feat(bomba): add mail

machines/bomba/secrets.nix

@@ -1,4 +1,4 @@
-{... }:
+{ ... }:
 {
   sops =
     let
@@ -27,6 +27,7 @@
         authentik_env = default;
         vaultwarden_env = default;
         vikunja_env = default;
+        mail_password = default;
       };
     };
 }

machines/bomba/services/caddy.nix

@@ -22,6 +22,10 @@
           root /var/www/patrickcanal.it/public
           file_server
         '';
+        "mail.patrickcanal.it".extraConfig = ''
+          root /var/www/patrickcanal.it/public
+          file_server
+        '';
         "vaultwarden.patrickcanal.it".extraConfig = ''
           encode zstd gzip
           reverse_proxy :8003 {

machines/bomba/services/default.nix

@@ -8,6 +8,7 @@
     ./fail2ban.nix
     ./gitea.nix
     ./homebox.nix
+    ./mail.nix
     ./navidrome.nix
     ./nextcloud.nix
     ./nixflix.nix

machines/bomba/services/mail.nix

@@ -0,0 +1,36 @@
+{ config, ... }:
+let
+  fqdn = "mail.patrickcanal.it";
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    certs."mail.patrickcanal.it" = {
+      webroot = "/var/www/patrickcanal.it/public/";
+    };
+  };
+
+  mailserver = {
+    enable = true;
+    stateVersion = 5;
+    fqdn = fqdn;
+    domains = [ "patrickcanal.it" ];
+
+    # Reference the existing ACME configuration created by nginx
+    x509.useACMEHost = fqdn;
+
+    # A list of all login accounts. To create the password hashes, use
+    # nix-shell -p mkpasswd --run 'mkpasswd -s'
+    accounts = {
+      "me@patrickcanal.it" = {
+        hashedPassword = "$y$j9T$zEKbsELY3HcPZq9CH6bSe0$T9syGTl9haNhjS5SNjDbrY5uoN5z/LCYEmbFowFcAP/";
+
+        # Additional addresses delivered to this mailbox
+        aliases = [
+          "postmaster@patrickcanal.it"
+          "io@patrickcanal.it"
+        ];
+      };
+    };
+  };
+}