migrate to impermanence?

flake.lock

@@ -91,6 +91,22 @@
         "type": "github"
       }
     },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -130,6 +146,22 @@
       }
     },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1751685974,
@@ -224,6 +256,54 @@
         "type": "github"
       }
     },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "nixos-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixos-mailserver",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "gnome-shell": {
       "flake": false,
       "locked": {
@@ -332,6 +412,29 @@
         "type": "github"
       }
     },
+    "nixos-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766321686,
+        "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1766651565,
@@ -432,7 +535,7 @@
     },
     "nvf": {
       "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts_2",
         "mnw": "mnw",
         "ndg": "ndg",
@@ -480,6 +583,7 @@
         "agenix": "agenix",
         "home-manager": "home-manager_2",
         "impermanence": "impermanence",
+        "nixos-mailserver": "nixos-mailserver",
         "nixpkgs": "nixpkgs",
         "noshell": "noshell",
         "nur": "nur",

flake.nix

@@ -9,6 +9,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     impermanence.url = "github:nix-community/impermanence";
+    nixos-mailserver = {
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     noshell = {
       url = "github:viperML/noshell";
@@ -35,6 +39,7 @@
     agenix,
     home-manager,
     impermanence,
+    nixos-mailserver,
     nixpkgs,
     noshell,
     nur,
@@ -56,6 +61,7 @@
             ./secrets.nix
             impermanence.nixosModules.impermanence
             agenix.nixosModules.default
+            nixos-mailserver.nixosModule
             phoenix.nixosModules.default
           ];
       };

machines.nix

@@ -10,8 +10,6 @@
   "109-199-104-83" = {
     hostname = "109-199-104-83";
     system = "x86_64-linux";
-    users = [
+    users = [];
-      "mtgmonkey"
-    ];
   };
 }

machines/109-199-104-83/configuration.nix

@@ -4,10 +4,58 @@
   machine,
   ...
 }: {
+  imports = [
+    ./impermanence.nix
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+  # roundcube config
+  services.roundcube = {
+    enable = true;
+    hostName = "webmail.${config.networking.domain}";
+    extraConfig = ''
+      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+    '';
+  };
+
+  # mailserver config
+  mailserver = {
+    enable = true;
+    stateVersion = 3;
+    fqdn = "mail.${config.networking.domain}";
+    domains = ["${config.networking.domain}"];
+    x509.useACMEHost = config.mailserver.fqdn;
+    loginAccounts = {
+      "test@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.secret3.path;
+      };
+    };
+  };
+
+  # cert config
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "mtgmonket@gmail.com";
+  };
+  services.nginx = {
+    enable = true;
+    virtualHosts."mail.${config.networking.domain}" = {
+      forceSSL = true;
+      enableACME = true;
+    };
+  };
+
+  # system config
   system.stateVersion = "25.11";
   nix.settings.experimental-features = ["flakes" "nix-command"];
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
   fileSystems."/" = {
+    device = "none";
+    fsType = "tmpfs";
+    options = ["defaults" "size=60%" "mode=755"];
+  };
+  fileSystems."/nix" = {
     device = "/dev/sda1";
     fsType = "ext4";
   };
@@ -22,6 +70,11 @@
     usePredictableInterfaceNames = true;
     hostName = machine.hostname;
     domain = "galaxious.de";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [80 443];
+      allowedUDPPorts = [80 443];
+    };
   };
   systemd.network = {
     enable = true;

machines/109-199-104-83/impermanence.nix

@@ -0,0 +1,30 @@
+{
+  environment.persistence."/nix/persist" = {
+    enable = true;
+    hideMounts = true;
+    directories = [
+      # logs
+      "/var/log"
+      "/var/lib/systemd/coredump"
+
+      # users
+      "/var/lib/nixos"
+
+      # private ssh keys
+      "/etc/ssh"
+
+      # mailserver
+      "/var/vmail"
+      "/var/dkim"
+      "/var/lib/dovecot"
+      "/var/lib/postfix"
+      "/var/lib/postgresql"
+      "/var/lib/redis-rspamd"
+      "/var/lib/roundcube"
+      "/var/lib/secrets"
+    ];
+    files = [
+      "/etc/machine-id"
+    ];
+  };
+}

pub-keys.nix

@@ -3,6 +3,7 @@
     secret0.file = ./secrets/secret0.age;
     secret1.file = ./secrets/secret1.age;
     secret2.file = ./secrets/secret2.age;
+    secret3.file = ./secrets/secret3.age;
   };
   pub-keys = {
     ssh = {

secrets/secret3.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg slLOkD/9TAYOuZ/g5U4NvPWUlmYZeie12xzggioviw0
+E0uAj4RMgv7DTJpvtEO54G9XHNLFOgFflR54Cl6/X8g
+-> ssh-ed25519 UHxfvA xHFujOdegur0PLNHZP+h5RxHhVD2K906NZx7nprMkUs
+PdDxzD5QBdE/yWPMnF+CDGROEpE4nYvg12v1G3QK9XI
+-> ssh-ed25519 Xoin5w YWsO9HtEFB79+aKr6eWi5Sg5geKfzT+IrDy2L5qEmx4
+sXLRmcRDyAv64nSGs8QXcHmKYO+F11Pzea1EVGmpEys
+--- Sjg8SqkkEEL4X0G1GOUoHO702ZtrM0hMniIdS7yIsDA
+'<27>B<EFBFBD><42>(<28><>7Dϓ=<3D><>h<EFBFBD><10><>h	f<>ɮ<13>xT<78><54>!K.<2E><1D><>~س<>,<2C>ߓ<>D|<7C><>+p<><70><EFBFBD>"<22>t<EFBFBD><74>G<EFBFBD>y<EFBFBD>Q<EFBFBD><51>RcP<63>Q<EFBFBD><51>Q<><51>

secrets/secrets.nix

@@ -7,4 +7,5 @@ in {
   "secret0.age".publicKeys = [andromeda lenovo];
   "secret1.age".publicKeys = [andromeda lenovo];
   "secret2.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "secret3.age".publicKeys = [andromeda lenovo _109-199-104-83];
 }

users/andromeda/home.nix

@@ -179,16 +179,15 @@ in {
     };
     gh.enable = true;
     home-manager.enable = true;
-    firefox.enable = true;
+    firefox = {
-    #    librewolf = {
+      enable = true;
-    #      enable = true;
+      package = pkgs.firefox.override {
-    #      package = pkgs.librewolf.override {
+        cfg.enableTridactylNative = true;
-    #        cfg.enableTridactylNative = true;
+      };
-    #      };
+      profiles.${config.home.username}.extensions.packages = [
-    #      profiles.${config.home.username}.extensions.packages = [
+        pkgs.nur.repos.rycee.firefox-addons.tridactyl
-    #        pkgs.nur.repos.rycee.firefox-addons.tridactyl
+      ];
-    #      ];
+    };
-    #    };
     lsd.enable = true;
     nvf = {
       enable = true;