From 6708d31eeec7dd19cfac5a7dbf469812436acfb9 Mon Sep 17 00:00:00 2001 From: Jakub Stachurski Date: Sat, 18 Apr 2026 15:14:14 +0200 Subject: Nix flake update - Remove GTK theming for now - Add cors for email - Uninstall iamb due to build errors --- home-modules/apps/default.nix | 2 +- home-modules/apps/nvim/default.nix | 1 - home-modules/theming.nix | 17 ++++--------- hosts/apocalypse/nvidia.nix | 2 +- hosts/omega-relay/default.nix | 4 +++ services/email.nix | 52 +++++++++++++++++++++++++++++++++++--- 6 files changed, 59 insertions(+), 19 deletions(-) diff --git a/home-modules/apps/default.nix b/home-modules/apps/default.nix index 940573a..13d5fc4 100644 --- a/home-modules/apps/default.nix +++ b/home-modules/apps/default.nix @@ -73,7 +73,7 @@ in }) (lib.mkIf cfg.comms.enable { home.packages = with pkgs; [ - iamb + # iamb # does not compile for some reason ]; }) (lib.mkIf cfg.utils.enable { diff --git a/home-modules/apps/nvim/default.nix b/home-modules/apps/nvim/default.nix index fc73d2d..af95c9b 100644 --- a/home-modules/apps/nvim/default.nix +++ b/home-modules/apps/nvim/default.nix @@ -55,7 +55,6 @@ in nixfmt # phpactor pyright - nodePackages.intelephense texlive.combined.scheme-medium texlab mermaid-cli diff --git a/home-modules/theming.nix b/home-modules/theming.nix index 15b596b..d6cdaf7 100644 --- a/home-modules/theming.nix +++ b/home-modules/theming.nix @@ -4,23 +4,16 @@ lib, ... }: -let - catppuccin_gtk = pkgs.catppuccin-gtk.override { - accents = [ "pink" ]; - size = "compact"; - tweaks = [ "black" ]; - variant = "mocha"; - }; -in { config = lib.mkIf hostconfig.addons.desktop.enable { #Gtk Theming gtk = { enable = true; - theme = { - package = catppuccin_gtk; - name = "catppuccin-mocha-pink-compact+black"; - }; + # theme = { + # package = catppuccin_gtk; + # name = "catppuccin-mocha-pink-compact+black"; + # }; + gtk4.theme = null; iconTheme = { package = pkgs.catppuccin-papirus-folders; name = "Papirus-Dark"; diff --git a/hosts/apocalypse/nvidia.nix b/hosts/apocalypse/nvidia.nix index db2e80a..7f1cb9f 100644 --- a/hosts/apocalypse/nvidia.nix +++ b/hosts/apocalypse/nvidia.nix @@ -40,7 +40,7 @@ nvidiaSettings = true; # Optionally, you may need to select the appropriate driver version for your specific GPU. - package = config.boot.kernelPackages.nvidiaPackages.production; + package = config.boot.kernelPackages.nvidiaPackages.legacy_580; prime = { offload = { diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index 17d004f..9932da2 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -51,6 +51,10 @@ ]; additionalDomains = [ "mail.wilkuu.nl" ]; doACME = !isVM; + corsDomains = [ + "qtab.wilkuu.nl" + "qtab-dev.wilkuu.nl" + ]; }; continuwuity = { enable = true; diff --git a/services/email.nix b/services/email.nix index 7966d8f..3a8c6da 100644 --- a/services/email.nix +++ b/services/email.nix @@ -31,6 +31,18 @@ in default = "/srv/data/stalwart"; example = "/srv/data/stalwart"; }; + stateVersion = mkOption { + type = types.str; + description = "The nixos version which is the version you started stalwart for the first time."; + example = "25.11"; + default = "25.11"; + }; + corsDomains = mkOption { + type = types.listOf types.str; + description = "List of domains that are permitted by cors"; + example = [ ]; + default = [ ]; + }; }; config = lib.mkIf cfg.enable ( @@ -61,6 +73,37 @@ in return = "302 ${if https then "https" else "http"}://${target}"; }; + # TODO: Move to a util + # TODO: Make it so the user can define the method for each origin. + nginxDomainRegex = domain: "~^https://${lib.escapeRegex domain}"; + nginxCorsMap = name: domains: '' + map $http_origin $cors_${name} { + default ""; + ${lib.concatLines (builtins.map (d: " ${nginxDomainRegex d} $http_origin;") domains)} + } + ''; + read_only_methods = "GET, OPTIONS"; + rest_methods = read_only_methods + "POST, PUT, DELETE"; + webdav_methods = "PROPFIND, PROPPATCH ,COPY, LOCK, UNLOCK, MKCOL, MOVE"; + all_methods = rest_methods + webdav_methods; + + # Source https://enable-cors.org/server_nginx.html feat. ClankGPT + nginxCorsBlock = name: _allowed_methods: '' + if $cors_${name} != "" { + add_header 'Vary' 'Origin' always; + add_header 'Access-Control-Allow-Origin' $cors_${name} always; + add_header 'Access-Control-Allow-Methods' '$allowed_methods'; + add_header 'Access-Control-Allow-Credentials' 'true always'; + add_header 'Access-Control-Allow-Headers' 'DNT, User-Agent, X-Requested-With, If-Modified-Since,Cache-Control,Content-Type,Range,Authorization'; + } + if ($request_method = OPTIONS) { + add_header 'Access-Control-Max-Age' 86400; + add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Length' 0; + return 204; + } + ''; + in { networking.hosts = { @@ -89,12 +132,11 @@ in (lib.genAttrs cfg.wellKnownDomains (_wdomain: { locations = (proxyWellKnown [ - "jmap" "mta-sts.txt" "mail-v1.xml" "autoconfig/mail" ]) - // (lib.genAttrs [ "/.well-known/caldav/" "/.well-known/webdav/" ] ( + // (lib.genAttrs [ "/.well-known/caldav/" "/.well-known/webdav/" "/.well-known/jmap" ] ( uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME )); })) @@ -104,13 +146,15 @@ in serverName = "${domain}"; locations."/" = { proxyPass = "http://localhost:3080"; + proxyWebsockets = true; recommendedProxySettings = true; + extraConfig = nginxCorsBlock "stalwart" all_methods; }; })); + services.nginx.appendHttpConfig = nginxCorsMap "stalwart" cfg.corsDomains; services.stalwart = { - enable = true; - dataDir = cfg.dataDir; + inherit (cfg) stateVersion dataDir enable; # Note set this to something else if you were to copy this module. openFirewall = false; credentials = (lib.genAttrs secrets toCredfilePath) -- cgit v1.3.1