Dominik Polakovics
67e81d39f3
Enables the auth providers and transactional email flows the self-hosted Supabase was missing compared to the cloud instance: - GoTrue now accepts Google and Apple OAuth (web flow); Apple client-secret JWT is signed fresh on every activation from the SOPS-stored .p8 so there's no 6-month rotation ritual. - SMTP points at mail.cloonar.com:587 with SASL auth via a new `supabase` LDAP account; a `noreply@fueltide.io` mailAlias lets that account send as the fueltide.io address. - rspamd on mail.cloonar.com gets a per-domain DKIM key for fueltide.io (selector `default`) so outbound mail is signed. - MAILER_AUTOCONFIRM is off so signup confirmation + password reset actually go through email. - SITE_URL + URI_ALLOW_LIST point at app.fueltide.io / stage so links in emails and OAuth redirects land in the right app. FUELTIDE_AUTH_SETUP.md documents the manual steps (LDAP entries, SOPS additions, DNS records, Google/Apple console setup) that must be completed before merging.
28 lines
874 B
Nix
28 lines
874 B
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
sops.secrets.rspamd-dkim-fueltide-io-key = {
|
|
owner = "rspamd";
|
|
group = "rspamd";
|
|
mode = "0400";
|
|
};
|
|
|
|
# rspamd's dkim_signing module in rspamd.nix picks up per-domain keys from
|
|
# /var/lib/rspamd/dkim/$domain.$selector.key. This one-shot drops the
|
|
# fueltide.io key into place before rspamd starts.
|
|
systemd.services.rspamd-dkim-fueltide-setup = {
|
|
description = "Install fueltide.io DKIM key into rspamd";
|
|
wantedBy = [ "multi-user.target" ];
|
|
before = [ "rspamd.service" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
install -d -o rspamd -g rspamd -m 0750 /var/lib/rspamd/dkim
|
|
install -o rspamd -g rspamd -m 0400 \
|
|
${config.sops.secrets.rspamd-dkim-fueltide-io-key.path} \
|
|
/var/lib/rspamd/dkim/fueltide.io.default.key
|
|
'';
|
|
};
|
|
}
|