This repository has no description
configs.zitadel: send verification mails as id@lassul.us
Zitadel asks every user with an unverified address (registration, all
byoidc logins) for a code before the login finishes. Without an SMTP
provider the code was never sent (Errors.SMTPConfig.NotFound) and these
users were stuck. They now come from the send-only account id@lassul.us
on the mailserver, over TLS on mail.lassul.us:465.
author
Hermes
committer
lassulus
date
(Oct 18, 2026, 9:57 AM CEST)
commit
fde2ec74
fde2ec7491d59daf11699cfb0a54b675bad58616
parent
778de7c8
778de7c828b94f9a2352bbaee6145a79b0535cdf
+33
+21
configs/mailserver.nix
+21
configs/mailserver.nix
···
57
57
hashedPasswordFile =
58
58
config.clan.core.vars.generators.mailserver-bot.files."bot-mail-password-hash".path;
59
59
};
60
+
# Zitadel (configs/zitadel.nix): verification codes and password resets.
61
+
# Zitadel 2.71 needs a password for an SMTP provider.
62
+
"id@lassul.us" = {
63
+
hashedPasswordFile = config.clan.core.vars.generators.mailserver-id.files."password-hash".path;
64
+
sendOnly = true;
65
+
};
60
66
# Hermes agent on coaxmetal; shared password var, see hermes-mail-vars.nix.
61
67
"hermes@lassul.us" = {
62
68
hashedPasswordFile = config.clan.core.vars.generators.hermes-mail.files."password-hash".path;
···
130
136
IMAP_PASSWORD=$(cat "$out/bot-mail-password")
131
137
IMAP_HOST=localhost
132
138
EOF
139
+
'';
140
+
};
141
+
142
+
# the plaintext is read by zitadel-reconcile (root)
143
+
clan.core.vars.generators.mailserver-id = {
144
+
files."password" = { };
145
+
files."password-hash" = { };
146
+
runtimeInputs = with pkgs; [
147
+
coreutils
148
+
mkpasswd
149
+
pwgen
150
+
];
151
+
script = ''
152
+
pwgen -s 32 1 | tr -d '\n' > "$out/password"
153
+
mkpasswd -sm bcrypt < "$out/password" > "$out/password-hash"
133
154
'';
134
155
};
135
156
+12
configs/zitadel.nix
+12
configs/zitadel.nix
···
125
125
allowUsernamePassword = true;
126
126
passwordlessType = "PASSWORDLESS_TYPE_ALLOWED";
127
127
};
128
+
# Verification codes and password resets. Zitadel asks every user whose
129
+
# address is unverified (registration, byoidc) to verify it before the
130
+
# login finishes. Sent as the send-only account id@lassul.us of the
131
+
# mailserver here (configs/mailserver.nix), which DKIM-signs it.
132
+
lass.zitadel.smtp = {
133
+
senderAddress = "id@lassul.us";
134
+
senderName = "lassul.us ID";
135
+
host = "mail.lassul.us:465";
136
+
tls = true;
137
+
user = "id@lassul.us";
138
+
passwordFile = config.clan.core.vars.generators.mailserver-id.files."password".path;
139
+
};
128
140
lass.zitadel.idps = {
129
141
GitHub = {
130
142
type = "github";