ft (wip): big initial config

modules/email.nix

@@ -0,0 +1,87 @@
+{ config, pkgs, ... }:
+
+
+{
+  programs.thunderbird.enable = true;
+}
+
+# TODO: use thunderbird seeding config
+
+# Thunderbird with all mail accounts declared. Thunderbird can't read passwords
+# from a command, so its credential store (logins.json + key4.db) is kept in
+# sops and copied into a fresh profile once. The Microsoft 365 account still
+# needs its OAuth consent once per machine.
+
+# let
+#   realName = "Djai Hougee";
+#   profile = "/home/djai/.thunderbird/main";
+#
+#   # without this thunderbird picks OAuth2 for gmail.com accounts, but these need app passwords
+#   passwordAuth = id: {
+#     "mail.server.server_${id}.authMethod" = 3;
+#     "mail.smtpserver.smtp_${id}.authMethod" = 3;
+#   };
+#
+#   oauthAuth = id: {
+#     "mail.server.server_${id}.authMethod" = 10;
+#     "mail.smtpserver.smtp_${id}.authMethod" = 10;
+#   };
+#
+#   account = flavor: address: auth: {
+#     inherit flavor address realName;
+#     userName = address;
+#     thunderbird = {
+#       enable = true;
+#       settings = auth;
+#     };
+#   };
+# in
+# {
+#   # Only seeds a profile that has no logins.json yet, so the live store (with
+#   # Thunderbird's own token refreshes) is never overwritten.
+#   systemd.services.thunderbird-seed-creds = {
+#     description = "Seed Thunderbird credential store from sops (first run only)";
+#     wantedBy = [ "multi-user.target" ];
+#     after = [
+#       "sops-install-secrets.service"
+#       "home-manager-djai.service"
+#     ];
+#     serviceConfig = {
+#       Type = "oneshot";
+#       User = "djai";
+#       RemainAfterExit = true;
+#     };
+#     script = ''
+#       set -eu
+#       secret="${config.sops.secrets."thunderbird-creds".path}"
+#       if [ ! -d "${profile}" ]; then
+#         echo "profile ${profile} not present yet; skipping seed"
+#         exit 0
+#       fi
+#       if [ -e "${profile}/logins.json" ]; then
+#         echo "logins.json already present; leaving live store untouched"
+#         exit 0
+#       fi
+#       if [ ! -r "$secret" ]; then
+#         echo "secret $secret not readable; skipping"
+#         exit 0
+#       fi
+#       ${pkgs.gnutar}/bin/tar -C "${profile}" -xf "$secret"
+#       echo "seeded Thunderbird credential store into ${profile}"
+#     '';
+#   };
+#
+#   home-manager.users.djai = {
+#     programs.thunderbird = {
+#       enable = true;
+#       profiles.main.isDefault = true;
+#     };
+#
+#     accounts.email.accounts = {
+#       djai = account "kolabnow.com" "ljxjah@mykolab.com" passwordAuth // {
+#         primary = true;
+#       };
+#       uni = account "gmail.com" "d.hougee@student.rug.nl" oauthAuth;
+#     };
+#   };
+# }