commit 5b37b423bec4d308e5fc4dc8dec6ed6468de2cfe · pyrox.dev/nix

systems/x86_64-linux/prefect/secrets/stalwart-fallback-admin-pw.age

This is a binary file and will not be displayed.

+6 -2

systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix

···

       1
       1
       -
       { cfg }:

     

       1
       1
       +
       # ACME for certs, using TLS-ALPN-01 Challenges(one fewer ports open)

     

       2
       2
       +
       # https://stalw.art/docs/server/tls/acme/configuration

     

       3
       3
       +
       { cfg, sec }:

     

       2
       4
        
       {

     

       3
       5
        
         letsencrypt = {

     

       4
       6
        
           directory = "https://acme-staging-v02.api.letsencrypt.org/directory";

     

       5
       5
       -
           challenge = "http-01";

     

       7
       7
       +
           challenge = "dns-01";

     

       6
       8
        
           contact = [ "pyrox@pyrox.dev" ];

     

       7
       9
        
           domains = [

     

       8
       10
        
             "mail.pyrox.dev"

     
···

       13
       15
        
           cache = "${cfg.dataDir}/acme/certs";

     

       14
       16
        
           renew-before = "30d";

     

       15
       17
        
           default = true;

     

       18
       18
       +
           provider = "desec";

     

       19
       19
       +
           secret = "%{file:${sec.stalwart-desec-token.path}}";

     

       16
       20
        
         };

     

       17
       21
        
       }

+14 -7

systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix

···

       28
       28
        
         services.stalwart-mail = {

     

       29
       29
        
           enable = true;

     

       30
       30
        
           dataDir = "/var/lib/stalwart";

     

       31
       31
       -
           credentials = {

     

       32
       32
       -
             rsa_private_key = sec.stalwart-secret-rsa.path;

     

       33
       33
       -
             ed25519_private_key = sec.stalwart-secret-ed25519.path;

     

       34
       34
       -
           };

     

       35
       31
        
           settings = {

     

       36
       32
        
             tracer.stdout.level = "debug";

     

       33
       33
       +
             authentication.fallback-admin = {

     

       34
       34
       +
               user = "fallback";

     

       35
       35
       +
               secret = "%{file:${sec.stalwart-fallback-admin-pw.path}}";

     

       36
       36
       +
             };

     

       37
       37
        
             config = {

     

       38
       38
        
               local-keys = [

     

       39
       39
        
                 "acme.*"

     
···

       56
       56
        
                 "resolver.*"

     

       57
       57
        
                 "server.*"

     

       58
       58
        
                 "session.*"

     

       59
       59
       +
                 "signature.*"

     

       59
       60
        
                 "storage.*"

     

       60
       61
        
                 "store.*"

     

       61
       62
        
                 "tracer.*"

     
···

       66
       67
        
               ];

     

       67
       68
        
             };

     

       68
       69
        
             server = import ./server.nix { inherit d; };

     

       69
       69
       -
             # ACME for certs, using TLS-ALPN-01 Challenges(one fewer ports open)

     

       70
       70
       -
             # https://stalw.art/docs/server/tls/acme/configuration

     

       71
       71
       -
             acme = import ./acme.nix { inherit cfg; };

     

       70
       70
       +
             acme = import ./acme.nix { inherit cfg sec; };

     

       72
       71
        
             # HTTP Configuration

     

       73
       72
        
             # https://stalw.art/docs/http/overview

     

       74
       73
        
             http = {

     
···

       78
       77
        
             # Disable HTTP Forms submission

     

       79
       78
        
             # https://stalw.art/docs/http/form-submission

     

       80
       79
        
             form.enable = false;

     

       80
       80
       +
             # DKIM Signatures

     

       81
       81
       +
             signature = import ./signature.nix { inherit sec; };

     

       81
       82
        
             # Storage Settings

     

       82
       83
        
             # https://stalw.art/docs/storage/overview

     

       83
       84
        
             store = {

     
···

       176
       177
        
           };

     

       177
       178
        
           stalwart-secret-ed25519 = smSecret // {

     

       178
       179
        
             file = ../../../secrets/stalwart-secret-ed25519.age;

     

       180
       180
       +
           };

     

       181
       181
       +
           stalwart-desec-token = smSecret // {

     

       182
       182
       +
             file = ../../../secrets/stalwart-desec-token.age;

     

       183
       183
       +
           };

     

       184
       184
       +
           stalwart-fallback-admin-pw = smSecret // {

     

       185
       185
       +
             file = ../../../secrets/stalwart-fallback-admin-pw.age;

     

       179
       186
        
           };

     

       180
       187
        
         };

     

       181
       188
        
       }

+3 -2

systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix

···

       1
       1
       +
       { sec }:

     

       1
       2
        
       let

     

       2
       3
        
         headers = [

     

       3
       4
        
           "From"

     
···

       20
       21
        
       {

     

       21
       22
        
         rsa = {

     

       22
       23
        
           inherit headers;

     

       23
       23
       -
           private-key = "%{file:/run/credentials/stalwart-mail.service/rsa_private_key}";

     

       24
       24
       +
           private-key = "%{file:${sec.stalwart-secret-rsa.path}}";

     

       24
       25
        
           domain = "pyrox.dev";

     

       25
       26
        
           selector = "rsa-default";

     

       26
       27
        
           algorithm = "rsa-sha256";

     
···

       30
       31
        
         };

     

       31
       32
        
         ed25519 = {

     

       32
       33
        
           inherit headers;

     

       33
       33
       -
           private-key = "%{file:/run/credentials/stalwart-mail.service/ed25519_private_key}";

     

       34
       34
       +
           private-key = "%{file:${sec.stalwart-secret-ed25519.path}}";

     

       34
       35
        
           domain = "pyrox.dev";

     

       35
       36
        
           selector = "default";

     

       36
       37
        
           algorithm = "ed25519-sha256";