summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.sops.yaml6
-rw-r--r--flake.nix6
-rw-r--r--hosts/aperture/default.nix1
-rw-r--r--hosts/aperture/testbed.nix62
-rw-r--r--secrets/aperture/lldap.yaml27
-rw-r--r--secrets/aperture/stalwart.yaml29
6 files changed, 119 insertions, 12 deletions
diff --git a/.sops.yaml b/.sops.yaml
index aa2cef4..ac8ee3b 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -5,7 +5,7 @@ keys:
- &vm_omega_relay age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4
- &server_omega_relay age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
- &server_threshold age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht
-
+ - &server_aperture age1plk5hf03zreyg8kmrz68uz8slwaeswt044f36ktql05f56xpkfdsk2fxx4
creation_rules:
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
@@ -27,5 +27,9 @@ creation_rules:
age:
- *admin_wilkuu
- *server_threshold
+ - path_regex: secrets/aperture/[^/]+\.(yaml|json|env|ini)$
+ age:
+ - *admin_wilkuu
+ - *server_aperture
diff --git a/flake.nix b/flake.nix
index e05060f..9207ce9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,8 +7,8 @@
stalwart-nix = {
# local testing
- # url = "path:/store2/code/stalwart-nix";
- url = "github:Wilkuu-2/stalwart-nix";
+ url = "path:/store2/code/stalwart-nix";
+ # url = "github:Wilkuu-2/stalwart-nix";
inputs.nixpkgs.follows = "nixpkgs";
inputs.treefmt-nix.follows = "treefmt-nix";
};
@@ -130,6 +130,7 @@
home-manager.nixosModules.default
disko.nixosModules.disko
sops-nix.nixosModules.default
+ stalwart-nix.nixosModules.default
];
};
@@ -159,6 +160,7 @@
home-manager.nixosModules.default
disko.nixosModules.default
sops-nix.nixosModules.default
+ stalwart-nix.nixosModules.default
];
};
};
diff --git a/hosts/aperture/default.nix b/hosts/aperture/default.nix
index ded949c..bca4615 100644
--- a/hosts/aperture/default.nix
+++ b/hosts/aperture/default.nix
@@ -18,6 +18,7 @@
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
+ nix.settings.trusted-users = [ "wilkuu"];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/hosts/aperture/testbed.nix b/hosts/aperture/testbed.nix
index 479de4a..5e9853d 100644
--- a/hosts/aperture/testbed.nix
+++ b/hosts/aperture/testbed.nix
@@ -1,4 +1,8 @@
-{ ... }:
+{ config, pkgs, lib, ... }: let
+ dotsToDn = type: domain: (lib.concatMapStringsSep "," (x: "${type}=${x}") (lib.splitString "." domain));
+ baseDN = dotsToDn "dc" "aperture.local";
+ sopsCred = name: config.sops.secrets."lldap/${name}".path;
+in
{
imports = [ ../../services/mail2.nix ];
wilkuu.services.test_endpoint = {
@@ -8,21 +12,61 @@
domain = "test.aperture.local";
};
- wilkuu.services.mail = {
+ # systemd.services.stalwart.serviceConfig.Environment = ["STALWART_PUBLIC_URL=http://mail.aperture.local"];
+ wilkuu.services.mail = let
+ domain_to_jid = lib.replaceString "." "_";
+ in {
enable = true;
doACME = false;
defaultDomain = "mail.aperture.local";
- domains = [ "mail.aperture.local" ];
- wellKnownDomains = [ "aperture.local" ];
- startupMode = "bootstrap";
+ domains = [ "aperture.local" ];
+ wellKnownDomains = [];
+ startupMode = "recovery";
+ extraCreate = [];
+ extraConfig = [];
};
+
+ users.users.lldap = {
+ isSystemUser = true;
+ group = "lldap";
+ };
+ users.groups.lldap = {};
+
+ sops.secrets = let
+ sopsPath = ../../secrets/${config.networking.hostName}/lldap.yaml;
+ secrets = ["admin_password" "jwt_secret"];
+ toSops = (sname: "lldap/${sname}");
+ in lib.genAttrs (map toSops secrets) ( _name: {
+ sopsFile = sopsPath;
+ mode = "0440";
+ owner = "lldap";
+ });
+
+ services.nginx.virtualHosts."ldap.aperture.local" = {
+ locations."/" = {
+ proxyPass = "http://127.0.0.1:${toString config.services.lldap.settings.http_port}";
+ recommendedProxySettings = true;
+ };
+ };
- lldap = {
- enable = false;
- environmentFile = null;
+ networking.firewall.allowedTCPPorts = [ 80 ];
+
+ services.lldap = let
+
+ in {
+ enable = true;
+ # environmentFile = null;
settings = {
+ force_ldap_user_pass_reset = "always";
+ jwt_secret_file = sopsCred "jwt_secret";
+ ldap_user_pass_file = sopsCred "admin_password";
+ ldap_user_dn = "ldap_admin";
+ ldap_user_email = "ldap_admin@aperture.local";
+
+ ldap_base_dn = baseDN;
+ ldap_port = 3890;
-
+ http_url = "http://ldap.aperture.local";
};
};
}
diff --git a/secrets/aperture/lldap.yaml b/secrets/aperture/lldap.yaml
new file mode 100644
index 0000000..3d4cdae
--- /dev/null
+++ b/secrets/aperture/lldap.yaml
@@ -0,0 +1,27 @@
+lldap:
+ jwt_secret: ENC[AES256_GCM,data:v6idYg+T+HsWSK4PUtK+LiOsHwBOuDtuMfrItlfks2lQkV2w3FolE/5kORGuf41GL7U2GSbG+XPHbTk9JbHq1WFqbXYcKUP4mWQX5BDdwbzCT1uU6k0aHg==,iv:gPBt7g1sGDC+T4QJNlnC613oatKcJAwRpBUNJ9j7bGQ=,tag:Qv3lIirsea5maWkbXMkyCg==,type:str]
+ admin_password: ENC[AES256_GCM,data:Vaz69UkS7ao68A79uw==,iv:7qXwV/iXM4ywYCvswFE2SN1WBwXa5qXchfWO0Rmmm9U=,tag:ASDdxH7CPLE5RFV584HLJQ==,type:str]
+sops:
+ age:
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMTHpteDNBYTg4dysxaVZu
+ NVNGTFhjOUpIUEh4a3hrT2g1eXlnVjhhMVdjClphSTNRa3U3Wi90ekI2L1FFUWd2
+ SGdQU1E1ZnJsY05Fa0l5SWxFNVNCeU0KLS0tIGpabklQNlVvTHVtUXJJRXo3aUto
+ TXhWRVlZTkVNdTZpSUJuUGVqVm1aT0EKLZghpnvLKTsV6QsJZKGOQUxiqG2rN3z4
+ 8+gMZmCOoQXaqv02nREAo3UsktwsCb1Zvl2E0jQqGTenT0gqdrWvVA==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMS2oxMWNENWtUMmdaT0xh
+ dGhDc1Rhc3RYZzBiUWNSVytTLzB6eTkvQjFBCnZLSjR6aENKR0NQekJZb21yb0Jq
+ Tnl5NTBDQTl2dU1hMEZUTW1TYklFZ2sKLS0tIDVodGZJZ0R0WnhSY2t3d3dNTkND
+ SHNFQzI1clUyYnBSZm1WcWFzWS9HREkK9m7IKO93pcTIDddiddhO6QAjkhEOUWP8
+ Ie227o05KSVlkrUnqIGxoFOrOqLDCwUfZjiR0v8gQAbFdNX8lHtPGw==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age1plk5hf03zreyg8kmrz68uz8slwaeswt044f36ktql05f56xpkfdsk2fxx4
+ lastmodified: "2026-05-30T22:51:00Z"
+ mac: ENC[AES256_GCM,data:ZJTJIy+Xy4bMH1BZkGac/sOPkDoDlYK/u8Swle64JxvtczKF218d6IhEc9pZhrGjvP3Klo/ryRfj+/BFFX1wwqQSYunBVzYZDW1qXT+ztzqejEzwUIuPMsf3f9asKyQZneNaIoykB8sb/T58XK/TyslOXOiS5cK318kK+j7FQm0=,iv:rL7vJ1VpunCwibUv+2mR9GUC/Fx/R59YP3i8+AM7cxk=,tag:vEFdunAizHh0cijcXHagVQ==,type:str]
+ unencrypted_suffix: _unencrypted
+ version: 3.13.1
diff --git a/secrets/aperture/stalwart.yaml b/secrets/aperture/stalwart.yaml
new file mode 100644
index 0000000..bb0b006
--- /dev/null
+++ b/secrets/aperture/stalwart.yaml
@@ -0,0 +1,29 @@
+stalwart16:
+ admin_user: ENC[AES256_GCM,data:yrAnPJk=,iv:uUVng0WQTFS3Rx+3FvP+05JWVLBt8ugwlZ2kxLqfVtg=,tag:2uQit0sa68G2LCxGZc2X0w==,type:str]
+ admin_password: ENC[AES256_GCM,data:FtcqBqA0D14=,iv:5ZAlFmZeUMIP28zhR9k36Zqz19FjpCQkGmdvndcpmbI=,tag:CMILU/WBtXfE0b5p8F+Lbw==,type:str]
+ recovery_user: ENC[AES256_GCM,data:ECKU3Aw=,iv:9tDVS+Qd33/6ZPIUF2wFWEc4eWGezQOqeg8d+j08yGA=,tag:6nQwmT3GXqpY0e3J2CDcKw==,type:str]
+ recovery_password: ENC[AES256_GCM,data:rqFbR8TmwlI=,iv:Mdj5UXwweGeckN8Kc9f1MBAj52yJ89mWzF7Oakuce8E=,tag:OjONxYdFa/bI1RIIirfDbQ==,type:str]
+sops:
+ age:
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwVXhDZ253M1NQZGdkTDRQ
+ MnNyMTc3c0g1ZVpob1AzV09FU3l3eE1OZkdjCmM0cFNSNUN3TlBER1p5RWpZTWpR
+ d3RTNFlWa1dwalRRc3piMng4QTF4emMKLS0tIHRLQnJBUkdOTnY0QWZpK1dsTWUx
+ MC9BUThkZi9kcmwwU3JZWlR3R1hXK2cKFYwivt65drnigbLEEBjoIJyUSlvbiRA/
+ +t0a9MOOFNlkSSbbLB+xobyM7iVuWodWgoEJuz+xqxeYqnEiVLdyQw==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkVE1DZ0Y4K25sMXVvcWtT
+ UURCNnI2UXFxSi90RUVXdzFqUUJ1V2VhMWhzCnUzK3B1cnJTVWJ4d0VLN3pTTUc3
+ K0xCNENadzg4MUNHTXhvdk04cnN5NFUKLS0tIGxockJJZUhRcnd2TTJZYVRtd0tD
+ Z1FzeXFqUlBnL3A0QU10TXFjaW9mSDQKg58Fybb0GPxRX8v3KnGJUgbDgkZh/alj
+ lJJMshofn+niP6wWsNuXlIOog2io5jA2QLGYkUbidsctlFH8EsuakQ==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age1plk5hf03zreyg8kmrz68uz8slwaeswt044f36ktql05f56xpkfdsk2fxx4
+ lastmodified: "2026-05-30T21:48:23Z"
+ mac: ENC[AES256_GCM,data:XrjlSmZ9GyDMzcsXAuV2kwx4eyxXFO2yiCzMVXEJRxqW9vqjbeC9pKpliguzBinw9F2yIzcVlX3RydUlAVuFPjDYO+wiYlb4VivTF9YfWFQVMY2Q8Viq3OfIYcLM8/cGKlY7oGn5ENQmrLMDL/NP5keIZCaqwgx2l5/Amva+b3I=,iv:9tyEBORku3ihxBFTOrYos7CoqjYCmf7SQ+LS3EBaG7Q=,tag:K8os1wCPiMJjSgxsHZwU4w==,type:str]
+ unencrypted_suffix: _unencrypted
+ version: 3.13.1
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-10 23:13:09 +0000