From 18c38635406586430c2aa772f0b708143104fb72 Mon Sep 17 00:00:00 2001 From: Jakub Stachurski Date: Sun, 31 May 2026 09:21:00 +0200 Subject: Move to stalwart 0.16 --- flake.lock | 6 +- hosts/apocalypse/default.nix | 11 ---- hosts/omega-relay/default.nix | 21 +++--- hosts/tacitus/default.nix | 2 +- secrets/omega-relay/stalwart.yaml | 28 ++++---- secrets/omega-relay/stalwart16.yaml | 48 ++++++++++++++ services/bulwark.nix | 5 +- services/mail2.nix | 126 ++++-------------------------------- 8 files changed, 91 insertions(+), 156 deletions(-) create mode 100644 secrets/omega-relay/stalwart16.yaml diff --git a/flake.lock b/flake.lock index d968e7a..b81dcbc 100644 --- a/flake.lock +++ b/flake.lock @@ -264,11 +264,11 @@ ] }, "locked": { - "lastModified": 1780084707, - "narHash": "sha256-ZN7DX+lZ8agl6F0CfWH7HHNuMq7yyFV5eg1eMwidCgs=", + "lastModified": 1780211733, + "narHash": "sha256-9keQVrQN6ZhODsyITo25sPMfbWlmBYfLQ59MyiX8Y38=", "owner": "Wilkuu-2", "repo": "stalwart-nix", - "rev": "57431323bb9cc1c48fa4879da4a2e7798cfbbcc8", + "rev": "3752aa11c22073b00507b67e1c14ba17e7ed3629", "type": "github" }, "original": { diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix index 4836702..db2f6c2 100644 --- a/hosts/apocalypse/default.nix +++ b/hosts/apocalypse/default.nix @@ -5,7 +5,6 @@ ./nvidia.nix ./backup.nix ./firewall.nix - ../../services/mail2.nix ]; ## TODO REMOVE LATER TO PREVENT ELI FROM BUILDING REMOTELY @@ -20,16 +19,6 @@ HandleLidSwitchDocked = "ignore"; }; - wilkuu.services.test_endpoint.enable = false; - wilkuu.services.mail = { - enable = true; - doACME = false; - defaultDomain = "apocalypse.local"; - domains = [ "apocalypse.local" ]; - wellKnownDomains = [ ]; - startupMode = "bootstrap"; - }; - ## Addons for this system addons = { desktop.hyprland.enable = false; diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index 32ba860..8901ca4 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -11,13 +11,13 @@ ./vm.nix ./hardware-configuration.nix ../../services/mysql.nix - ../../services/email.nix ../../services/vaultwarden.nix ../../services/uptimekuma.nix ../../services/freshrss.nix ../../services/wakapi.nix ../../services/continuwuity.nix ../../services/bulwark.nix + ../../services/mail2.nix ]; addons = { @@ -28,6 +28,7 @@ gpg.enable = true; virtualisation.guest = true; }; + nix.settings.trusted-users = [ "wilkuu"]; boot.loader.grub = { enable = true; efiSupport = false; @@ -49,24 +50,22 @@ doACME = !isVM; port = 8080; }; - - stalwart = { + + mail = { enable = true; - domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz"; + startupMode = "recovery"; + defaultDomain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz"; wellKnownDomains = [ "wilkuu.xyz" "wilkuu.nl" ]; - additionalDomains = [ "mail.wilkuu.nl" ]; + domains = [ "wilkuu.xyz" "wilkuu.nl" ]; doACME = !isVM; - corsDomains = [ - "qtab.wilkuu.nl" - "qtab-dev.wilkuu.nl" - "bulwark.wilkuu.nl" - "bulwark.wilkuu.xyz" - ]; + extraConfig = []; + extraCreate = []; }; + bulwark = { enable = true; jmap_servers = [ "mail.wilkuu.xyz" ]; diff --git a/hosts/tacitus/default.nix b/hosts/tacitus/default.nix index 1efc539..38de6d0 100644 --- a/hosts/tacitus/default.nix +++ b/hosts/tacitus/default.nix @@ -13,7 +13,7 @@ gpg.enable = true; virtualisation.host = true; }; - + nix.settings.trusted-users = [ "wilkuu"]; # Bootloader and boot setup. boot.loader.efi.canTouchEfiVariables = lib.mkDefault true; boot.loader.limine = { diff --git a/secrets/omega-relay/stalwart.yaml b/secrets/omega-relay/stalwart.yaml index 64d9286..689ffc0 100644 --- a/secrets/omega-relay/stalwart.yaml +++ b/secrets/omega-relay/stalwart.yaml @@ -1,9 +1,14 @@ stalwart: user_admin_password: ENC[AES256_GCM,data:oHKLJRLYCbVO7AQuzqwOd40jTV5Y7M76do9EduXpbas=,iv:u+jwIZL8c603XlbuANNYjXTY1vKan0xO3eWTiW6NlQo=,tag:C81dfQOuqtqnXPxJv5QuHw==,type:str] +stalwart16: + admin_password: ENC[AES256_GCM,data:Xzbq7douI5PZxMtCPRtyxTUYu6z6aVhEHyn72xYCjpw=,iv:dirKSIFqQThuxsjam0urUhPMhMbINWy7YSED53oBu+s=,tag:8tG8sayZqbrsNNZlrpnCoA==,type:str] + admin_user: ENC[AES256_GCM,data:7E4eEHo=,iv:fLK2cwe5DbTC3/lQToM/sv1JKy/rRFVVRHFYaclqcUk=,tag:aeQNMFd3bhXkqym6Id3m5w==,type:str] + recovery_user: ENC[AES256_GCM,data:lxUjjzI=,iv:NweaPoIO402kQicfoztEOKe+A/BySvAQlmPmdrCM5W8=,tag:xbwkv5JeixyN2hwQGU02mA==,type:str] + recovery_password: ENC[AES256_GCM,data:unlGEQ7xwSSW7sJJNaJGp/JJerHYB9U01YQypgOHuLA=,iv:hObYM/2VwMPJ5II7sHH8j/qleCEDW9KeHNY6Aug8iYQ=,tag:/K+ml7ANyZXXwTTVYZnauQ==,type:str] + oidc_secret: ENC[AES256_GCM,data:EzoFm3bIm5g5YnR2VtloSHfDUBDWI2eKzyMjilZRyh8LVffQ5+us0pCLwM3dGje6HWwdd8+GMZ0WaYW1HulX9S4NI/DDksVjpe4YMqAVf5CjjKmws9JEAQ==,iv:hy3HtKJ7cyIMqEuK4CRe+vTbCvaEmg1fWL/mNECie0k=,tag:JxJJMZCfM/PUsW1Jxh51Ng==,type:str] sops: age: - - recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZMFJ3ZTZFMzFTSThPTTc5 R3hlcXN0d0FKZ0d1Y0F0dkNWaThEcnVsVGt3CmxkcTNXa1hEV0NaUFBQYkZFVWRL @@ -11,8 +16,8 @@ sops: WE9tcCsxQThMN3J2SW9iZi9vM1h3NncKDIBFEkix0DG0TpsoAKNmT9y1cPf8QGUY l0DhwfbUy081Qd6EvW3c8WaL4uKiN45PtV5swUl7wZUkExSt8x57yA== -----END AGE ENCRYPTED FILE----- - - recipient: age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg - enc: | + recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXaWE1bGcvMkhxaVRZa1Jz RTlxR3Joa2xLRjBwVGc4NXdTUXNoZFc5alRnClc3U0wzRlNhWjhUWGJybW1ieHB5 @@ -20,8 +25,8 @@ sops: MXdIdFEvdm1qQXp3aERVVk9BR3J0ekUK0MigpfH9/0kazAnUpCr1ubzSaKBNU+k9 bxiK9cEIH8+bhKe5QujimM4/sEtNzTbXo2KzO6s5ez3ba7/VcT6SxA== -----END AGE ENCRYPTED FILE----- - - recipient: age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4 - enc: | + recipient: age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlaC9vS2U2UzZjUmVaeHBz U2lKOHRIN1FUN3VwOTRBSVZjZDVQT0xWb1dzCnlPSmZQb0JuYkFRWWxMQzM2bnp6 @@ -29,8 +34,8 @@ sops: bnlTdksxRjk3ZlhvODZpZjE5RVRHL2sKSjydmq8Yhzn2Ze9/UJBONcv5qHjsEDoP /ERd6jQR9Hi8B6v8fUF5W56VeFcciJhj4Paxt7cpH0xlSAz0XAC8zQ== -----END AGE ENCRYPTED FILE----- - - recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4 - enc: | + recipient: age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4 + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2U2VhSnl4aDN4bmk1elE3 NlNjL3d5SG0rNUZDcVZNSmVTMTJTNkRsN1FJCmpjald4YWtGejR2dGI2U3ZNdUtE @@ -38,7 +43,8 @@ sops: aVVRTjZSUGdsa2lPWmQ1Yk9yYXFrcmcKq3rFIP2fGpqsFujP27bgUhEfbg67ULv8 EbaohOYOQJiCeQfRdT7IwWIjTVcBhyU4wDw5Ss9HFk8faQn2wrQdOg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-17T21:45:45Z" - mac: ENC[AES256_GCM,data:ZN8Zmo6yvhuyJKrnAw4btIf6FxEWiQuCCBpWedYGj0S973YRgEbl7Q9HKsYrVOwNwGIMS5MBv+hjjvOMZvJU0331V7PefRy4yzqN10pJLgLwyB63ZrhOdY87q9U8Gz3K1qOoPJievJmyxBwUvbdwO7JWoeiNVxsC+YwGZiJ19yg=,iv:OillC3jS5bILDrZahmsN/sztSlFqrr2BpqzUYjdd7vU=,tag:28az0UH1hVcEq9532yY8nw==,type:str] + recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4 + lastmodified: "2026-05-31T07:09:36Z" + mac: ENC[AES256_GCM,data:PwhcGqFEdIli5A2dn3o6ZysuznkgvM5VP54AIW5FWd+WT1CtH5thsfMB+V7IuObYnVEde/WxYoNFADWOOIgGj2ZVqGVNQtGJLsRqkVgR6B2fq7MkbPjXWhITbVzFvgqT85eiwHV7LNp4DBpF0kEfBYok3qjZMA6KxsMAOOZb59Q=,iv:z83S5rxzUCnyiVNiioDYXTLH+fXK8N3wNckV8a90PXg=,tag:pRFnhvmI4Rb+UHwzeBEBPg==,type:str] unencrypted_suffix: _unencrypted - version: 3.11.0 + version: 3.13.1 diff --git a/secrets/omega-relay/stalwart16.yaml b/secrets/omega-relay/stalwart16.yaml new file mode 100644 index 0000000..12b88e1 --- /dev/null +++ b/secrets/omega-relay/stalwart16.yaml @@ -0,0 +1,48 @@ +stalwart16: + admin_password: ENC[AES256_GCM,data:jeiP2ZJssGdA9LMFWbZptM4FAH2VpG+8GlkfHMhZKYs=,iv:YZa0fUwdIEkpr+4X6if1CRyDjCfBbccIYM6m6yLHjmw=,tag:3FPDGL0BtgmjWmpMl9Ch1g==,type:str] + admin_user: ENC[AES256_GCM,data:A3/ycNw=,iv:Ebyl9gbqEK9b433UahPjp94/2TpN3AusDtan0GiOo64=,tag:7/qYX8LHkMyz+98TWw448Q==,type:str] + recovery_user: ENC[AES256_GCM,data:+IO6djQ=,iv:AeS8lw1KUE6hjT8F8z9rzsW/SYehyAensjBFgAQosTY=,tag:K5QtrhQoRP0ur4kSrFp9Ow==,type:str] + recovery_password: ENC[AES256_GCM,data:9XeEvrIRMfGznU4uf+cWAtJXUlj0VXggFTFUoFDIhK4=,iv:CHo8CaXDCAHriSyDfmSfeTOf1V9Qg7daMtV1rnK3D8I=,tag:hED15sAgk/5gOnVRyUPPDA==,type:str] + oidc_secret: ENC[AES256_GCM,data:iqDw/wKrkWLGfJCuj8fbc2METbcI/GU1q6LQg2F1t2eVNRXjs0cZWYDVN2XPGcd/IwXsfQ0gVZ8knsKcibUxNclwBj+PSbzi1PrtpmoQray03s/szq8eKg==,iv:yb8eonGjI77kZ2Rb8C4YbiRaTevYDeGkK/2ol/menJ0=,tag:mpV7yTNNzj+apRVNDXSpJA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLeG0xNlFoTHBoSzRKdGxQ + Tk8wSXA0Uks2NUp3ZDRKdHFjSTV5NXkyS0FnCjdVQndjTzlPVWlzN3JVVkc4NTFw + NzFUNnoxb2FOdXdzY1E1aUhzYXpUNFEKLS0tIFdvZC9KQ3RQV1U1eVU0L3NwQWQ0 + aGozUkNYSTFzeFVMUFZremJMV0tlS0EKZ1rTerxX2RXZk9u+lH5kZlQVD8MYD361 + Y7Z/eC11GlZyVg0QOpenouN5bSYtcoOoqP82//xV0a7lU12r7oqr5A== + -----END AGE ENCRYPTED FILE----- + recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhOFhRRXpuaHIxbGcza0k4 + bHgwdm5kWmVRQ01YVkVEQVo3OHA3dUh6OFdBCkdnUmo4azFQNDgyaUhPY3lWSTBz + N3dFSStseVhGeVQ1MkZoNmRYalNSTkkKLS0tIFY4QkVwQmRtczVUamFZUk5acGZ4 + am1uMHRFLzI2eTd0U0l1Q1JTdjUxNUkKoIrdk7URS9+wfOGLcmki6Z15UFNP/Kyd + h5w/TePoAKZEIEdtxDwyM86vI5fgVkXe3S74+bDVD5dK81ax4uvjtA== + -----END AGE ENCRYPTED FILE----- + recipient: age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHWVpLVit1MlVObkt3U01I + REk0aEd2dExQTndrRThIekdUanNVcGpHb1Z3CjV3eTJQeFZaczBSNWx6UDQ2VjJr + Y1h6bWhwR01TWSt2RVMvdmhFZFhRYzAKLS0tIGlpaWZTNGcrREw1WE5mdmw2dWJz + VmZoR0NTVEcxNHFzZmpMSTk1ckswd0UKx9dqX/kESOmU8ENU01sXwTuOLNJ5vOb0 + ExqFy5nilwVeHs1MY7JGRrODGLJF9tlDRmot7IvlrstHelMoaIgKpQ== + -----END AGE ENCRYPTED FILE----- + recipient: age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQbEU0cHhhYVBudXM1QnM5 + SU1zd1V2dFRtUEUvaVFJY1FRV2xVNFd4Tm1vCnliOUZXNFJaU0pLS2VXVWxRTE16 + M3lwaXJWSVFMS2F3R2hWeEp1bmkrTEUKLS0tIDN5cmsreDZCQXRJTmdmVG1ON2NJ + RnFidGhXUzJxWHhhTVFFQnlSUkNlamsKo27Gu0r/yodBHJr+HVQis/Gy5KGUDuAR + 9oP/nCZKl8HPhUB3IWGrBdBiNZrJWeSPKsEDbqgrLzoql4ohIt71Tw== + -----END AGE ENCRYPTED FILE----- + recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4 + lastmodified: "2026-05-31T07:08:36Z" + mac: ENC[AES256_GCM,data:5Nk7dQ4/2nh1guB3Dd5lfhs1bey8cVATg6WoiK5e55DSzcwadsOp/KKjsLV/4sAjnpe+o4IqmeYtz5NafjulBXnEBrfjVrOWEHhg9Vi/4184yVkMAmyUsf3AhaFdH0ipeLQ5DVJgnupilil9gAGTAIDIroWxq24+/97QcKgV0qk=,iv:kPdbrw0CE/fkq7R9KUi/cJnX9jsEDhmvqYZLuDYqq9Y=,tag:LTvBbjJ7zPT5uoMnRUFQkw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/services/bulwark.nix b/services/bulwark.nix index a5f3f87..00198cd 100644 --- a/services/bulwark.nix +++ b/services/bulwark.nix @@ -6,7 +6,7 @@ }: let cfg = config.wilkuu.services.bulwark; - stalwart_cfg = config.wilkuu.services.stalwart; + stalwart_cfg = config.stalwart-nix.stalwart; hostname = config.networking.hostName; # Importing stuff from stalwart and defaults etc. @@ -79,9 +79,6 @@ in groups.bulwark = { }; }; - config.wilkuu.services.stalwart.corsDomains = lib.optionals ( - cfg.enable && stalwart_cfg.enable - ) cfg.domains; config.sops.secrets = ( lib.genAttrs (map toSops secrets) (_name: { sopsFile = sopsPath; diff --git a/services/mail2.nix b/services/mail2.nix index ae4a9eb..e2f041a 100644 --- a/services/mail2.nix +++ b/services/mail2.nix @@ -57,131 +57,26 @@ in config = lib.mkIf cfg.enable ( let - tools = config.stalwart-nix.stalwart.toolbox; sopsPath = ../secrets/${hostname}/stalwart.yaml; secrets = [ "admin_user" "admin_password" "recovery_user" "recovery_password" + "oidc_secret" ]; toSops = (sname: "stalwart16/${sname}"); toPlaceholder = (sname: config.sops.placeholder.${toSops sname}); toCredfilePath = (name: config.sops.secrets.${toSops name}.path); - domain_to_jid = lib.replaceString "." "_"; # We do this to satisfy the foreign key constraint of the SystemSettings singleton - placeholderDomain = "bootstrap-placeholder.home.arpa"; - planPreamble = lib.concatLists [ - (tools.mkIdempotentCreateLine { - "object" = "Domain"; - deleteBy = "name"; - value."#placeholder-domain" = { - name = placeholderDomain; - certificateManagement = { - "@type" = "Manual"; - }; - dnsManagement = { - "@type" = "Manual"; - }; - dkimManagement = { - "@type" = "Manual"; - }; - subAddressing = { - "@type" = "Enabled"; - }; - }; - }) - [ - { - "@type" = "update"; - "object" = "SystemSettings"; - "value" = { - "defaultDomainId" = "#placeholder-domain"; - }; - } - ] - ]; - # TODO: Is this nice, or is using 1 object better? - # This approach makes it more atomic afaik? - domainCreateRules = ( - lib.forEach cfg.domains (domain: { - object = "Domain"; - deleteBy = "name"; - value.${domain_to_jid domain} = { - name = domain; - certificateManagement = { - "@type" = "Manual"; - }; - dnsManagement = { - "@type" = "Manual"; - }; - dkimManagement = { - "@type" = "Manual"; - }; - subAddressing = { - "@type" = "Enabled"; - }; - }; - }) - ); - certificateCreateRules = lib.optionals cfg.doACME ( - lib.forEach (lib.unique ([ cfg.default_domain ] ++ cfg.domains)) ( - (domain: { - object = "Certificate"; - deleteBy = "certificate.filePath"; - value."cert_${domain_to_jid domain}" = { - certificate = { - "@type" = "File"; - filePath = "/run/credentials/stalwart.service/tls_${domain}_cert.pem"; - }; - privateKey = { - "@type" = "File"; - filePath = "/run/credentials/stalwart.service/tls_${domain}_key.pem"; - }; - }; - }) - - ) - ); - baseSetupRules = [ - { - "@type" = "update"; - "object" = "SystemSettings"; - "value" = { - "defaultDomainId" = "#${domain_to_jid (builtins.elemAt cfg.domains 0)}"; - "defaultHostname" = cfg.defaultDomain; - }; - } - { - "@type" = "update"; - "object" = "BlobStore"; - "value" = { - "@type" = "Default"; - }; - } - { - "@type" = "update"; - "object" = "InMemoryStore"; - "value" = { - "@type" = "Default"; - }; - } - { - "@type" = "update"; - "object" = "SearchStore"; - "value" = { - "@type" = "Default"; - }; - } - ]; proxyWellKnown = names: let uris = map (n: "/.well-known/${n}") names; in (lib.genAttrs uris (uri: { - proxyPass = "http://localhost:3080${uri}"; + proxyPass = "http://127.0.0.1:8080${uri}"; recommendedProxySettings = true; })); makeHTTPRedirectBody = target: https: "302 ${if https then "https" else "http"}://${target}"; @@ -236,11 +131,11 @@ in "mail-v1.xml" "autoconfig/mail" "openid-configuration" - "/.well-known/oauth-authorization-server" + "oauth-authorization-server" ]) // (lib.genAttrs [ "/.well-known/caldav/" "/.well-known/webdav/" "/.well-known/jmap" ] (uri: { extraConfig = '' - return ${makeHTTPRedirectBody "${cfg.domain}${uri}" cfg.doACME}; + return ${makeHTTPRedirectBody "${cfg.defaultDomain}${uri}" cfg.doACME}; ''; })); @@ -251,23 +146,24 @@ in enableACME = cfg.doACME; #serverName = "${domain}"; locations."/" = { - proxyPass = "http://localhost:8080"; + proxyPass = "http://127.0.0.1:8080"; proxyWebsockets = true; recommendedProxySettings = true; }; })); - stalwart-nix.stalwart = { + stalwart-nix.stalwart = let + in { enable = cfg.enable; - url = if cfg.startupMode != "normal" then "http://localhost:8080/" else cfg.defaultDomain; + url = if cfg.startupMode != "normal" then "http://127.0.0.1:8080/" else "http://${cfg.defaultDomain}"; credentialsFile = config.sops.templates.stalwart-config-creds.path; recoveryCredentialsFile = config.sops.templates.stalwart-recovery-creds.path; startupMode = cfg.startupMode; user = "stalwart"; group = "stalwart"; - configPlanPre = planPreamble; - idempotentCreate = certificateCreateRules ++ domainCreateRules ++ cfg.extraCreate; - configPlanPost = baseSetupRules ++ cfg.extraConfig; + configPlanPre = []; + idempotentCreate = cfg.extraCreate; + configPlanPost = cfg.extraConfig; credentials = (lib.genAttrs secrets toCredfilePath) // (builtins.foldl' (a: b: a // b) ({ }) ( -- cgit v1.3.1