mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 23:00:39 +02:00
Code Activity

chore: update stalwart, add firezone tokens

Browse source
This commit is contained in:
oddlama 2025-03-16 15:13:53 +01:00
parent be7e4d158c
commit 3dabfb23e0
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
5 changed files with 30 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hosts/envoy/stalwart-mail.nix
View file

@ -351,11 +351,8 @@ in
];
};
config.resource.spam-filter = builtins.trace "remove when stalwart 0.11" "file://${config.services.stalwart-mail.package}/etc/stalwart/spamfilter.toml";
config.resource.webadmin = builtins.trace "remove when stalwart 0.11" "file://${config.services.stalwart-mail.package.webadmin}/webadmin.zip";
# FIXME: 1.11+
# spam-filter.resource = "file://${config.services.stalwart-mail.package}/etc/stalwart/spamfilter.toml";
# webadmin.resource = "file://${config.services.stalwart-mail.package.webadmin}/webadmin.zip";
spam-filter.resource = "file://${config.services.stalwart-mail.package}/etc/stalwart/spamfilter.toml";
webadmin.resource = "file://${config.services.stalwart-mail.package.webadmin}/webadmin.zip";
webadmin.path = "/var/cache/stalwart-mail";
certificate.default = {
@ -364,8 +361,8 @@ in
default = true;
};
lookup.default.hostname = stalwartDomain;
server = {
hostname = stalwartDomain;
tls = {
certificate = "default";
ignore-client-order = true;

15
hosts/sentinel/firezone.nix
View file

@ -28,6 +28,11 @@ in
{
age.secrets.firezone-smtp-password.generator.script = "alnum";
# NOTE: state: this token is from a manually created service account
age.secrets.firezone-relay-token = {
rekeyFile = config.node.secretsDir + "/firezone-relay-token.age";
};
# Mirror the original oauth2 secret
age.secrets.firezone-oauth2-client-secret = {
inherit (nodes.ward-kanidm.config.age.secrets.kanidm-oauth2-firezone) rekeyFile;
@ -137,6 +142,16 @@ in
web.externalUrl = "https://${firezoneDomain}/";
};
services.firezone.relay = {
enable = true;
name = "sentinel";
apiUrl = "wss://${firezoneDomain}/api/";
tokenFile = config.age.secrets.firezone-relay-token.path;
publicIpv4 = lib.net.cidr.ip config.repo.secrets.local.networking.interfaces.wan.hostCidrv4;
publicIpv6 = lib.net.cidr.ip config.repo.secrets.local.networking.interfaces.wan.hostCidrv6;
openFirewall = true;
};
services.nginx = {
upstreams.firezone = {
servers."127.0.0.1:${toString config.services.firezone.server.web.port}" = { };

BIN
hosts/sentinel/secrets/firezone-relay-token.age Normal file
View file

Binary file not shown.

12
hosts/ward/default.nix
View file

@ -58,6 +58,18 @@
};
};
# NOTE: state: this token is from a manually created service account
age.secrets.firezone-gateway-token = {
rekeyFile = config.node.secretsDir + "/firezone-gateway-token.age";
};
services.firezone.gateway = {
enable = true;
name = "ward";
apiUrl = "wss://${globals.services.firezone.domain}/api/";
tokenFile = config.age.secrets.firezone-gateway-token.path;
};
guests =
let
mkGuest = guestName: {

BIN
hosts/ward/secrets/firezone-gateway-token.age Normal file
View file

Binary file not shown.