chore: merge mail into main

feat(bomba): add mail

flake.lock

@@ -46,6 +46,22 @@
         "type": "github"
       }
     },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
     "client-ts-generator-src": {
       "flake": false,
       "locked": {
@@ -94,6 +110,22 @@
         "type": "github"
       }
     },
+    "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
@@ -191,6 +223,31 @@
         "type": "github"
       }
     },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "simple-mailserver",
+          "flake-compat"
+        ],
+        "nixpkgs": [
+          "simple-mailserver",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784288435,
+        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -394,6 +451,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1786548149,
+        "narHash": "sha256-pBv1JbhCqqMcF5ciyLi8D9nzVyw4Gv2sk/tcGF4mBHA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "5df1f9ae934fe1bffbd3867a1ae2870ab22302ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixvim": {
       "inputs": {
         "flake-utils": "flake-utils_2",
@@ -515,9 +588,31 @@
         "nixpkgs-my-features": "nixpkgs-my-features",
         "nixvim": "nixvim",
         "noctalia": "noctalia",
+        "simple-mailserver": "simple-mailserver",
         "sops-nix": "sops-nix"
       }
     },
+    "simple-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat_3",
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1786567397,
+        "narHash": "sha256-H713vbgy+n1asVNn/0kBwbFgroNgC1dnx8pEMKcFdgk=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "e668474df221aeef1ebd374d0364aa07f1d4f827",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -4,6 +4,7 @@
     nixpkgs-25-11.url = "github:nixos/nixpkgs/nixos-25.11";
     nixpkgs-my-features.url = "github:Superredstone/nixpkgs/my-features";
     nix-cachyos-kernel.url = "github:xddxdd/nix-cachyos-kernel/release";
+    simple-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -42,6 +43,7 @@
       noctalia,
       nixflix,
       authentik-nix,
+      simple-mailserver,
       ...
     }@inputs:
     let
@@ -56,6 +58,7 @@
           nixvim
           sops-nix
           noctalia
+          simple-mailserver
           inputs
           nixpkgs
           nixpkgs-25-11
@@ -93,6 +96,7 @@
         additionalModules = [
           nixflix.nixosModules.default
           authentik-nix.nixosModules.default
+          simple-mailserver.nixosModules.default
         ];
       };
       nixosConfigurations."frog" = mkSystem "frog" {

lib/mksystem.nix

@@ -4,6 +4,7 @@
   nixvim,
   sops-nix,
   noctalia,
+  simple-mailserver,
   inputs,
   nixpkgs,
   nixpkgs-25-11,
@@ -32,6 +33,7 @@ let
       workSystem
       enableZram
       nixvim
+      simple-mailserver
       sops-nix
       noctalia
       inputs

machines/bomba/secrets.nix

@@ -1,4 +1,4 @@
-{... }:
+{ ... }:
 {
   sops =
     let
@@ -27,6 +27,7 @@
         authentik_env = default;
         vaultwarden_env = default;
         vikunja_env = default;
+        mail_password = default;
       };
     };
 }

machines/bomba/services/caddy.nix

@@ -22,6 +22,10 @@
           root /var/www/patrickcanal.it/public
           file_server
         '';
+        "mail.patrickcanal.it".extraConfig = ''
+          root /var/www/patrickcanal.it/public
+          file_server
+        '';
         "vaultwarden.patrickcanal.it".extraConfig = ''
           encode zstd gzip
           reverse_proxy :8003 {

machines/bomba/services/default.nix

@@ -8,6 +8,7 @@
     ./fail2ban.nix
     ./gitea.nix
     ./homebox.nix
+    ./mail.nix
     ./navidrome.nix
     ./nextcloud.nix
     ./nixflix.nix

machines/bomba/services/mail.nix

@@ -0,0 +1,36 @@
+{ config, ... }:
+let
+  fqdn = "mail.patrickcanal.it";
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    certs."mail.patrickcanal.it" = {
+      webroot = "/var/www/patrickcanal.it/public/";
+    };
+  };
+
+  mailserver = {
+    enable = true;
+    stateVersion = 5;
+    fqdn = fqdn;
+    domains = [ "patrickcanal.it" ];
+
+    # Reference the existing ACME configuration created by nginx
+    x509.useACMEHost = fqdn;
+
+    # A list of all login accounts. To create the password hashes, use
+    # nix-shell -p mkpasswd --run 'mkpasswd -s'
+    accounts = {
+      "me@patrickcanal.it" = {
+        hashedPassword = "$y$j9T$zEKbsELY3HcPZq9CH6bSe0$T9syGTl9haNhjS5SNjDbrY5uoN5z/LCYEmbFowFcAP/";
+
+        # Additional addresses delivered to this mailbox
+        aliases = [
+          "postmaster@patrickcanal.it"
+          "io@patrickcanal.it"
+        ];
+      };
+    };
+  };
+}

secrets/bomba.sops.yaml

@@ -10,6 +10,7 @@ prowlarr_api_key: ENC[AES256_GCM,data:UDpnqIP64k8Qt9k/sjbESNostFiGHfLo3CEYfyWppH
 seerr_api_key: ENC[AES256_GCM,data:KDQxxo2W4tz9UokscAUSz7pf7wY2AfsEQpZh2aXGjsQOBgSLt1DEe5LUxealBZju8gabhp4sNGFvp0+ioZpfkg==,iv:V/rbR6bZtVnDhLLVmygGyTf5Ujm8sb2xHy4JuvLiiV8=,tag:MxGzXHbZWgu3H+ICS2tSNQ==,type:str]
 indexers_ilcorsaroblu_password: ENC[AES256_GCM,data:w3CIGQqLxHEkUHvscZc=,iv:fjsB3zt4Z43MKRECjpa7+gNDzM8D+JK0sbKt2P+Hdiw=,tag:KvLawon+KfrhGmi1TWRHLw==,type:str]
 gitea_registration_token: ENC[AES256_GCM,data:aHoUBwPXtlme9RgGObwWt1V90JU5qeVBUtpINrb1hY6XjKi4+kLxAg==,iv:zkgDdx82Lku7/oNIoSoKUIrxvZuyPaGUI411V/rkW9c=,tag:0eBC0Kd71UwokH9scs/AKA==,type:str]
+mail_password: ENC[AES256_GCM,data:fznlr+Mzu+cpHsLN8EYx6g==,iv:s/DidEGNar4jGHGcbXsysZ2grpwVO1T2Zd+jksb90T8=,tag:LgJ7r+stG7QCpX9n/UZUsA==,type:str]
 navidrome_env: ENC[AES256_GCM,data:SjEg735zoiWNjp0+uYi5CyLadDd7mSXpG1LInLsaqESz0LNgMi+r46ohPjpEC3GD+WbE9D3XRwhB22oIey3K7p3GdB/bYjIR6wOa8MVjj3EDvzdBWbnhkXsGnIhLGuyZwDmMdA==,iv:gHv7lZzU09V3XVjs3nEOEm55xRwD23+sVWfgbuX18p4=,tag:8UAMIGXPGobQfBAao2nI6Q==,type:str]
 yamtrack_env: ENC[AES256_GCM,data:fUaM7prLhu7aJQbWimzjPWmSD7SiCFTiXaWz4Ep34EadofCXvrBKnUa8ZDOSX9mw1PUAdqbao8l1TbA6LieV1ywW4VqC7+fUyJsfOhjRqtg+ud286UilIrMTcU/bodcKxbzxIjG9HMJ4HVs+hNnrVm4SUaloueXZm6pT0iB4Pm3ygXb/NjyBR5PdGc3MiJ0kJ4OvrLzMXYipdFTVqGvgiKazQm37ug3JFw+UjpRanYLlGT+q/aC0Km+UK41CQjvB06N8jwfd3vFWIxKHtWTfMaiJAarwSh6320lQWj5bIkbK5p4TXgqy+UgBqwEt6eWDbeZ5L46covfUi2ZUCDMBYSslFK5cYqaOvfRb0VO1nb+06djBi1WvuVR4i6PkNpyb5PGZa9f2cZB8yqXaUGNJQaut+nu7G8t8YWFlTP78fXAHOyd4kfCFot68LYJ1Vjo08v6SnUuF8JA+tmBOddBPpyO15IP5Ln7mEfinAhYRI7MACO/uOcfRX4ydcyHdELwKwM1hY69c8Ph2++1pkzJOtnSco1iJD07JreMTlOSyT7Y5Q96jR6OZdbPQ0KgoCQNjeRfoQlo2cRBwrCyvNb/Ajy2eW8JgRnY/U+SV+JkmjqrUh740sNbD0CNfFCOvvyIn9pSqQBkezfrqDKUznF6jMMATTdG75XMynbvS3RKfv/pd6ZR+m0DMFuWvvmL5cfjYsAe+M46TtfpHipCB+rxt27gn8+WN3o1cIm5OCsWK3bY51+pFFNr8P/S2kXPyRmq7B7GjLxfMBBYpERSPgzy1vTdpx+n1bREoFPll2d3KWSceVd+2izdj2S14ONPP/Ov4ImpIQQche1/Avaem6A/Go+y8Lpmnjp8/9ATwz3/b3RkbupX0bQy6y4gDg/V5bByaTpmb8Uh8,iv:rHGqUoLl6iJ1+LDHSuDFuIsl/YLlb75lUwl8gaxV79c=,tag:GVet48AfHBX5IXa/u1wXFA==,type:str]
 authentik_env: ENC[AES256_GCM,data:kAva3C4pWZ4+BFhGbbq9j1rSXeldb+NAwU16aZUD7wiw8k7Sg0kVq/43rj1HtR2ZTQY6DxhPlsK5I7opVAg953GwN0kTErpuhKLRWaRGSb8rC8kkxnY=,iv:X61qSjH18KQRWNOtYq1o8IZmY6Dz4TrJzehJWxE7b2o=,tag:mifmD1C3A+XSQveLviLt2w==,type:str]
@@ -26,7 +27,7 @@ sops:
             ZQ17gIIOjhKHlGx8Lo5t/PekzFyQKCKdijS7caq74dVib1vO3tk+uQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx
-    lastmodified: "2026-07-24T19:39:25Z"
-    mac: ENC[AES256_GCM,data:Gs/dqDo+NRqAb8H+L2WHuBQYisC4NEJ/zEJPSOcA8pdpdjxAbJ/Pqq/yQ4WDc/59w7pu13dddA7JmDv7sSwAmfSHVNB7JRWhfVm7YG7L5/6vSi5NG3OgJeQYcLYYJzfDK3f1FJkMe9OKV02mSZ2531AdCJmEa4URjkgXZoY8QDY=,iv:WGRxhf0A6ddi39xNlkE3yB+PybrAkZP0N1ulzA/sWvY=,tag:kW3MyTLVNaQE0M5mndurTA==,type:str]
+    lastmodified: "2026-08-16T15:41:59Z"
+    mac: ENC[AES256_GCM,data:JCmj1SmD62xYMckWkfereDLbWg5NnEGO53diijpFNtsJbHQqnoCRIekQNq53FOpHBUadl7Qjz2snjsd0a5NzFaV5jP4WXqFKpSuFE4BK16Xj15v/HSUSwYc0APKCMwFeX7Oeu39iQNgsQ/quOQy8LRQcX8ck99NCVBPV8xeqfIo=,iv:FGk3Y/GuFNPCZ4L04+ygvM+2LJQvn3f7uRvArhpbQ14=,tag:UTU2Fjj2gJl7Og2r45+jwQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.2
+    version: 3.13.3