From 4022b9da21896ceb9b49ebef639c39b4b404a9d9 Mon Sep 17 00:00:00 2001 From: dish Date: Fri, 15 Aug 2025 17:14:15 -0400 Subject: [PATCH] [prefect] more fixes because why not --- flake.lock | 17 +++++++++ flake.nix | 1 + systems/x86_64-linux/prefect/default.nix | 11 +++++- .../prefect/secrets/acme-creds.age | 35 +++++++++---------- .../x86_64-linux/prefect/services/acme.nix | 7 ++-- .../services/mailserver/stalwart/default.nix | 8 +++-- .../services/mailserver/stalwart/server.nix | 1 + systems/x86_64-linux/zaphod/misc.nix | 2 +- 8 files changed, 57 insertions(+), 25 deletions(-) diff --git a/flake.lock b/flake.lock index ee0a170d..a092c4bf 100644 --- a/flake.lock +++ b/flake.lock @@ -908,6 +908,22 @@ "type": "github" } }, + "nixpkgs-stalwart-fix": { + "locked": { + "lastModified": 1755293787, + "narHash": "sha256-L+msFwg9jXAj4JmDFQF9BIg2kQhgUzexVmDYePfKMW8=", + "owner": "pyrox0", + "repo": "nixpkgs", + "rev": "52f6d43ca3db097cde5d0bfb30db0af5bdf41103", + "type": "github" + }, + "original": { + "owner": "pyrox0", + "ref": "fix/stalwart-module", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs_2": { "locked": { "lastModified": 1747179050, @@ -988,6 +1004,7 @@ "nix-search": "nix-search", "nixpkgs": "nixpkgs_4", "nixpkgs-lib": "nixpkgs-lib", + "nixpkgs-stalwart-fix": "nixpkgs-stalwart-fix", "snowfall-lib": "snowfall-lib", "stable": "stable", "systems": "systems_2", diff --git a/flake.nix b/flake.nix index 31e2410f..848ea1eb 100644 --- a/flake.nix +++ b/flake.nix @@ -25,6 +25,7 @@ inputs.flake-compat.follows = "flake-compat"; }; nixpkgs.url = "https://nixpkgs.dev/channel/nixpkgs-unstable"; + nixpkgs-stalwart-fix.url = "github:pyrox0/nixpkgs/fix/stalwart-module"; stable.url = "github:nixos/nixpkgs/nixos-24.05"; # Overrides flake-compat.url = "github:edolstra/flake-compat"; diff --git a/systems/x86_64-linux/prefect/default.nix b/systems/x86_64-linux/prefect/default.nix index 650971c8..ef4c8e06 100644 --- a/systems/x86_64-linux/prefect/default.nix +++ b/systems/x86_64-linux/prefect/default.nix @@ -1,6 +1,15 @@ -{ pkgs, system, ... }: { + pkgs, + system, + inputs, + ... +}: +{ + disabledModules = [ + "services/mail/stalwart-mail.nix" + ]; imports = [ + "${inputs.nixpkgs-stalwart-fix}/nixos/modules/services/mail/stalwart-mail.nix" # Machine-specific configurations. ./bootloader.nix ./firewall.nix diff --git a/systems/x86_64-linux/prefect/secrets/acme-creds.age b/systems/x86_64-linux/prefect/secrets/acme-creds.age index 11bfe9fe..bb47e00b 100644 --- a/systems/x86_64-linux/prefect/secrets/acme-creds.age +++ b/systems/x86_64-linux/prefect/secrets/acme-creds.age @@ -1,20 +1,19 @@ age-encryption.org/v1 --> ssh-ed25519 LcWOqQ i/qdqW02ufOTMiy8czjhOa/AJRZTuAFQ5MNrQjNjgXI -ZcYytLIizQ25y/kwXmYy9q6e4fyvJju1HIYja2ucEcY +-> ssh-ed25519 LcWOqQ W9y79zRYtD++Eh6rHy123fXPpbjF/VKym6yKbiJdeko +RblRsoHs16Zi2sG3wqdcW60hRUWG2QQQS/Rvro5fPlk -> ssh-rsa fFaiTA -od7jPtXTEEZ6xYCXScOFmNs1EFThNKoFlw1MRXBmlRW8+PlLyuQ6m3d3DsPpXXdk -VN/HUF5vSv8pHVXBuoBSCOG5c4uYfN1unsuHkj1R/rnlP7MP8R4KSnzgLWRgRGfg -xOGXvK+nUDqjEY7SousJ5n4E03FeuiQVrYV/YNZWhTgpuciX3BCcYQkgzZxsUAt/ -tyMpEwGirr2PbAOPzeDN394yNfWQgU5PderJJuyiEywFn8kZJDlZZmex+PBuAzxQ -XJ+jmi0D7M/FsSzfv/G8xfaWCns/6FIvClK+vIhnInxVHz6aQnGSFHMsNTHaQTzI -+ps6A6cKrCpuhd0nuaibd9WE/EkU54q5lFiUQPVpr+8qBbYD+Jcqk763Z3dGYE6P -aNL8Xun0HjcifqEs67fsMLmUEnDaI5+xadPW90oCJcDtc/FYtUalUS/sf9LTlbzP -XOyj2xhRCRl+wxSLhZw28c/3L0eqsDzN3tZzLPHfXn3qR5D4ohfS/Cw5OZHENyrM -5EpjSPUr0OF7ySL7L2DGAG1zY0FhqcMJgl2ccVhyBzinzPWIEfnc29yrEvwG1ALq -bOAwDzMrJPhFgnLe4AdAeiOKcdUwa+/5wMepxCuzKyjCvTJxuet367ledF53fLMn -uXeltHwG5M4kCw7YoFGGoo0y8SrDLJEP78U8gfQEMwU --> ssh-ed25519 wpmdHA oU+tow9XZ1O9mtSRV9U8tJGSoKALwBVncVbKQZd37Dc -ycDQoOW0EjZFTJjA6meC2E5naJrNy7Lg9VS4HlKZStI ---- nLQZlSx//ps1f1UOReCuNOYtGIP+XJlloVIbkiDNRsU -Ie�f�_�I���\Ќl,j3�u���E�������k�IZO�G�u�����y�?���̟�ƨk� -ޱ?�;�� \ No newline at end of file +gfo7VZ2QjUSHTSuY5fL9clW/RwnMLbFEBcM6tGwXdaJBtnGJiK3TE/haiX078y9l +Yw8qA04rQ0d4PSN2aUvLhbj1la8WfkutwZM1E4otuiI0waPLVBK7lyImSucMJVRW +ZyYJuRUNAbyGZcj6qrbTPOK2qv4NORbVNJrXA5utUOn7+SimpifUcN60mSY1LTXG +AmWa+qo7iWTkSngEG+ZaqnCqKRBGn9j3b9h925ah13PKaP9Y1g3L2EtSj/Z0BMPS +PGTuObBgc1a+mQswcDY1tLq2gdohPAoRV/6djRdL7cnkVK3gcrPq+qca6Vy4xV1N +w1IPPb4TTEPuTdqJRHQ/56b3QK9+ahpDUQMfUGcJ7nQeVqYksu8fbEhkCNTW2nK7 +Z+XC9BbksI/xlIC0t7HjMf99c2rLxbBY3lkh8EiH3vlCEURAqbAw4yRjSeUU24SP +ieEI3fFp1ShFxVKQ15mcICGD6bCK55S7lk6RFYMsPFn+gaNWpy1k6KPPom6Bw0pf +uHQ2Mc8eTPe6pmeLkV133TIvf5fWZTpOaw9fV9DLyggd04yTYsfbn2g7TBEC/PaK +9UjuxtlyZOLWzvoa6leKhqJDhJnQcYKSXGczjMtWzwwdhDlK7gM84uSw/NHjc/uP +mswdQXpTIZ3AawGtgJy1hx0gxOBNNTJTu3T0kR2TP9E +-> ssh-ed25519 wpmdHA QHgeXP4+KHH7z+oNDoJiQx2W5rywdt8ufTFqMKJSAg4 +8Ws80AAf/4LYBu+BIxFaCf5+X6STrurg2Oel8wQ4LVI +--- gtLhAHFMWYrIqO7DB2HyBXvh3rFaTY9T99R/1Nn8Jq0 +(�h�=gx��:�d9�y��^c�m��2b��$�� K�M3:�f*�VH�8�h��9��!� i�U����k?�� \ No newline at end of file diff --git a/systems/x86_64-linux/prefect/services/acme.nix b/systems/x86_64-linux/prefect/services/acme.nix index f23c6d8d..a6d4ac2e 100644 --- a/systems/x86_64-linux/prefect/services/acme.nix +++ b/systems/x86_64-linux/prefect/services/acme.nix @@ -2,14 +2,15 @@ { security.acme = { acceptTerms = true; - certs."mail.pyrox.dev" = { + certs."pyroxdev-mail" = { + domain = "mail.pyrox.dev"; extraDomainNames = [ "mail2.pyrox.dev" "mta-sts.pyrox.dev" "autoconfig.pyrox.dev" "autodiscover.pyrox.dev" ]; - reloadServices = [ "stalwart-mail.service" ]; + reloadServices = [ "stalwart-mail" ]; }; defaults = { # LE Production Server @@ -19,9 +20,9 @@ dnsProvider = "desec"; # Enable DNS Propagation checks(ensure DNS records exist before requesting certs) dnsPropagationCheck = true; + dnsResolver = "9.9.9.9:53"; # Agenix-encrypted credentials for ACME credentialsFile = config.age.secrets.acme-creds.path; - dnsResolver = "9.9.9.9:53"; }; }; age.secrets.acme-creds = { diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix index f13d6e0a..e15200e7 100644 --- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix +++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix @@ -9,7 +9,7 @@ let sec = config.age.secrets; creds = config.services.stalwart-mail.credentials; credsDir = "/run/credentials/stalwart-mail.service"; - certDir = config.security.acme.certs."mail.pyrox.dev".directory; + certDir = config.security.acme.certs."pyroxdev-mail".directory; isAuthenticated = d: { "if" = "!is_empty(authenticated_as)"; "then" = d; @@ -35,7 +35,7 @@ in enable = true; dataDir = "/var/lib/stalwart"; settings = { - tracer.stdout.level = "debug"; + tracer.stdout.level = "info"; authentication.fallback-admin = { user = "fallback"; secret = "%{file:${sec.stalwart-fallback-admin-pw.path}}%"; @@ -192,6 +192,10 @@ in }; }; }; + systemd.services.stalwart-mail.serviceConfig = { + Restart = lib.mkForce "always"; + RestartSec = lib.mkForce 1; + }; age.secrets = { stalwart-secret-rsa = smSecret // { file = ../../../secrets/stalwart-secret-rsa.age; diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/server.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/server.nix index 539da5b8..7daa4d1e 100644 --- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/server.nix +++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/server.nix @@ -64,5 +64,6 @@ proxy.trusted-networks = [ "fd7a:115c:a1e0::/48" "100.64.0.0/10" + "127.0.0.1/8" ]; } diff --git a/systems/x86_64-linux/zaphod/misc.nix b/systems/x86_64-linux/zaphod/misc.nix index a1aac68f..15df948b 100644 --- a/systems/x86_64-linux/zaphod/misc.nix +++ b/systems/x86_64-linux/zaphod/misc.nix @@ -21,7 +21,7 @@ # systemd.tmpfiles.rules = ["L+ /lib64 - - - - /run/current-system/sw/lib64"]; virtualisation.virtualbox = { - host.enable = true; + host.enable = false; host.enableExtensionPack = false; guest = { enable = false; -- 2.51.2