From 19e3d28ebe310f449f2afcfc2e8412a20798b1d3 Mon Sep 17 00:00:00 2001
From: Pyrox <pyrox@pyrox.dev>
Date: Sat, 28 Sep 2024 11:38:28 -0400
Subject: [PATCH] [systems.prefect] Update mail cert copying to be monthly

---
 .../prefect/services/mailserver/default.nix   | 40 ++++++++++++++-----
 1 file changed, 29 insertions(+), 11 deletions(-)

diff --git a/systems/x86_64-linux/prefect/services/mailserver/default.nix b/systems/x86_64-linux/prefect/services/mailserver/default.nix
index 2b56875e..7367b678 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/default.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/default.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 {
   imports = [
     ./logins.nix
@@ -93,19 +93,37 @@
     certificateFile = "/var/lib/mail/mail.crt";
     keyFile = "/var/lib/mail/mail.key";
   };
-  system.activationScripts = {
-    mail-certs.text = ''
-      # Copy and chown the mail cert
-      cp -fvr /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.pyrox.dev/mail.pyrox.dev.crt /var/lib/mail/mail.crt
-      chmod a+r /var/lib/mail/mail.crt
-      cp -fvr /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.pyrox.dev/mail.pyrox.dev.key /var/lib/mail/mail.key
-      chmod a+r /var/lib/mail/mail.key
-      chown -hR virtualMail:virtualMail /var/lib/mail/
 
-    '';
-  };
   services.opendkim = {
     user = lib.mkForce "virtualMail";
     group = lib.mkForce "virtualMail";
   };
+
+  # Copy mail certs every month so that they don't expire
+  systemd = {
+    timers."copy-mail-certs" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "5m";
+        OnCalendar = "monthly";
+        Unit = "copy-mail-certs.service";
+      };
+    };
+
+    services."copy-mail-certs" = {
+      script = ''
+        set -eu
+        cp -fvr /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.pyrox.dev/mail.pyrox.dev.crt /var/lib/mail/mail.crt
+        chmod a+r /var/lib/mail/mail.crt
+        cp -fvr /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.pyrox.dev/mail.pyrox.dev.key /var/lib/mail/mail.key
+        chmod a+r /var/lib/mail/mail.key
+        chown -hR virtualMail:virtualMail /var/lib/mail/
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+      };
+    };
+  };
+
 }
-- 
2.54.0