Gonne/nixConfig
1
0
Fork 0
forked from Fachschaft/nixConfig
Code Pull requests Activity

Post mailaddresses to HRZ allowlist

Browse source
This commit is contained in:
Gonne 2025-02-25 16:16:12 +01:00
parent 95f66f6210
commit 14ee694ed6
4 changed files with 178 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nixos/machines/kaalut/configuration.nix
View file

@ -10,6 +10,7 @@
# System configuration here
services.mathebau-mail = {
enable = true;
stalwartAdmin = config.sops.secrets.stalwartAdmin.path;
# see passwd on azathoth for plaintext or machine secret in encoded format for HTTP Basic AUTH
stalwartAdminHash = "$argon2i$v=19$m=4096,t=3,p=1$d0hYOTkzclpzSmFTZUplWnhVeWE$I7q9uB19RWL0oZKaPlMPSlGfFp6FQ/vrx80FFKCsalg";
domains = [
@ -40,7 +41,19 @@
vmNetwork.ipv4 = "192.168.0.17";
system.stateVersion = "24.05";
sops.secrets = {
sops.secrets = let
allowlistSops = {
sopsFile = ./allowlistPass.yaml;
owner = "stalwart-mail";
group = "stalwart-mail";
mode = "0400";
};
in {
# Password for the HRZ API that gets a list of mailaddresses that we serve
"allowlistPass/matheball" = allowlistSops;
"allowlistPass/mathebau" = allowlistSops;
"allowlistPass/mathechor" = allowlistSops;
"allowlistPass/koma" = allowlistSops;
# Virtual alias file
"mathebau.aliases" = {
sopsFile = ./mathebau.aliases.yaml;
@ -60,6 +73,13 @@
group = "stalwart-mail";
mode = "0440";
};
# password for https://stalw.art/docs/auth/authorization/administrator/#fallback-administrator encoded to be supplied in the basic auth header
stalwartAdmin = {
sopsFile = ./stalwartAdmin.yaml;
owner = "stalwart-mail";
group = "stalwart-mail";
mode = "0400";
};
backupKey = {
sopsFile = ./backupKey.yaml;
owner = "root";