feat: hectic-lab: mail server

nixos/module/hectic/archetype/base.nix

@@ -12,6 +12,7 @@
 in {
   imports = [
     inputs.disko.nixosModules.default
+    inputs.nixos-mailserver.nixosModules.mailserver
   ];
 
   options.hectic.archetype.base.enable = lib.mkEnableOption "Enable archetupe.dev";

nixos/module/hectic/service/mailserver.nix

@@ -0,0 +1,62 @@
+{
+  inputs,
+  flake,
+  self,
+}:
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.services.mailserver;
+  transformLoginAccounts = domain: input:
+    builtins.listToAttrs (map (key: {
+      name  = key + "@" + domain;
+      value = input.${key};
+    }) (builtins.attrNames input));
+in {
+  options = {
+    services.mailserver.enable = lib.mkEnableOption "Mail server";
+
+    services.mailserver.domain = lib.mkOption {
+      type        = lib.types.str;
+      description = "The domain name of the mail server";
+    };
+
+    services.mailserver.loginAccounts = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          hashedPassword = lib.mkOption {
+            type    = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          hashedPasswordFile = lib.mkOption {
+            type        = lib.types.nullOr lib.types.str;
+            default     = null;
+            description = ''
+              Full path to a file containing the hashed password suitable
+              for use with `chpasswd -e`.
+            '';
+          };
+        };
+      });
+      default     = {};
+      description = "Login accounts for the mail server";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    mailserver = {
+      enable   = true;
+      fqdn     = "mail." + cfg.domain;
+      domains  = [ cfg.domain ];
+
+      loginAccounts = transformLoginAccounts cfg.domain cfg.loginAccounts;
+
+      certificateScheme = "acme-nginx";
+    };
+
+    security.acme.acceptTerms       = true;
+    security.acme.defaults.email    = "security@" + cfg.domain;
+  };
+}

nixos/system/hectic-lab/hectic-lab.nix

@@ -41,6 +41,19 @@ in {
     };
   };
 
+  # NOTE(yukkop): disk was provisioned by Hetzner rescue image, disko was never
+  # run, so partition labels don't exist. Override fileSystems with actual UUIDs.
+  fileSystems."/" = lib.mkForce {
+    device = "/dev/disk/by-uuid/48ba7286-d019-4cdc-9784-459767979b07";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = lib.mkForce {
+    device = "/dev/disk/by-uuid/71F2-4E98";
+    fsType = "vfat";
+    options = [ "umask=0077" ];
+  };
+
   programs.zsh.enable = true;
   programs.zsh.interactiveShellInit = ''
     setopt vi
@@ -89,27 +102,33 @@ in {
 
   sops.secrets."mailserver/security/hashedPassword" = {};
   sops.secrets."mailserver/yukkop/hashedPassword"   = {};
+  sops.secrets."mailserver/founders/hashedPassword"   = {};
   sops.secrets."mailserver/snuff/hashedPassword"    = {};
   sops.secrets."mailserver/antoshka/hashedPassword" = {};
 
-  # services.mailserver = {
-  #   enable = false;
-  #   domain = domain;
-  #   loginAccounts = {
-  #     "security" = {
-  #       hashedPasswordFile = config.sops.secrets."mailserver/security/hashedPassword".path;
-  #     };
-  #     "yukkop" = {
-  #       hashedPasswordFile = config.sops.secrets."mailserver/yukkop/hashedPassword".path;
-  #     };
-  #     "snuff" = {
-  #       hashedPasswordFile = config.sops.secrets."mailserver/snuff/hashedPassword".path;
-  #     };
-  #     "antoshka" = {
-  #       hashedPasswordFile = config.sops.secrets."mailserver/antoshka/hashedPassword".path;
-  #     };
-  #   };
-  # };
+  services.mailserver = {
+    enable = true;
+    domain = domain;
+    loginAccounts = {
+      "security" = {
+        hashedPasswordFile = config.sops.secrets."mailserver/security/hashedPassword".path;
+      };
+      "founders" = {
+        hashedPasswordFile = config.sops.secrets."mailserver/founders/hashedPassword".path;
+      };
+      "yukkop" = {
+        hashedPasswordFile = config.sops.secrets."mailserver/yukkop/hashedPassword".path;
+      };
+      "snuff" = {
+        hashedPasswordFile = config.sops.secrets."mailserver/snuff/hashedPassword".path;
+      };
+      "antoshka" = {
+        hashedPasswordFile = config.sops.secrets."mailserver/antoshka/hashedPassword".path;
+      };
+    };
+  };
+
+  mailserver.stateVersion = 3;
 
   services.redis.servers."vproxy-bot-test-state" = {
     enable = true;