112 lines
3.2 KiB
Nix
112 lines
3.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
users.users.ai-mailer = {
|
|
isSystemUser = true;
|
|
group = "ai-mailer";
|
|
home = "/var/lib/ai-mailer";
|
|
createHome = true;
|
|
description = "AI Mailer service user";
|
|
};
|
|
users.groups.ai-mailer = { };
|
|
|
|
environment.etc."ai-mailer/config.yaml" = {
|
|
mode = "0400";
|
|
user = "ai-mailer";
|
|
group = "ai-mailer";
|
|
text = ''
|
|
imap:
|
|
server: "imap.gmail.com"
|
|
port: 993
|
|
username: "it@paraclub.at"
|
|
password: "file://${config.sops.secrets.ai-mailer-imap-password.path}"
|
|
mailbox_in: "INBOX"
|
|
draft_box: "[Gmail]/Entwürfe"
|
|
processed_box: "INBOX/Done"
|
|
use_tls: true
|
|
|
|
ai:
|
|
openrouter_api_key: "file://${config.sops.secrets.ai-mailer-openrouter-key.path}"
|
|
model: "openai/gpt-5-mini"
|
|
temperature: 0.3
|
|
max_tokens: 200000
|
|
|
|
context:
|
|
urls:
|
|
- "https://paraclub.cloonar.dev/de/tandemfallschirmspringen/faq/"
|
|
- "https://paraclub.at/de/"
|
|
- "https://paraclub.at/de/tandemfallschirmspringen/alle-infos/"
|
|
- "https://paraclub.at/de/tandemfallschirmspringen/kosten-tandemsprung/"
|
|
- "https://paraclub.at/de/ueber-uns/anfahrt/"
|
|
- "https://paraclub.at/de/tandemfallschirmspringen/faq/"
|
|
- "https://paraclub.at/de/ausbildung/uebersicht/"
|
|
- "https://paraclub.at/de/ausbildung/aff-ablauf/"
|
|
- "https://paraclub.at/de/ausbildung/kurstermine/"
|
|
- "https://paraclub.at/de/ausbildung/anmeldung/"
|
|
- "https://paraclub.at/de/ausbildung/kosten/"
|
|
|
|
polling:
|
|
interval: "300s"
|
|
|
|
processing:
|
|
max_tokens: 30000
|
|
skip_junk_emails: false
|
|
|
|
logging:
|
|
level: "info"
|
|
file_path: "/var/log/ai-mailer/ai-mailer.log"
|
|
'';
|
|
};
|
|
|
|
sops.secrets.ai-mailer-imap-password = {
|
|
owner = "ai-mailer";
|
|
};
|
|
|
|
sops.secrets.ai-mailer-openrouter-key = {
|
|
owner = "ai-mailer";
|
|
};
|
|
|
|
systemd.services.ai-mailer = {
|
|
description = "AI Mail Assistant Service";
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = "ai-mailer";
|
|
Group = "ai-mailer";
|
|
WorkingDirectory = "/var/lib/ai-mailer";
|
|
ExecStart = "${pkgs.ai-mailer}/bin/ai-mailer -config /etc/ai-mailer/config.yaml";
|
|
Restart = "always";
|
|
RestartSec = "10s";
|
|
StateDirectory = "ai-mailer";
|
|
LogsDirectory = "ai-mailer";
|
|
RuntimeDirectory = "ai-mailer";
|
|
|
|
# Security settings
|
|
NoNewPrivileges = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
PrivateTmp = true;
|
|
PrivateDevices = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectControlGroups = true;
|
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
|
RestrictNamespaces = true;
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
CapabilityBoundingSet = "";
|
|
};
|
|
|
|
restartTriggers = [
|
|
"/etc/ai-mailer/config.yaml"
|
|
config.sops.secrets.ai-mailer-imap-password.path
|
|
config.sops.secrets.ai-mailer-openrouter-key.path
|
|
];
|
|
};
|
|
}
|