migrate to nix flake

systems/LoutreOS/configuration.nix

@@ -4,10 +4,6 @@
 
 { config, pkgs, ... }:
 
-let
-  gitRev = "4c45e960e797d660358a11723e736afee3998261";
-  nixpkgs = fetchTarball "https://github.com/nyanloutre/nixpkgs/archive/${gitRev}.tar.gz";
-in
 {
   imports = [
     ../common-cli.nix
@@ -27,10 +23,12 @@ in
     tmpOnTmpfs = true;
   };
 
-  nix.nixPath = [
-    "nixpkgs=${nixpkgs}"
-    "nixos-config=/etc/nixos/configuration.nix"
-  ];
+  nix = {
+    package = pkgs.nixUnstable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
 
   documentation.nixos.enable = false;
 

systems/LoutreOS/hardware-configuration.nix

@@ -4,10 +4,6 @@
 { config, lib, pkgs, ... }:
 
 {
-  imports =
-    [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
-    ];
-
   boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

systems/LoutreOS/services.nix

@@ -26,7 +26,6 @@ in
 
 {
   imports = [
-    ../../services/mail-server.nix
     ../../services/python-ci.nix
     ../../services/sdtdserver.nix
     # ../../containers/vsftpd.nix
@@ -36,7 +35,62 @@ in
     ./web.nix
   ];
 
+  security.acme.certs = {
+    "${domaine}" = {
+      extraDomainNames = [
+        "mail.${domaine}"
+      ];
+      postRun = ''
+        systemctl reload dovecot2.service
+      '';
+    };
+  };
+
+  mailserver = {
+    enable = true;
+    fqdn = "mail.${domaine}";
+    domains = [ domaine ];
+
+    # A list of all login accounts. To create the password hashes, use
+    # mkpasswd -m sha-512 "super secret password"
+    loginAccounts = {
+      "paul@${domaine}" = {
+        hashedPassword = "$6$8wWQbtqVqUoH8$pQKg0bZPcjCbuPvyhjJ1lQy949M/AgfmAye/hDEIVUnCfwtlUxC1yj8CBHpNKeiiXhd8IUqk9r0/IJNvB6okf0";
+      };
+      "claire@${domaine}" = {
+        hashedPassword = "$6$Y.vlWP9./DX$NEQQOLzYftbHOvXDkKdBYFAjzIjh8mlpomDuQRq6qkkZijrdy/p6jSbrpBLhoWwVmj4j1OWekHU1f4C9xCNJk.";
+      };
+    };
+
+    # Certificate setup
+    certificateScheme = 1;
+    certificateFile = "/var/lib/acme/${domaine}/fullchain.pem";
+    keyFile = "/var/lib/acme/${domaine}/key.pem";
+
+    # Enable IMAP and POP3
+    enableImap = true;
+    enablePop3 = true;
+    enableImapSsl = true;
+    enablePop3Ssl = true;
+
+    # Enable the ManageSieve protocol
+    enableManageSieve = true;
+  };
+
   services = {
+    postfix = {
+      relayHost = "mailvps.nyanlout.re";
+      relayPort = 587;
+      config = {
+        smtp_tls_cert_file = lib.mkForce "/var/lib/postfix/postfixrelay.crt";
+        smtp_tls_key_file = lib.mkForce "/var/lib/postfix/postfixrelay.key";
+      };
+    };
+
+    rspamd.workers.controller.extraConfig = ''
+      secure_ip = ["127.0.0.1", "10.30.135.71"];
+    '';
+
     redis.enable = true;
 
     logrotate = {
@@ -58,11 +112,6 @@ in
 
     fstrim.enable = true;
 
-    mailserver = {
-      enable = true;
-      domaine = domaine;
-    };
-
     syncthing = {
       enable = true;
       dataDir = "/var/lib/syncthing";

systems/LoutreOS/web.nix

@@ -88,7 +88,6 @@ in
       '';
       sso = {
         enable = true;
-        environmentFile = "/mnt/secrets/nginx-sso.env";
         configuration = {
           listen = {
             addr = "127.0.0.1";
@@ -325,4 +324,6 @@ in
     wantedBy = [ "sockets.target" ];
     listenStreams = [ "/run/site-musique.sock" ];
   };
+
+  systemd.services.nginx-sso.serviceConfig.EnvironmentFile = "/mnt/secrets/nginx-sso.env";
 }