feat: add mailserver

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

hosts/common/servers/default.nix

@@ -3,17 +3,11 @@
   imports = [
     inputs.disko.nixosModules.disko
 
-    ./disk-config.nix
-    {
-      _module.args.disks = [ "/dev/sda" ];
-    }
+    ../global/sops.nix
+
     ./hetzner.nix
   ];
 
-  time.timeZone = "Europe/Helsinki";
-
-  networking.hostName = "cloud-1";
-
   programs.zsh.enable = true;
   environment.pathsToLink = [ "/share/zsh" ];
   environment.shells = [ pkgs.zsh ];
@@ -59,6 +53,4 @@
       options = "--delete-older-than 7d";
     };
   };
-
-  system.stateVersion = "24.11";
 }

hosts/mail-01/default.nix

@@ -0,0 +1,81 @@
+{ inputs, config, ... }:
+let
+  floatingIPv4 = "78.47.245.200";
+in
+{
+  imports = [
+    ./disk-config.nix
+    {
+      _module.args.disks = [ "/dev/sda" ];
+    }
+
+    inputs.nixos-mailserver.nixosModules.mailserver
+
+    ../common/servers
+  ];
+
+  time.timeZone = "Europe/Berlin";
+
+  networking.hostName = "mail-01";
+  networking.interfaces.enp1s0 = {
+    ipv4.addresses = [
+      {
+        address = floatingIPv4;
+        prefixLength = 32;
+      }
+    ];
+  };
+  networking.defaultGateway = {
+    address = "172.31.1.1";
+    interface = "enp1s0";
+  };
+  networking.nameservers = [ "8.8.8.8" ];
+
+  sops.secrets.mail-password-lander = {
+    owner = "root";
+    group = "root";
+    sopsFile = ./secrets.yaml;
+  };
+
+  mailserver = {
+    enable = true;
+    fqdn = "mail.escapeangle.com";
+    domains = [ "escapeangle.com" ];
+
+    loginAccounts = {
+      "lander@escapeangle.com" = {
+        hashedPasswordFile = config.sops.secrets.mail-password-lander.path;
+
+        aliases = [
+          "postmaster@escapeangle.com"
+        ];
+
+        catchAll = [
+          "escapeangle.com"
+        ];
+      };
+    };
+
+    extraVirtualAliases = {
+      "abuse@escapeangle.com" = "lander@escapeangle.com";
+    };
+
+    certificateScheme = "acme-nginx";
+
+    enableImap = true;
+    enableImapSsl = true;
+
+    enableManageSieve = true;
+
+    virusScanning = true;
+  };
+
+  services.postfix.config = {
+    "smtp_bind_address" = floatingIPv4;
+  };
+
+  security.acme.defaults.email = "landervandenbulcke@gmail.com";
+  security.acme.acceptTerms = true;
+
+  system.stateVersion = "24.11";
+}

hosts/mail-01/secrets.yaml

@@ -0,0 +1,32 @@
+mail-password-lander: ENC[AES256_GCM,data:6A0pw04sdzAAE2dakrGt68OkYzMFzeY1fKBAAIcO6PF1Sbna+6JbdIjikuN7ucdEGC+cPBpHNaWM8ZuZ,iv:LC4WSSAWW4uEFGHiDiZG5Q1mQgQnp28WngFyE4sECI8=,tag:gcDe1+PX9Zbe7Uu6RXJ8Ng==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1u2a7wakgsyct6ed7ah2pksymh7jjl08ankedeyl5pa5jcs8r0uks02jpza
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrUXBtSzJiYXhZMStON3dj
+            MTlXdE5BaVRWalAzUDBxRWpDT3dWTmRLNFVnCnN0cGc3Qkt5YXRTTHJCaGVIQjgw
+            NVozQzZDTE5TNUpsa3cyVU9mNEdWOUEKLS0tIG1FWkkrQ0s1TlV1VkIxR2RjRXFw
+            bG9hd3RXaERsYU5RaCtiOVYrcFlvam8Ky3iq96BO4uMiYLpZ903UCJYfByQIMtI5
+            YNDVMgIqVI9vVDq1BnPqyOssHJ7FO69i+BUSSrjqZKsyAjknqPmvoA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-17T23:47:07Z"
+    mac: ENC[AES256_GCM,data:aY/fxm82ypgW5Js6d2m4+xWX/mb1quNt8VSIATsvXOlQTrFHWBJr0ZoI1ZvgkAYDNrgqBm9iCBq9KzM+Uvin+LnuH1EPkjMtoIdTPK8z2pHcHlcHJec9sTG7WHHqCzvVQIXFC7ht4nYvzDJbS5nJBgEVaTGDx7jFyq7oJglvyP0=,iv:ysG15QRfWkqUMPf7IYnQoGvI9H0yuZEM2OiwXneGKNM=,tag:oIfsso9FVLCTzd8X+6sUQA==,type:str]
+    pgp:
+        - created_at: "2025-01-17T23:46:22Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DARdpY4woM6wSAQdAKAJEIw16NdGquumUwVQeZeHWaQixvg6z/BiWYhkdmRAw
+            U7r4y86ZTf/Am1D+N+mMSZTWB0ncKjgfS8nzvHyFKHUkBMmJhIwtVNxlIoWe4+xc
+            0l4BC+s5Mk8rhkofbq+fw6k5dwVF5HxqE7o9JK9ntbOkyHGsblQd9PsIyvr6pXt+
+            Edllt9Ol/oJC+T+Sv3O2Y21y9ZzNJoleGv7UaFvgQ1+9nksYTbYRHLGh7w0B+xSH
+            =YYVU
+            -----END PGP MESSAGE-----
+          fp: 4BE1257015580BAB9F4B9D5FCA5B1C34E649BF92
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2

hosts/wodan/default.nix

@@ -26,6 +26,8 @@
 
     initrd.luks.devices."luks-ed2282ac-fd73-4d82-9224-b7596b5b7cac".device =
       "/dev/disk/by-uuid/ed2282ac-fd73-4d82-9224-b7596b5b7cac";
+
+    binfmt.emulatedSystems = [ "aarch64-linux" ];
   };
 
   services.xserver.enable = true;