From d3087cca6490a340aa9d0710acf3702cb49e956b Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Wed, 13 Aug 2025 21:12:39 -0400
Subject: [PATCH] [prefect.stalwart] more acme stuff

---
 systems/x86_64-linux/prefect/default.nix      |  6 ++--
 .../prefect/secrets/acme-creds.age            | 35 ++++++++++---------
 .../secrets/stalwart-fallback-admin-pw.age    | 35 ++++++++++---------
 .../x86_64-linux/prefect/services/acme.nix    | 27 +++++++++-----
 .../services/mailserver/stalwart/acme.nix     |  2 +-
 .../services/mailserver/stalwart/default.nix  | 28 ++++++++++++---
 .../mailserver/stalwart/signature.nix         |  4 +--
 .../x86_64-linux/prefect/services/secrets.nix |  4 ---
 8 files changed, 84 insertions(+), 57 deletions(-)

diff --git a/systems/x86_64-linux/prefect/default.nix b/systems/x86_64-linux/prefect/default.nix
index 4c60bbcc..650971c8 100644
--- a/systems/x86_64-linux/prefect/default.nix
+++ b/systems/x86_64-linux/prefect/default.nix
@@ -12,8 +12,8 @@
     ./dn42/default.nix
 
     # Running Services
-    # ./services/acme.nix
-    ./services/blog-update.nix
+    ./services/acme.nix
+    # ./services/blog-update.nix
     ./services/caddy.nix
     # ./services/dn42-peerfinder.nix
     ./services/fail2ban.nix
@@ -21,7 +21,7 @@
     ./services/mailserver
     ./services/mailserver/stalwart
     # ./services/netdata.nix
-    ./services/nginx
+    # ./services/nginx
     ./services/prometheus.nix
     ./services/secrets.nix
     ./services/tailscale.nix
diff --git a/systems/x86_64-linux/prefect/secrets/acme-creds.age b/systems/x86_64-linux/prefect/secrets/acme-creds.age
index e4f86ce4..11bfe9fe 100644
--- a/systems/x86_64-linux/prefect/secrets/acme-creds.age
+++ b/systems/x86_64-linux/prefect/secrets/acme-creds.age
@@ -1,19 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 LcWOqQ SK4nXQ08Kdv5W2oFVHMcFL3KkxBqpnFa6T/DmsQROnQ
-Z2haZq1zi+5nwDgD1DaRZN6jfoG8nA7TUm0jeKcsExs
+-> ssh-ed25519 LcWOqQ i/qdqW02ufOTMiy8czjhOa/AJRZTuAFQ5MNrQjNjgXI
+ZcYytLIizQ25y/kwXmYy9q6e4fyvJju1HIYja2ucEcY
 -> ssh-rsa fFaiTA
-diaNjLb29gn/MLR+yPp4I7CxkRLU/2HRTuI0HrWMuLs8GJA5eaBMviuD9mM9onqs
-1QoQYCeN4tVF4+6BNnzqwUcX33VHh03BQuoRP3nkmerL/BGx7Rw42XasP2mvLtco
-uXiKeGg/Hp8LN1nnptgU4d6aMlJ1PUmEFdujp5vDQjUf3uZo6fx92CvYQnOFDrYC
-+SVJhn2DrRBNajwz5SSzdg7dPOQ4EhyG6BFFA1KX0x1lUCoGW1MmOMpI/3P07eEA
-qsiiIhEpON4AXLIy32ipopA3/GH4goT+D1ajN5R321OXmchHHMAnDelF5pgUNTN5
-/GG1SZ6ztaSqHxK3LwLvMKIFTQy+Vk/0suOnWtmiu7zuSWAXJonkDDyWk/A9VIsG
-RX700mmAXGoHNq/TfjU8UkLNez18IxPpuywBncz1tfSCaDduU2Ox+Yp3H0cJWZYs
-eOUD2WX7PTtT3H6vWiMcN1e58bXi18Faa0W9zgI09QHOUtQnNd0m5+saxmAoaPy4
-wiKzjrvgANcDa45RMFGSx94bNLVx4LNbKpEi4oIoTvIIiqyFG3F3BuhGjQfePH8w
-Vd+AkDRFxHyUKRxTUINuocqGnesIy1VazsZGuG7HJvN5vt8ir26SGNfweVOtMmtC
-spk4Cv4R4qOuAc8nifOISlzdvlmzCqCIHeCWf/aN1Dk
--> ssh-ed25519 wpmdHA xDq9RflMMee4GeBllnb5vGbu1GuKQEPyYE7i0xTD3BA
-p2PYAhfBQgfmP+ElVvMp+ZMxF2Kji317X8XID1oryzE
---- e9B9Ypj91p0p2fraHLy6xURke2CvIQcPf8BPUQNjc4c
-��B�X�'Dp���
٭0Tb� ��k�t����F��j�Vn@}H���`�i,������֣Z��Fb9�0)��$Si�c1�3�ɫVc���8^
�:�i��v����,����e�C
\ No newline at end of file
+od7jPtXTEEZ6xYCXScOFmNs1EFThNKoFlw1MRXBmlRW8+PlLyuQ6m3d3DsPpXXdk
+VN/HUF5vSv8pHVXBuoBSCOG5c4uYfN1unsuHkj1R/rnlP7MP8R4KSnzgLWRgRGfg
+xOGXvK+nUDqjEY7SousJ5n4E03FeuiQVrYV/YNZWhTgpuciX3BCcYQkgzZxsUAt/
+tyMpEwGirr2PbAOPzeDN394yNfWQgU5PderJJuyiEywFn8kZJDlZZmex+PBuAzxQ
+XJ+jmi0D7M/FsSzfv/G8xfaWCns/6FIvClK+vIhnInxVHz6aQnGSFHMsNTHaQTzI
++ps6A6cKrCpuhd0nuaibd9WE/EkU54q5lFiUQPVpr+8qBbYD+Jcqk763Z3dGYE6P
+aNL8Xun0HjcifqEs67fsMLmUEnDaI5+xadPW90oCJcDtc/FYtUalUS/sf9LTlbzP
+XOyj2xhRCRl+wxSLhZw28c/3L0eqsDzN3tZzLPHfXn3qR5D4ohfS/Cw5OZHENyrM
+5EpjSPUr0OF7ySL7L2DGAG1zY0FhqcMJgl2ccVhyBzinzPWIEfnc29yrEvwG1ALq
+bOAwDzMrJPhFgnLe4AdAeiOKcdUwa+/5wMepxCuzKyjCvTJxuet367ledF53fLMn
+uXeltHwG5M4kCw7YoFGGoo0y8SrDLJEP78U8gfQEMwU
+-> ssh-ed25519 wpmdHA oU+tow9XZ1O9mtSRV9U8tJGSoKALwBVncVbKQZd37Dc
+ycDQoOW0EjZFTJjA6meC2E5naJrNy7Lg9VS4HlKZStI
+--- nLQZlSx//ps1f1UOReCuNOYtGIP+XJlloVIbkiDNRsU
+Ie�f�_�I���\Ќl,j3�u���E�������k�IZO�G�u���
��y�?���̟�ƨk�
+ޱ?�;��
\ No newline at end of file
diff --git a/systems/x86_64-linux/prefect/secrets/stalwart-fallback-admin-pw.age b/systems/x86_64-linux/prefect/secrets/stalwart-fallback-admin-pw.age
index 798b1cd3..b9cb1719 100644
--- a/systems/x86_64-linux/prefect/secrets/stalwart-fallback-admin-pw.age
+++ b/systems/x86_64-linux/prefect/secrets/stalwart-fallback-admin-pw.age
@@ -1,19 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 LcWOqQ S0HRjqp8jO+XO9hOUAHPqOVWRp094ee/Wf6YXngG6Vc
-SsNb4FTH0zwoJS3eS+A+Eyab2nVGSUfa1nhZsldRKYU
+-> ssh-ed25519 LcWOqQ 7togPtzcJXZIAe+97CEtOpKYvKcXdMPZN1ZXaDtiF2M
+bx4Slxv+LPXPTyjRbl/1fme4nEO2aY9pF6J5ww7k2gQ
 -> ssh-rsa fFaiTA
-G7PhLEp36AwfIC2SZX8xh59JH3o/lzeDPDdhnl0CcO8ZADkE0yVwmZCyyjAq/5O3
-KQF8HrgooLx34ooniGPpPoMAMJttjuNuEKxWlunmhipG8i/5tjzlyILrbqnEX9jc
-MLpUVnjJBOZSqTnin85n5V7nmRghhsLccOLqYEMV91z4tMeB3NOU0ULikLSPXNDM
-V2LOV7fZDaY7CB/vQQdodQ5G8QoM2drk4OLC0tPUk/GsDhcUFN0J2vP5diMpsy5b
-H7X/mDbnqvP6ZSs+vJ8laewzpMbSJXHRlVAlUoirBEAxOw75Zb0Z3N2VXNSkWWJ/
-Tjq5VU/aK5FCIQs9CtFIL5h9Gs7+4ZACHu3KIQJGw3CerjEJE/USEGgkjF05QXAl
-YLF4+SSgA+yknXVb3RnzkDmP2qWrwSIgzTNojtHky61ssuu/HlFa/sDy2qdXmvma
-DNwl43aCpR9AHBLowBuDEd8YOydC4A9hi2KgGg43scUdqEsxkJo72PLHO8RlNqSe
-AYbb/WX8Q5vtuOuf49/7qwO2moyNO306FtO7AXkUb+Kobc8c8ZOaQ8LWOl6nQUn6
-F1f7ifv2tdFGkyaHffCr8BVCH4n4JdzZaR7sxO8vU6aS7CY+c/pRoi9Qy9ROy7EA
-8NhCy3rGNk1KeiK95dZyl+i4SAH4EVlDHjLfRO+9Qvo
--> ssh-ed25519 wpmdHA ZFi1FtljkiRtG24iTzJK6fhen/xAl6ZT/lzVvE3OjRQ
-BXI6c8iY+9f/cbSRKcsX23A68Eo3WbTITemlyTNSzT0
---- xtjZg8c7aBnCM3DiE8PlY/vy2nhGGuS1wadsW9k/gPE
-��oK$�Ċ��i������D캴Mr%�+:|�`k�a�T
�]�f<�}��Q���Am}��=)l�Hl��2����8�՟�
�X���?I����*��OT��i9�\��_y�7��Lo�62�V#���m���n
\ No newline at end of file
+I9AeATPIo5M+Tqd0lbLs37jGa/I/m6C56/vVdVd2r2kH8FobbhFXkypmBfZjleNB
+FqP4Jn12IAWACTY9LEoSrhaeABpdZAUE6Vt+hqYDOc8UL5WuTekVUCW+Sw2EJbnl
+oyBBcTRSuSd3OEO3Q4hp5SmHiGUkL7eDfEdXMXe7fnYEIfJoYu6Op1bLoTK7Tiuz
+g5c7a9kgxcD73ynfeRz0kQM/AXbEXrtu0Wr7CH9ZWWmCkkhcpNnS7CRtTb5Qhk4L
+oTVn+Rs6Mgv395pmV0Ou3fqkys3+t7PdO+tHDtlMNqORn3KaQuPLAWjgBCG1408T
+iGpbkqdoGb3VpBUfw/dWISPrDZsJGcLOFULHX76JKIGQXV/UG8zNlS5lddo7zY7T
+mh8tBqZrj9MWOwkG0nDDV87sEFOqFfj4gclEF5GRE55Sypog6oRZLTVjvH636E+2
+mztdPJyhUzMtvhQQfvftG+AwxhNGt4SRdMd7O+QeYSWmqykTlZx7nF73BBeYP0JC
+xSmVsdxuS3aur2HcogCSICo2+jGGoP33FOYnpzVY/Y67B4tunfL1ItfmbGeKVwG0
+f9sm6meYvRw9JvAdBcqFILOxPvg/P2VARaf5fDpZP6MmRTWkl9FH2J1Wp9m7ZMi3
+m8RAfpH7l5U/vVcbLYUaL5w0e4cNeHBQSbn/AhqCeFQ
+-> ssh-ed25519 wpmdHA rPRuQwrporOZbD6kpZwGZbZoEYNvG7E+t1zDolmwmzE
+CtTiaRwa+S+vn1wrUjkZWatUkLcvXVPQDbsvtwdT7X4
+--- xDaJBT4M3JZNN0aABAp9QnPw7rsl/D9/SRIz0aHEGRE
+��?�%*�N�������"h#_E��:c&��f�d�r��
+��J<Ci����X��g�;�ҏ�
f�\^����Y�q�+��S�{=܀a��L�ն������Vt�n����EXu�hݿZ0�׎����u��+ޖ��
\ No newline at end of file
diff --git a/systems/x86_64-linux/prefect/services/acme.nix b/systems/x86_64-linux/prefect/services/acme.nix
index 2684892a..f23c6d8d 100644
--- a/systems/x86_64-linux/prefect/services/acme.nix
+++ b/systems/x86_64-linux/prefect/services/acme.nix
@@ -1,23 +1,32 @@
 { config, ... }:
 {
   security.acme = {
-    certs."pyrox.dev" = {
-      domain = "*.pyrox.dev";
+    acceptTerms = true;
+    certs."mail.pyrox.dev" = {
+      extraDomainNames = [
+        "mail2.pyrox.dev"
+        "mta-sts.pyrox.dev"
+        "autoconfig.pyrox.dev"
+        "autodiscover.pyrox.dev"
+      ];
+      reloadServices = [ "stalwart-mail.service" ];
     };
     defaults = {
       # LE Production Server
       server = "https://acme-v02.api.letsencrypt.org/directory";
-      # use EC-384 instead of the default, EC-256
-      keyType = "ec384";
       email = "pyrox@pyrox.dev";
-      # Enable OSCP Must-Staple(see https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/ )
-      ocspMustStaple = true;
-      # For DNS Challenges, use ClouDNS(my provider)
-      dnsProvider = "cloudns";
+      # For DNS Challenges, use DeSec(my provider)
+      dnsProvider = "desec";
       # Enable DNS Propagation checks(ensure DNS records exist before requesting certs)
       dnsPropagationCheck = true;
-      # Agenix-encrypted credentials for ClouDNS
+      # Agenix-encrypted credentials for ACME
       credentialsFile = config.age.secrets.acme-creds.path;
+      dnsResolver = "9.9.9.9:53";
     };
   };
+  age.secrets.acme-creds = {
+    file = ../secrets/acme-creds.age;
+    owner = "acme";
+    group = "acme";
+  };
 }
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix
index 686afc60..cd1e49f7 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix
@@ -16,6 +16,6 @@
     renew-before = "30d";
     default = true;
     provider = "desec";
-    secret = "%{file:${sec.stalwart-desec-token.path}}";
+    secret = "%{file:${sec.stalwart-desec-token.path}}%";
   };
 }
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix
index 1b780a49..f13d6e0a 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix
@@ -8,6 +8,8 @@ let
   cfg = config.services.stalwart-mail;
   sec = config.age.secrets;
   creds = config.services.stalwart-mail.credentials;
+  credsDir = "/run/credentials/stalwart-mail.service";
+  certDir = config.security.acme.certs."mail.pyrox.dev".directory;
   isAuthenticated = d: {
     "if" = "!is_empty(authenticated_as)";
     "then" = d;
@@ -26,18 +28,20 @@ let
 in
 {
   services.stalwart-mail = {
+    credentials = {
+      cert = "${certDir}/cert.pem";
+      key = "${certDir}/key.pem";
+    };
     enable = true;
     dataDir = "/var/lib/stalwart";
     settings = {
       tracer.stdout.level = "debug";
       authentication.fallback-admin = {
         user = "fallback";
-        secret = "%{file:${sec.stalwart-fallback-admin-pw.path}}";
+        secret = "%{file:${sec.stalwart-fallback-admin-pw.path}}%";
       };
       config = {
         local-keys = [
-          "!acme.*.eab.*"
-          "acme.*"
           "asn.*"
           "auth.*"
           "authentication.*"
@@ -67,8 +71,24 @@ in
           "spam-filter.*"
         ];
       };
+      certificate = {
+        default = {
+          default = true;
+          cert = "%{file:${credsDir}/cert}%";
+          private-key = "%{file:${credsDir}/key}%";
+          subjects = [
+            "mail.pyrox.dev"
+            "mail2.pyrox.dev"
+            "mta-sts.pyrox.dev"
+            "autoconfig.pyrox.dev"
+            "autodiscover.pyrox.dev"
+          ];
+        };
+      };
       server = import ./server.nix { inherit d; };
-      acme = import ./acme.nix { inherit cfg sec; };
+      # Use NixOS-generated certs now, since stalwart can't do it on its own
+      # (DeSec API Errors abound)
+      # acme = import ./acme.nix { inherit cfg sec; };
       # HTTP Configuration
       # https://stalw.art/docs/http/overview
       http = {
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix
index 64529cd7..6899257d 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix
@@ -21,7 +21,7 @@ in
 {
   rsa = {
     inherit headers;
-    private-key = "%{file:${sec.stalwart-secret-rsa.path}}";
+    private-key = "%{file:${sec.stalwart-secret-rsa.path}}%";
     domain = "pyrox.dev";
     selector = "rsa-default";
     algorithm = "rsa-sha256";
@@ -31,7 +31,7 @@ in
   };
   ed25519 = {
     inherit headers;
-    private-key = "%{file:${sec.stalwart-secret-ed25519.path}}";
+    private-key = "%{file:${sec.stalwart-secret-ed25519.path}}%";
     domain = "pyrox.dev";
     selector = "default";
     algorithm = "ed25519-sha256";
diff --git a/systems/x86_64-linux/prefect/services/secrets.nix b/systems/x86_64-linux/prefect/services/secrets.nix
index cb537da7..9d4ff2ef 100644
--- a/systems/x86_64-linux/prefect/services/secrets.nix
+++ b/systems/x86_64-linux/prefect/services/secrets.nix
@@ -18,9 +18,5 @@
       file = ../secrets/wireguard-priv-key.age;
       path = "/run/agenix/wireguard-priv-key";
     };
-    acme-creds = {
-      file = ../secrets/acme-creds.age;
-      group = "acme";
-    };
   };
 }
-- 
2.51.2