sarahlament/nix-configurations

internal mail relays over wireguard now #70

Merged

sarahlament merged 1 commit from modularity into main

2026-07-07 20:01:47 -05:00

sarahlament commented

2026-07-07 13:57:15 -05:00

Owner

ripped out per-service authenticated SMTP - every host relays outbound through the mailserver over the tunnel instead
- mailserver trusts each full host's internal WG address via postfix mynetworks (peers like phone/tablet stay out)
- services point SMTP_ADDR/host at (roleHost "mailserver").ip.internal, port 25, no auth, no TLS - the tunnel already encrypts
- forgejo lost its forgejoMailPass secret and its whole mailserver.accounts entry, relays plaintext now
- grafana + vaultwarden actually got outbound mail wired up (neither had it before)
moved git (forgejo) off athena -> minerva, one-line backend flip in directory.services
- added a /persist entry for /var/lib/forgejo that carries git:git ownership - a plain string dir lands root:root and forgejo can't write its state
- inert on non-impermanent hosts; /var/backup/forgejo stays out since the dump preHook regenerates it each borg run
new roleHost helper in myLib.helpers - "the host that declares role X", one findFirst
- networking.nix was doing this inline twice (hub/resolver), collapsed both onto it
- the mail relay changes lean on it too (roleHost "mailserver")
secrets: mail passwords pulled out of sops/pass.yaml into their own sops/mail.yaml (lamentMailPass/adminMailPass); forgejoMailPass gone
cleanup: folded serviceModules straight into activeModules ++ ... across all three hosts, no more separate binding - mostly formatting

- ripped out per-service authenticated SMTP - every host relays outbound through the `mailserver` over the tunnel instead - `mailserver` trusts each full host's internal WG address via `postfix mynetworks` (peers like phone/tablet stay out) - services point `SMTP_ADDR`/`host` at `(roleHost "mailserver").ip.internal`, port 25, no auth, no TLS - the tunnel already encrypts - `forgejo` lost its `forgejoMailPass` secret *and* its whole `mailserver.accounts` entry, relays plaintext now - `grafana` + `vaultwarden` actually got outbound mail wired up (neither had it before) - moved `git` (forgejo) off `athena` -> `minerva`, one-line `backend` flip in `directory.services` - added a `/persist` entry for `/var/lib/forgejo` that carries `git:git` ownership - a plain string dir lands `root:root` and forgejo can't write its state - inert on non-impermanent hosts; `/var/backup/forgejo` stays out since the dump `preHook` regenerates it each borg run - new `roleHost` helper in `myLib.helpers` - "the host that declares role X", one `findFirst` - `networking.nix` was doing this inline twice (`hub`/`resolver`), collapsed both onto it - the mail relay changes lean on it too (`roleHost "mailserver"`) - secrets: mail passwords pulled out of `sops/pass.yaml` into their own `sops/mail.yaml` (`lamentMailPass`/`adminMailPass`); `forgejoMailPass` gone - cleanup: folded `serviceModules` straight into `activeModules ++ ...` across all three hosts, no more separate binding - mostly formatting

sarahlament added 1 commit

2026-07-07 13:57:15 -05:00

I'm tired of describing all these changes in commits...

CI / check (pull_request) Successful in 33s

Details

CI / deploy (athena) (pull_request) Has been skipped

Details

CI / deploy (ishtar) (pull_request) Has been skipped

Details

CI / deploy (minerva) (pull_request) Has been skipped

Details

CI / build (athena) (pull_request) Successful in 15s