summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--flake.lock6
-rw-r--r--hosts/apocalypse/default.nix11
-rw-r--r--hosts/omega-relay/default.nix21
-rw-r--r--hosts/tacitus/default.nix2
-rw-r--r--secrets/omega-relay/stalwart.yaml28
-rw-r--r--secrets/omega-relay/stalwart16.yaml48
-rw-r--r--services/bulwark.nix5
-rw-r--r--services/mail2.nix126
8 files changed, 91 insertions, 156 deletions
diff --git a/flake.lock b/flake.lock
index d968e7a..b81dcbc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -264,11 +264,11 @@
]
},
"locked": {
- "lastModified": 1780084707,
- "narHash": "sha256-ZN7DX+lZ8agl6F0CfWH7HHNuMq7yyFV5eg1eMwidCgs=",
+ "lastModified": 1780211733,
+ "narHash": "sha256-9keQVrQN6ZhODsyITo25sPMfbWlmBYfLQ59MyiX8Y38=",
"owner": "Wilkuu-2",
"repo": "stalwart-nix",
- "rev": "57431323bb9cc1c48fa4879da4a2e7798cfbbcc8",
+ "rev": "3752aa11c22073b00507b67e1c14ba17e7ed3629",
"type": "github"
},
"original": {
diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix
index 4836702..db2f6c2 100644
--- a/hosts/apocalypse/default.nix
+++ b/hosts/apocalypse/default.nix
@@ -5,7 +5,6 @@
./nvidia.nix
./backup.nix
./firewall.nix
- ../../services/mail2.nix
];
## TODO REMOVE LATER TO PREVENT ELI FROM BUILDING REMOTELY
@@ -20,16 +19,6 @@
HandleLidSwitchDocked = "ignore";
};
- wilkuu.services.test_endpoint.enable = false;
- wilkuu.services.mail = {
- enable = true;
- doACME = false;
- defaultDomain = "apocalypse.local";
- domains = [ "apocalypse.local" ];
- wellKnownDomains = [ ];
- startupMode = "bootstrap";
- };
-
## Addons for this system
addons = {
desktop.hyprland.enable = false;
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 32ba860..8901ca4 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -11,13 +11,13 @@
./vm.nix
./hardware-configuration.nix
../../services/mysql.nix
- ../../services/email.nix
../../services/vaultwarden.nix
../../services/uptimekuma.nix
../../services/freshrss.nix
../../services/wakapi.nix
../../services/continuwuity.nix
../../services/bulwark.nix
+ ../../services/mail2.nix
];
addons = {
@@ -28,6 +28,7 @@
gpg.enable = true;
virtualisation.guest = true;
};
+ nix.settings.trusted-users = [ "wilkuu"];
boot.loader.grub = {
enable = true;
efiSupport = false;
@@ -49,24 +50,22 @@
doACME = !isVM;
port = 8080;
};
-
- stalwart = {
+
+ mail = {
enable = true;
- domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz";
+ startupMode = "recovery";
+ defaultDomain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz";
wellKnownDomains = [
"wilkuu.xyz"
"wilkuu.nl"
];
- additionalDomains = [ "mail.wilkuu.nl" ];
+ domains = [ "wilkuu.xyz" "wilkuu.nl" ];
doACME = !isVM;
- corsDomains = [
- "qtab.wilkuu.nl"
- "qtab-dev.wilkuu.nl"
- "bulwark.wilkuu.nl"
- "bulwark.wilkuu.xyz"
- ];
+ extraConfig = [];
+ extraCreate = [];
};
+
bulwark = {
enable = true;
jmap_servers = [ "mail.wilkuu.xyz" ];
diff --git a/hosts/tacitus/default.nix b/hosts/tacitus/default.nix
index 1efc539..38de6d0 100644
--- a/hosts/tacitus/default.nix
+++ b/hosts/tacitus/default.nix
@@ -13,7 +13,7 @@
gpg.enable = true;
virtualisation.host = true;
};
-
+ nix.settings.trusted-users = [ "wilkuu"];
# Bootloader and boot setup.
boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
boot.loader.limine = {
diff --git a/secrets/omega-relay/stalwart.yaml b/secrets/omega-relay/stalwart.yaml
index 64d9286..689ffc0 100644
--- a/secrets/omega-relay/stalwart.yaml
+++ b/secrets/omega-relay/stalwart.yaml
@@ -1,9 +1,14 @@
stalwart:
user_admin_password: ENC[AES256_GCM,data:oHKLJRLYCbVO7AQuzqwOd40jTV5Y7M76do9EduXpbas=,iv:u+jwIZL8c603XlbuANNYjXTY1vKan0xO3eWTiW6NlQo=,tag:C81dfQOuqtqnXPxJv5QuHw==,type:str]
+stalwart16:
+ admin_password: ENC[AES256_GCM,data:Xzbq7douI5PZxMtCPRtyxTUYu6z6aVhEHyn72xYCjpw=,iv:dirKSIFqQThuxsjam0urUhPMhMbINWy7YSED53oBu+s=,tag:8tG8sayZqbrsNNZlrpnCoA==,type:str]
+ admin_user: ENC[AES256_GCM,data:7E4eEHo=,iv:fLK2cwe5DbTC3/lQToM/sv1JKy/rRFVVRHFYaclqcUk=,tag:aeQNMFd3bhXkqym6Id3m5w==,type:str]
+ recovery_user: ENC[AES256_GCM,data:lxUjjzI=,iv:NweaPoIO402kQicfoztEOKe+A/BySvAQlmPmdrCM5W8=,tag:xbwkv5JeixyN2hwQGU02mA==,type:str]
+ recovery_password: ENC[AES256_GCM,data:unlGEQ7xwSSW7sJJNaJGp/JJerHYB9U01YQypgOHuLA=,iv:hObYM/2VwMPJ5II7sHH8j/qleCEDW9KeHNY6Aug8iYQ=,tag:/K+ml7ANyZXXwTTVYZnauQ==,type:str]
+ oidc_secret: ENC[AES256_GCM,data:EzoFm3bIm5g5YnR2VtloSHfDUBDWI2eKzyMjilZRyh8LVffQ5+us0pCLwM3dGje6HWwdd8+GMZ0WaYW1HulX9S4NI/DDksVjpe4YMqAVf5CjjKmws9JEAQ==,iv:hy3HtKJ7cyIMqEuK4CRe+vTbCvaEmg1fWL/mNECie0k=,tag:JxJJMZCfM/PUsW1Jxh51Ng==,type:str]
sops:
age:
- - recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
- enc: |
+ - enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZMFJ3ZTZFMzFTSThPTTc5
R3hlcXN0d0FKZ0d1Y0F0dkNWaThEcnVsVGt3CmxkcTNXa1hEV0NaUFBQYkZFVWRL
@@ -11,8 +16,8 @@ sops:
WE9tcCsxQThMN3J2SW9iZi9vM1h3NncKDIBFEkix0DG0TpsoAKNmT9y1cPf8QGUY
l0DhwfbUy081Qd6EvW3c8WaL4uKiN45PtV5swUl7wZUkExSt8x57yA==
-----END AGE ENCRYPTED FILE-----
- - recipient: age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg
- enc: |
+ recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+ - enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXaWE1bGcvMkhxaVRZa1Jz
RTlxR3Joa2xLRjBwVGc4NXdTUXNoZFc5alRnClc3U0wzRlNhWjhUWGJybW1ieHB5
@@ -20,8 +25,8 @@ sops:
MXdIdFEvdm1qQXp3aERVVk9BR3J0ekUK0MigpfH9/0kazAnUpCr1ubzSaKBNU+k9
bxiK9cEIH8+bhKe5QujimM4/sEtNzTbXo2KzO6s5ez3ba7/VcT6SxA==
-----END AGE ENCRYPTED FILE-----
- - recipient: age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4
- enc: |
+ recipient: age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg
+ - enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlaC9vS2U2UzZjUmVaeHBz
U2lKOHRIN1FUN3VwOTRBSVZjZDVQT0xWb1dzCnlPSmZQb0JuYkFRWWxMQzM2bnp6
@@ -29,8 +34,8 @@ sops:
bnlTdksxRjk3ZlhvODZpZjE5RVRHL2sKSjydmq8Yhzn2Ze9/UJBONcv5qHjsEDoP
/ERd6jQR9Hi8B6v8fUF5W56VeFcciJhj4Paxt7cpH0xlSAz0XAC8zQ==
-----END AGE ENCRYPTED FILE-----
- - recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
- enc: |
+ recipient: age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4
+ - enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2U2VhSnl4aDN4bmk1elE3
NlNjL3d5SG0rNUZDcVZNSmVTMTJTNkRsN1FJCmpjald4YWtGejR2dGI2U3ZNdUtE
@@ -38,7 +43,8 @@ sops:
aVVRTjZSUGdsa2lPWmQ1Yk9yYXFrcmcKq3rFIP2fGpqsFujP27bgUhEfbg67ULv8
EbaohOYOQJiCeQfRdT7IwWIjTVcBhyU4wDw5Ss9HFk8faQn2wrQdOg==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-01-17T21:45:45Z"
- mac: ENC[AES256_GCM,data:ZN8Zmo6yvhuyJKrnAw4btIf6FxEWiQuCCBpWedYGj0S973YRgEbl7Q9HKsYrVOwNwGIMS5MBv+hjjvOMZvJU0331V7PefRy4yzqN10pJLgLwyB63ZrhOdY87q9U8Gz3K1qOoPJievJmyxBwUvbdwO7JWoeiNVxsC+YwGZiJ19yg=,iv:OillC3jS5bILDrZahmsN/sztSlFqrr2BpqzUYjdd7vU=,tag:28az0UH1hVcEq9532yY8nw==,type:str]
+ recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
+ lastmodified: "2026-05-31T07:09:36Z"
+ mac: ENC[AES256_GCM,data:PwhcGqFEdIli5A2dn3o6ZysuznkgvM5VP54AIW5FWd+WT1CtH5thsfMB+V7IuObYnVEde/WxYoNFADWOOIgGj2ZVqGVNQtGJLsRqkVgR6B2fq7MkbPjXWhITbVzFvgqT85eiwHV7LNp4DBpF0kEfBYok3qjZMA6KxsMAOOZb59Q=,iv:z83S5rxzUCnyiVNiioDYXTLH+fXK8N3wNckV8a90PXg=,tag:pRFnhvmI4Rb+UHwzeBEBPg==,type:str]
unencrypted_suffix: _unencrypted
- version: 3.11.0
+ version: 3.13.1
diff --git a/secrets/omega-relay/stalwart16.yaml b/secrets/omega-relay/stalwart16.yaml
new file mode 100644
index 0000000..12b88e1
--- /dev/null
+++ b/secrets/omega-relay/stalwart16.yaml
@@ -0,0 +1,48 @@
+stalwart16:
+ admin_password: ENC[AES256_GCM,data:jeiP2ZJssGdA9LMFWbZptM4FAH2VpG+8GlkfHMhZKYs=,iv:YZa0fUwdIEkpr+4X6if1CRyDjCfBbccIYM6m6yLHjmw=,tag:3FPDGL0BtgmjWmpMl9Ch1g==,type:str]
+ admin_user: ENC[AES256_GCM,data:A3/ycNw=,iv:Ebyl9gbqEK9b433UahPjp94/2TpN3AusDtan0GiOo64=,tag:7/qYX8LHkMyz+98TWw448Q==,type:str]
+ recovery_user: ENC[AES256_GCM,data:+IO6djQ=,iv:AeS8lw1KUE6hjT8F8z9rzsW/SYehyAensjBFgAQosTY=,tag:K5QtrhQoRP0ur4kSrFp9Ow==,type:str]
+ recovery_password: ENC[AES256_GCM,data:9XeEvrIRMfGznU4uf+cWAtJXUlj0VXggFTFUoFDIhK4=,iv:CHo8CaXDCAHriSyDfmSfeTOf1V9Qg7daMtV1rnK3D8I=,tag:hED15sAgk/5gOnVRyUPPDA==,type:str]
+ oidc_secret: ENC[AES256_GCM,data:iqDw/wKrkWLGfJCuj8fbc2METbcI/GU1q6LQg2F1t2eVNRXjs0cZWYDVN2XPGcd/IwXsfQ0gVZ8knsKcibUxNclwBj+PSbzi1PrtpmoQray03s/szq8eKg==,iv:yb8eonGjI77kZ2Rb8C4YbiRaTevYDeGkK/2ol/menJ0=,tag:mpV7yTNNzj+apRVNDXSpJA==,type:str]
+sops:
+ age:
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLeG0xNlFoTHBoSzRKdGxQ
+ Tk8wSXA0Uks2NUp3ZDRKdHFjSTV5NXkyS0FnCjdVQndjTzlPVWlzN3JVVkc4NTFw
+ NzFUNnoxb2FOdXdzY1E1aUhzYXpUNFEKLS0tIFdvZC9KQ3RQV1U1eVU0L3NwQWQ0
+ aGozUkNYSTFzeFVMUFZremJMV0tlS0EKZ1rTerxX2RXZk9u+lH5kZlQVD8MYD361
+ Y7Z/eC11GlZyVg0QOpenouN5bSYtcoOoqP82//xV0a7lU12r7oqr5A==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhOFhRRXpuaHIxbGcza0k4
+ bHgwdm5kWmVRQ01YVkVEQVo3OHA3dUh6OFdBCkdnUmo4azFQNDgyaUhPY3lWSTBz
+ N3dFSStseVhGeVQ1MkZoNmRYalNSTkkKLS0tIFY4QkVwQmRtczVUamFZUk5acGZ4
+ am1uMHRFLzI2eTd0U0l1Q1JTdjUxNUkKoIrdk7URS9+wfOGLcmki6Z15UFNP/Kyd
+ h5w/TePoAKZEIEdtxDwyM86vI5fgVkXe3S74+bDVD5dK81ax4uvjtA==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHWVpLVit1MlVObkt3U01I
+ REk0aEd2dExQTndrRThIekdUanNVcGpHb1Z3CjV3eTJQeFZaczBSNWx6UDQ2VjJr
+ Y1h6bWhwR01TWSt2RVMvdmhFZFhRYzAKLS0tIGlpaWZTNGcrREw1WE5mdmw2dWJz
+ VmZoR0NTVEcxNHFzZmpMSTk1ckswd0UKx9dqX/kESOmU8ENU01sXwTuOLNJ5vOb0
+ ExqFy5nilwVeHs1MY7JGRrODGLJF9tlDRmot7IvlrstHelMoaIgKpQ==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4
+ - enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQbEU0cHhhYVBudXM1QnM5
+ SU1zd1V2dFRtUEUvaVFJY1FRV2xVNFd4Tm1vCnliOUZXNFJaU0pLS2VXVWxRTE16
+ M3lwaXJWSVFMS2F3R2hWeEp1bmkrTEUKLS0tIDN5cmsreDZCQXRJTmdmVG1ON2NJ
+ RnFidGhXUzJxWHhhTVFFQnlSUkNlamsKo27Gu0r/yodBHJr+HVQis/Gy5KGUDuAR
+ 9oP/nCZKl8HPhUB3IWGrBdBiNZrJWeSPKsEDbqgrLzoql4ohIt71Tw==
+ -----END AGE ENCRYPTED FILE-----
+ recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
+ lastmodified: "2026-05-31T07:08:36Z"
+ mac: ENC[AES256_GCM,data:5Nk7dQ4/2nh1guB3Dd5lfhs1bey8cVATg6WoiK5e55DSzcwadsOp/KKjsLV/4sAjnpe+o4IqmeYtz5NafjulBXnEBrfjVrOWEHhg9Vi/4184yVkMAmyUsf3AhaFdH0ipeLQ5DVJgnupilil9gAGTAIDIroWxq24+/97QcKgV0qk=,iv:kPdbrw0CE/fkq7R9KUi/cJnX9jsEDhmvqYZLuDYqq9Y=,tag:LTvBbjJ7zPT5uoMnRUFQkw==,type:str]
+ unencrypted_suffix: _unencrypted
+ version: 3.13.1
diff --git a/services/bulwark.nix b/services/bulwark.nix
index a5f3f87..00198cd 100644
--- a/services/bulwark.nix
+++ b/services/bulwark.nix
@@ -6,7 +6,7 @@
}:
let
cfg = config.wilkuu.services.bulwark;
- stalwart_cfg = config.wilkuu.services.stalwart;
+ stalwart_cfg = config.stalwart-nix.stalwart;
hostname = config.networking.hostName;
# Importing stuff from stalwart and defaults etc.
@@ -79,9 +79,6 @@ in
groups.bulwark = { };
};
- config.wilkuu.services.stalwart.corsDomains = lib.optionals (
- cfg.enable && stalwart_cfg.enable
- ) cfg.domains;
config.sops.secrets = (
lib.genAttrs (map toSops secrets) (_name: {
sopsFile = sopsPath;
diff --git a/services/mail2.nix b/services/mail2.nix
index ae4a9eb..e2f041a 100644
--- a/services/mail2.nix
+++ b/services/mail2.nix
@@ -57,131 +57,26 @@ in
config = lib.mkIf cfg.enable (
let
- tools = config.stalwart-nix.stalwart.toolbox;
sopsPath = ../secrets/${hostname}/stalwart.yaml;
secrets = [
"admin_user"
"admin_password"
"recovery_user"
"recovery_password"
+ "oidc_secret"
];
toSops = (sname: "stalwart16/${sname}");
toPlaceholder = (sname: config.sops.placeholder.${toSops sname});
toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
- domain_to_jid = lib.replaceString "." "_";
# We do this to satisfy the foreign key constraint of the SystemSettings singleton
- placeholderDomain = "bootstrap-placeholder.home.arpa";
- planPreamble = lib.concatLists [
- (tools.mkIdempotentCreateLine {
- "object" = "Domain";
- deleteBy = "name";
- value."#placeholder-domain" = {
- name = placeholderDomain;
- certificateManagement = {
- "@type" = "Manual";
- };
- dnsManagement = {
- "@type" = "Manual";
- };
- dkimManagement = {
- "@type" = "Manual";
- };
- subAddressing = {
- "@type" = "Enabled";
- };
- };
- })
- [
- {
- "@type" = "update";
- "object" = "SystemSettings";
- "value" = {
- "defaultDomainId" = "#placeholder-domain";
- };
- }
- ]
- ];
- # TODO: Is this nice, or is using 1 object better?
- # This approach makes it more atomic afaik?
- domainCreateRules = (
- lib.forEach cfg.domains (domain: {
- object = "Domain";
- deleteBy = "name";
- value.${domain_to_jid domain} = {
- name = domain;
- certificateManagement = {
- "@type" = "Manual";
- };
- dnsManagement = {
- "@type" = "Manual";
- };
- dkimManagement = {
- "@type" = "Manual";
- };
- subAddressing = {
- "@type" = "Enabled";
- };
- };
- })
- );
- certificateCreateRules = lib.optionals cfg.doACME (
- lib.forEach (lib.unique ([ cfg.default_domain ] ++ cfg.domains)) (
- (domain: {
- object = "Certificate";
- deleteBy = "certificate.filePath";
- value."cert_${domain_to_jid domain}" = {
- certificate = {
- "@type" = "File";
- filePath = "/run/credentials/stalwart.service/tls_${domain}_cert.pem";
- };
- privateKey = {
- "@type" = "File";
- filePath = "/run/credentials/stalwart.service/tls_${domain}_key.pem";
- };
- };
- })
-
- )
- );
- baseSetupRules = [
- {
- "@type" = "update";
- "object" = "SystemSettings";
- "value" = {
- "defaultDomainId" = "#${domain_to_jid (builtins.elemAt cfg.domains 0)}";
- "defaultHostname" = cfg.defaultDomain;
- };
- }
- {
- "@type" = "update";
- "object" = "BlobStore";
- "value" = {
- "@type" = "Default";
- };
- }
- {
- "@type" = "update";
- "object" = "InMemoryStore";
- "value" = {
- "@type" = "Default";
- };
- }
- {
- "@type" = "update";
- "object" = "SearchStore";
- "value" = {
- "@type" = "Default";
- };
- }
- ];
proxyWellKnown =
names:
let
uris = map (n: "/.well-known/${n}") names;
in
(lib.genAttrs uris (uri: {
- proxyPass = "http://localhost:3080${uri}";
+ proxyPass = "http://127.0.0.1:8080${uri}";
recommendedProxySettings = true;
}));
makeHTTPRedirectBody = target: https: "302 ${if https then "https" else "http"}://${target}";
@@ -236,11 +131,11 @@ in
"mail-v1.xml"
"autoconfig/mail"
"openid-configuration"
- "/.well-known/oauth-authorization-server"
+ "oauth-authorization-server"
])
// (lib.genAttrs [ "/.well-known/caldav/" "/.well-known/webdav/" "/.well-known/jmap" ] (uri: {
extraConfig = ''
- return ${makeHTTPRedirectBody "${cfg.domain}${uri}" cfg.doACME};
+ return ${makeHTTPRedirectBody "${cfg.defaultDomain}${uri}" cfg.doACME};
'';
}));
@@ -251,23 +146,24 @@ in
enableACME = cfg.doACME;
#serverName = "${domain}";
locations."/" = {
- proxyPass = "http://localhost:8080";
+ proxyPass = "http://127.0.0.1:8080";
proxyWebsockets = true;
recommendedProxySettings = true;
};
}));
- stalwart-nix.stalwart = {
+ stalwart-nix.stalwart = let
+ in {
enable = cfg.enable;
- url = if cfg.startupMode != "normal" then "http://localhost:8080/" else cfg.defaultDomain;
+ url = if cfg.startupMode != "normal" then "http://127.0.0.1:8080/" else "http://${cfg.defaultDomain}";
credentialsFile = config.sops.templates.stalwart-config-creds.path;
recoveryCredentialsFile = config.sops.templates.stalwart-recovery-creds.path;
startupMode = cfg.startupMode;
user = "stalwart";
group = "stalwart";
- configPlanPre = planPreamble;
- idempotentCreate = certificateCreateRules ++ domainCreateRules ++ cfg.extraCreate;
- configPlanPost = baseSetupRules ++ cfg.extraConfig;
+ configPlanPre = [];
+ idempotentCreate = cfg.extraCreate;
+ configPlanPost = cfg.extraConfig;
credentials =
(lib.genAttrs secrets toCredfilePath)
// (builtins.foldl' (a: b: a // b) ({ }) (
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-10 23:09:43 +0000