feat: start migrating steveej-t14 and sj-vps-htz-0 to sops

nix/os/containers/mailserver.nix

@@ -1,4 +1,5 @@
 {
+  repoFlake,
   hostAddress,
   localAddress,
   imapsPort ? 993,
@@ -7,10 +8,34 @@
 }: let
   passwords = import ../../variables/passwords.crypt.nix;
 in {
-  config = {pkgs, ...}: {
+  config = {
+    pkgs,
+    config,
+    ...
+  }: {
     system.stateVersion = "21.11"; # Did you read the comment?
 
-    imports = [../profiles/containers/configuration.nix ../profiles/common/user.nix];
+    imports = [
+      ../profiles/containers/configuration.nix
+
+      repoFlake.inputs.sops-nix.nixosModules.sops
+      ../profiles/common/user.nix
+    ];
+
+    # sops.defaultSopsFile = ./mailserver_secrets.yaml;
+    sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+    sops.secrets.email_mailStefanjunkerDe = {
+      sopsFile = ./mailserver_secrets.yaml;
+      owner = config.users.users.steveej.name;
+    };
+    sops.secrets.email_schtifATwebDe = {
+      sopsFile = ./mailserver_secrets.yaml;
+      owner = config.users.users.steveej.name;
+    };
+    sops.secrets.email_dovecot_steveej = {
+      sopsFile = ./mailserver_secrets.yaml;
+      owner = config.users.users.dovecot2.name;
+    };
 
     networking.firewall.enable = false;
 
@@ -54,9 +79,10 @@ in {
       '';
     };
 
-    environment.etc."dovecot/users".text = ''
-      steveej:${passwords.email.steveej}
-    '';
+    # environment.etc."dovecot/users".text = ''
+    #   steveej:${passwords.email.steveej}
+    # '';
+    environment.etc."dovecot/users".source = config.sops.secrets.email_dovecot_steveej.path;
 
     systemd.services.steveej-getmail-stefanjunker = {
       enable = true;
@@ -79,7 +105,7 @@ in {
           server = ssl0.ovh.net
           port = 993
           username = mail@stefanjunker.de
-          password = ${passwords.email.mailStefanjunkerDe}
+          password_command = ("${pkgs.coreutils}/bin/cat", "${config.sops.secrets.email_mailStefanjunkerDe.path}")
           mailboxes = ('INBOX',)
 
           [destination]
@@ -112,7 +138,7 @@ in {
           server = imap.web.de
           port = 993
           username = schtif
-          password = ${passwords.email.schtifATwebDe}
+          password_command = ("${pkgs.coreutils}/bin/cat", "${config.sops.secrets.email_schtifATwebDe.path}")
           mailboxes = ('INBOX',)
 
           [destination]
@@ -128,6 +154,9 @@ in {
   inherit autoStart;
 
   bindMounts = {
+    "/etc/ssh/ssh_host_ed25519_key".isReadOnly = true;
+    "/etc/ssh/ssh_host_ed25519_key.pub".isReadOnly = true;
+
     "/etc/secrets/" = {
       hostPath = "/var/lib/container-volumes/mailserver/etc-secrets";
       isReadOnly = false;

nix/os/containers/mailserver_secrets.yaml

@@ -0,0 +1,38 @@
+email_mailStefanjunkerDe: ENC[AES256_GCM,data:DsPwNMahaSKFF8mof2qGxj6cIdYZeL6uRr4=,iv:2lamFXYKrGkHey5QCXBlEODYksDuJDyW3MYpz/7qj7s=,tag:2L34qD0XSbfsl0djvgYJYw==,type:str]
+email_schtifATwebDe: ENC[AES256_GCM,data:OOmxkHcM25A+rSmPE1lmvUylv0TT2qWWeA==,iv:ysnRyv4WwbnovgEZcwmk1Rdo6U7gBWDFvGIxgF/m/5A=,tag:9b7q+mceiDx5y8qVVHjBhw==,type:str]
+email_dovecot_steveej: ENC[AES256_GCM,data:nZJX2ZIe2pJTzBIU/XRZaiiy9NmUtJydaOvSAQT3icCEeLTvgah48mgrz14eGPuOEupVqKII5jpHw3Xid+QWzdIels0B9M4+GgVT85yVAaPQKw==,iv:vb2bKtgeJI4fvRfKoR8AoBpv9WOkAAKQ3DzMInGF4SA=,tag:p6q0rfyG0g1hF8PR476TZQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age18dmqd7r7fanrfmdxsvwgv9psvhs3hw5ydpvw0na0dv3dlrg4rs3q2wpvgv
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWaE9nNytUbXhWeWZYWndn
+            R3pMV3N1NjJPK2gzUDl2YitxWEU4NUFPRUJ3Cm1tMGhGcU56bSs5SUIzRmhqVHN2
+            dXIzYlkvS1JnWnladGdXTnRKMXNOWncKLS0tIGhyRFhFV1VRVXVYN1pJWjNFd1Rj
+            bENCWmVNUEJyZFBpRmYwbWVndFJGcUEKzvkGz3WycSrU4qPcBhs4cSCn/9TQ62sl
+            T6TuDra97qJJ1Pg9VZGHT/OoSleLA4s0qpNlAxnAnNaO0conTsREZQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-07-02T21:16:00Z"
+    mac: ENC[AES256_GCM,data:bDHu/9Hz2lyzoA92yA4K9/oaO6gxDjog8OSoEduE4Q8KE6VObzkHHvMwsPR46LE74dtRy9LNEXcMTWQzJBYoaKGi+wz0IJ/wy8Japrbu0Kiwx3dIeY0mg/OvBGlsAybvbDpfSjCsxVpgg7g1jQNntejljv1WHp4zD0hKn9hdYm0=,iv:MUaGwoPaHEZQgoTHXxkhMHdTGaIgk0UYx9qwfpt4Uds=,tag:qLa2QBTFbs/BdOH8TJWVxw==,type:str]
+    pgp:
+        - created_at: "2023-07-02T20:30:30Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcBMA0SHG/zF3227AQgAli6PQTNwh9N5Oo1LJvHysQNdxdZAq4QbfcwcIfpJIDds
+            0TQs28EeSttv47P2ga4Nb1O5dVUnlvwbP+uV9RbioYF4LfZ2/uNlS1lSGwsLbPcf
+            SsY+U2WvpJgyo3EWQRusR/OXLFg0EdqDPDseH1w1u8tGALDrewre5oBjrMa0GRbb
+            5F8lK/FVxSJxz70UkHgE7c6pSqPpznlgVduUwoOWnlhTw4aet7lLik+/C9K7LBDc
+            Q04sW1W2yqYr2882xPAUwfBhgfZQ1Uld5aDwqwPH+1Ttx26e7JrGSFaIX8GTVVpc
+            RJqN6uman5at3lOaEKXS1qf7T9ZI003CvdFwHS1G89JRAemdeK4bur5wS3VXBhDx
+            44fHgmDcOohHilTahwmyXCT70KjjHbd9665vAhsl0N9aOrOBdOgq0HmLjNzAQkz5
+            uGcEfsNiUXPngkNrh/Nvhh9w
+            =yHDZ
+            -----END PGP MESSAGE-----
+          fp: 6F7069FE6B96E894E60EC45C6EEFA706CB17E89B
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3