6 files changed, 219 insertions, 5 deletions

diff --git a/accounts/gkleen@skadhi/default.nix b/accounts/gkleen@skadhi/default.nix
index 99a592c5..e4b35a78 100644
--- a/accounts/gkleen@skadhi/default.nix
+++ b/accounts/gkleen@skadhi/default.nix
@@ -3,7 +3,7 @@ let
   user = config.users.users.${userName};
 in {
   imports = [
-    ./greetd.nix ./rzm
+    ./greetd.nix ./rzm ./email
   ] ++ (with flake.nixosModules.userProfiles.${userName}; [
     zsh mpv yt-dlp
   ]) ++ (with flake.nixosModules.systemProfiles; [
@@ -72,6 +72,8 @@ in {
           "Downloads" "documents" "screenshots" "media" "projects"
           ".local/share/direnv"
           ".config/Element" ".thunderbird"
+          ".config/chromium"
+          ".config/sops"
         ];
       };
 
@@ -284,6 +286,8 @@ in {
         enable = true;
         serverUrl = "https://etesync.yggdrasil.li";
       };
+
+      programs.chromium.enable = true;
     };
   };
 }
diff --git a/accounts/gkleen@skadhi/email/default.nix b/accounts/gkleen@skadhi/email/default.nix
new file mode 100644
index 00000000..aaf15901
--- /dev/null
+++ b/accounts/gkleen@skadhi/email/default.nix
@@ -0,0 +1,111 @@
+{ config, lib, pkgs, ... }:
+{
+  services.postfix = {
+    enable = true;
+    enableSmtp = false;
+    enableSubmission = false;
+    setSendmail = true;
+    # networksStyle = "host";
+    settings.main = {
+      recpipient_delimiter = "+";
+      mydestination = [];
+      myhostname = "skadhi.midgard.yggdrasil";
+
+      mydomain = "yggdrasil.li";
+
+      local_transport = "error:5.1.1 No local delivery";
+      alias_database = [];
+      alias_maps = [];
+      local_recipient_maps = [];
+
+      inet_interfaces = "loopback-only";
+
+      message_size_limit = 0;
+
+      authorized_submit_users = "inline:{ gkleen= }";
+      authorized_flush_users = "inline:{ gkleen= }";
+      authorized_mailq_users = "inline:{ gkleen= }";
+
+      smtp_generic_maps = "inline:{ root=root+skadhi }";
+
+      mynetworks = ["127.0.0.0/8" "[::1]/128"];
+      smtpd_client_restrictions = ["permit_mynetworks" "reject"];
+      smtpd_relay_restrictions = ["permit_mynetworks" "reject"];
+
+      sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" ''
+        /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de
+        /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587
+        /@math(ematik)?\.(lmu|uni-muenchen)\.de$/ smtps:smtp.math.lmu.de:465
+        /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de
+      ''}'';
+      sender_bcc_maps = ''regexp:${pkgs.writeText "sender_bcc" ''
+        /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de
+        /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de
+      ''}'';
+      relayhost = ["[surtr.yggdrasil.li]:465"];
+      default_transport = "relay";
+
+      smtp_sasl_auth_enable = true;
+      smtp_sender_dependent_authentication = true;
+      smtp_sasl_tls_security_options = "noanonymous";
+      smtp_sasl_mechanism_filter = ["plain"];
+      smtp_sasl_password_maps = "regexp:/run/credentials/postfix.service/sasl_passwd";
+      smtp_cname_overrides_servername = false;
+      smtp_always_send_ehlo = true;
+      smtp_tls_security_level = "dane";
+
+      smtp_tls_loglevel = "1";
+      smtp_dns_support_level = "dnssec";
+    };
+    settings.master = {
+      submission = {
+        type = "inet";
+        private = false;
+        command = "smtpd";
+        args = [
+          "-o" "syslog_name=postfix/$service_name"
+        ];
+      };
+      smtp = { };
+      smtps = {
+        type = "unix";
+        private = true;
+        privileged = true;
+        chroot = false;
+        command = "smtp";
+        args = [
+          "-o" "smtp_tls_wrappermode=yes"
+          "-o" "smtp_tls_security_level=encrypt"
+        ];
+      };
+      relay = {
+        command = "smtp";
+        args = [
+          "-o" "smtp_fallback_relay="
+          "-o" "smtp_tls_security_level=verify"
+          "-o" "smtp_tls_wrappermode=yes"
+          "-o" "smtp_tls_cert_file=${./relay.crt}"
+          "-o" "smtp_tls_key_file=/run/credentials/postfix.service/relay.key"
+        ];
+      };
+    };
+  };
+
+  systemd.services.postfix = {
+    serviceConfig.LoadCredential = [
+      "sasl_passwd:${config.sops.secrets."postfix-sasl-passwd".path}"
+      "relay.key:${config.sops.secrets."relay-key".path}"
+    ];
+  };
+
+  sops.secrets = {
+    postfix-sasl-passwd = {
+      key = "sasl-passwd";
+      sopsFile = ./secrets.yaml;
+    };
+    relay-key = {
+      format = "binary";
+      sopsFile = ./relay.key;
+    };
+  };
+}
diff --git a/accounts/gkleen@skadhi/email/relay.crt b/accounts/gkleen@skadhi/email/relay.crt
new file mode 100644
index 00000000..ac13e7cb
--- /dev/null
+++ b/accounts/gkleen@skadhi/email/relay.crt
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBjDCCAQygAwIBAgIPQAAAAGgLfNoL/PSMAsutMAUGAytlcTAXMRUwEwYDVQQD
+DAx5Z2dkcmFzaWwubGkwHhcNMjUwNDI1MTIwOTQ1WhcNMzUwNDI2MTIxNDQ1WjAR
+MQ8wDQYDVQQDDAZna2xlZW4wKjAFBgMrZXADIQB3outi3/3F4YO7Q97WAAaMHW0a
+m+Blldrgee+EZnWnD6N1MHMwHwYDVR0jBBgwFoAUTtn+VjMw6Ge1f68KD8dT1CWn
+l3YwHQYDVR0OBBYEFFOa4rYZYMbXUVdKv98NB504GUhjMA4GA1UdDwEB/wQEAwID
+6DAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAUGAytlcQNzABC0
+0UgIt7gLZrU1TmzGoqPBris8R1DbKOJacicF5CU0MIIjHcX7mPFW8KtB4qm6KcPq
+kF6IaEPmgKpX3Nubk8HJik9vhIy9ysfINcVTvzXx8pO1bxbvREJRyA/apj10nzav
+yauId0cXHvN6g5RLAMsMAA==
+-----END CERTIFICATE-----
diff --git a/accounts/gkleen@skadhi/email/relay.key b/accounts/gkleen@skadhi/email/relay.key
new file mode 100644
index 00000000..109241d9
--- /dev/null
+++ b/accounts/gkleen@skadhi/email/relay.key
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:lBlTuzOS75pvRmcTKT4KhHMH44RlE2SvCFAUP+GfsXws1Uai7DZ1MmbhvxxCa+pcLW19+sQYxrXLRNZWby1yOeKBJ2UQeYV5LOk9LSL/WIE3FZkCo5Dv0O0gSFKjjb61WN22a4JnHbLWADf/mLT3GZv91XfvFDo=,iv:ho8wQH3UNzX9JPW5gVcUGtxZzdVwsMFus0Z4KYe5t48=,tag:dAgZyHOva2xVVhE1nTl+lg==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzZ2gxbU5YYVkvdkF0eTB2\nU25RL254NHp1UFlwTWtPSEpnSmp0cng1dkVjCnZuSU96V2R5OVMxcU9XSDhmT3Az\nWExhelo4Wi9nU2ZycCtyM2F0VWpVVjQKLS0tIFpHZmRNSU9aSk0yeUFkSytVaC9B\nTHBpU2RudDFHY2czYjdMZ2p5T0VPUWcKQzVYd29LnP7v5+tOatkjugEP8LGLr8Dj\nTNC8ZxVRqQwyiTM29elmzJMD1xY1unZi/jLGiDrZi7Arsc10npt2Sw==\n-----END AGE ENCRYPTED FILE-----\n",
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866"
+                        },
+                        {
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpVkltdnVzWUhDYjFPVm1w\nTmlDMGdHTlZkUVpuNEM0OGtHTkZ1ZE1jclJvCjZBUHo0NjF3S3UyWFRpV0lCREJO\nYlJpVXJ4TTMwMjBKVVF6a3RwSnZ5VWMKLS0tIGx6WkZZY0N1cGFwb0hsR3ZzOFdC\nRWxqcW5MR0JHVlBwcm43bFJKTTdaZWcKFETZni5oEHnj197CiHk56EtJO3labtFo\npe8jvh81iZIiLdZxhazhh25d3+GGT1NXtQwKcRIsGPBG5PJdul8aNg==\n-----END AGE ENCRYPTED FILE-----\n",
+                                "recipient": "age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e"
+                        }
+                ],
+                "lastmodified": "2025-04-25T12:14:44Z",
+                "mac": "ENC[AES256_GCM,data:pObl2bJA93az9E3Ya+hA3ekI8TKKZ9NNTi0KzmWZBOiQwi9FuQYtpnmmT80L1KXWyOKJV6wGdAri3mNe/ue2S0TziSbQ/4+Dj4ubFKgkH7thb5q2dFyxw5FzhYzRQiXFqD/pxcNN9uL0lQI2Al0Eci0zX8Kcd1rAQ6RzLEoSmco=,iv:zo/3QFKTUEDxLy1k5yyU7Z1JMZ7cKdYUc6GHjaTTZKQ=,tag:f63Eja3lBfwJCYAOyEt56g==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/accounts/gkleen@skadhi/email/secrets.yaml b/accounts/gkleen@skadhi/email/secrets.yaml
new file mode 100644
index 00000000..fa634212
--- /dev/null
+++ b/accounts/gkleen@skadhi/email/secrets.yaml
@@ -0,0 +1,25 @@
+sasl-passwd: ENC[AES256_GCM,data:L5QOQTEOplm9rQ+PuyDUl492ZTgIgZdRXNCNRaPQ4FLU+ha0GO7rjYWAOtvW7/oVdALrkQveSpBolnLG0nayvkjLpPuA6o9brR6bky52QmhOd8cYN9LMOhJcLJTwpUuvDesXkJD1mWA+ifuPnK6elVEfPuOndzMyw8MEvbPl53yCKQ7HOJc2nGvneD5QFkiHB9W9MmrR1gjGqaCSjZ0ahCnxe/Z2SwqccmBR9l60vt683RXMYbKNLDuSgE7HcXbzF9NstfnoSq7b332y/NgYsXvY0w+f6yPhsDuPhUXU+7gIcPb4+1TFOtdZP8uIPm1aLqG2nNKNhMGt23X8dD5Myy0FF6XmbTj43mDzKJahNel7pT91d+Vac5s08UeyUpQSjtrVMYneVTYbHEwiFPAD7S57LF0kZuE1aXIRF35g6XV3GB4rQDsrBsrZzn9vsGS12L2pdtYFVCvt/dLFlmd/GjPpm4JWyNSg,iv:fUEBrr1iby7+hK8ZesW+77HLMW93c6LpCcoJy8pgXUE=,tag:cW8vKVAebnJqo1gNNwDohQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpQVM4V3RZNTUyZzN4bERP
+            SnRhM2hOK2FzNDRzRTR0bG4yYk1YS0tMclZrCkIrQWdBcnBkeU1wbWVZOEN4T0lY
+            c0lnaWtidTJLQjV0c3Rzd3o3alNIekkKLS0tIG5lZjQ5MWZoVGNIaTROOXJpdDhC
+            R3hyNlcxN2RQRS9aOGI4RzVPbUtBY3MKBKWGmZjjqZ7CBwVniEF9VjhyWH0kZv56
+            7eWx3lOhb849izKM8EEjr50t1DqrvBLL4KStLq8fbNV5uPotGuKOwA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbStwZ0w5STFxcHNKNDhO
+            SnhZVHprVUlkUStvVXNpTW5RZ0dTSVpLWEZjCjdDa1ZtOU5KUjJxSHRlNy9WamJq
+            a0VEdUtiODdCL3RTeDlTc2NqY0Q1dDgKLS0tIGcwNkQxemVuSGw4V2RQNWp1cjhM
+            cHQ4WXBPNGJGRXZTL1kxSDhRb1c0ZVUKIhyhHihWR79vQBBNuaVLzIAFggmfdkM8
+            40/m+3OllYsTCvm55LdNVNjxQC8QnfsalgtIh+ZzUzhrjCksumqypw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e
+    lastmodified: "2022-02-02T14:45:23Z"
+    mac: ENC[AES256_GCM,data:UdM/VmdfqhYm1aFCHaO0mbJA/oyV/J2oKVVmGDa0Co3MWq9aWMqP726O+rLk36W0HOG4fmue//R1Q524au2hMW9bZUFzrubfQt2V78tZRZeHCJSRmOmi1D1EDdfPz9J3oWDvIEgIIsAk5H5EuuH0j6FILye6tzcomNGDAKZbwuc=,iv:a7dJAqkcroLp01gkGKV5gm6gTIIMa/9P8qJn44ISrw0=,tag:R9/6X6mgfVSLK7bmoWRnfQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.7.1
diff --git a/accounts/gkleen@skadhi/rzm/default.nix b/accounts/gkleen@skadhi/rzm/default.nix
index efe5468e..11d8af8b 100644
--- a/accounts/gkleen@skadhi/rzm/default.nix
+++ b/accounts/gkleen@skadhi/rzm/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 let
   mwnSubnetsPublic =
     [ "129.187.0.0/16" "141.40.0.0/16" "141.84.0.0/16"
@@ -98,9 +98,15 @@ in {
     };
 
     home-manager.users.gkleen = { sysConfig, config, ... }: {
-      home.persistence."/persistent".files = [
-        "rz.kdbx" ".config/Element-lmu"
-      ];
+      home.persistence."/persistent" = {
+        files = [
+          "rz.kdbx"
+        ];
+        directories = [
+          ".config/Element-lmu" ".config/worktime"
+          ".config/chromium-kimai" ".config/chromium-rainbow"
+        ];
+      };
 
       xdg.desktopEntries = {
         element-lmu = {
@@ -124,6 +130,44 @@ in {
             StartupNotify = "true";
           };
         };
+        rainbow = {
+          name = "Rainbow";
+          exec = toString (pkgs.writeShellScript "rainbow" ''
+            exec -- \
+              ${lib.getExe' sysConfig.systemd.package "systemd-run"} --wait --user --slice-inherit \
+              --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \
+              -E DSCP=46 -E NIXOS_OZONE_WL \
+              -- ${lib.getExe pkgs.dscp} ${lib.getExe config.programs.chromium.package} \
+              --class=Rainbow \
+              --app="https://web.openrainbow.com" \
+              --user-data-dir=''${HOME}/.config/chromium-rainbow
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://web.openrainbow.com/rb/2.174.21/assets/skins/rainbow/images/homepage/logo__rainbow.svg";
+            hash = "sha256-5fmo8rDqVDpzkGaPjk4Y+SsSZpAsY7VUQSFW6WdHwuU=";
+          };
+          settings = {
+            StartupWMClass = "Rainbow";
+          };
+        };
+        kimai = {
+          name = "Kimai";
+          exec = toString (pkgs.writeShellScript "kimai" ''
+            exec -- \
+              ${lib.getExe config.programs.chromium.package} \
+              --class=Kimai \
+              --app="https://kimai.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/chromium-kimai
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.kimai.org/images/kimai_logo.png";
+            hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs=";
+          };
+          settings = {
+            StartupWMClass = "Kimai";
+            StartupNotify = "true";
+          };
+        };
       };
 
       programs.zsh.dirHashes = {