diff --git a/config/secrets.nix b/config/secrets.nix index cd9885e..0722f4e 100644 --- a/config/secrets.nix +++ b/config/secrets.nix @@ -42,6 +42,22 @@ || die "Failure while aggregating basic auth hashes" ''); + age.generators.argon2id = { + pkgs, + lib, + decrypt, + deps, + ... + }: let + dep = builtins.head deps; + in '' + echo " -> Deriving argon2id hash from "${lib.escapeShellArg dep.host}":"${lib.escapeShellArg dep.name}"" >&2 + ${decrypt} ${lib.escapeShellArg dep.file} \ + | tr -d '\n' \ + | ${pkgs.libargon2}/bin/argon2 "$(${pkgs.openssl}/bin/openssl rand -base64 16)" -id \ + || die "Failure while generating argon2id hash" + ''; + # Just before switching, remove the agenix directory if it exists. # This can happen when a secret is used in the initrd because it will # then be copied to the initramfs under the same path. This materializes diff --git a/hosts/envoy/idmail.nix b/hosts/envoy/idmail.nix index b89444a..8a90466 100644 --- a/hosts/envoy/idmail.nix +++ b/hosts/envoy/idmail.nix @@ -4,26 +4,47 @@ lib, ... }: let - mailDomains = globals.domains.mail; - primaryDomain = mailDomains.primary; + primaryDomain = globals.mail.primary; idmailDomain = "alias.${primaryDomain}"; -in { - # Not needed, we store stuff in stalwart's directory - #environment.persistence."/persist".directories = [ - # { - # directory = "/var/lib/idmail"; - # user = "idmail"; - # group = "idmail"; - # mode = "0700"; - # } - #]; - age.secrets.idmail-admin-hash = { - rekeyFile = ./secrets/idmail-admin-hash.age; + mkRandomSecret = { + generator.script = "alnum"; + mode = "000"; + }; + + mkArgon2id = secret: { + generator.dependencies = [config.age.secrets.${secret}]; + generator.script = "argon2id"; mode = "440"; group = "stalwart-mail"; }; + shortHash = x: lib.substring 0 16 (builtins.hashString "sha256" "${globals.salt}:${x}"); +in { + environment.persistence."/persist".directories = [ + { + directory = "/var/lib/idmail"; + user = "idmail"; + group = "idmail"; + mode = "0700"; + } + ]; + + age.secrets = lib.mergeAttrsList ( + [ + { + idmail-user-pw_admin = mkRandomSecret; + idmail-user-hash_admin = mkArgon2id "idmail-user-pw_admin"; + } + ] + ++ lib.forEach (lib.attrNames globals.mail.domains) ( + domain: { + "idmail-mailbox-pw_catch-all@${shortHash domain}" = mkRandomSecret; + "idmail-mailbox-hash_catch-all@${shortHash domain}" = mkArgon2id "idmail-mailbox-pw_catch-all@${shortHash domain}"; + } + ) + ); + globals.services.idmail.domain = idmailDomain; globals.monitoring.http.idmail = { url = "https://${idmailDomain}"; @@ -31,6 +52,11 @@ in { network = "internet"; }; + #systemd.tmpfiles.settings."50-idmail"."${dataDir}".d = { + # user = "idmail"; + # mode = "0750"; + #}; + services.idmail = { enable = true; user = "stalwart-mail"; @@ -39,12 +65,20 @@ in { enable = true; users.admin = { admin = true; - password_hash = "%{file:${config.age.secrets.idmail-admin-hash.path}}%"; + password_hash = "%{file:${config.age.secrets.idmail-user-hash_admin.path}}%"; }; - domains = lib.genAttrs mailDomains.all (_: { + domains = lib.flip lib.mapAttrs globals.mail.domains (domain: domainCfg: { owner = "admin"; - public = true; + catch_all = "catch-all@${domain}"; + inherit (domainCfg) public; }); + mailboxes = lib.flip lib.mapAttrs' globals.mail.domains ( + domain: _domainCfg: + lib.nameValuePair "catch-all@${domain}" { + password_hash = "%{file:${config.age.secrets."idmail-mailbox-hash_catch-all@${shortHash domain}".path}}%"; + owner = "admin"; + } + ); }; }; systemd.services.idmail.serviceConfig.RestartSec = "60"; # Retry every minute diff --git a/hosts/envoy/net.nix b/hosts/envoy/net.nix index 3c36b09..7d752a6 100644 --- a/hosts/envoy/net.nix +++ b/hosts/envoy/net.nix @@ -7,8 +7,8 @@ icfg = config.repo.secrets.local.networking.interfaces.wan; in { networking.hostId = config.repo.secrets.local.networking.hostId; - networking.domain = globals.domains.mail.primary; - networking.hosts."127.0.0.1" = ["mail.${globals.domains.mail.primary}"]; + networking.domain = globals.mail.primary; + networking.hosts."127.0.0.1" = ["mail.${globals.mail.primary}"]; globals.monitoring.ping.envoy = { hostv4 = lib.net.cidr.ip icfg.hostCidrv4; diff --git a/hosts/envoy/secrets/idmail-admin-hash.age b/hosts/envoy/secrets/idmail-admin-hash.age deleted file mode 100644 index 3d3e61d..0000000 Binary files a/hosts/envoy/secrets/idmail-admin-hash.age and /dev/null differ diff --git a/hosts/envoy/secrets/stalwart-admin-hash.age b/hosts/envoy/secrets/stalwart-admin-hash.age deleted file mode 100644 index 6870748..0000000 --- a/hosts/envoy/secrets/stalwart-admin-hash.age +++ /dev/null @@ -1,11 +0,0 @@ -age-encryption.org/v1 --> X25519 t0FJIrbn5q7oX4+1tHvjDnWDCiD6NMkNw7Aq2MfSXw4 -W6aq9jnVOH9W+pjsrSCZG1BJXSNojhiUrTgzANFpM9w --> piv-p256 xqSe8Q A3qjOwYgwBFDf0beUSyw3nHhkO9ZhsJzGHBh4BTw7+tS -ffyaSOMoOHiIXfXvCJY/apYkEc7wZgkhOGTNT9O7oJ0 --> n[k#S-grease /{ w79 (TV$':-8 4E -hxVz/9v74X2gEt9y0yvKMClVgId3mAl5PVisyL0r8WUn4extTHoh8qj2fSFl++54 -c0aRZZ5Y+Pdqu/7FyignIhV4WbUtverMWhWdRAhGsXqFm/8ejLqPfELQ54w ---- rTgyJNg/7gotGoTSMt5jDxSFE0tM8CP+azNlDTRjCow -Liݓk.?N@1 lH΢Нm@8N^Uu -σ/dzFIHk+*+;#3vx~3ڂVZ߯oђZC|՛T*ۇ^- .71c+gō \ No newline at end of file diff --git a/hosts/envoy/stalwart-mail.nix b/hosts/envoy/stalwart-mail.nix index ecc59bc..cc15fe6 100644 --- a/hosts/envoy/stalwart-mail.nix +++ b/hosts/envoy/stalwart-mail.nix @@ -5,8 +5,7 @@ pkgs, ... }: let - mailDomains = globals.domains.mail; - primaryDomain = mailDomains.primary; + primaryDomain = globals.mail.primary; stalwartDomain = "mail.${primaryDomain}"; dataDir = "/var/lib/stalwart-mail"; in { @@ -19,8 +18,14 @@ in { } ]; + age.secrets.stalwart-admin-pw = { + generator.script = "alnum"; + mode = "000"; + }; + age.secrets.stalwart-admin-hash = { - rekeyFile = ./secrets/stalwart-admin-hash.age; + generator.dependencies = [config.age.secrets.stalwart-admin-pw]; + generator.script = "argon2id"; mode = "440"; group = "stalwart-mail"; }; diff --git a/modules/globals.nix b/modules/globals.nix index 90b4dbf..92d36e8 100644 --- a/modules/globals.nix +++ b/modules/globals.nix @@ -108,6 +108,11 @@ in { })); }; + salt = mkOption { + type = types.str; + description = "A salt value to use for hashes. Not secret, but also not public so you sneaky little buggers can't brute force my mail domains."; + }; + services = mkOption { type = types.attrsOf (types.submodule { options = { @@ -214,6 +219,26 @@ in { }; }; + mail = { + domains = mkOption { + default = {}; + description = "All domains on which we receive mail."; + type = types.attrsOf (types.submodule { + options = { + public = mkOption { + type = types.bool; + description = "Whether the domain should be available for use by any user"; + }; + }; + }); + }; + + primary = mkOption { + type = types.str; + description = "The primary mail domain."; + }; + }; + domains = { me = mkOption { type = types.str; @@ -224,16 +249,6 @@ in { type = types.str; description = "My personal domain."; }; - - mail.all = mkOption { - type = types.listOf types.str; - description = "All domains to configure on the mail server."; - }; - - mail.primary = mkOption { - type = types.str; - description = "The primary mail domain."; - }; }; macs = mkOption { diff --git a/nix/globals.nix b/nix/globals.nix index ed16b8e..f55f43b 100644 --- a/nix/globals.nix +++ b/nix/globals.nix @@ -34,10 +34,12 @@ hetzner kanidm macs + mail monitoring myuser net root + salt services ; }; diff --git a/secrets/generated/envoy/idmail-mailbox-hash_catch-all@2171ec5b4ea361de.age b/secrets/generated/envoy/idmail-mailbox-hash_catch-all@2171ec5b4ea361de.age new file mode 100644 index 0000000..e03e325 Binary files /dev/null and b/secrets/generated/envoy/idmail-mailbox-hash_catch-all@2171ec5b4ea361de.age differ diff --git a/secrets/generated/envoy/idmail-mailbox-hash_catch-all@30a80c5c819a6d2f.age b/secrets/generated/envoy/idmail-mailbox-hash_catch-all@30a80c5c819a6d2f.age new file mode 100644 index 0000000..b13d57a --- /dev/null +++ b/secrets/generated/envoy/idmail-mailbox-hash_catch-all@30a80c5c819a6d2f.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> X25519 Fmh3QK1rauE4Yy1F9uvzGtMumQfTHPsZpB/mFHyTik4 +uQZQ9AeMHIDYKOdSNJDY8yyr+vmFvfJYLe0F7bhPDIs +-> piv-p256 xqSe8Q Ap39opLW1MU2pC+UmNliHT/p9+Ktlh+Er0SBz481KE94 +iy1JR54/vixGF4KgHXq19vKKNlTUEtf7soKdG8jOnwE +-> Qb{iiDl-grease e/(Ds5o{ +qixGDiCAz/9W5rqKL8H0rjTGknJ0 +--- Xb6CEtGUamg7Rlt3gImrGyHgnztP0C6ZvOVtS1pUddM +rKf:hT6^lm/ryҐ:!k/$)kdBQڌdOc+sCZwnP%4ƈօ".Ύ]}Y-Y`9 M3JQzo`nڳeĶ骙Zh}bE. D`]Z52:5L"`?f&RI&e~85j]7 uޮrfvXHKIƟ drp>#hޟ{G闗EHzgƪVS X25519 hwiSO2uHMPYqzcHJe+fJNZQthIheNV+z8QzNRR19f30 +gJ2hYbFPvENqg2UtwgdCFKRlNB7pksSipl61IYD6NlI +-> piv-p256 xqSe8Q AxLma+4Ap7aFLCZb6gt/VdbL78lMwp7zw9Y9E2yyi80A +GvLv0n/kqC6xksv+nn1AEuwtGqd+vT5ivwo1yvMg+h4 +-> XJ0-grease +Njn6lpWsxPRwkFg9asSo986W1Cd0Lhj4VpGbXyBkg2TgdxLPZKN580tgk3e6jwc +--- mFCHJ/g5E3KqSoGdYMA4+6NnbaHYMoTmWnO+AeQuRwY +oi)$7Xzrǩ ?E !c#u=C-/]{RXRĆ@.MC`qH D@ \ No newline at end of file diff --git a/secrets/generated/envoy/idmail-mailbox-pw_catch-all@30a80c5c819a6d2f.age b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@30a80c5c819a6d2f.age new file mode 100644 index 0000000..4466acc --- /dev/null +++ b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@30a80c5c819a6d2f.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> X25519 Ied4Rc6fx3Wrkq4DAEjr3KTqnrR3VgzZ3uHZsbTUr3w +1kMMehvutM7wCedlVYg7Sys2Q7aEYxRO8Ajqp4bYXIQ +-> piv-p256 xqSe8Q Ah9bkx79XWlb/zW/gVRtTmOcsOcTCaU027jz/vxBjp74 +fi8FQ+rQILsnlxTC1/MoagAL7D4lqyR0QYaefAi9m3s +-> KW5K]-grease [K{/LCm5 s2 +TcDYJHaundRXKi8+K50c8FY/fIv2m28daA +--- Km5TCqqCFoiI0CmtBwTFNOjKtJ7tXKZfzTJocBIeH9Y +rrW +bzc'/kwd le[al7OgAZ%ꣅCtzjɼh-dG \ No newline at end of file diff --git a/secrets/generated/envoy/idmail-mailbox-pw_catch-all@39e88e1845ef6176.age b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@39e88e1845ef6176.age new file mode 100644 index 0000000..6e7396b Binary files /dev/null and b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@39e88e1845ef6176.age differ diff --git a/secrets/generated/envoy/idmail-mailbox-pw_catch-all@477075fe5513c902.age b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@477075fe5513c902.age new file mode 100644 index 0000000..460d3e4 --- /dev/null +++ b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@477075fe5513c902.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> X25519 TbcDtTD07pJ/Hxs+1wWcvk+fB5oPYAD9wklnyAcEJ08 +Q+YwFN8oKy3I18z4/pLEnsvA/yfnYun+Bz4M1WEV+hY +-> piv-p256 xqSe8Q AuLtBYkwIATPvcb3Se1yR7BL2qgeigjLtl5+rF+pPFVV +CmE6/5sj+Fie3hZqIWI7vtw+FQeVIh4q1xDkIAlGaV4 +-> }PFmeQ-grease N=(Zr +M/UiKZLS9K6xgn9mfMXC/akO7cWtbWDoG68GF7LDOT3khbvuG+Ol7+Mw8r321P7v +fLrjgfqCug +--- 3GiwrF82wC51ln1ZoPr8heBKPG3smcTHrpn3QwuP1SA +vMꮎv$iԋ;(L9ϸs-1[Bqק5뚥8>Kbl(( 1H \ No newline at end of file diff --git a/secrets/generated/envoy/idmail-mailbox-pw_catch-all@5b58b7c64bdf6ac8.age b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@5b58b7c64bdf6ac8.age new file mode 100644 index 0000000..944d101 --- /dev/null +++ b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@5b58b7c64bdf6ac8.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> X25519 lAFGflmWdJh9wzYqQF75W9A7yWnJpatVTSYL+UnShmc +5G176dn4/b0hBFMNxged8HQTJc6/i/kiWG9U2We3Z3I +-> piv-p256 xqSe8Q ArchEEGFmxin8qORVYBYG76Ta11kuVWQoEwA3VnF6+ev +/KSenFW6R0mzA8rdYX10O0QlE/pJj1P9+R3oLULuev0 +-> Wm:Yith-grease bk`Ui9y M9L +hZ1ei31xfhAZisW6DXlo5+4919PYx5QtDTgL0IbHbnWXYr+NSls7KPyE +--- NChUIl35wGl5r/FYvovD8x+RWuVilpqsm5xqvOr/FH8 +aRQ9h o+M%3ݕύ}|) + 3Kw'D5:+6%͜mUձ m4F \ No newline at end of file diff --git a/secrets/generated/envoy/idmail-mailbox-pw_catch-all@7b098b000a97e947.age b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@7b098b000a97e947.age new file mode 100644 index 0000000..462cd8a Binary files /dev/null and b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@7b098b000a97e947.age differ diff --git a/secrets/generated/envoy/idmail-mailbox-pw_catch-all@b3ad8b0f0313feef.age b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@b3ad8b0f0313feef.age new file mode 100644 index 0000000..cb74c1d --- /dev/null +++ b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@b3ad8b0f0313feef.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> X25519 jwLw0ZQDE0oPK1pfI+SE6pPHFmXTjBBR9bKGlwpRxg4 +9cvfMwxS/e0xRIUA4/bzFhBT/qu4yStCWs3NKnr7n5o +-> piv-p256 xqSe8Q Aklmj780XFjRXB6hP5HICrYvnqpHxI4V3XKBoCVGV2i0 +LJ1Ugx1hTOo/0USFYGM4KGv54qyi/6V7wDv1czFCT4E +-> gC-grease + +--- 2J6EqVCz9ZYUkyEGMbUraHE+SknGrsanAFBeFivNmJ8 +BgzyU mt H̨n*ZUw (%$4֗gT:Cc& +D)3%./Сh3=~߲ \ No newline at end of file diff --git a/secrets/generated/envoy/idmail-mailbox-pw_catch-all@cde738bc7ba35556.age b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@cde738bc7ba35556.age new file mode 100644 index 0000000..5d1a1e1 --- /dev/null +++ b/secrets/generated/envoy/idmail-mailbox-pw_catch-all@cde738bc7ba35556.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> X25519 tHxG6fGgWTc55QntSpCGlHlLmoybQBm5uySO0JDFlFs +keCZTsYnm9PpxLFbqT318W9O26MQPrLgSoIO2ZZBkts +-> piv-p256 xqSe8Q Aho/0opoUZGV/WfRsZ1q/EWhW5yjB4EP94DrKaDGcjBg +WLdqd0YwFDLTYGSMeMww0Mgqw3MZBqh2rdJJSo9jifs +-> (F7y+-grease PHIp60- +5krq5aozR08UQTSWVpeiYV6imrnMw2yeeY3lhUpAG5UPdIWVwWxvut22cAr0f4/T +fs/OB6IYy7wBhzfd1Ba/hXZNxwHwM6ohBpU +--- sikO0jRf7KcPPuQz6Fs4EQRozL8++s/F9pXQGw+qKRA +&mm*8ɘUO +w7z68O St@¨_E[ꜾM69BXG} ?#Per \ No newline at end of file diff --git a/secrets/generated/envoy/idmail-user-hash_admin.age b/secrets/generated/envoy/idmail-user-hash_admin.age new file mode 100644 index 0000000..f34c255 --- /dev/null +++ b/secrets/generated/envoy/idmail-user-hash_admin.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> X25519 LvYxfujP+6Q6NC/2ebtVnnRphiM3oEUGMmDBEuHCHFw +/ew4mPbRht3v+yhWPT5HdlQGnELJZWPhSoUIW1z0z1I +-> piv-p256 xqSe8Q Amu9UjGXIFylvwWA7hJCNd90zy171sjawkLV330vte26 +33kHGMIyuxGnUpF5Q9Ap5/rTC5ooe95tNA0Z/hWnlYU +-> f8_>qB")-grease +Vh2DLuANNDIq9O7gddvYRKcgMmg1vqcsjxkUFO4Xaf15yoZQJbvybeiVbRP99umV +VfClhMnMeeTVwmRYutgpS2+yuw +--- cfE8lNGxFWSd/UnoNOrdrGV3U90/7e1ZZpGtrUgrhto +5#5GfNϣ0dj,y *sƊ;] ZS5&32ĨqqkIf'BrJJu7 {v:'H \ No newline at end of file diff --git a/secrets/generated/envoy/idmail-user-pw_admin.age b/secrets/generated/envoy/idmail-user-pw_admin.age new file mode 100644 index 0000000..420a340 Binary files /dev/null and b/secrets/generated/envoy/idmail-user-pw_admin.age differ diff --git a/secrets/generated/envoy/stalwart-admin-hash.age b/secrets/generated/envoy/stalwart-admin-hash.age new file mode 100644 index 0000000..f651ac9 Binary files /dev/null and b/secrets/generated/envoy/stalwart-admin-hash.age differ diff --git a/secrets/generated/envoy/stalwart-admin-pw.age b/secrets/generated/envoy/stalwart-admin-pw.age new file mode 100644 index 0000000..16bf4dd --- /dev/null +++ b/secrets/generated/envoy/stalwart-admin-pw.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> X25519 6sJBGxU146bj34dJ29XjGY5n2XzeYG2Coy8fuQ/nmnQ +GoaSv5YXPFTOoeiRc9vLZOEd+ON1KM4IhF5pdFMRz68 +-> piv-p256 xqSe8Q A/JZvoPMzIUCiMT9I8qFwBWCmnNgcs/z91HGIYjDu6cP +JPyH+tRo+wwlsDV1MERLVqzwQ5kNGO/KT/d4860hwvU +-> W-grease BB +ZWThAsUDG5jjhan+twfPawEUbiKRdA8bhIP0R2i/0P9Xz7QgaMTPWsmPRar2sqzi +i9/W4G9Z/X4/K62idlQBs+7cXJL2QosAHA +--- 5B0vPvtgG66dZ524vBpMkKhG3QlkrIRi+G3V6kFM524 +h8I%)f;_FbAbJ=D%gEă,.ϰx*Oք HPW_= \ No newline at end of file diff --git a/secrets/global.nix.age b/secrets/global.nix.age index 5c98fc1..02e09a6 100644 Binary files a/secrets/global.nix.age and b/secrets/global.nix.age differ diff --git a/secrets/rekeyed/envoy/094b537b793ed00fcca8a4ff65da1dea-idmail-mailbox-pw_catch-all@5b58b7c64bdf6ac8.age b/secrets/rekeyed/envoy/094b537b793ed00fcca8a4ff65da1dea-idmail-mailbox-pw_catch-all@5b58b7c64bdf6ac8.age new file mode 100644 index 0000000..4f58527 --- /dev/null +++ b/secrets/rekeyed/envoy/094b537b793ed00fcca8a4ff65da1dea-idmail-mailbox-pw_catch-all@5b58b7c64bdf6ac8.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w OkYHAta0AExLlkMIAHvjY+DKkvhMPvQ75eI57PbQgWo +Y9bzTu2PQOMUNPf5374N4UyTQzPSnOs516jbKFacsvw +-> &-grease +yM59yW9IXM7h4kU81cj2P61jg5Rr2uk4FnS9dGlSVhOmYMADIy2mgt9huk2/CICB +WBFmMlsq +--- mqzSNgjR/BjsBU8pa9NKgmEFaVagLsTe5SE6ZehxC3s +|2cjGH> h}۠cGڳXƺ* +]XIbb-_n\ؔSt\XO \ No newline at end of file diff --git a/secrets/rekeyed/envoy/1220927bbc345582ca53f7d8960b655d-idmail-user-pw_admin.age b/secrets/rekeyed/envoy/1220927bbc345582ca53f7d8960b655d-idmail-user-pw_admin.age new file mode 100644 index 0000000..d2fa92d --- /dev/null +++ b/secrets/rekeyed/envoy/1220927bbc345582ca53f7d8960b655d-idmail-user-pw_admin.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w 8lcufW1HozxdF54nm+LXLLjJDUskQRyb/8HCxOOM6lc +eJHF9oPqt4tHAYxymcPclZzXY94FmW06SxGIxO2X43U +-> {-grease kn6_3P Dqd! +P3/hh9OYfA +--- Z67nmrfzCH0yLCbCXTQlwoN+MkFNoj744bah/j6nG+o +\FAoT ޟ_LLb&=vO +sy,@96t%v4LKCtɫf P \ No newline at end of file diff --git a/secrets/rekeyed/envoy/1b5d4ce27d2fc2444e991926c3b9e0fb-idmail-mailbox-hash_catch-all@7b098b000a97e947.age b/secrets/rekeyed/envoy/1b5d4ce27d2fc2444e991926c3b9e0fb-idmail-mailbox-hash_catch-all@7b098b000a97e947.age new file mode 100644 index 0000000..e419950 --- /dev/null +++ b/secrets/rekeyed/envoy/1b5d4ce27d2fc2444e991926c3b9e0fb-idmail-mailbox-hash_catch-all@7b098b000a97e947.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w CZ//VhaWYODA2wjXJOQ/+KUEVBUK/wEUHcgWwAokHDs +3xrPcXRvnyZc0EXnwQ0BdEXlhIUKIlcnD05IMBmEGGg +-> O>P`waLd-grease Svn~RD c&N3jclb R=! y=IbV#Ix +FPMA/wSTJiTd1P76HlC7Br4yVj77356/MH2lZVkJpeh/KFSl3X20Ap6iL528TGXb +CQ +--- /VZfZw9RFXnpXzTAna7XINY8onqDPgFNwQqlT/Py2Sg +s||O.0`]5qnkъ0QN6]O+,Z2e{ϊMu3{Q1ou|&mXl@8f #>&4 :MR=O1?ˠIJ>t*? Ɣs=1]ds^f{iH3ٹNsy"x!PӏJո*tGk6==ZJIzd+؃s T1,d$su|PɽR[R׮q3ѳ/8=4 \ No newline at end of file diff --git a/secrets/rekeyed/envoy/239f1af6d431b122fe07891d57fdf9f0-idmail-user-hash_admin.age b/secrets/rekeyed/envoy/239f1af6d431b122fe07891d57fdf9f0-idmail-user-hash_admin.age new file mode 100644 index 0000000..1071618 --- /dev/null +++ b/secrets/rekeyed/envoy/239f1af6d431b122fe07891d57fdf9f0-idmail-user-hash_admin.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w HoQnsVVkcyaZFasO5JXGHHxMBIoOSxupWY0tNreVeys +Wjz8Ns9/tue5JxMhq2MBC2iMhgLktIv2jTeQ5vEDo3Y +-> D-:-grease _CE!K o4V x<\ YYr>ZN9K +BiZxrEOLoSFc2HmOmOKnqK7Vj7KxsJkKOak41Z8AX4HZjQ+eT74dVX10SuejC5ZF +DTGKAM8eGljUOwvbU7aghGuFI78yKqn0ncsieNAwFb4 +--- Wo9h1/P17v0i5Hb9K100Wpn7dtUNTW2M2rjNAb5RXbs +[RD+xAO3Aƥ%tD, ʙ{vBBS ssh-ed25519 rz300w go7St2w4V+OeN5VgddWbw0WHuMJrZFNAE6ybU9tAbmI -sGjDHvZO56PPiIB0CvCuR1tyk2UzObeZk4IRoi+hvWA --> wxzPB1{z-grease {^`is<&c [D`g< -Gurn/IfyXKKbuyKJNnlHfxwSOBKyqj3SlW3cxqcw6CwoL9Gc0UXeWlOgEHPzas9L -v2un ---- dmrjPRsNFeNkTPWOD1MbORG3X2AuOBp1lbFIS64kPyg -8 (yZ\{j~Zɨn dHUƱw3?n nQP>P8J0 "_cHtpNh=8%HEuHr.Q+up4\oTN[nX!t;z \ No newline at end of file diff --git a/secrets/rekeyed/envoy/607fa10823f4768ee427becfcb98e12e-idmail-mailbox-pw_catch-all@30a80c5c819a6d2f.age b/secrets/rekeyed/envoy/607fa10823f4768ee427becfcb98e12e-idmail-mailbox-pw_catch-all@30a80c5c819a6d2f.age new file mode 100644 index 0000000..655657d --- /dev/null +++ b/secrets/rekeyed/envoy/607fa10823f4768ee427becfcb98e12e-idmail-mailbox-pw_catch-all@30a80c5c819a6d2f.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w 9xHKoTsXryIPchQHpj0TCkrjYzJL73X9E4PatTkpcQ4 +uznzwCWVlaSkd3TsgeUE7jIqPGEYtrorBAP6Q2ep4zY +-> x-grease KQn7 +vP56IKkmO+GVptk+iworBsPIpT7AqnMISw8yHHhCNR2Ihy77KCjBscM +--- fEohwNhvtx1ArxQ7L5qnFjF9UE/0SaLRGnXB2rjuW1A +U S&Eujnn + +DBeE^V+igZ/7# l=BЭC2')Hq \ No newline at end of file diff --git a/secrets/rekeyed/envoy/65fadf7ccfb558182fa099b76c0526db-idmail-mailbox-pw_catch-all@7b098b000a97e947.age b/secrets/rekeyed/envoy/65fadf7ccfb558182fa099b76c0526db-idmail-mailbox-pw_catch-all@7b098b000a97e947.age new file mode 100644 index 0000000..32540a7 --- /dev/null +++ b/secrets/rekeyed/envoy/65fadf7ccfb558182fa099b76c0526db-idmail-mailbox-pw_catch-all@7b098b000a97e947.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w N9mUWEbdNtvw4jZskXt2ZGzBwXxNGIcAIgQWSNtu9zw +7iNU3zvlMWfa4iXY7BVqlCzRMaLlsC+0quWQwUYUozk +-> P9[M-grease +GpkRAuOj5FHe5xuzeZv6mh5PKUWMtyRqC1iVoitoE7REUB6rpJ8oXvBPo173s43G +9vHQhmkeU1jEe/i8W/8iClm37FlPoA6OVQSmybGRiFuNWcsBOWi9l3kYn/bX +--- mhVs9W8Q0piMYZ5JV55ayDpTC13cIdp+jfpD4cy1TK4 +ސ+N3vi̾DMf!%9I]RN%8\?ͽPt$%7 q! \ No newline at end of file diff --git a/secrets/rekeyed/envoy/69b72d5bb1fbe6b941678114b8bc3779-idmail-mailbox-pw_catch-all@cde738bc7ba35556.age b/secrets/rekeyed/envoy/69b72d5bb1fbe6b941678114b8bc3779-idmail-mailbox-pw_catch-all@cde738bc7ba35556.age new file mode 100644 index 0000000..d50de1b Binary files /dev/null and b/secrets/rekeyed/envoy/69b72d5bb1fbe6b941678114b8bc3779-idmail-mailbox-pw_catch-all@cde738bc7ba35556.age differ diff --git a/secrets/rekeyed/envoy/825a81b7e683a3e0e255547043cacaed-idmail-mailbox-pw_catch-all@2171ec5b4ea361de.age b/secrets/rekeyed/envoy/825a81b7e683a3e0e255547043cacaed-idmail-mailbox-pw_catch-all@2171ec5b4ea361de.age new file mode 100644 index 0000000..2a99490 --- /dev/null +++ b/secrets/rekeyed/envoy/825a81b7e683a3e0e255547043cacaed-idmail-mailbox-pw_catch-all@2171ec5b4ea361de.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w S826+T9SqnIU4aCCCUdse0dfyoep8biPZpPcJd9XbxE +9hs1+nSJCo0Y6K+bPGt4Dg78WFVDwssNzrTw6o3GiJI +-> 7W\[-grease HSm n^&7 M*nP[ uDc +M2eA0EryPobxGD9Ekug7PhY/9Lkh9afVQMGxFQlamPkYKzdq1VZCA+e3r/+cQ5Q8 +zPicDLWHBGB6ChELz61Bx6zwZrofiSa/cZcqeXTViUzfusY +--- fSUlFOyenk+vxDafcml8aJdVHY0MAOCU8J4Mj3Tr21o +\ԭV<01 l4$ruW صCܹʿu`ձ/HefK5V.)Eu \ No newline at end of file diff --git a/secrets/rekeyed/envoy/8a0a79c570fe4367032a6dc2b07b8727-stalwart-admin-pw.age b/secrets/rekeyed/envoy/8a0a79c570fe4367032a6dc2b07b8727-stalwart-admin-pw.age new file mode 100644 index 0000000..0acc1c0 --- /dev/null +++ b/secrets/rekeyed/envoy/8a0a79c570fe4367032a6dc2b07b8727-stalwart-admin-pw.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w 0J9u3JGS+t6kiwgInZSh6LrbgteuGuYDMAYiIXsjiS0 +eYhHL5ouC7oMuNQwhMXYYAK21tJ4aOgqnV6lveENneo +-> qXi1$-grease 2 o}0~mZv# N|"yDa +xJWfySLDpLi/yu14kUAB+3CWlb6jiweScOHJG23o +--- FrqyOGzxhzWInvDZes975yLYXR0s6Om/tdVPQqZsKCs +p:q CB$7=~D2!+tw؀'(/@ B̞ǭ^"Ѽl_&I;ud] \ No newline at end of file diff --git a/secrets/rekeyed/envoy/8b788b5e8f46ee2858a4b0593d038152-idmail-mailbox-hash_catch-all@39e88e1845ef6176.age b/secrets/rekeyed/envoy/8b788b5e8f46ee2858a4b0593d038152-idmail-mailbox-hash_catch-all@39e88e1845ef6176.age new file mode 100644 index 0000000..94380df Binary files /dev/null and b/secrets/rekeyed/envoy/8b788b5e8f46ee2858a4b0593d038152-idmail-mailbox-hash_catch-all@39e88e1845ef6176.age differ diff --git a/secrets/rekeyed/envoy/98f465c979b3c50466d381121cd46cab-idmail-mailbox-hash_catch-all@cde738bc7ba35556.age b/secrets/rekeyed/envoy/98f465c979b3c50466d381121cd46cab-idmail-mailbox-hash_catch-all@cde738bc7ba35556.age new file mode 100644 index 0000000..3f3991d --- /dev/null +++ b/secrets/rekeyed/envoy/98f465c979b3c50466d381121cd46cab-idmail-mailbox-hash_catch-all@cde738bc7ba35556.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w Z9bxq/m67wt27YLFMGDc/mRCwpOYWoyleE1kq6ULF2w +TC9+IRTAIoZyK4Zf9c3WO29r7Ofzey5oMXib/LmQblQ +-> Gp"-grease hzbGw mS [pe +LKBfjRckJwOjFNHjltM/O+16s+K/tzItw4I3+JOCPQZ1eA +--- ygl3F9EOdj2RhG5GADVUbguGvWIPxvRTJsWHnT2hbys +6g :2{3RA*R0a‹\U@> D?d`;XcGg/{=æ~cx]n3xWtjy {ٟ6[ډpүI/7X~]͵Gr Jsd_S|Fs%XUy! +͐<@!jĒK14O6t] #7D%Fs#cH1~,N[+A'-yCюΈHW!hM c45LB&"L +-0}s`!ff +Dm? \ No newline at end of file diff --git a/secrets/rekeyed/envoy/acf0b090d94289aa33a7abe02bb4b0e1-idmail-mailbox-pw_catch-all@b3ad8b0f0313feef.age b/secrets/rekeyed/envoy/acf0b090d94289aa33a7abe02bb4b0e1-idmail-mailbox-pw_catch-all@b3ad8b0f0313feef.age new file mode 100644 index 0000000..4270d60 --- /dev/null +++ b/secrets/rekeyed/envoy/acf0b090d94289aa33a7abe02bb4b0e1-idmail-mailbox-pw_catch-all@b3ad8b0f0313feef.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w EJmmMDqhjpdje5w2XhXrTEmf7bM+z7nSOWBkdaDF41w +QTTc70EUolP/ED6dzSbmMlkGUH0tufl1nDw89Naamsg +-> kh!x-grease V \ZB/O j*.b6m' +elk7wq0IFo0Wz03+g4Lh +--- P6ertGMfxGfckpYEcjd996vcGoRKAinM+k1dV/ExcOc +8WY; __SV:p" V܎О~L[xoa +YFk?]+d \ No newline at end of file diff --git a/secrets/rekeyed/envoy/b9197385e28d009cf8ac7eeb1925f062-idmail-mailbox-hash_catch-all@2171ec5b4ea361de.age b/secrets/rekeyed/envoy/b9197385e28d009cf8ac7eeb1925f062-idmail-mailbox-hash_catch-all@2171ec5b4ea361de.age new file mode 100644 index 0000000..dca84e6 Binary files /dev/null and b/secrets/rekeyed/envoy/b9197385e28d009cf8ac7eeb1925f062-idmail-mailbox-hash_catch-all@2171ec5b4ea361de.age differ diff --git a/secrets/rekeyed/envoy/baa0cd6fc5d610bf012834323d0febcb-stalwart-admin-hash.age b/secrets/rekeyed/envoy/baa0cd6fc5d610bf012834323d0febcb-stalwart-admin-hash.age new file mode 100644 index 0000000..76e9639 Binary files /dev/null and b/secrets/rekeyed/envoy/baa0cd6fc5d610bf012834323d0febcb-stalwart-admin-hash.age differ diff --git a/secrets/rekeyed/envoy/c738bec281d57a1c1e7a8510949100da-idmail-mailbox-hash_catch-all@30a80c5c819a6d2f.age b/secrets/rekeyed/envoy/c738bec281d57a1c1e7a8510949100da-idmail-mailbox-hash_catch-all@30a80c5c819a6d2f.age new file mode 100644 index 0000000..af03987 Binary files /dev/null and b/secrets/rekeyed/envoy/c738bec281d57a1c1e7a8510949100da-idmail-mailbox-hash_catch-all@30a80c5c819a6d2f.age differ diff --git a/secrets/rekeyed/envoy/dceddc3043473dfa8d8c1976e9810622-idmail-mailbox-pw_catch-all@477075fe5513c902.age b/secrets/rekeyed/envoy/dceddc3043473dfa8d8c1976e9810622-idmail-mailbox-pw_catch-all@477075fe5513c902.age new file mode 100644 index 0000000..17ed851 --- /dev/null +++ b/secrets/rekeyed/envoy/dceddc3043473dfa8d8c1976e9810622-idmail-mailbox-pw_catch-all@477075fe5513c902.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 rz300w SQoLq+Es6/NvmUCwNaPSMloLPpQ9GKbu6UES2VP03VU +Dzn8KF4fDL+NnIO3iOSiC/K0w4RGxau00v0oLbpDLOE +-> Whx!)}-grease +CQXmmH5hUagWqNhk +--- hUTqCDD4arRwuHf3O1BAbiUxqopLpib1gJRkxqh37RA +>+!jdHmٞe=qISG@i>뽥 , +EFOغ'og-1FVʸ \ No newline at end of file diff --git a/secrets/rekeyed/envoy/e31e38256af974e40952071d88c6732f-idmail-mailbox-hash_catch-all@b3ad8b0f0313feef.age b/secrets/rekeyed/envoy/e31e38256af974e40952071d88c6732f-idmail-mailbox-hash_catch-all@b3ad8b0f0313feef.age new file mode 100644 index 0000000..6f5d54d Binary files /dev/null and b/secrets/rekeyed/envoy/e31e38256af974e40952071d88c6732f-idmail-mailbox-hash_catch-all@b3ad8b0f0313feef.age differ diff --git a/secrets/rekeyed/envoy/ef5fc4197f5f066ec09387f4769f0cd2-idmail-mailbox-hash_catch-all@5b58b7c64bdf6ac8.age b/secrets/rekeyed/envoy/ef5fc4197f5f066ec09387f4769f0cd2-idmail-mailbox-hash_catch-all@5b58b7c64bdf6ac8.age new file mode 100644 index 0000000..f77df64 Binary files /dev/null and b/secrets/rekeyed/envoy/ef5fc4197f5f066ec09387f4769f0cd2-idmail-mailbox-hash_catch-all@5b58b7c64bdf6ac8.age differ