diff --git a/flake.lock b/flake.lock index 548d052..2bae8fd 100644 --- a/flake.lock +++ b/flake.lock @@ -46,6 +46,22 @@ "type": "github" } }, + "blobs": { + "flake": false, + "locked": { + "lastModified": 1604995301, + "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=", + "owner": "simple-nixos-mailserver", + "repo": "blobs", + "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265", + "type": "gitlab" + }, + "original": { + "owner": "simple-nixos-mailserver", + "repo": "blobs", + "type": "gitlab" + } + }, "client-ts-generator-src": { "flake": false, "locked": { @@ -94,6 +110,22 @@ "type": "github" } }, + "flake-compat_3": { + "flake": false, + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "NixOS", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "NixOS", + "repo": "flake-compat", + "type": "github" + } + }, "flake-parts": { "inputs": { "nixpkgs-lib": "nixpkgs-lib" @@ -191,6 +223,31 @@ "type": "github" } }, + "git-hooks": { + "inputs": { + "flake-compat": [ + "simple-mailserver", + "flake-compat" + ], + "nixpkgs": [ + "simple-mailserver", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1784288435, + "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=", + "owner": "cachix", + "repo": "git-hooks.nix", + "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "git-hooks.nix", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -394,6 +451,22 @@ "type": "github" } }, + "nixpkgs_5": { + "locked": { + "lastModified": 1786548149, + "narHash": "sha256-pBv1JbhCqqMcF5ciyLi8D9nzVyw4Gv2sk/tcGF4mBHA=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "5df1f9ae934fe1bffbd3867a1ae2870ab22302ed", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable-small", + "repo": "nixpkgs", + "type": "github" + } + }, "nixvim": { "inputs": { "flake-utils": "flake-utils_2", @@ -515,9 +588,31 @@ "nixpkgs-my-features": "nixpkgs-my-features", "nixvim": "nixvim", "noctalia": "noctalia", + "simple-mailserver": "simple-mailserver", "sops-nix": "sops-nix" } }, + "simple-mailserver": { + "inputs": { + "blobs": "blobs", + "flake-compat": "flake-compat_3", + "git-hooks": "git-hooks", + "nixpkgs": "nixpkgs_5" + }, + "locked": { + "lastModified": 1786567397, + "narHash": "sha256-H713vbgy+n1asVNn/0kBwbFgroNgC1dnx8pEMKcFdgk=", + "owner": "simple-nixos-mailserver", + "repo": "nixos-mailserver", + "rev": "e668474df221aeef1ebd374d0364aa07f1d4f827", + "type": "gitlab" + }, + "original": { + "owner": "simple-nixos-mailserver", + "repo": "nixos-mailserver", + "type": "gitlab" + } + }, "sops-nix": { "inputs": { "nixpkgs": [ diff --git a/flake.nix b/flake.nix index 2b31552..8a06134 100644 --- a/flake.nix +++ b/flake.nix @@ -4,6 +4,7 @@ nixpkgs-25-11.url = "github:nixos/nixpkgs/nixos-25.11"; nixpkgs-my-features.url = "github:Superredstone/nixpkgs/my-features"; nix-cachyos-kernel.url = "github:xddxdd/nix-cachyos-kernel/release"; + simple-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver"; home-manager = { url = "github:nix-community/home-manager"; inputs.nixpkgs.follows = "nixpkgs"; @@ -42,6 +43,7 @@ noctalia, nixflix, authentik-nix, + simple-mailserver, ... }@inputs: let @@ -56,6 +58,7 @@ nixvim sops-nix noctalia + simple-mailserver inputs nixpkgs nixpkgs-25-11 @@ -93,6 +96,7 @@ additionalModules = [ nixflix.nixosModules.default authentik-nix.nixosModules.default + simple-mailserver.nixosModules.default ]; }; nixosConfigurations."frog" = mkSystem "frog" { diff --git a/lib/mksystem.nix b/lib/mksystem.nix index b348416..0a4112f 100644 --- a/lib/mksystem.nix +++ b/lib/mksystem.nix @@ -4,6 +4,7 @@ nixvim, sops-nix, noctalia, + simple-mailserver, inputs, nixpkgs, nixpkgs-25-11, @@ -32,6 +33,7 @@ let workSystem enableZram nixvim + simple-mailserver sops-nix noctalia inputs diff --git a/machines/bomba/secrets.nix b/machines/bomba/secrets.nix index bc0297b..549e09b 100644 --- a/machines/bomba/secrets.nix +++ b/machines/bomba/secrets.nix @@ -1,4 +1,4 @@ -{... }: +{ ... }: { sops = let @@ -27,6 +27,7 @@ authentik_env = default; vaultwarden_env = default; vikunja_env = default; + mail_password = default; }; }; } diff --git a/machines/bomba/services/caddy.nix b/machines/bomba/services/caddy.nix index fa17c54..9b83fca 100644 --- a/machines/bomba/services/caddy.nix +++ b/machines/bomba/services/caddy.nix @@ -22,6 +22,10 @@ root /var/www/patrickcanal.it/public file_server ''; + "mail.patrickcanal.it".extraConfig = '' + root /var/www/patrickcanal.it/public + file_server + ''; "vaultwarden.patrickcanal.it".extraConfig = '' encode zstd gzip reverse_proxy :8003 { diff --git a/machines/bomba/services/default.nix b/machines/bomba/services/default.nix index a0af7ec..8f98831 100644 --- a/machines/bomba/services/default.nix +++ b/machines/bomba/services/default.nix @@ -8,6 +8,7 @@ ./fail2ban.nix ./gitea.nix ./homebox.nix + ./mail.nix ./navidrome.nix ./nextcloud.nix ./nixflix.nix diff --git a/machines/bomba/services/mail.nix b/machines/bomba/services/mail.nix new file mode 100644 index 0000000..c54debe --- /dev/null +++ b/machines/bomba/services/mail.nix @@ -0,0 +1,36 @@ +{ config, ... }: +let + fqdn = "mail.patrickcanal.it"; +in +{ + security.acme = { + acceptTerms = true; + certs."mail.patrickcanal.it" = { + webroot = "/var/www/patrickcanal.it/public/"; + }; + }; + + mailserver = { + enable = true; + stateVersion = 5; + fqdn = fqdn; + domains = [ "patrickcanal.it" ]; + + # Reference the existing ACME configuration created by nginx + x509.useACMEHost = fqdn; + + # A list of all login accounts. To create the password hashes, use + # nix-shell -p mkpasswd --run 'mkpasswd -s' + accounts = { + "me@patrickcanal.it" = { + hashedPassword = "$y$j9T$zEKbsELY3HcPZq9CH6bSe0$T9syGTl9haNhjS5SNjDbrY5uoN5z/LCYEmbFowFcAP/"; + + # Additional addresses delivered to this mailbox + aliases = [ + "postmaster@patrickcanal.it" + "io@patrickcanal.it" + ]; + }; + }; + }; +} diff --git a/secrets/bomba.sops.yaml b/secrets/bomba.sops.yaml index 07393c0..106b5c5 100644 --- a/secrets/bomba.sops.yaml +++ b/secrets/bomba.sops.yaml @@ -10,6 +10,7 @@ prowlarr_api_key: ENC[AES256_GCM,data:UDpnqIP64k8Qt9k/sjbESNostFiGHfLo3CEYfyWppH seerr_api_key: ENC[AES256_GCM,data:KDQxxo2W4tz9UokscAUSz7pf7wY2AfsEQpZh2aXGjsQOBgSLt1DEe5LUxealBZju8gabhp4sNGFvp0+ioZpfkg==,iv:V/rbR6bZtVnDhLLVmygGyTf5Ujm8sb2xHy4JuvLiiV8=,tag:MxGzXHbZWgu3H+ICS2tSNQ==,type:str] indexers_ilcorsaroblu_password: ENC[AES256_GCM,data:w3CIGQqLxHEkUHvscZc=,iv:fjsB3zt4Z43MKRECjpa7+gNDzM8D+JK0sbKt2P+Hdiw=,tag:KvLawon+KfrhGmi1TWRHLw==,type:str] gitea_registration_token: ENC[AES256_GCM,data:aHoUBwPXtlme9RgGObwWt1V90JU5qeVBUtpINrb1hY6XjKi4+kLxAg==,iv:zkgDdx82Lku7/oNIoSoKUIrxvZuyPaGUI411V/rkW9c=,tag:0eBC0Kd71UwokH9scs/AKA==,type:str] +mail_password: ENC[AES256_GCM,data:fznlr+Mzu+cpHsLN8EYx6g==,iv:s/DidEGNar4jGHGcbXsysZ2grpwVO1T2Zd+jksb90T8=,tag:LgJ7r+stG7QCpX9n/UZUsA==,type:str] navidrome_env: ENC[AES256_GCM,data:SjEg735zoiWNjp0+uYi5CyLadDd7mSXpG1LInLsaqESz0LNgMi+r46ohPjpEC3GD+WbE9D3XRwhB22oIey3K7p3GdB/bYjIR6wOa8MVjj3EDvzdBWbnhkXsGnIhLGuyZwDmMdA==,iv:gHv7lZzU09V3XVjs3nEOEm55xRwD23+sVWfgbuX18p4=,tag:8UAMIGXPGobQfBAao2nI6Q==,type:str] yamtrack_env: ENC[AES256_GCM,data:fUaM7prLhu7aJQbWimzjPWmSD7SiCFTiXaWz4Ep34EadofCXvrBKnUa8ZDOSX9mw1PUAdqbao8l1TbA6LieV1ywW4VqC7+fUyJsfOhjRqtg+ud286UilIrMTcU/bodcKxbzxIjG9HMJ4HVs+hNnrVm4SUaloueXZm6pT0iB4Pm3ygXb/NjyBR5PdGc3MiJ0kJ4OvrLzMXYipdFTVqGvgiKazQm37ug3JFw+UjpRanYLlGT+q/aC0Km+UK41CQjvB06N8jwfd3vFWIxKHtWTfMaiJAarwSh6320lQWj5bIkbK5p4TXgqy+UgBqwEt6eWDbeZ5L46covfUi2ZUCDMBYSslFK5cYqaOvfRb0VO1nb+06djBi1WvuVR4i6PkNpyb5PGZa9f2cZB8yqXaUGNJQaut+nu7G8t8YWFlTP78fXAHOyd4kfCFot68LYJ1Vjo08v6SnUuF8JA+tmBOddBPpyO15IP5Ln7mEfinAhYRI7MACO/uOcfRX4ydcyHdELwKwM1hY69c8Ph2++1pkzJOtnSco1iJD07JreMTlOSyT7Y5Q96jR6OZdbPQ0KgoCQNjeRfoQlo2cRBwrCyvNb/Ajy2eW8JgRnY/U+SV+JkmjqrUh740sNbD0CNfFCOvvyIn9pSqQBkezfrqDKUznF6jMMATTdG75XMynbvS3RKfv/pd6ZR+m0DMFuWvvmL5cfjYsAe+M46TtfpHipCB+rxt27gn8+WN3o1cIm5OCsWK3bY51+pFFNr8P/S2kXPyRmq7B7GjLxfMBBYpERSPgzy1vTdpx+n1bREoFPll2d3KWSceVd+2izdj2S14ONPP/Ov4ImpIQQche1/Avaem6A/Go+y8Lpmnjp8/9ATwz3/b3RkbupX0bQy6y4gDg/V5bByaTpmb8Uh8,iv:rHGqUoLl6iJ1+LDHSuDFuIsl/YLlb75lUwl8gaxV79c=,tag:GVet48AfHBX5IXa/u1wXFA==,type:str] authentik_env: ENC[AES256_GCM,data:kAva3C4pWZ4+BFhGbbq9j1rSXeldb+NAwU16aZUD7wiw8k7Sg0kVq/43rj1HtR2ZTQY6DxhPlsK5I7opVAg953GwN0kTErpuhKLRWaRGSb8rC8kkxnY=,iv:X61qSjH18KQRWNOtYq1o8IZmY6Dz4TrJzehJWxE7b2o=,tag:mifmD1C3A+XSQveLviLt2w==,type:str] @@ -26,7 +27,7 @@ sops: ZQ17gIIOjhKHlGx8Lo5t/PekzFyQKCKdijS7caq74dVib1vO3tk+uQ== -----END AGE ENCRYPTED FILE----- recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx - lastmodified: "2026-07-24T19:39:25Z" - mac: ENC[AES256_GCM,data:Gs/dqDo+NRqAb8H+L2WHuBQYisC4NEJ/zEJPSOcA8pdpdjxAbJ/Pqq/yQ4WDc/59w7pu13dddA7JmDv7sSwAmfSHVNB7JRWhfVm7YG7L5/6vSi5NG3OgJeQYcLYYJzfDK3f1FJkMe9OKV02mSZ2531AdCJmEa4URjkgXZoY8QDY=,iv:WGRxhf0A6ddi39xNlkE3yB+PybrAkZP0N1ulzA/sWvY=,tag:kW3MyTLVNaQE0M5mndurTA==,type:str] + lastmodified: "2026-08-16T15:41:59Z" + mac: ENC[AES256_GCM,data:JCmj1SmD62xYMckWkfereDLbWg5NnEGO53diijpFNtsJbHQqnoCRIekQNq53FOpHBUadl7Qjz2snjsd0a5NzFaV5jP4WXqFKpSuFE4BK16Xj15v/HSUSwYc0APKCMwFeX7Oeu39iQNgsQ/quOQy8LRQcX8ck99NCVBPV8xeqfIo=,iv:FGk3Y/GuFNPCZ4L04+ygvM+2LJQvn3f7uRvArhpbQ14=,tag:UTU2Fjj2gJl7Og2r45+jwQ==,type:str] unencrypted_suffix: _unencrypted - version: 3.13.2 + version: 3.13.3