Add aperture host

6 files changed, 119 insertions, 12 deletions

diff --git a/.sops.yaml b/.sops.yaml
index aa2cef4..ac8ee3b 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -5,7 +5,7 @@ keys:
   - &vm_omega_relay age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4 
   - &server_omega_relay age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
   - &server_threshold age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht
-
+  - &server_aperture age1plk5hf03zreyg8kmrz68uz8slwaeswt044f36ktql05f56xpkfdsk2fxx4
 
 creation_rules: 
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
@@ -27,5 +27,9 @@ creation_rules:
     age: 
       - *admin_wilkuu 
       - *server_threshold 
+  - path_regex: secrets/aperture/[^/]+\.(yaml|json|env|ini)$
+    age:
+      - *admin_wilkuu 
+      - *server_aperture 
 
 
diff --git a/flake.nix b/flake.nix
index e05060f..9207ce9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,8 +7,8 @@
 
     stalwart-nix = {
       # local testing
-      # url = "path:/store2/code/stalwart-nix";
-      url = "github:Wilkuu-2/stalwart-nix";
+      url = "path:/store2/code/stalwart-nix";
+      # url = "github:Wilkuu-2/stalwart-nix";
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.treefmt-nix.follows = "treefmt-nix";
     };
@@ -130,6 +130,7 @@
             home-manager.nixosModules.default
             disko.nixosModules.disko
             sops-nix.nixosModules.default
+            stalwart-nix.nixosModules.default
           ];
 
         };
@@ -159,6 +160,7 @@
             home-manager.nixosModules.default
             disko.nixosModules.default
             sops-nix.nixosModules.default
+            stalwart-nix.nixosModules.default
           ];
         };
       };
diff --git a/hosts/aperture/default.nix b/hosts/aperture/default.nix
index ded949c..bca4615 100644
--- a/hosts/aperture/default.nix
+++ b/hosts/aperture/default.nix
@@ -18,6 +18,7 @@
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
+  nix.settings.trusted-users = [ "wilkuu"]; 
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/hosts/aperture/testbed.nix b/hosts/aperture/testbed.nix
index 479de4a..5e9853d 100644
--- a/hosts/aperture/testbed.nix
+++ b/hosts/aperture/testbed.nix
@@ -1,4 +1,8 @@
-{ ... }:
+{ config, pkgs, lib, ... }: let 
+    dotsToDn = type: domain: (lib.concatMapStringsSep ","  (x: "${type}=${x}") (lib.splitString "." domain));
+    baseDN = dotsToDn "dc" "aperture.local";
+    sopsCred = name: config.sops.secrets."lldap/${name}".path; 
+in 
 {
   imports = [ ../../services/mail2.nix ];
   wilkuu.services.test_endpoint = {
@@ -8,21 +12,61 @@
     domain = "test.aperture.local";
   };
   
-  wilkuu.services.mail = {
+  # systemd.services.stalwart.serviceConfig.Environment = ["STALWART_PUBLIC_URL=http://mail.aperture.local"];
+  wilkuu.services.mail = let 
+      domain_to_jid = lib.replaceString "." "_";
+  in {
     enable = true;
     doACME = false;
     defaultDomain = "mail.aperture.local";
-    domains = [ "mail.aperture.local" ];
-    wellKnownDomains = [ "aperture.local" ];
-    startupMode = "bootstrap";
+    domains = [ "aperture.local" ];
+    wellKnownDomains = [];
+    startupMode = "recovery";
+    extraCreate = []; 
+    extraConfig = []; 
   };
+  
+  users.users.lldap = {
+    isSystemUser = true;
+    group = "lldap"; 
+  };
+  users.groups.lldap = {};
+
+  sops.secrets = let 
+    sopsPath = ../../secrets/${config.networking.hostName}/lldap.yaml;
+    secrets  = ["admin_password" "jwt_secret"];
+    toSops = (sname: "lldap/${sname}"); 
+  in lib.genAttrs (map toSops secrets) ( _name: {
+    sopsFile = sopsPath; 
+    mode = "0440";
+    owner = "lldap";
+  }); 
+  
+  services.nginx.virtualHosts."ldap.aperture.local" = {
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString config.services.lldap.settings.http_port}";
+      recommendedProxySettings = true; 
+    };
+  }; 
 
-  lldap = {
-    enable = false; 
-    environmentFile = null; 
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  services.lldap = let 
+
+  in {
+    enable = true; 
+    # environmentFile = null; 
     settings = {
+      force_ldap_user_pass_reset = "always"; 
+      jwt_secret_file      = sopsCred "jwt_secret";  
+      ldap_user_pass_file  = sopsCred "admin_password"; 
+      ldap_user_dn         = "ldap_admin";  
+      ldap_user_email      = "ldap_admin@aperture.local"; 
+
+      ldap_base_dn         = baseDN;  
+      ldap_port            = 3890; 
       
-      
+      http_url             = "http://ldap.aperture.local"; 
     }; 
   }; 
 }
diff --git a/secrets/aperture/lldap.yaml b/secrets/aperture/lldap.yaml
new file mode 100644
index 0000000..3d4cdae
--- /dev/null
+++ b/secrets/aperture/lldap.yaml
@@ -0,0 +1,27 @@
+lldap:
+    jwt_secret: ENC[AES256_GCM,data:v6idYg+T+HsWSK4PUtK+LiOsHwBOuDtuMfrItlfks2lQkV2w3FolE/5kORGuf41GL7U2GSbG+XPHbTk9JbHq1WFqbXYcKUP4mWQX5BDdwbzCT1uU6k0aHg==,iv:gPBt7g1sGDC+T4QJNlnC613oatKcJAwRpBUNJ9j7bGQ=,tag:Qv3lIirsea5maWkbXMkyCg==,type:str]
+    admin_password: ENC[AES256_GCM,data:Vaz69UkS7ao68A79uw==,iv:7qXwV/iXM4ywYCvswFE2SN1WBwXa5qXchfWO0Rmmm9U=,tag:ASDdxH7CPLE5RFV584HLJQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMTHpteDNBYTg4dysxaVZu
+            NVNGTFhjOUpIUEh4a3hrT2g1eXlnVjhhMVdjClphSTNRa3U3Wi90ekI2L1FFUWd2
+            SGdQU1E1ZnJsY05Fa0l5SWxFNVNCeU0KLS0tIGpabklQNlVvTHVtUXJJRXo3aUto
+            TXhWRVlZTkVNdTZpSUJuUGVqVm1aT0EKLZghpnvLKTsV6QsJZKGOQUxiqG2rN3z4
+            8+gMZmCOoQXaqv02nREAo3UsktwsCb1Zvl2E0jQqGTenT0gqdrWvVA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMS2oxMWNENWtUMmdaT0xh
+            dGhDc1Rhc3RYZzBiUWNSVytTLzB6eTkvQjFBCnZLSjR6aENKR0NQekJZb21yb0Jq
+            Tnl5NTBDQTl2dU1hMEZUTW1TYklFZ2sKLS0tIDVodGZJZ0R0WnhSY2t3d3dNTkND
+            SHNFQzI1clUyYnBSZm1WcWFzWS9HREkK9m7IKO93pcTIDddiddhO6QAjkhEOUWP8
+            Ie227o05KSVlkrUnqIGxoFOrOqLDCwUfZjiR0v8gQAbFdNX8lHtPGw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1plk5hf03zreyg8kmrz68uz8slwaeswt044f36ktql05f56xpkfdsk2fxx4
+    lastmodified: "2026-05-30T22:51:00Z"
+    mac: ENC[AES256_GCM,data:ZJTJIy+Xy4bMH1BZkGac/sOPkDoDlYK/u8Swle64JxvtczKF218d6IhEc9pZhrGjvP3Klo/ryRfj+/BFFX1wwqQSYunBVzYZDW1qXT+ztzqejEzwUIuPMsf3f9asKyQZneNaIoykB8sb/T58XK/TyslOXOiS5cK318kK+j7FQm0=,iv:rL7vJ1VpunCwibUv+2mR9GUC/Fx/R59YP3i8+AM7cxk=,tag:vEFdunAizHh0cijcXHagVQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
diff --git a/secrets/aperture/stalwart.yaml b/secrets/aperture/stalwart.yaml
new file mode 100644
index 0000000..bb0b006
--- /dev/null
+++ b/secrets/aperture/stalwart.yaml
@@ -0,0 +1,29 @@
+stalwart16:
+    admin_user: ENC[AES256_GCM,data:yrAnPJk=,iv:uUVng0WQTFS3Rx+3FvP+05JWVLBt8ugwlZ2kxLqfVtg=,tag:2uQit0sa68G2LCxGZc2X0w==,type:str]
+    admin_password: ENC[AES256_GCM,data:FtcqBqA0D14=,iv:5ZAlFmZeUMIP28zhR9k36Zqz19FjpCQkGmdvndcpmbI=,tag:CMILU/WBtXfE0b5p8F+Lbw==,type:str]
+    recovery_user: ENC[AES256_GCM,data:ECKU3Aw=,iv:9tDVS+Qd33/6ZPIUF2wFWEc4eWGezQOqeg8d+j08yGA=,tag:6nQwmT3GXqpY0e3J2CDcKw==,type:str]
+    recovery_password: ENC[AES256_GCM,data:rqFbR8TmwlI=,iv:Mdj5UXwweGeckN8Kc9f1MBAj52yJ89mWzF7Oakuce8E=,tag:OjONxYdFa/bI1RIIirfDbQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwVXhDZ253M1NQZGdkTDRQ
+            MnNyMTc3c0g1ZVpob1AzV09FU3l3eE1OZkdjCmM0cFNSNUN3TlBER1p5RWpZTWpR
+            d3RTNFlWa1dwalRRc3piMng4QTF4emMKLS0tIHRLQnJBUkdOTnY0QWZpK1dsTWUx
+            MC9BUThkZi9kcmwwU3JZWlR3R1hXK2cKFYwivt65drnigbLEEBjoIJyUSlvbiRA/
+            +t0a9MOOFNlkSSbbLB+xobyM7iVuWodWgoEJuz+xqxeYqnEiVLdyQw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkVE1DZ0Y4K25sMXVvcWtT
+            UURCNnI2UXFxSi90RUVXdzFqUUJ1V2VhMWhzCnUzK3B1cnJTVWJ4d0VLN3pTTUc3
+            K0xCNENadzg4MUNHTXhvdk04cnN5NFUKLS0tIGxockJJZUhRcnd2TTJZYVRtd0tD
+            Z1FzeXFqUlBnL3A0QU10TXFjaW9mSDQKg58Fybb0GPxRX8v3KnGJUgbDgkZh/alj
+            lJJMshofn+niP6wWsNuXlIOog2io5jA2QLGYkUbidsctlFH8EsuakQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1plk5hf03zreyg8kmrz68uz8slwaeswt044f36ktql05f56xpkfdsk2fxx4
+    lastmodified: "2026-05-30T21:48:23Z"
+    mac: ENC[AES256_GCM,data:XrjlSmZ9GyDMzcsXAuV2kwx4eyxXFO2yiCzMVXEJRxqW9vqjbeC9pKpliguzBinw9F2yIzcVlX3RydUlAVuFPjDYO+wiYlb4VivTF9YfWFQVMY2Q8Viq3OfIYcLM8/cGKlY7oGn5ENQmrLMDL/NP5keIZCaqwgx2l5/Amva+b3I=,iv:9tyEBORku3ihxBFTOrYos7CoqjYCmf7SQ+LS3EBaG7Q=,tag:K8os1wCPiMJjSgxsHZwU4w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1