mail works

flake.lock

@@ -97,7 +97,28 @@
         "deploy-rs": "deploy-rs",
         "grasswren": "grasswren",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790247521,
+        "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -8,11 +8,14 @@
     home-manager.url = "github:nix-community/home-manager/release-26.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
   
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+
     grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main";
     grasswren.flake = false;
   };
 
-  outputs = inputs@{ self, nixpkgs, deploy-rs, home-manager, grasswren, ... }: 
+  outputs = inputs@{ self, nixpkgs, deploy-rs, home-manager, sops-nix, grasswren, ... }: 
   {
     nixosConfigurations = {
       laptop = nixpkgs.lib.nixosSystem {
@@ -20,6 +23,7 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
+          sops-nix.nixosModules.sops
           ./hosts/laptop.nix
         ];
       };
@@ -29,6 +33,7 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
+          sops-nix.nixosModules.sops
           ./hosts/desktop.nix
         ];
       };

hosts/desktop.nix

@@ -9,12 +9,12 @@
     ../modules/mail.nix
     ../modules/music.nix
     ../modules/photo.nix
+    ../modules/secrets.nix
     ../modules/ssh.nix
     ../modules/vault.nix
     ../lilac.nix
   ];
 
-
   environment.systemPackages = with pkgs; [
     whipper
     restic

hosts/laptop.nix

@@ -44,6 +44,8 @@
   hardware.graphics.enable32Bit = true;
   hardware.enableRedistributableFirmware = true;
 
+  virtualisation.docker.enable = true;
+
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nixpkgs.config.allowUnfree = true;
   system.stateVersion = "26.05";

hosts/vps.nix

@@ -44,7 +44,7 @@
         content = ''
           chain prerouting {
             type nat hook prerouting priority dstnat; policy accept;
-            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
+            iifname "enp1s0" tcp dport { 25, 80, 443, 993 } dnat to 10.0.0.2
           }
           chain postrouting {
             type nat hook postrouting priority srcnat; policy accept;

modules/mail.nix

@@ -1,5 +1,62 @@
 { config, lib, pkgs, ... }:
 
 {
+  services.maddy = {
+    enable = true;
 
+    ensureAccounts = [ "lilac@grasswren.net" ];
+    ensureCredentials."lilac@grasswren.net".passwordFile = config.sops.secrets.mxpass.path;
+
+    secrets = [ config.sops.secrets.cftoken.path ];
+
+    tls = {
+      loader = "acme";
+      extraConfig = ''
+        hostname $(hostname)
+        email lilac@grasswren.net
+        agreed
+        challenge dns-01
+        dns cloudflare {
+          api_token "{env:CFTOKEN}"
+        }
+      '';
+    };
+
+    primaryDomain = "grasswren.net";
+    hostname = "grasswren.net";
+
+    config = ''
+      auth.pass_table local_authdb {
+        table sql_table {
+          driver sqlite3
+          table_name passwords
+          dsn auth.db
+        }
+      }
+
+      storage.imapsql local_mailboxes {
+        driver sqlite3
+        dsn mailbox.db
+      }
+
+      smtp tcp://0.0.0.0:25 {
+        default_source {
+          destination grasswren.net {
+            modify {
+              replace_rcpt regexp ".*" "lilac@grasswren.net"
+            }
+            deliver_to &local_mailboxes
+          }
+          default_destination {
+            reject 550 5.1.1 "No Such User"
+          }
+        }
+      }
+
+      imap tls://0.0.0.0:993 {
+        auth &local_authdb
+        storage &local_mailboxes
+      }
+    '';
+  };
 }

modules/secrets.nix

@@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+
+{
+  sops.defaultSopsFile = ../secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets.cftoken = {
+    owner = "maddy";
+    group = "maddy";
+    mode = "0440";
+    restartUnits = [ "maddy.service" ];
+  };
+
+  sops.secrets.mxpass = {
+    owner = "maddy";
+    group = "maddy";
+    mode = "0440";
+    restartUnits = [ "maddy.service" ];
+  };
+}

secrets.yaml

@@ -0,0 +1,26 @@
+cftoken: ENC[AES256_GCM,data:nxIZzGDkznGwf3FFDojSM740RMcNqv6FCUvY2h54eAFUB3/z34UIJCESauRsZMV+SpXy7AJc0XXujE7yHg==,iv:/8sQH4wJJOQGhSc8QkhrxVuMTqBRzULebCauVaL5fzY=,tag:skTdCNMTFAutaWl9fh+y4Q==,type:str]
+mxpass: ENC[AES256_GCM,data:dDTNmIfc378Kv4JL/id3b3+/v61cMEYX0QtA6p2+EIk=,iv:W0EO+Ft63q8GYCmqd442oTeeaBKWWQqCoY8jhqfKfFE=,tag:GNCj/FUOk7G0DTvrYBZurw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYY3VCSURaZElwT1IwRG1m
+            S3M3NGJ0UjZNVE95V1ZaSVhiSm51NTgvVlRvCkhyRUdOVTZlM2ZhQzRVMG10bld3
+            cFZ1UUtPTWtYTlQ2MUdBOVFjSjJ4ODAKLS0tIFhoWUFFdHJWdGJ5N1A2Y0dNcEo3
+            SkxMTVdpeVFzcEkrK01NTmErbHJ1aUkK1tOGJIZWI3skWiabHi0CtA6UqRNsPfmu
+            WOb2j6ypZBNxMP9q+zZGtgbU4knG2yKlEn1w9riR/pWloXUoI8xkKA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1fmzahr59j39krdq5etg5kktje2jel3sga8qs52hhj7t24scz2fhs2fkd4w
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMWk5UG1JR2hrTFhWdGpP
+            b1owdWZRMlc2Vkh4S0R6cDBqYXdvTW5ISWp3CnVUajRjS1RSTHZGaVRqN3VUelo3
+            Z1pkSG1oaXptNm9sYko2bXNSb2lubEkKLS0tIDNqR2FPMnA5RmxwY3IyOTFJTmZt
+            VWh4QktmVEhUVlV4WW4yNVhoSDhENUEKi+cGeGczZ6exocdQz3PBgvMi2Zl3vZLT
+            hf9QRDmVWjp9NEStovhWRfjUxJyHNHMOB5XNBjcFcDKrYNaYoz4i3w==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ttmws269mrs30f65qwky5rzkwuq0dcfgrhgegxr7u9x9ty2nqfxq9v8dwu
+    lastmodified: "2026-09-25T18:29:05Z"
+    mac: ENC[AES256_GCM,data:ogyYh/cu3aAQhOzuQ6fbN9UeWOR7IKAQWcDhfKEo7gr4shpQwxRSUx0kLjj/buJfa8+l0cO0TodH23CfQE++xjFAy7m6lgIPTrAX0OQ/6QAaFCB0HV4ifwZ+l3yod4CCD3MEx6E5irsb1xyrz4lEQdlywyWIp6Zc3XKuSEpdOdg=,iv:EiZvFZhQgmJgAA+RBC+/0QPkp3ssbzbWaQ+lfrPhJPo=,tag:SFGlHRfsgc6zev3dDXxBow==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3