switch to systemd LoadCredential

README.md

@@ -43,17 +43,38 @@ Add the module to your `flake.nix`:
 Add this to your `configuration.nix` file
 
 ```nix
-environment.etc."eintopf-radar-sync-secrets.yml".text = ''
+environment.etc."mail-quota-warning-secrets.yml".text = ''
-EINTOPF_AUTHORIZATION_TOKEN=foobar23
+accounts:
+  - name: Sales
+    imap_server: mail.example.com
+    imap_port: 993
+    username: sales@example.com
+    password: secret
+
+  - name: Support
+    imap_server: mail.example.com
+    imap_port: 993
+    username: support@example.com
+    password: secret
+
+mail:
+  smtp_server: mail.example.com
+  smtp_port: 587
+  smtp_username: monitoring@example.com
+  smtp_password: secret
+  from_address: monitoring@example.com
+  recipients:
+    - admin1@example.com
+    - admin2@example.com
 '';
 
 services.mail-quota-warning = {
   enable = true;
   settings = {
-    EINTOPF_URL = "https://karlsunruh.eintopf.info";
+    CHECK_INTERVAL_DAYS = 7;
-    RADAR_GROUP_ID = "436012";
+    QUOTA_WARNING_THRESHOLD_PERCENT = 80;    
   };
-  secrets = [ /etc/mail-quota-warning-secrets.yml ];
+  secretFile = "/etc/mail-quota-warning-secrets.yml";
 };
 ```
 
@@ -64,8 +85,7 @@ Replace setting variables according to your setup.
 ```
 cd mail-quota-warning
 nix develop
-export EINTOPF_URL = "https://karlsunruh.eintopf.info"
+export CHECK_INTERVAL_DAYS=7
-export EINTOPF_AUTHORIZATION_TOKEN = "secret key"
+export QUOTA_WARNING_THRESHOLD_PERCENT=80
-export RADAR_GROUP_ID = "436012"
 nix run
 ```

config.yml.example

@@ -1,6 +1,5 @@
 check_interval_days: 7   # Minimum days between warnings for same account
 quota_warning_threshold_percent: 80
-working_dir: /var/lib/mail-quota-warning
 
 accounts:
   - name: Sales

mail-quota-warning.py

@@ -181,7 +181,7 @@ def should_send_warning(state, account_name, interval_days):
     last_sent = datetime.fromisoformat(last_sent_str)
     return datetime.now() - last_sent >= timedelta(days=interval_days)
 
-def send_warning(config, triggered_accounts, all_quotas):
+def send_warning(config, triggered_accounts, all_quotas, threshold):
     mail_cfg = config["mail"]
     
     # Create subject based on number of accounts
@@ -199,7 +199,7 @@ def send_warning(config, triggered_accounts, all_quotas):
         body_lines.append(f"The mailbox for account '{account_name}' has reached {quota_info['percent_used']:.1f}% of its quota.")
         body_lines.append(f"Usage: {format_bytes(quota_info['used_kb'])} of {format_bytes(quota_info['limit_kb'])}")
     else:
-        body_lines.append("The following mailboxes have exceeded the quota threshold:")
+        body_lines.append(f"The following mailboxes have exceeded the quota threshold ({threshold}%):")
         body_lines.append("")
         for account_name, quota_info in triggered_accounts.items():
             body_lines.append(f"• {account_name}: {quota_info['percent_used']:.1f}% ({format_bytes(quota_info['used_kb'])} of {format_bytes(quota_info['limit_kb'])})")
@@ -263,8 +263,8 @@ def main():
     args = parse_args()
     config = load_config(args.config)
     state = load_state()
-    interval_days = config.get("check_interval_days", 7)
+    interval_days = get_config_value(config, "CHECK_INTERVAL_DAYS", "check_interval_days", 7, int)
-    threshold = config.get("quota_warning_threshold_percent", 80)
+    threshold = get_config_value(config, "QUOTA_WARNING_THRESHOLD_PERCENT", "quota_warning_threshold_percent", 80, int)
     
     # For thread-safe state updates
     state_lock = threading.Lock()
@@ -287,7 +287,7 @@ def main():
     
     # Send consolidated warning email if any accounts triggered
     if triggered_accounts:
-        send_warning(config, triggered_accounts, all_quotas)
+        send_warning(config, triggered_accounts, all_quotas, threshold)
     
     save_state(state)
 

module.nix

@@ -1,4 +1,9 @@
-{config, lib, pkgs, ...}:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
 
   cfg = config.services.mail-quota-warning;
@@ -19,43 +24,49 @@ in
 
       settings = lib.mkOption {
         type = lib.types.submodule {
-            freeformType = with lib.types; attrsOf types.str;
+          freeformType = with lib.types; attrsOf anything;
           options = {
             CHECK_INTERVAL_DAYS = lib.mkOption {
-                default = "";
+              default = 7;
-                type = lib.types.str;
+              type = lib.types.int;
               description = ''
-		  Base URL of the target Eintopf host.
+                Interval of days in which a warning message will be
+                delivered.
               '';
             };
             QUOTA_WARNING_THRESHOLD_PERCENT = lib.mkOption {
-                default = "";
+              default = 80;
-                type = lib.types.str;
+              type = lib.types.int;
               description = ''
-		  Radar group ID which events to sync.
+                Threshold of used mailbox space in percent after which
+                a warning message will be delivered.
               '';
             };
           };
         };
         default = { };
         description = ''
-            Extra options which should be used by the Radar sync script.
+          Extra options which should be used by the mailbox quota warning script.
         '';
         example = lib.literalExpression ''
           {
-              EINTOPF_URL = "eintopf.info";
+            CHECK_INTERVAL_DAYS = 7;
-    	      RADAR_GROUP_ID = "436012";
+            QUOTA_WARNING_THRESHOLD_PERCENT = 80;
           }
         '';
       };
 
       secretFile = lib.mkOption {
-          type = with lib.types; listOf path;
+        type = lib.types.nullOr (lib.types.pathWith {
+          inStore = false;
+          absolute = true;
+        });
+        default = null;
+        example = "/run/keys/mail-quota-warning-secrets";
         description = ''
-            A list of files containing the various secrets. Should be in the
+          A YAML file containing secrets, see example config file
-            format expected by systemd's `EnvironmentFile` directory.
+          in the repository.
         '';
-          default = [ ];
       };
 
       interval = lib.mkOption {
@@ -80,10 +91,14 @@ in
       wants = [ "network-online.target" ];
       environment = {
         PYTHONUNBUFFERED = "1";
-	} // cfg.settings;
+      }
+      // lib.mapAttrs (_: v: toString v) cfg.settings;
       serviceConfig = {
         Type = "simple";
-          ExecStart = lib.getExe pkgs.mail-quota-warning;
+        LoadCredential = lib.optionalString (cfg.secretFile != null) "secrets.yaml:${cfg.secretFile}";
+        ExecStart = "${lib.getExe pkgs.mail-quota-warning}${lib.optionalString (cfg.secretFile != null) " --config \${CREDENTIALS_DIRECTORY}/secrets.yaml";
+        WorkingDirectory = "%S/mail-quota-warning";
+        StateDirectory = "mail-quota-warning";
 
         # hardening
         AmbientCapabilities = "";
@@ -107,15 +122,19 @@ in
         ProtectProc = "invisible";
         ProtectSystem = "strict";
         RemoveIPC = true;
-          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
-          SystemCallFilter = [ "@system-service" "~@privileged" ];
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
         UMask = "0077";
-        } // lib.optionalAttrs (cfg.secretFile != [ ]) {
-	  EnvironmentFile = cfg.secretFile;
       };
     };
 
@@ -136,4 +155,3 @@ in
   };
 
 }
-

vm-eintopf.nix

@@ -1,29 +0,0 @@
-{ pkgs, ... }:
-let
-
-  template-karlsunruh = pkgs.stdenv.mkDerivation {
-    name = "karlsunruh";
-    src = pkgs.fetchgit {
-      url = "https://git.project-insanity.org/onny/eintopf-karlsunruh.git";
-      rev = "0c2a36574260da70da80b379d7475af7b29849c9";
-      hash = "sha256-GPKlqpztl4INqVyz/4y/vVrkDPHA3rIxtUZB9LNZ96c=";
-    };
-    dontBuild = true;
-    installPhase = ''
-      cp -r . $out/
-    '';
-  };
-
-in
-{
-
-  services.eintopf = {
-    enable = true;
-    settings = {
-      EINTOPF_THEMES = "eintopf,${template-karlsunruh}";
-      EINTOPF_ADMIN_PASSWORD = "foobar23";
-      EINTOPF_ADMIN_EMAIL = "onny@project-insanity.org";
-    };
-  };
-
-}

vm-mail-quota-warning.py

@@ -0,0 +1,38 @@
+{ pkgs, ... }:
+{
+
+  environment.etc."mail-quota-warning-secrets.yml".text = ''
+    accounts:
+      - name: Sales
+        imap_server: mail.example.com
+        imap_port: 993
+        username: sales@example.com
+        password: secret
+
+      - name: Support
+        imap_server: mail.example.com
+        imap_port: 993
+        username: support@example.com
+        password: secret
+
+    mail:
+      smtp_server: mail.example.com
+      smtp_port: 587
+      smtp_username: monitoring@example.com
+      smtp_password: secret
+      from_address: monitoring@example.com
+      recipients:
+        - admin1@example.com
+        - admin2@example.com
+  '';
+
+  services.mail-quota-warning = {
+    enable = true;
+    settings = {
+      CHECK_INTERVAL_DAYS = 7;
+      QUOTA_WARNING_THRESHOLD_PERCENT = 80;
+    };
+    secretFile = "/etc/mail-quota-warning-secrets.yml";
+  };
+
+}