ft: sops-nix + secrets

modules/email.nix

@@ -3,84 +3,3 @@
 {
   programs.thunderbird.enable = true;
 }
-
-# TODO: use thunderbird seeding config
-
-# Thunderbird with all mail accounts declared. Thunderbird can't read passwords
-# from a command, so its credential store (logins.json + key4.db) is kept in
-# sops and copied into a fresh profile once. The Microsoft 365 account still
-# needs its OAuth consent once per machine.
-
-# let
-#   realName = "Djai Hougee";
-#   profile = "/home/djai/.thunderbird/main";
-#
-#   # without this thunderbird picks OAuth2 for gmail.com accounts, but these need app passwords
-#   passwordAuth = id: {
-#     "mail.server.server_${id}.authMethod" = 3;
-#     "mail.smtpserver.smtp_${id}.authMethod" = 3;
-#   };
-#
-#   oauthAuth = id: {
-#     "mail.server.server_${id}.authMethod" = 10;
-#     "mail.smtpserver.smtp_${id}.authMethod" = 10;
-#   };
-#
-#   account = flavor: address: auth: {
-#     inherit flavor address realName;
-#     userName = address;
-#     thunderbird = {
-#       enable = true;
-#       settings = auth;
-#     };
-#   };
-# in
-# {
-#   # Only seeds a profile that has no logins.json yet, so the live store (with
-#   # Thunderbird's own token refreshes) is never overwritten.
-#   systemd.services.thunderbird-seed-creds = {
-#     description = "Seed Thunderbird credential store from sops (first run only)";
-#     wantedBy = [ "multi-user.target" ];
-#     after = [
-#       "sops-install-secrets.service"
-#       "home-manager-djai.service"
-#     ];
-#     serviceConfig = {
-#       Type = "oneshot";
-#       User = "djai";
-#       RemainAfterExit = true;
-#     };
-#     script = ''
-#       set -eu
-#       secret="${config.sops.secrets."thunderbird-creds".path}"
-#       if [ ! -d "${profile}" ]; then
-#         echo "profile ${profile} not present yet; skipping seed"
-#         exit 0
-#       fi
-#       if [ -e "${profile}/logins.json" ]; then
-#         echo "logins.json already present; leaving live store untouched"
-#         exit 0
-#       fi
-#       if [ ! -r "$secret" ]; then
-#         echo "secret $secret not readable; skipping"
-#         exit 0
-#       fi
-#       ${pkgs.gnutar}/bin/tar -C "${profile}" -xf "$secret"
-#       echo "seeded Thunderbird credential store into ${profile}"
-#     '';
-#   };
-#
-#   home-manager.users.djai = {
-#     programs.thunderbird = {
-#       enable = true;
-#       profiles.main.isDefault = true;
-#     };
-#
-#     accounts.email.accounts = {
-#       djai = account "kolabnow.com" "ljxjah@mykolab.com" passwordAuth // {
-#         primary = true;
-#       };
-#       uni = account "gmail.com" "d.hougee@student.rug.nl" oauthAuth;
-#     };
-#   };
-# }