6 files changed, 74 insertions, 6 deletions
diff --git a/hosts/by-name/server3/configuration.nix b/hosts/by-name/server3/configuration.nix
index 9ad73ea..f7ee7d3 100644
--- a/hosts/by-name/server3/configuration.nix
+++ b/hosts/by-name/server3/configuration.nix
@@ -1,4 +1,4 @@
-{...}: {
+{lib, ...}: {
   imports = [
     ./networking.nix # network configuration that just works
     ./hardware.nix
@@ -18,9 +18,25 @@
         "92.60.38.179"
         "2a03:4000:33:25b::4f4e"
       ];
-      zones = import ../../../zones {};
+      zones = import ../../../zones {inherit lib;};
     };
+
+    monitoring = {
+      prometheus = {
+        enable = true;
+        remoteWriteTo = {
+          url = "https://prometheus-server2.vhack.eu";
+        };
+      };
+      # TODO: Also provide something for Loki <2026-07-19>
+    };
+
     fail2ban.enable = true;
+    rocie = {
+      enable = true;
+      domain = "rocie.vhack.eu";
+      loginSecret = ./secrets/rocie/login.age;
+    };
     nix-sync = {
       enable = true;
       domains = import ./websites.nix {};
@@ -67,6 +83,25 @@
         "/var/log"
       ];
     };
+    stalwart-mail = {
+      # enable = false;
+      # fqdn = "mail.vhack.eu";
+      # admin = "admin@vhack.eu";
+      # security = {
+      #   dkimKeys = let
+      #     loadKey = name: {
+      #       dkimPublicKey = builtins.readFile (./secrets/dkim + "/${name}-public");
+      #       dkimPrivateKeyPath = ./secrets/dkim + "/${name}-private.age";
+      #       keyAlgorithm = "ed25519-sha256";
+      #     };
+      #   in {
+      #     "mail.vhack.eu" = loadKey "mail.vhack.eu";
+      #   };
+      #   verificationMode = "strict";
+      # };
+      # openFirewall = true;
+      # principals = null;
+    };
     postgresql.enable = true;
     rust-motd.enable = true;
     users.enable = true;
diff --git a/hosts/by-name/server2/secrets/dkim/gen_key.sh b/hosts/by-name/server3/secrets/dkim/gen_key.sh
index 61da156..61da156 100755
--- a/hosts/by-name/server2/secrets/dkim/gen_key.sh
+++ b/hosts/by-name/server3/secrets/dkim/gen_key.sh
diff --git a/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-private.age b/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-private.age
new file mode 100644
index 0000000..8d66808
--- /dev/null
+++ b/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-private.age
@@ -0,0 +1,16 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdEtVSWhiOVR1N1Q5bTBV
+NXRMMm42VlR5NitSWlhiSFpUZDZQSlloWlJ3ClA3ZEJSU2dDbmRVL0NMZlFOVU5J
+V1lEbDM0MlN3S3dZMUkyc1pQZVVpdDAKLT4gWDI1NTE5IFk4YnFFZmFLTlA0WENY
+K3FGME1CbUV4b0Z4V1FIRFBmNVphYmhCMG1QVkkKOGhFcnl3Y2hZQU8rY0ROMTlq
+d0lUVG8rRWpPNm4vWkw2WFROU3NJalgzWQotPiBzc2gtZWQyNTUxOSBweXU5Ymcg
+UDV4YUdZRWZieHN4RVU1WWEvdlFRVHpTL1V5Q3Nya1kvNjFxVytpS1NGawpUWnlR
+RmtQL1Z1ZFkwTC9ua3VVb05VQVlLemtuOCtLSkdxbFE5U2wyM0xZCi0+IFktZ3Jl
+YXNlCk56M0t2NXB3QVpjYTNFdkEvMmpDZXBPcWlLNXNWL2tPalNMM1g0KzBJL2xz
+T1gvTldRLzNxM25BOUhFZml3dFQKSnNMeHBXK3BrS2pWVU1uTkNKZ3BnaGt2Ci0t
+LSBuWURsUEYxRkx3bVQzU3JTcGlwUTFCZ09IRWIrNExUclhPSmdGdUtNOFlFCuKw
+PBh8U5VmweDGoY+xFXw/nqTqrKw9gZyUR2vbnHdnN9y8BToht7prsEaAn//DVivI
+GMFGMhbPYTumWnEiTho8ZqQv5tKiDdIGV/9YghzUdHtMnzfO7q5ztrFYx19qjgi/
+lW17WyY8Jk2DZIH3icYweTICx9IU5K11DNj6WgNGDe8/fAyfuHTekE8sZtHPDw76
+M3wkUZM=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-public b/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-public
new file mode 100644
index 0000000..fa5d243
--- /dev/null
+++ b/hosts/by-name/server3/secrets/dkim/mail.vhack.eu-public
@@ -0,0 +1 @@
+U0eOxgLD3yK7PKzQRSZdJ3EH/UwVxPeYmfm42gYXsDg=
diff --git a/hosts/by-name/server3/secrets/rocie/login.age b/hosts/by-name/server3/secrets/rocie/login.age
new file mode 100644
index 0000000..0a6b8d3
--- /dev/null
+++ b/hosts/by-name/server3/secrets/rocie/login.age
@@ -0,0 +1,16 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWN3ZFdjMyNjBvQXQ1YVYz
+OTBHMWYvbk5xK1ArVDYvMmZEUFF5dHRSajFNCkFXSCtPV2VVdW50amVVMVYxYXBK
+SHd4bXRXSEw0ZnJ3TTMvbmZGTStFbEUKLT4gWDI1NTE5IDZYMFJKWVBPVmc5QmFK
+M0xGNGNJZHNnRWxBcytaZXU3VWlqMzQvdDdhbm8KcVlIZTlRYVBZNEx1djZJbURD
+Qy9NUTEwYVN0VjhZbkc3TTNuUWd0QTFjcwotPiBzc2gtZWQyNTUxOSBweXU5Ymcg
+SnZ0czg2OUszeFJIbmNpU2RDV2tnMVRlUUVvMk5BTWcwbFFibDVzQXZUbwpJbkVC
+bFFqYzJZQTFQWDM4Zk42ZzE4Q2kzQlh4aTRtMHUyRlgrWlc1WUtjCi0+IFFELWdy
+ZWFzZQpCMDVUczNTa01KS2hFREhpM0k5L3ZHT0NDUEtVck1iZE13cnVkSi9Kdk80
+WXU1M3A0V1pZbGxZaVNGanZRUnE4CmYwUlo4QlVFTjc4YlFaQjZyU3BybTAwaTVP
+WHc2K1FyYzduT0RBYWtEa0xSREEKLS0tIExFSThrd2xGT3lEU1p6VXE0eWpZUG5z
+ZlVXMWJFS0NxczhycXl1VWc1bmsK4Dq740IgQP9CnGtkUrwWxM4QUOnQTgWe1YbI
+LtC471ykB4YlPIbMiqUdnBuFZQ9cBAOT2YuicxbI+/2Rb/mSRV0l8dGKpc2fqOVy
+zLLcX8A48NfmcbPeUtlv/HnVfu6Fe7X91V0bw6eMjWSvvcpQXsaIAd7TEPTpexCs
+gfAWd+brZMq6VzwslklxO4S5ZIu0jUSz4q6covAuxfEW3hdSbIg=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/server3/websites.nix b/hosts/by-name/server3/websites.nix
index 466f1e9..ece6247 100644
--- a/hosts/by-name/server3/websites.nix
+++ b/hosts/by-name/server3/websites.nix
@@ -1,7 +1,7 @@
 {...}: let
   mkWkd = domain: {
     domain = "openpgpkey.${domain}";
-    repositoryUrl = "https://git.foss-syndicate.org/vhack.eu/pgp-wkd.git";
+    repositoryUrl = "https://git.foss-syndicate.org/vhack.eu/pgp-wkd";
     extraSettings = {
       locations."/.well-known/openpgpkey/".extraConfig = ''
         default_type application/octet-stream;
@@ -15,17 +15,17 @@
 in [
   {
     domain = "vhack.eu";
-    repositoryUrl = "https://codeberg.org/vhack.eu/website.git";
+    repositoryUrl = "https://codeberg.org/vhack.eu/website";
   }
   {
     domain = "b-peetz.de";
-    repositoryUrl = "https://git.foss-syndicate.org/bpeetz/b-peetz.de.git";
+    repositoryUrl = "https://git.foss-syndicate.org/bpeetz/b-peetz.de";
   }
 
   # Trinitrix
   {
     domain = "trinitrix.vhack.eu";
-    repositoryUrl = "https://codeberg.org/trinitrix/website.git";
+    repositoryUrl = "https://codeberg.org/trinitrix/website";
   }
 
   # WKD