Apply changes from messing around and making things work

4 files changed, 52 insertions, 35 deletions

diff --git a/services/email.nix b/services/email.nix
index 5fbd04a..906b44d 100644
--- a/services/email.nix
+++ b/services/email.nix
@@ -33,7 +33,7 @@ in
       secrets = [ "user_admin_password" ];
       toSops = (sname: "stalwart/${sname}");
       toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
-      toStalwartCred = name: "%{file:/run/credentials/stalwart-mail.service/${name}}%";
+      toStalwartCred = name: "%{file:/run/credentials/${config.systemd.services.stalwart.name}/${name}}%";
 
       basicListener = proto: port: tls: {
         bind = [ "[::]:${toString port}" ];
@@ -63,10 +63,10 @@ in
 
       # Need this bc otherwise sops will complain for some reason
       users = {
-        groups.stalwart-mail = { };
-        users.stalwart-mail = {
+        groups.stalwart = { };
+        users.stalwart = {
           isSystemUser = true;
-          group = "stalwart-mail";
+          group = "stalwart";
         };
       };
 
@@ -93,39 +93,37 @@ in
                 uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME
               ));
           })
-        ))
-        //
+        )) //
+        { ${cfg.domain} = {
+	      addSSL = cfg.doACME;
+	      enableACME = cfg.doACME;
+	      serverName = "${cfg.domain}";
+	      locations."/" = {
+		proxyPass = "http://localhost:3080";
+		recommendedProxySettings = true;
+	      };
+        };};
 
-          (lib.genAttrs
-            (map (x: "${x}${cfg.domain}") [
-              ""
-              "autodiscover."
-              "autoconfig."
-            ])
-            (domain: {
-              addSSL = cfg.doACME;
-              enableACME = cfg.doACME;
-              serverName = "${domain}";
-              locations."/" = {
-                proxyPass = "http://localhost:3080";
-                recommendedProxySettings = true;
-              };
-            })
-          );
-
-      services.stalwart-mail = {
+      services.stalwart = {
         enable = true;
         dataDir = cfg.dataDir;
         openFirewall = false;
-        credentials = lib.genAttrs secrets toCredfilePath;
+        credentials = (lib.genAttrs secrets toCredfilePath) // (let 
+		acme_dir = config.security.acme.certs.${cfg.domain}.directory;
+		cert_path = file: "${acme_dir}/${file}";
+	in (if cfg.doACME then {
+		"tls_cert.pem" = cert_path "cert.pem";
+		"tls_key.pem"  = cert_path  "key.pem";
+	} else {}));
+
         settings = {
           server.listener = {
             smtp = basicListener "smtp" 25 false;
             submission = basicListener "smtp" 465 true;
             imaptls = basicListener "imap" 993 true;
             imap = basicListener "imap" 143 true;
-            webdav = basicListener "http" 3080 false;
-            jmap = basicListener "http" 3080 false;
+            # webdav = basicListener "http" 3080 false;
+            # jmap = basicListener "http" 3080 false;
             http = basicListener "http" 3080 false;
           };
 
@@ -155,8 +153,20 @@ in
 
           http = {
             use-x-forwarded = true;
-            url = "protocol + \"${cfg.domain}\"";
+            url = "protocol + \"://${cfg.domain}\"";
           };
+
+	  session.connect = {
+		hostname = "config_get('server.hostname')";
+	  };
+
+	  server.hostname = "${cfg.domain}";  
+
+	  certificate."nix_${cfg.domain}" = lib.mkIf cfg.doACME {
+		cert = toStalwartCred "tls_cert.pem"; 
+		private-key = toStalwartCred "tls_key.pem";
+		default = true; 
+	  };  
         };
       };
     }
diff --git a/services/freshrss.nix b/services/freshrss.nix
index 2c28baa..26a1853 100644
--- a/services/freshrss.nix
+++ b/services/freshrss.nix
@@ -59,6 +59,7 @@ in
         enable = true;
         users."freshrss" = {
           sopsPlaceholder = config.sops.placeholder."fresh-rss/db_pass";
+	  host = "localhost";
         };
         databases."freshrss" = {
           enable = true;
diff --git a/services/mysql.nix b/services/mysql.nix
index 83a5033..06edfcb 100644
--- a/services/mysql.nix
+++ b/services/mysql.nix
@@ -23,10 +23,10 @@ let
       (
         ''
           -- Clauses for user ${name}
-          ALTER USER IF EXISTS '${name}'@'%' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; 
-          CREATE USER IF NOT EXISTS '${name}'@'%' IDENTIFIED BY '${ucfg.sopsPlaceholder}';  
+          ALTER USER IF EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; 
+          CREATE USER IF NOT EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}';  
         ''
-        + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'name'@'%'") (create_users_ensure name))
+        + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'${ucfg.host}'") (create_users_ensure name))
       )
     else
       " -- Ommitted user ${name}";
@@ -84,6 +84,10 @@ in
               allowedRanges = mkOption {
                 type = types.listOf types.str;
               };
+	      host = mkOption {
+		type = types.str; 
+		default = "%"; 
+	      };
             };
           }
         );
diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix
index d98a0b3..720040d 100644
--- a/services/uptimekuma.nix
+++ b/services/uptimekuma.nix
@@ -67,10 +67,12 @@ in
     services.uptime-kuma = {
       enable = true;
       settings = {
-        UPTIME_KUMA_PORT = "3111";
-        UPTIME_KUMA_HOST = "127.0.0.1";
-        UPTIME_KUMA_DB_TYPE = "sqlite";
-        UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
+        UPTIME_KUMA_PORT        = "3111";
+        UPTIME_KUMA_HOST        = "127.0.0.1";
+        UPTIME_KUMA_DB_TYPE     = "sqlite";
+        #UPTIME_KUMA_DB_SOCKET   = "/run/mysqld/mysqld.sock";
+	#UPTIME_KUMA_DB_USERNAME = config.systemd.services.uptime-kuma.serviceConfig.User;
+	#UPTIME_KUMA_DB_NAME     = "uptimekuma"; 
       };
     };
   });