Add Freescout
@infinisil and I paired on this. It's already deployed, and he has an admin account so he can start trying it out.
Jeremy Fleischman committed
Jun 3, 2025 at 13:36 UTC
6204b1393115151cd1d2615c33a2892d50c0ce92
5 files changed
+99
flake.lock
+24
@@ -240,6 +240,29 @@
240
"type": "github"
241
}
242
},
243
+ "freescout": {
244
+ "inputs": {
245
+ "flake-utils": [
246
+ "flake-utils"
247
+ ],
248
+ "nixpkgs": [
249
+ "nixpkgs"
250
+ ]
251
+ },
252
+ "locked": {
253
+ "lastModified": 1743845578,
254
+ "narHash": "sha256-tS1fQfOasIbzOnCCBZHAjdOCsKD/Zt5btciC/cgcwWc=",
255
+ "ref": "refs/heads/main",
256
+ "rev": "2b5bcee06a673c13c5b5a62b4f4dd1300ce85903",
257
+ "revCount": 33,
258
+ "type": "git",
259
+ "url": "https://cyberchaos.dev/e1mo/freescout-nix-flake.git"
260
+ },
261
+ "original": {
262
+ "type": "git",
263
+ "url": "https://cyberchaos.dev/e1mo/freescout-nix-flake.git"
264
+ }
265
+ },
266
"git-hooks": {
267
"inputs": {
268
"flake-compat": [
@@ -518,6 +541,7 @@
541
"first-time-contribution-tagger": "first-time-contribution-tagger",
542
"flake-parts": "flake-parts",
543
"flake-utils": "flake-utils",
544
+ "freescout": "freescout",
545
"hydra": "hydra",
546
"nixos-channel-scripts": "nixos-channel-scripts",
547
"nixpkgs": "nixpkgs",
flake.nix
+8
@@ -43,6 +43,14 @@
43
44
flake-utils.url = "github:numtide/flake-utils";
45
46
+ freescout = {
47
+ url = "git+https://cyberchaos.dev/e1mo/freescout-nix-flake.git";
48
+ inputs = {
49
+ flake-utils.follows = "flake-utils";
50
+ nixpkgs.follows = "nixpkgs";
51
+ };
52
+ };
53
+
54
treefmt-nix = {
55
url = "github:numtide/treefmt-nix";
56
inputs.nixpkgs.follows = "nixpkgs-unstable";
non-critical-infra/modules/mailserver/default.nix
+1
@@ -4,6 +4,7 @@
4
imports = [
5
./mailing-lists.nix
6
./postsrsd.nix
7
+ ./freescout.nix
8
];
9
10
mailserver = {
non-critical-infra/modules/mailserver/freescout.nix
new
+43
@@ -0,0 +1,43 @@
1
+{
2
+ inputs,
3
+ config,
4
+ pkgs,
5
+ ...
6
+}:
7
+
8
+{
9
+ imports = [
10
+ inputs.freescout.nixosModules.freescout
11
+ ../nginx.nix
12
+ ];
13
+
14
+ services.freescout = {
15
+ enable = true;
16
+ # Workaround for https://cyberchaos.dev/e1mo/freescout-nix-flake/-/merge_requests/1
17
+ package = inputs.freescout.packages.${pkgs.system}.default;
18
+ domain = "freescout.nixos.org";
19
+
20
+ settings.APP_KEY._secret = config.sops.secrets.freescout-app-key.path;
21
+
22
+ databaseSetup.enable = true;
23
+
24
+ nginx = {
25
+ forceSSL = true;
26
+ enableACME = true;
27
+ };
28
+ };
29
+
30
+ # How to generate:
31
+ #
32
+ # $ cd non-critical-infra
33
+ # $ SECRET_PATH=secrets/freescout-app-key.umbriel
34
+ # $ echo "base64:$(nix run nixpkgs#openssl -- rand -base64 32)" > "$SECRET_PATH"
35
+ # $ sops encrypt --in-place "$SECRET_PATH"
36
+ sops.secrets.freescout-app-key = {
37
+ format = "binary";
38
+ owner = config.services.postsrsd.user;
39
+ group = config.services.postsrsd.group;
40
+ sopsFile = ../../secrets/freescout-app-key.umbriel;
41
+ restartUnits = [ "postsrsd.service" ];
42
+ };
43
+}
non-critical-infra/secrets/freescout-app-key.umbriel
new
+23
@@ -0,0 +1,23 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:jYgs3IlDta15hr1OIFMtT4HU9u96nvN0GRPDa1+TPuC+gcMbCBRWtFrFYM+/O03mDtJV2w==,iv:M6yUMvnHHe4DUDMCvjL3uQViMxbZzz0NOYlx2J8Mz8c=,tag:qm+/x0TWQwrZbh+pxpto6w==,type:str]",
3
+ "sops": {
4
+ "age": [
5
+ {
6
+ "recipient": "age15vcp7875xwtf64j4yshyld0a3hpgzv6n2kxky493s3q0swr9hdaqxugpv6",
7
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnb3N4UitvYUg2NHNVVFR5\nVmNydmUrOXE1bG9mVFh5NkZZdENENmNZcG1vCjV6RExtL3MxUVZHTk1xVzZBSmFk\nTE1yeFRxMnpYYXJjekNNejN4SWc5M2cKLS0tIG9IMm05bVRwSGV2bjJoK1Fjenht\nU2xWVWx6TXJHQWg1TnBFM3JWSXo1MWcKnNfOufmvt90kpjiB0GZ8yWTv8UIXaQAs\nba2Ew4Ca68s3zUCgsaQOstkbh8Dszia6HyoYZ7yj1sjzaUI2AMqknw==\n-----END AGE ENCRYPTED FILE-----\n"
8
+ },
9
+ {
10
+ "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUMlZheitoajRtWWhpRG5n\nS3dFY1NsaFlYRVR5cFZvYStjQ1JoREh0cjBzCnNGZUlEV2RsdHpBcWxCRVhCZURi\nTlROK0NJMDQrdE53OWNKdkhaVmNWdncKLS0tIDFoNXZEY1B2bXI5blQ0SVlxN0Zi\nUUpDUjYvWWM0ZE5OL1FpK3JIY1RScUUKLTur/VK1HukuFybYVep78VKQGJFAc8bC\n6XjsFe2xhr6mwfWpRW62LbxzQkjPqdWpNAilH+oQWh6EnDcjBOUCPg==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibEp5MDk0ZzQyeExuVzhR\nQmY1NnNYTzh2c2VhWFNFc285dVB5MEdBNWxvCnVnTU9oaGJlNVdOSS8rMUFiQnU3\nOWN2aVdPeFU0WWFYNGplM3hNYmRFdncKLS0tIEZyeUFMMVpYUXhBakN3TTRNOGxO\nVXJXa0tRcVgwWGx6Y0RmdmpkOTRuSk0KyAxdvgekHTatCurFIQlg74BoDwjVrw+y\n3xtTubPw6M3qW5/k1b4ClQwHVpppbIG1hQg8OG/QD+nARqSKMCoH3g==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ }
17
+ ],
18
+ "lastmodified": "2025-06-03T19:23:12Z",
19
+ "mac": "ENC[AES256_GCM,data:oZOR73ZapeN5Eir+Z0BXAqLzoRdtrCbuNAsrCGh9wyCDuL1Xv478jLhVvYhe3O0+errwnAnY8/SiAv5+dSu7sJDHL0RDtY9OWjQhxdv0iTTXZUn+gci1i383pkgLccQzlDZzhtVj33HBY968KOhavD9yNhN8nSy9ow8cLzhcYio=,iv:Xq9Dwsez/HjcHr+hSQNN97ZuoUGbOVrlBTl5JigMJEs=,tag:wkPDY1lYU6vOZ6uED6lalQ==,type:str]",
20
+ "unencrypted_suffix": "_unencrypted",
21
+ "version": "3.10.2"
22
+ }
23
+}