feat: add harold

flake.lock

···
         "type": "github"
       }
     },
+    "herald": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768060179,
+        "narHash": "sha256-tevqlXq0mrTo5KWLHQYjrgnhDvlTYblpEOjFDvnJg+c=",
+        "ref": "main",
+        "rev": "384c53a43b18d6e4351643055cedec76ec43b6c1",
+        "revCount": 44,
+        "type": "git",
+        "url": "https://tangled.org/dunkirk.sh/herald"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://tangled.org/dunkirk.sh/herald"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
···
         "flare": "flare",
         "frc-nix": "frc-nix",
         "hardware": "hardware",
+        "herald": "herald",
         "home-manager": "home-manager_2",
         "hyprland-contrib": "hyprland-contrib",
         "import-tree": "import-tree",

flake.nix

···
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    herald = {
+      url = "git+https://tangled.org/dunkirk.sh/herald?ref=main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     import-tree.url = "github:vic/import-tree";
 
     nur = {
···
             
             zmx-binary = prev.callPackage ./packages/zmx.nix { };
             bore-auth = prev.callPackage ./packages/bore-auth.nix { };
+            herald = inputs.herald.packages.${prev.system}.default;
           })
         ];
       };

machines/atalanta/home/default.nix

···
           zmx = true;
         };
 
+        herald = {
+          hostname = "herald.dunkirk.sh";
+          port = 2223;
+        };
+
         prattle = {
           hostname = "150.136.63.103";
           zmx = true;

machines/terebithia/default.nix

···
     ./home-manager.nix
 
     (inputs.import-tree ../../modules/nixos)
+    ../../modules/nixos/services/herald.nix
     inputs.tangled.nixosModules.knot
     inputs.tangled.nixosModules.spindle
   ];
···
       file = ../../secrets/control.age;
       owner = "control";
     };
+    herald = {
+      file = ../../secrets/herald.age;
+      owner = "herald";
+    };
+    herald-dkim = {
+      file = ../../secrets/herald-dkim.age;
+      owner = "herald";
+      mode = "0400";
+    };
 
     "restic/env".file = ../../secrets/restic/env.age;
     "restic/repo".file = ../../secrets/restic/repo.age;
···
       22
       80
       443
+      2223 # Herald SSH
       28868 # Minecraft server
     ];
     allowedUDPPorts = [
···
         };
       };
     };
+  };
+
+  atelier.services.herald = {
+    enable = true;
+    domain = "herald.dunkirk.sh";
+    sshPort = 2223;
+    externalSshPort = 2223;
+    httpPort = 8085;
+    smtp = {
+      host = "smtp.mailchannels.net";
+      port = 587;
+      user = "kieranklukascontracting";
+      from = "[e-mail]";
+      dkim = {
+        selector = "mailchannels";
+        domain = "dunkirk.sh";
+        privateKeyFile = "${config.age.secrets.herald-dkim.path}";
+      };
+    };
+    secretsFile = config.age.secrets.herald.path;
   };
 
   services.n8n = {

modules/nixos/services/herald.nix

···
+# Herald - RSS-to-Email via SSH
+#
+# Feeds uploaded via SSH/SCP, emails sent on schedule
+
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.atelier.services.herald;
+  
+  # Generate config.yaml from options
+  configFile = pkgs.writeText "herald-config.yaml" ''
+    host: ${cfg.host}
+    ssh_port: ${toString cfg.sshPort}
+    http_port: ${toString cfg.httpPort}
+    origin: https://${cfg.domain}
+    external_ssh_port: ${toString cfg.externalSshPort}
+    
+    host_key_path: ${cfg.dataDir}/host_key
+    db_path: ${cfg.dataDir}/herald.db
+    
+    smtp:
+      host: ${cfg.smtp.host}
+      port: ${toString cfg.smtp.port}
+      user: ${cfg.smtp.user}
+      pass: ''${SMTP_PASS}
+      from: ${cfg.smtp.from}
+      ${lib.optionalString (cfg.smtp.dkim.selector != null) ''dkim_selector: ${cfg.smtp.dkim.selector}''}
+      ${lib.optionalString (cfg.smtp.dkim.domain != null) ''dkim_domain: ${cfg.smtp.dkim.domain}''}
+      ${lib.optionalString (cfg.smtp.dkim.privateKeyFile != null) ''dkim_private_key_file: ${cfg.smtp.dkim.privateKeyFile}''}
+    
+    allow_all_keys: ${if cfg.allowAllKeys then "true" else "false"}
+  '';
+in
+{
+  options.atelier.services.herald = {
+    enable = lib.mkEnableOption "Herald RSS-to-Email service";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      description = "Domain to serve Herald on";
+      example = "herald.dunkirk.sh";
+    };
+
+    host = lib.mkOption {
+      type = lib.types.str;
+      default = "0.0.0.0";
+      description = "Host address to bind to";
+    };
+
+    sshPort = lib.mkOption {
+      type = lib.types.port;
+      default = 2223;
+      description = "Internal SSH port for Herald";
+    };
+
+    externalSshPort = lib.mkOption {
+      type = lib.types.port;
+      default = 2223;
+      description = "External SSH port (for display in UI)";
+    };
+
+    httpPort = lib.mkOption {
+      type = lib.types.port;
+      default = 8085;
+      description = "Internal HTTP port for Herald web interface";
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/herald";
+      description = "Directory to store Herald data";
+    };
+
+    allowAllKeys = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Allow all SSH keys (false to use allowed_keys)";
+    };
+
+    smtp = {
+      host = lib.mkOption {
+        type = lib.types.str;
+        description = "SMTP server host";
+        example = "smtp.gmail.com";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 587;
+        description = "SMTP server port";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        description = "SMTP username";
+      };
+
+      from = lib.mkOption {
+        type = lib.types.str;
+        description = "From address for emails";
+        example = "[e-mail]";
+      };
+
+      dkim = {
+        selector = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          description = "DKIM selector";
+          example = "mailchannels";
+        };
+
+        domain = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          description = "DKIM domain";
+          example = "dunkirk.sh";
+        };
+
+        privateKeyFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          description = "Path to DKIM private key file";
+          example = "/var/lib/herald/dkim_private.pem";
+        };
+      };
+    };
+
+    secretsFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to agenix secrets file (must contain SMTP_PASS)";
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.herald;
+      description = "Herald package to use";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Create user and group
+    users.groups.services = {};
+    
+    users.users.herald = {
+      isSystemUser = true;
+      group = "herald";
+      extraGroups = [ "services" ];
+      home = cfg.dataDir;
+      createHome = true;
+      shell = pkgs.bash;
+    };
+
+    users.groups.herald = {};
+
+    # Systemd service
+    systemd.services.herald = {
+      description = "Herald RSS-to-Email service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = "herald";
+        Group = "herald";
+        WorkingDirectory = cfg.dataDir;
+        EnvironmentFile = cfg.secretsFile;
+        ExecStart = "${cfg.package}/bin/herald serve -c ${configFile}";
+        Restart = "always";
+        RestartSec = "10s";
+        
+        # Security hardening
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ReadWritePaths = [ cfg.dataDir ];
+        PrivateTmp = true;
+      };
+
+      preStart = ''
+        mkdir -p ${cfg.dataDir}
+        chown -R herald:services ${cfg.dataDir}
+        chmod -R g+rwX ${cfg.dataDir}
+      '';
+    };
+
+    # Ensure working directory exists
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir} 0755 herald services -"
+    ];
+
+    # Open firewall ports
+    networking.firewall.allowedTCPPorts = [ cfg.sshPort ];
+
+    # Caddy reverse proxy for HTTP interface
+    services.caddy.virtualHosts.${cfg.domain} = {
+      extraConfig = ''
+        tls {
+          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+        }
+        header {
+          Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        }
+        reverse_proxy localhost:${toString cfg.httpPort} {
+          header_up X-Forwarded-Proto {scheme}
+          header_up X-Forwarded-For {remote}
+        }
+      '';
+    };
+
+    # Backup configuration
+    atelier.backup.services.herald = {
+      paths = [ cfg.dataDir ];
+      exclude = [ "*.log" ];
+      # Uses SQLite, stop before backup
+      preBackup = "systemctl stop herald";
+      postBackup = "systemctl start herald";
+    };
+  };
+}

secrets/herald.age

···
+age-encryption.org/v1
+-> ssh-rsa DqcG0Q
+FM0Rezreqi8ZVC6v8KBCGxzdWmHBm7KRYK9RiS9LiWRsMjhhmgGZUM7lIjafKtJy
+9TXHSQeXAv6iA7W5TZ059EJTx3R5q3Dn8Dim3MtLTUtthSSPst+QO9eWxBxnWmxo
+ZhzcmWO1Li6qmp8Mk6vO+lAdOrPWM91gPjQnubXBhzomXPMzlTlLYaSxSn3eMk+6
+uwMD4XSxKIdcXTjGPzSs+NnHEo6fw6WOCU1W0k+Ex7Aajj0qBXN+j86XIhloODv+
+bAZ/g9ozxOTAiTZyVv2/mXGpOqUcfDn/T8Wx54EIdYdr1lbBO1lTOZ+oHoQF9HhI
+dJawI3lPyjrmnREpNa3nCjzZlbuunj0cWn2vwYBEju6wcYoB6t840iQl4CY+OJ0Y
+zAYy/JaEOmvx6qBVrDoPZQOZfErwDzqUzQOXkf8/D7e2sWtUDeN1TxcQZzRoV6Zj
+cYcGSQlbygLDWwJgIeuzCbgnYnKFkrnDHN5C5b/dHrJ30ozPd4skqf8dHj8JZ+VJ
+
+--- MYSw03+0Llf1UwKqYqEhkoKNNnfKJcHN6jsyy0PNAVc
+D����]EI��Y�f�5��]ː����N�H��l������i���g�`
P\'�3��K"[���]Ga

secrets/secrets.nix

···
   "tangled-session.age".publicKeys = [
     kierank
   ];
+  "herald.age".publicKeys = [
+    kierank
+  ];
+  "herald-dkim.age".publicKeys = [
+    kierank
+  ];
 }