@cryptotaxi247 / infra-1 / commits / a209dbda

docuseal: init on umbriel

This completes https://github.com/NixOS/infra/issues/972

Jeremy Fleischman committed May 29, 2026 at 17:02 UTC a209dbdacd84164c4d478a3ee14c3a881fba28fb
6 files changed +143
non-critical-infra/hosts/caliban/default.nix
+1
@@ -19,6 +19,7 @@
19 ../../modules/matrix-synapse.nix
20 ../../modules/owncast.nix
21 ../../modules/vaultwarden.nix
22 + ../../modules/docuseal.nix
23 ./nixpkgs-swh.nix
24 ];
25
non-critical-infra/modules/docuseal.nix new
+55
@@ -0,0 +1,55 @@
1 +{ config, ... }:
2 +{
3 + services.backup.includes = [ "/var/lib/docuseal" ];
4 +
5 + services.docuseal = {
6 + enable = true;
7 + extraConfig = {
8 + SMTP_ADDRESS = "umbriel.nixos.org";
9 + SMTP_PORT = "465";
10 + SMTP_ENABLE_STARTTLS = "false"; # We're using port 465, which uses implicit TLS.
11 + SMTP_FROM = "docuseal-noreply@nixos.org";
12 + SMTP_USERNAME = "docuseal-noreply@nixos.org";
13 + SMTP_ENABLE_TLS = "true";
14 + };
15 + extraEnvFiles = [ config.sops.templates."docuseal.env".path ];
16 + };
17 +
18 + # How to generate:
19 + #
20 + # $ cd non-critical-infra
21 + # $ SECRET_PATH=secrets/docuseal-secret-key-base.caliban
22 + # $ openssl rand -hex 64 | tr -d '\n' > "$SECRET_PATH"
23 + # $ sops encrypt --in-place "$SECRET_PATH"
24 + sops.secrets.docuseal-secret-key-base = {
25 + sopsFile = ../secrets/docuseal-secret-key-base.caliban;
26 + format = "binary";
27 + restartUnits = [ config.systemd.services.docuseal.name ];
28 + };
29 +
30 + sops.secrets.docuseal-smtp-password = {
31 + # Keep this in sync with <../secrets/docuseal-noreply-email-login.umbriel>.
32 + sopsFile = ../secrets/docuseal-noreply-email-login.caliban;
33 + format = "binary";
34 + restartUnits = [ config.systemd.services.docuseal.name ];
35 + };
36 +
37 + sops.templates."docuseal.env".content = ''
38 + SMTP_PASSWORD=${config.sops.placeholder.docuseal-smtp-password}
39 + '';
40 +
41 + services.docuseal.secretKeyBaseFile = "/run/credentials/${config.systemd.services.docuseal.name}/secret-key-base";
42 +
43 + systemd.services.docuseal.serviceConfig = {
44 + LoadCredential = "secret-key-base:${config.sops.secrets.docuseal-secret-key-base.path}";
45 + };
46 +
47 + services.nginx.virtualHosts."docuseal.nixos.org" = {
48 + forceSSL = true;
49 + enableACME = true;
50 + locations."/" = {
51 + proxyPass = "http://127.0.0.1:${toString config.services.docuseal.port}";
52 + proxyWebsockets = true;
53 + };
54 + };
55 +}
non-critical-infra/modules/mailserver/mailing-lists.nix
+7
@@ -22,6 +22,13 @@
22 ];
23 };
24
25 + "docuseal-noreply@nixos.org" = {
26 + loginAccount = {
27 + encryptedHashedPassword = ../../secrets/docuseal-noreply-email-login.umbriel;
28 + storeEmail = false;
29 + };
30 + };
31 +
32 "finance@nixos.org" = {
33 loginAccount = {
34 encryptedHashedPassword = ../../secrets/finance-email-login.umbriel;
non-critical-infra/secrets/docuseal-noreply-email-login.caliban new
+27
@@ -0,0 +1,27 @@
1 +{
2 + "data": "ENC[AES256_GCM,data:ODndbvg9R5hvuOdhDtt73RhH3bcz,iv:hHxr5NfVQdXpgizGM20b8vBKPKowrGQn0LXdx13CXC8=,tag:omyLiE2uEt9dLPui4h+xFA==,type:str]",
3 + "sops": {
4 + "age": [
5 + {
6 + "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
7 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkaUd1Z0JaUERIZVhHL3pR\naHE1cnJZMmh1SGFxOEpJNExKRlZxUVhnbW1JCnVHeDV5NWcrek9jVk1pZytZK0Fp\nbCtkRWw4dWttdjYySzVSbzdNKzBzSkkKLS0tIHUwR2VEQllXQnhoSFZtNzlML2ha\na2FVQURjU3hTb1RvM2RXWTlkVURkOEUKs+usN4bf7NpLwEc38QDIRO73nXfNFDOk\nvw+m0ZAdDMpcaF0MEX/5roh+2hliFA4dTTEoilKWjF3R6O6Ii0v3TA==\n-----END AGE ENCRYPTED FILE-----\n"
8 + },
9 + {
10 + "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
11 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPL0NVT3NsRGk1cnptbXh3\nekxjNDFWN0gxbWtYNmdkSUJOd2dKWVBaMG5FCkk0MlNHcUl5aVVwR0Z0aXhtQkF5\nM1ZxSkFvcjhvbzE1cWFPeVpqa0NPUEEKLS0tIERYTnRvS3dOTjB0QlcrUWhYRFNN\nYkxCMFQvM0dQU1ZjMURQVTRPa3NkZ2cKxqIHqftUtbKes2u/Vi9rgu2OcDUTx1nS\nc0qYUpnATEqqXD5EAdWnWFho3wA2gSo2CJQOsvxugH0O/wgXF0zDWw==\n-----END AGE ENCRYPTED FILE-----\n"
12 + },
13 + {
14 + "recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz",
15 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaGZZV1hWRHEvSk8zWEhv\nYUF1aXZCU2o1c2pkVENIV0V2RTkwRmxYbmtJCk5nOU96S3lrc2IyelBqTUNWRVVL\nVU8vbUp1c3FBd0JySWZnUWRYMVFEUjAKLS0tIE1OMEY3NFhjMnA4Y3J3UkFqeU5s\nS2t1UFlkMFdXMWlocEpaVTdIQXA0N2sKBo9GnPASZKPc5OFnZ3XKincjUWspIDeX\nPAiAFXU4P56GDhcrSYW91wv7+QP94tO/58wVz9JyHoRBWKMFJuR21g==\n-----END AGE ENCRYPTED FILE-----\n"
16 + },
17 + {
18 + "recipient": "age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h",
19 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SVR3dlZxTWFVdVI0Uk85\nMUcrQXFZWlhkV05JWjR5YllGeUVvQnRWV2wwCnFVQ2RIZHRmQ3NZeTJhSlg1TEg5\nWHRiY1ZoZXBBaE82QjR3Zys1bmQ0cHMKLS0tIExHaFdNS1Z0bWJZcEF3M01vMnFU\nMFYyYmJtN3pWMHZwN2U3dzRLRUpmSXcKVJyfussjP7mKPMfVutCEaMda8FNFfjqX\nCB8AZKBfS9Qy3iAcdinE4l+KBWKKhUPnD4LejELIpR1Rl8TNX1yV3w==\n-----END AGE ENCRYPTED FILE-----\n"
20 + }
21 + ],
22 + "lastmodified": "2026-05-30T20:42:46Z",
23 + "mac": "ENC[AES256_GCM,data:bvVqYYwZFWNiPJU1t3vtUYFbu8JPKPD2D6EmyfWSAwAETtrCMOjMTdeDDE0uGJtw1DJvLo9LqdjbCsG+/6lF4asUxMxJ/k3JCKhPCkhPMI1VP/h2zKr0YTcIaUXbb8jsNfYCB1ycpbU50NSRohaOMcd1eYWTNn9KO36wdImldf0=,iv:P2gHcCh0kEU0lX6UCyzOeseHg+U899sUS/qU6WSF+kM=,tag:Rjms7oWT73PJpiMznoYCHQ==,type:str]",
24 + "unencrypted_suffix": "_unencrypted",
25 + "version": "3.10.2"
26 + }
27 +}
non-critical-infra/secrets/docuseal-noreply-email-login.umbriel new
+26
@@ -0,0 +1,26 @@
1 +{
2 + "data": "ENC[AES256_GCM,data:LIbaZ5dGgz5hfPHo0gE9DMnOh/p14joLMEdXCA8WeY/9p3wvr9QnkbQWLVMz992AYiTJGw+w3WfxTfn3nA==,iv:YCVTKmPVrgoobRTmnqx7P6f7cse01LS27o3WvpgaSBU=,tag:kcdnhOofFsxWrFjO2vL3BQ==,type:str]",
3 + "sops": {
4 + "age": [
5 + {
6 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUemxrUGYrUldQVmg5S3Jv\nSXFvZ1dDSXpxTWhmVWh6RlJRVVErN1ZYQWlBCmpJd083ZUJOVDIvL3U4bEhieVlE\ncFY0cUV2a2tMQjRRaDFHKzJwc2VmK1kKLS0tIDU0MHhpSTVoZ0dVYjZUWndhc0w1\ncVZNUm1qTlV0VlZJdm16Yzg3Mm9UcDAKLPxaMsR3u1+FBkdn+Du0NlEDThLa4eZx\nOBDwYi1Dt3oNA6u4lXuV/ozAfi7naJ+PkYgupjFKd6pCx+DINu3IsQ==\n-----END AGE ENCRYPTED FILE-----\n",
7 + "recipient": "age15vcp7875xwtf64j4yshyld0a3hpgzv6n2kxky493s3q0swr9hdaqxugpv6"
8 + },
9 + {
10 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWlZZTnRNZzd6MFVIWWlq\nR1lMSmRnc1RLT0dpWEk1L3hrU3ZFSExDemhBCmhzaE1KaFVwNy9UMzhlUWJkM3Z3\ndURTRlFQMk1ZMElVKzl0K0pCSmhNeVUKLS0tIHp0WWExTUJQQS9Dc2VoNll2RzFW\nN3ZoTVRVZW5IelA2Um5yQ2VTbmNjWXMKzUvYfSHYVMFQSdByPwZ6bwC8FWUcoQdt\nMgGNG/RWT/OZS8uBo3u8D4Jk8Jggn9d+9pKv8pieuNxxO/63PzpP6w==\n-----END AGE ENCRYPTED FILE-----\n",
11 + "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x"
12 + },
13 + {
14 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvbDVtNHNidGFIU1hEU290\naE9kd29EUDBXNDQwc3AvTnE5dnRac3lTUDFNCnJpN1Z2S3psM05STDNPR1NuSzgz\nRGFCR0hURWphcXN2ZEZvK3d5YUlXUjgKLS0tIGRxU2oyNVZqWmwyRnAwY0hGME95\nbmNRQ2FXUnAybTZSbzJ6SGpEQS9hdUUK5Ej3FRPf/jEKrqED/78NCuOWbyO0GLyt\nf8n1ELAnFW58ZWwXzPfTd8cAwE6YaGt85x9+81dkRLR7X/tzRhmM0w==\n-----END AGE ENCRYPTED FILE-----\n",
15 + "recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz"
16 + },
17 + {
18 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6K2FieC9sM1lCSk1BT2FO\nVmFOd0dXcnZZOUd3QktLbDVIbCtxUTJCQkhrCmQ0UkF4NWxaRVprem9YNktDSWZs\nMlBPL1BHNjhLUmhRWDhkYUZpc0ZveUUKLS0tIEtJRUxRV0p4aXN0MEw0QllCK2Fo\nRTRzc0gxTGJCOW1lZmJrcTNOT2FGd1kK8E21JhgvyqZsYdh9DBurnaNleivfpHXX\nGHNqI/afVqTvKQBF4wWGqsk+vKMn7u1Jhby75XWB/s/tNNkUXmka6A==\n-----END AGE ENCRYPTED FILE-----\n",
19 + "recipient": "age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h"
20 + }
21 + ],
22 + "lastmodified": "2026-05-30T20:37:20Z",
23 + "mac": "ENC[AES256_GCM,data:c+XNkiUxck9WWTNT0BqRRyda50dI3xfiLRP65yvgS3B+OSNI9YdhYiLMvy2Kp8kp0/CTQ1+M9Ia8fg8BFbE4GCOLFs/c9GJu1lrhs1M4VEYpYGaHroTaagFcwIudpQUiHsC+TTGWI3H0ZlQPGYs8HSIHO5f5F+RLP8Xj/3y787E=,iv:0rnTFnJ8wRAhNE3+QDVvdY7Ogchk7PopAqz/wZSMT88=,tag:oh6n5EoDJrVJT2tbpdsjKw==,type:str]",
24 + "version": "3.13.1"
25 + }
26 +}
non-critical-infra/secrets/docuseal-secret-key-base.caliban new
+27
@@ -0,0 +1,27 @@
1 +{
2 + "data": "ENC[AES256_GCM,data:lViIagkHAbCr4xJtgYGOFCdpARA4VPUx21VIaTmwYb7RFC6CY6xEs8EihCwWEktSpMR0cGsSeGE0SE2GH6io3RaPVhXhPlPKG1ZyuxdxjfNh8+4/u+DFxSZZ5OuE4BVCyMBOx7DTXF80WGfqjzHg/3NiBgi3MHliSNk2boD5OdM=,iv:ar0Hh+2bllZbtIdAfnpzYlrdhPyEAl/c/3/SstT5zqg=,tag:QOGlnb2yITHdOT5s/qWYog==,type:str]",
3 + "sops": {
4 + "age": [
5 + {
6 + "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
7 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5S0o0RzhvVVFPZ20rQXJX\nZmhYUSt1ZzUyeFpHYVhiMjlUMDJHT3dBZzJrClUrNnZuSVl3MkZJT3dqV2t0Sjdj\neG1lQk1hUkpRSTZ4V21QTkFJU29LZzQKLS0tIFNBdjFUdDJ2TnhzVStNZ1dpRnBv\nT0NxOEZENmpBekpNdTJ2dWN6T0pDd28Kq7iPJPMBQ2uqAkRFgwYNOCILJDIGEktf\nyOGPP39Yj3buwthoIH+C+2oC0+xHCMyhd1k8R0eCOox+apbLdk5R3A==\n-----END AGE ENCRYPTED FILE-----\n"
8 + },
9 + {
10 + "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
11 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RTlGb1VnYk9MR3BET09r\nOGErVFZiMVpmSFhJNFZXR1lUZDZjdHA4UVRRClFYekdmR0l2WDAwcTFseFVQbC8x\ndDM4QkpnK1pWemZpSFY4aFlJTTg5azgKLS0tIEFWZW9TdUsybGREaE1CSmwyQkU2\nclFKa1FTeGQ0VjhEWDhUeVVCV0xkUFEKQGdlPaheFS7ti9KEEXWBJKLIdq3CDBh8\nlwr6BXMQ5Sf1VYLu/ZfmHH50kpeULkhZrRaWlMtt+k9n5bO2RXGcKA==\n-----END AGE ENCRYPTED FILE-----\n"
12 + },
13 + {
14 + "recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz",
15 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQRWVDMHVLSW1yZzdGZDl2\nRUVmWEtkN01ibi9UVmtRc0ZuTXQ2czRsclM0CnB0L3REUGVUanNwaW5wUHdxYzJI\nZ2lLN2pzRWZuUTFTODdDa1pqb0ZEVFEKLS0tIDUwWUVNaHhLeSt2cTVTSUZOM20z\nWk9WVGZ2a1M3by92dng3SFR5V2NZU0UKGKZcsKJ2HLtUfK62sE2WTkfgKUJ8GglW\n/T/oY07nSrQBYIpy+lVgYgQ/FaIvRi34Ov1jJiTqIGw4zkXr7LZ97w==\n-----END AGE ENCRYPTED FILE-----\n"
16 + },
17 + {
18 + "recipient": "age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h",
19 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByQjZKc1NZQzIzTXBuZlI2\nclpuWUJ5N1B1VUp1cXV5UnpYRGxocWVMNkhJCndiaGRRQUduL2s0UEFRb2xTbGZo\nV0lyMnUzRDFzc08xMjFhZWJ4UnU1U28KLS0tIENSbUpRV1JVTGd4d0xuUFAzN1VH\nN1kyWjcxM0FrMmVUVktudDBQa0VGYjAKQqEB19kegGhow0NEzZ+uaFO1LJw4zW1g\n7hP0lRzezOoJwR0yyKVZLoMBpR0+qAR0ei8l1R0TLvJvxMhllRurkg==\n-----END AGE ENCRYPTED FILE-----\n"
20 + }
21 + ],
22 + "lastmodified": "2026-05-30T14:07:44Z",
23 + "mac": "ENC[AES256_GCM,data:22X8lCNOh8IhUd2+xU9dP2P+0lYmr1QaujNeZ81KECymUzrHmFczhCvH5Moeqesp0CTXMkDLVy9LY2oKFgx2q6l2C7MqXh4GR6xyNkWsvig4AYmCtFPRcmYLKbSyMRPpzs9hnxhfX9JI3ZGYdHb2IAZijvI+5zda4wfoTQ2KNPs=,iv:+IGPSEw+diKROB0IeiRAaegHHXTGOPIlHXPKP2gxZRo=,tag:3OorWcn70hyKkeCJIw6Q8g==,type:str]",
24 + "unencrypted_suffix": "_unencrypted",
25 + "version": "3.10.2"
26 + }
27 +}