};
@@ -29,6 +33,7 @@
specialArgs = { inherit inputs; };
modules = [
home-manager.nixosModules.home-manager
sops-nix.nixosModules.sops
./hosts/desktop.nix
];
};
hosts/desktop.nix
+1 -1
View File
@@ -9,12 +9,12 @@
../modules/mail.nix
../modules/music.nix
../modules/photo.nix
../modules/secrets.nix
../modules/ssh.nix
../modules/vault.nix
../lilac.nix
];
environment.systemPackages = with pkgs; [
whipper
restic
hosts/laptop.nix
+2
View File
@@ -44,6 +44,8 @@
hardware.graphics.enable32Bit = true;
hardware.enableRedistributableFirmware = true;
virtualisation.docker.enable = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nixpkgs.config.allowUnfree = true;
system.stateVersion = "26.05";
hosts/vps.nix
+1 -1
View File
@@ -44,7 +44,7 @@
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
iifname "enp1s0" tcp dport { 25, 80, 443 } dnat to 10.0.0.2
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
modules/mail.nix
+55
View File
@@ -1,5 +1,60 @@
{ config, lib, pkgs, ... }:
{
services.maddy = {
enable = true;
ensureAccounts = [ "lilac@grasswren.net" ];
ensureCredentials."lilac@grasswren.net".passwordFile = config.sops.secrets.mxpass.path;
secrets = [ config.sops.secrets.cftoken.path ];
tls = {
loader = "acme";
extraConfig = ''
email lilac@grasswren.net
agreed
challenge dns-01
dns cloudflare {
api_token "{env:CFTOKEN}"
}
'';
};
config = ''
hostname grasswren.net
auth.pass_table authdb {
table sql_table {
driver sqlite3
table_name passwords
dsn auth.db
}
}
storage.imapsql mailbox {
driver sqlite3
dsn mailbox.db
}
smtp tcp://0.0.0.0:25 {
default_source {
destination grasswren.net {
modify {
replace_rcpt regexp ".*" "lilac@grasswren.net"
}
deliver_to &mailbox
}
default_destination {
reject 550 5.1.1 "No Such User"
}
}
}
imap tls://0.0.0.0:993 {
auth &authdb
storage &mailbox
}
'';
};
}
modules/secrets.nix
+20
View File
@@ -0,0 +1,20 @@
{ config, lib, pkgs, ... }:
{
sops.defaultSopsFile = "../secrets.yaml";
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets.cftoken = {
owner = "maddy";
group = "maddy";
mode = "0440";
restartUnits = [ "maddy.service" ];
};
sops.secrets.mxpass = {
owner = "maddy";
group = "maddy";
mode = "0440";
restartUnits = [ "maddy.service" ];
};
}
secrets.yaml
+26
View File
@@ -0,0 +1,26 @@
cftoken: ENC[AES256_GCM,data:nxIZzGDkznGwf3FFDojSM740RMcNqv6FCUvY2h54eAFUB3/z34UIJCESauRsZMV+SpXy7AJc0XXujE7yHg==,iv:/8sQH4wJJOQGhSc8QkhrxVuMTqBRzULebCauVaL5fzY=,tag:skTdCNMTFAutaWl9fh+y4Q==,type:str]
mxpass: ENC[AES256_GCM,data:dDTNmIfc378Kv4JL/id3b3+/v61cMEYX0QtA6p2+EIk=,iv:W0EO+Ft63q8GYCmqd442oTeeaBKWWQqCoY8jhqfKfFE=,tag:GNCj/FUOk7G0DTvrYBZurw==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYY3VCSURaZElwT1IwRG1m
S3M3NGJ0UjZNVE95V1ZaSVhiSm51NTgvVlRvCkhyRUdOVTZlM2ZhQzRVMG10bld3
cFZ1UUtPTWtYTlQ2MUdBOVFjSjJ4ODAKLS0tIFhoWUFFdHJWdGJ5N1A2Y0dNcEo3
SkxMTVdpeVFzcEkrK01NTmErbHJ1aUkK1tOGJIZWI3skWiabHi0CtA6UqRNsPfmu
WOb2j6ypZBNxMP9q+zZGtgbU4knG2yKlEn1w9riR/pWloXUoI8xkKA==
-----END AGE ENCRYPTED FILE-----
recipient: age1fmzahr59j39krdq5etg5kktje2jel3sga8qs52hhj7t24scz2fhs2fkd4w
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMWk5UG1JR2hrTFhWdGpP
b1owdWZRMlc2Vkh4S0R6cDBqYXdvTW5ISWp3CnVUajRjS1RSTHZGaVRqN3VUelo3
Z1pkSG1oaXptNm9sYko2bXNSb2lubEkKLS0tIDNqR2FPMnA5RmxwY3IyOTFJTmZt
VWh4QktmVEhUVlV4WW4yNVhoSDhENUEKi+cGeGczZ6exocdQz3PBgvMi2Zl3vZLT
hf9QRDmVWjp9NEStovhWRfjUxJyHNHMOB5XNBjcFcDKrYNaYoz4i3w==
-----END AGE ENCRYPTED FILE-----
recipient: age1ttmws269mrs30f65qwky5rzkwuq0dcfgrhgegxr7u9x9ty2nqfxq9v8dwu
lastmodified: "2026-09-25T18:29:05Z"
mac: ENC[AES256_GCM,data:ogyYh/cu3aAQhOzuQ6fbN9UeWOR7IKAQWcDhfKEo7gr4shpQwxRSUx0kLjj/buJfa8+l0cO0TodH23CfQE++xjFAy7m6lgIPTrAX0OQ/6QAaFCB0HV4ifwZ+l3yod4CCD3MEx6E5irsb1xyrz4lEQdlywyWIp6Zc3XKuSEpdOdg=,iv:EiZvFZhQgmJgAA+RBC+/0QPkp3ssbzbWaQ+lfrPhJPo=,tag:SFGlHRfsgc6zev3dDXxBow==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3