feat[work]: use s/mime certificates for mail

SwarselSystems.org

@@ -11715,7 +11715,7 @@ Sets environment variables. Here I am only setting the EDITOR variable, most var
         SWARSEL_CAL3 = source3;
         SWARSEL_CAL3NAME = source3-name;
         SWARSEL_FULLNAME = fullName;
-        SWARSEL_MAIL_ALL = allMailAddresses;
+        SWARSEL_MAIL_ALL = lib.mkDefault allMailAddresses;
         GITHUB_NOTIFICATION_TOKEN_PATH = nixosConfig.sops.secrets.github-notifications-token.path;
         OPENROUTER_API_KEY = openrouterApi;
       };
@@ -15220,6 +15220,8 @@ The rest of the settings is at [[#h:bbf2ecb6-c8ff-4462-b5d5-d45b28604ddf][work]]
   { self, config, pkgs, lib, vars, nixosConfig ? config, ... }:
   let
     inherit (config.swarselsystems) homeDir;
+    inherit (nixosConfig.repo.secrets.local.mail) allMailAddresses;
+    inherit (nixosConfig.repo.secrets.local.work) mailAddress;
   in
   {
     options.swarselmodules.optional.work = lib.mkEnableOption "optional work settings";
@@ -15240,14 +15242,16 @@ The rest of the settings is at [[#h:bbf2ecb6-c8ff-4462-b5d5-d45b28604ddf][work]]
           vscode
         ];
 
-
         systemd.user.sessionVariables = {
           DOCUMENT_DIR_WORK = lib.mkForce "${homeDir}/Documents/Work";
+        } // lib.optionalAttrs (!config.swarselsystems.isPublic) {
+          SWARSEL_MAIL_ALL = lib.mkForce allMailAddresses;
+          SWARSEL_MAIL_WORK = lib.mkForce mailAddress;
         };
 
         accounts.email.accounts.work =
           let
-                inherit (nixosConfig.repo.secrets.local.work) mailAddress mailName;
+            inherit (nixosConfig.repo.secrets.local.work) mailName;
           in
           {
             primary = false;
@@ -21838,6 +21842,35 @@ This adds the simple utility of sending desktop notifications whenever a new mai
   (mu4e t)
 #+end_src
 
+**** Work: Signing Mails (S/MIME, smime)
+
+Used to automatically sign messages sent from my work email address using S/MIME certificate.
+
+#+begin_src emacs-lisp
+  (let ((work (getenv "SWARSEL_MAIL_WORK")))
+    (when (and work (not (string-empty-p work)))
+
+      (setq swarsel-smime-cert-path "~/.Certificates/$SWARSEL_MAIL_WORK.pem")
+      (setq swarsel-smime-cert-path (substitute-env-vars swarsel-smime-cert-path))
+      (setq mml-secure-prefer-scheme 'smime)
+      (setq mml-secure-smime-sign-with-sender t)
+      (add-hook 'mu4e-compose-mode-hook
+                (lambda ()
+                  (when (and (boundp 'user-mail-address)
+                             (stringp user-mail-address)
+                             (string-equal user-mail-address (getenv "SWARSEL_MAIL_WORK")))
+                    (mml-secure-message-sign-smime))))
+
+      (setq smime-keys
+            `((,(getenv "SWARSEL_MAIL_WORK")
+               ,swarsel-smime-cert-path
+               ("~/Certificates/harica-root.pem"
+                "~/Certificates/harica-intermediate.pem"
+                ))))
+      ))
+
+#+end_src
+
 *** Calendar
 :PROPERTIES:
 :CUSTOM_ID: h:c760f04e-622f-4b3e-8916-53ca8cce6edc

files/emacs/init.el

@@ -1605,6 +1605,28 @@ create a new one."
 
 (mu4e t)
 
+(let ((work (getenv "SWARSEL_MAIL_WORK")))
+  (when (and work (not (string-empty-p work)))
+
+    (setq swarsel-smime-cert-path "~/.Certificates/$SWARSEL_MAIL_WORK.pem")
+    (setq swarsel-smime-cert-path (substitute-env-vars swarsel-smime-cert-path))
+    (setq mml-secure-prefer-scheme 'smime)
+    (setq mml-secure-smime-sign-with-sender t)
+    (add-hook 'mu4e-compose-mode-hook
+              (lambda ()
+                (when (and (boundp 'user-mail-address)
+                           (stringp user-mail-address)
+                           (string-equal user-mail-address (getenv "SWARSEL_MAIL_WORK")))
+                  (mml-secure-message-sign-smime))))
+
+    (setq smime-keys
+          `((,(getenv "SWARSEL_MAIL_WORK")
+             ,swarsel-smime-cert-path
+             ("~/Certificates/harica-root.pem"
+              "~/Certificates/harica-intermediate.pem"
+              ))))
+    ))
+
 (use-package org-caldav
   :init
   ;; set org-caldav-sync-initalization

hosts/nixos/pyramid/secrets/pii.nix.enc

@@ -1,5 +1,5 @@
 {
-	"data": "ENC[AES256_GCM,data:TAwmpSF2fhM/gHIL2qUs4lvaLwzbg3UR2ges9x3uioLMYCn4o0fFnf+NbqM3CBERqrBTh6f4TpWTD1SJ9934ZhvwR09xhjc1wVM6JcE9yWfAifm8zwxK85SAn8c3Ap1WRsuDKT7RdoyDwh5IDkl2bgkznlFNVIrIMaUSjj1XITacNwFuIBKoPBJjX9jHjYg0PT07RSQ2VWh9xGLbp9/RKDu+csVaNSdPqRRPYwPbwpcML34ABWvlwDre1dCwJjhq/hdBdAL9/fasvHSdYOinDytH67d8jrEOPGZGKUTOERf2GUGsgqMYuPmkVSG+3JRhZvOZZEVuCexvyErVvHoxXzMCfv/DzaqB9KgKZmL1Wfak/KLCeXs4jfPUS0+dEi0sxNc+R77opPbVqTEBO64mgniWbtvk0N3GHrBJj1BDR/9v/gs72QMcatQnSuWMAZ1DnRfsHVBYxvuAdZ+vEKhQ61lkdh7bV7FKkG9xQwO/W0b2dfAdpfTe3n2tRhzznEwhGDyujfTTguOpQrd/0whuI8Ete0eTGNFj5zrUcBOHR+HE+CuQlathFUEMAjxx+/oy7gk6pm9olDBSl6ptzJjGDF/suV0NUT5mcm6zVSUxGMMCjuH3MlKI0VTcdm69WpgDYj07seFvBfRs/pAEj5mMVbEY9VE8BRNiM5fQumQzwr5BlAEyWgy6VZ74wt4F/Y/3iPHv3n516ZwmBYVJ7xxqYqo3+lpenVurYCy9v0rw0KndojcE852oil90GX6R6ZhMQmM0JbUl4n75oI6ug5zHyzHUluuTNIZ1rNZzPamt32EOIeXkSTs+jAfyjku0eENt8aX14BZBsCh7JG+f7YNyIs711wK7rzMw3JBvk1vXveOFPjK4vBimIG3uBkiAiQ4GFk01ISTbpMvdmLmdtPeZdjp29OiMqWlG4GLm/4XfmHMvsLpnkCTKEKn75RD4eOuvp1P1oaopkPt1oQqMVJtUmFjA4NZlyRSn+KkLTO0lAjsfl03HsTC6RnQcnBNlEMBD0I2VFhH4qIKHrmwgMy5LCeWWQ0/QYPgtfV/xbO2AlvRwX4I5VYjlAZ00TZ3147qXF2KAweINOEHGavegFabx9Bh3MwM8JP2l1BPlO7eE5iXkwmvIPT2yr+dzNyd3A/uV4tnX/h3z7eErpmv189EZY6iKq6011d1En8l3x3PJMrtU0qwCXbwG0RBERbh1rH++gfED0A2LFnVDUAmiVTWTv26ik3kG9YRQbAL1LC9Bfx0jhktRy8uQRu9COMJX6oobC64/FThV1phuPfsEm468r5sJ/8sTkVHYQPf57ePE4uP5axvNB9D0nZwRhlh5duSaaOY64Sg3PdxT6h39V6GR42q9lCTJ7MFxm8YLzaeh3cf0Tl2aoZC4T6WQCbcNZ4SzncUBwDmJvbBjHqHM63nHuvlK5XPAgyWCtAoLpvQAKWeDPupCxLNyHB6uDbzAS3sY/XVD5qDAJffZBxNqwJHdPiO3gDn8aBZe51AamOmdqxK2ujl1XlBSLFmFkRSwssGoQQrLfQp1o0O0pCSfRy0cSStCp8uwzSubGF2Z1ebYViBpl8HwFmAA+i31nWhplEsFivdBqSlO+R5slKCZcZRVQynFsvLe2Rrp2uXaQzs27GeKUKE5jl0Yzmia8V7EKacTxZhs0/uEkhTRiMIjLzGPjFDHCPQr5APYzXrzauJeVbf9w7pkDlXeyDfu3pG+Nk3ljL+blyCA/sPFMFpwEUm5WdoVAb5sE2d8WcCDmJG9jWRrRs32i3lrfEphORYku8qd+jdBiqqnOGqAySv01Ip+0zkhstXuze6WoH7k32DMHgxKEfPLHqqGKJxAVfCluKhybJlWnaZ2BMW2Ctz5yZHNyXnkqv9FONArLJPgnNpecaEPiZXDWLbOsBXuqjhuNvuB6llX5GOCoc36ynZGjoI/PgG2V7SU2DDQf5ibM7qQnLye/bKi8YiZKvzDcMzbkujM5+PZDhuXbilYjMybR5ct03QOHnv2xg7Tc2Uf0uCCc9GqaFGiKL/q7tTR2AqYJ0moypVVLRVhMBJolQtO1eUrUoZjtbM9gFRF8+BHbDbNP/zVO2Gk0hNIBl/VCG0eusqmSPk5dfesF2xhoTTdwTBjoxTGWzEezoBj+ufL1zK49n44+uLwTF1isS0PSsTlGHQmvZC4sDQCtr0bjzWag6CHAe3cYa6zizC0SHbrrkZhuxJId3yk0pVzpRMYZ5HRGMrTw0W9Y5oQt10GeCtmhM03H80J+Q7M8/TtqF2dWf249aNI93RGQLiVMUj06k5hLwHk2/BlFdeOgzzQxzrVx03Y+qWNUMPVVJViyQp42tCinAaLYw2eCbtrj4/Ze0v8u/gZYMdgq1KegyNEPIQqlM9MGbCcwIXgEWGl9hvIngmQ+ZuoiJtjGhvRHtqUzql4x2IsfxOxcUVwXxoM6yISZrOdmiLgpd/mp/NBPEomba6E5AjQFlzy/b5Vk0/HT6EgYdJNXBthVWqB+X0/4IzQ79o9Kwd1VjOAkBvXy/siWuSU03demYuKnZTsCBV7h2bWyge19rCYyUryN9WaB+fcnVHmFvU999SUudE+6QXZC/0ZIU1SV2K9K5Cqovw7zSCTM2w+0QZp+0LCbPDS/tDOKpd2z0uHg5UWy11gH/i4P9Lt7ygRAjRQ0gZ9K3N41Z2RfH9UTTUsnKMXR5+Z6ebZhi6IST6VlOa1ahJj7CRXOSBxNeK6vWtHfSmO56wJN7FcoItsehpcwDyMYVIYYEe53eZTuho3UKqd/q9QEBlgwFpiBmUy6CEX4jryiC6LDiUEFL63YIq2qNy4JLhSjG7JwaAzjCXdDv3Au3tiWV+sDXNV88MG0AEAM/zQ83bHMhv/xcyvp/TA2YOuYBfvlVYuxXASbFzl,iv:Fu+GmDArq6JSpODMPTJ7boKT/N33l57UbHqdTwpYuxA=,tag:gi/VuS3QTzeOiUsZBfm7BQ==,type:str]",
+	"data": "ENC[AES256_GCM,data:Avje6G0sf17iETA622PNdboM3FlYSFtdiPtEuCKpytuUS/2ATu1g9rTeLuSwKHzMfuweF1l+GWkME4D3PQZ2hzgtyByISnuHTFB0kO/QmnmpoNpEkGXgUKpogEaFWiTyFkg+Ceo8IFzSA+AW22DcNnU6ygZlnuK92XH3qJ9F/xyF8yd3eFXx9skA68GdpyoOxnw648ZKeL0/mWLcZVSxDpt7o2bnnL/lU8qp4HErRkgbIh8aUCfaZjRJMXOMfZj4rNSZ58ZCSTl1akuDRYQfqk8WdprrveDXVPtFe3Ol1LY2yqZtTTjE/L94fmQtkLE4U36uJfQBtnUAjqXJQqCpZRrJcQgqPyW29CWwIxK/2hccYIikv6033j2kUKQbXWMcniBsnFfmBvLLKBHdylNX2AstKjtkJ48dZskL833QvYwxNxePEk0heJ463goWHtDLWNFAMW5vrI/BYg8NM6PDYvZWG6yswUZFlUmzKoQxzbxKgnsXj4yDH+pNu8B8uWzKaEYDQjeKdOPEhagNVroeT+T6r0hp/sEJUTh8ekIwpmmNssF7DalKumEcuQy0K3Lvt7fUhB5Z+dFMz3eqhQuXtwQl9p0mpf13F8qVtbuB4Ye0N8HmGFp+TF5sVXy1RsgP80uVawaqKVyhiRoT+ZDMUno4MwkmPAmkYhemkH9UIsooiRdFOb9W4zzQbpC79htnGXGVWgDQMNYVun/TX0RMNnmFls/HoPQz5Ft6sKQp6cQ8bNxsWMJKTRR/Y8g32OomcGMegPDM+oeutvTFkUhhZdgFHd98brOZjrEeQVwyh6fOLqHaSIZB8XFjh/rDytPbX85/HQSH+k9zWgL4kpHoZeLPUK0alY2RMFlYuNd/a8yhgdlQZGGSfVP92JrdmOcTxgOd11zy6/eTWBWVZVE279CJvAYkKDTFN/MyoAC0gTl2mR9vW44BbDAHywOy8AJjzoDMWacg7DBFSqxW9ZGJbFs3udqYk5IDhrdOz941jE+WsP978K8uTn2F7d/Qz6lhmberdyIuPC0H18+2Gzv1L/LWtc6/kqqPOB9RYrlaayAfymqNV/3FdhFSxfx4Pm4SD5MIaZ99FS7+AwP3B5kmnCZToLZlFsgPL9DUwqwgx69gQxUlb362ih5swaCY0nOL63oa6c25/UvO9rYkDh52FhGl1N9gzvbzbYC0Mp7QuwzF1XWUFbhE+f9aJ6bAXHyS10GMfa76eLnnoPSslYZ4rZfLMjHOGjbTMY7wTLl50wKg4VbThWtpkxwbITGd5VZH1/iO6e7F8K0gMwHNMYSm/doNaRcN1HWi7eD6YtQVWlWlewx0C9BzW6TsOy3e9MtQBULFDkPEIbzoT/29dS1o7YKyomdBG867xbqKV31DkqBpq9G0Fv6kHCeu5MmfzeqhueA11+XFQvvNl2KsLW5LvlP7GPOl0VjlEBY61SGjXibMGcLOAEgsxyzzZhLP97pl1dTb2yokBkDTy9n9pgpWJ5NmZi68XMVew8Nx4vz0Dj6jZruPgO3vBtpUytx6vjp/hwKcUQq09PxY8QN5l3gfmZJvAiDMuZh6ZzaJvVhkK/afzt2YN1rozd+Ibo4k3831X+RkfKLFoiA6E0g9SEgm6HAl/gfRIKR740yH0uVVbpCNIRpfBuAQMAvoLczcgYjsMaZ5hqHh0nOC+hsHmEIP47KrPzyA8U3+TjQEbAN1aHAGkzVDVJ4E8iwPkPAP0B+b6mtSNfscdyG5iX2zlqcivvA51s8zouhxEZ4KZ9TiVtg6dlngP7fu1SjM2DYzG2Sshg8L+WyzFFjDgWPe5RO8btzWEFuNTpFgvaRYQWONa7JWgnigP4ZE7Tc+shN8BXGhjJnGM4Z1+PNPRWvB/d1Fqe1KbgTyVFHizD8DnNWmfgghFLOwenKbZXe8wAAGmfIaCHE7IMrTSeuqhfKpGGnrnlE9Hd3y/8ojYtOFPQ16ohTPxBVwN/gt8RCmBdP+i4Y11He0vdX3HaF3W9yGkIPDLY/aJ33NvK9lmCvXBYANSLirBJmY/xEgdxIbG9TDRnZPoUQ0b8WBZS8RFg7wuxNucNrMAHp+8n3Ww0D9+zqo1rropr7FRc1xYjRrxSvx+g0xhb46qe7In+mSaJy1seITD6T+LdnOz3SK6bXpZ1I1sg7B0XXCLyMe2cs3KrqmUwDYowm6rbyM65X2CVgl/ULXg0rjPBaKqqYpFeQDAYdBgLiLiA99tWhI3hf6WEYb9aio6gIgkDtKMe242TnauUBkCDHxqgC/Lhp4fG4+TCjRTNopO3nmEYoYH67+VQONyU4YRn7lmWReT5pFrkczBIogeihgCwL+zNzA/f4wvGdADNLH9uxuGIpR5a1/HwWa6cKxCQ375kl013By6dHre50zal18KHMz/ou8dDQOsWDMbjE01aDJEHHSVPZiySjXiNWD+mvy8SE8hMRVyP/9PyB91wXwhRAU1UJifFSCuKAlqkwOCkqrMJ+EDhoIrGhx+XfM84/wu/RIowKTtF4Zz7CmpjN8cSgm+Ht4akg7XaBiAGsZMal3TY33SzY7MHZ1Tsv2AeYHPtssyXBdVd8GRZAw7phoPqXpV1hSvLwS7fY2F3+Ie8U3E55p4U7HrYGo9SHqF90rSB/tUhQdah7ptcpywBWlCWqA9L+q7I5kljSLFSf/2Hl1B33M80rCCdnOSiyjawF+0n9Pysw4C/z0aHQIBTDYYTZ9a6RIEjHDFlX7GKX8CKw6XvTvsIgs2kDklcUNTgXI5MRMtkyIrh081V2gNj65B0+yWxlK2VvyKLv2AuFCH2m401Dazusp89yA624wMFRF/DQmiC7MPvWFMzhLbsQu3dRW+JKDv88t18OymQeQlbP+lNdff4Cd4fVoTqt6xCoDLrIcmX/rw9QZnmJF/dW2wmMVQIONdfBx6O+CHsaaLScHdJg0/RIfjA8bkObPh+p1ULvJ9ddLQA5J7Cd2omwhZqXpPbAiveykCEWRMOCD0mama5RHJOyNnqQGYUmPvpq+QwaR4+6DeGy319uyNiLcmKKMIx+hSq2qQhK+ler1DS5VLJC0g5rWcovE7bUs7sNKETvMfO8gr1Crve2wTWA6DCrNZSSkWXwzwJOsVmVx66e/hmh17k/DCqDG55z11QR6X7C0EryzAj1JPJ6wG9KamgsZOCqJL1h2piNdbTnnBPfE5btg2OIw1453OYgWI2f833p6BZR4irditSs67fNt4ZFGad7pq5ETlpFU1FQUZFuEm7iFrw==,iv:7YztaPs7GSC4AdIF36G3qb8lQAhUwkaD613z8LcUW7A=,tag:ULku+TZreQNt5/6ZyLtWog==,type:str]",
 	"sops": {
 		"age": [
 			{
@@ -11,8 +11,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z2tONmQxTUhZUW12Z2Jm\nUnoxSnpYcnZDNGNzSko1ckl2RDh3NG1VS2dFCmIwUXhmSk1OUk02S0JPVDR5UWJ4\na0gwWlg0V005ZWxYa29PZ0laS2VqM0kKLS0tIHN5SU9pQ090eHljeXJGWm5hRFQ4\nZ001Nzkyb29RYkNUMDNDNlo4YnVQeTQK34bNIBgxId2+DHKQNVV3Iro3KGkE03Sp\niB1+dADT6nRvGvoyPqnLq/NYfw7eQ6XqYt55zkdCta8v6L1UNUkw8g==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-10-11T08:44:45Z",
-		"mac": "ENC[AES256_GCM,data:pNbRA83NQcfWwTjgowEaFlfZVbZntWb1alGKdaX3IqjBlZEmYfJGKaxkbiL1uoMFNmrc5HtQUQLz0QVUpQ87ggH/HEUtdVcHnT65hxWjX3NWg3G2C9cbPqe3SiLv+UWPUsN70gu/xAJUuaiM9tsQoHkpNdefT3t382/uxF+Cb3M=,iv:1njSCqZFoCX46IhiowRqUteG8VJ5EEHDxricjMd4l58=,tag:9WBBXfUUW+7wmXy3zksMKQ==,type:str]",
+		"lastmodified": "2025-10-21T17:51:36Z",
+		"mac": "ENC[AES256_GCM,data:nogwxr8xZVIPv1vnZyBZuGu5WHO7ygxfeoF+Nrmdqin4YrZ8nK3f8oVNAsEBfNvUyr2mkRAbAT3tgcP+u/w+RJgH9ERHWljnw5xy8iGLkTF36B83+lCL7cp3wIzllOQyRUYEHegnQWA79WoWWHD3u4sZmlinByJRUMscRV9uTww=,iv:rZd+3+WlcOVtqgJGhoBkJGm/HF/01wuopeFlEwvcupI=,tag:P7fIdk4ithHyOAfqui6xNw==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2025-06-14T22:31:01Z",

modules/home/common/env.nix

@@ -28,7 +28,7 @@ in
       SWARSEL_CAL3 = source3;
       SWARSEL_CAL3NAME = source3-name;
       SWARSEL_FULLNAME = fullName;
-      SWARSEL_MAIL_ALL = allMailAddresses;
+      SWARSEL_MAIL_ALL = lib.mkDefault allMailAddresses;
       GITHUB_NOTIFICATION_TOKEN_PATH = nixosConfig.sops.secrets.github-notifications-token.path;
       OPENROUTER_API_KEY = openrouterApi;
     };

modules/home/optional/work.nix

@@ -1,6 +1,8 @@
 { self, config, pkgs, lib, vars, nixosConfig ? config, ... }:
 let
   inherit (config.swarselsystems) homeDir;
+  inherit (nixosConfig.repo.secrets.local.mail) allMailAddresses;
+  inherit (nixosConfig.repo.secrets.local.work) mailAddress;
 in
 {
   options.swarselmodules.optional.work = lib.mkEnableOption "optional work settings";
@@ -21,14 +23,16 @@ in
         vscode
       ];
 
-
       systemd.user.sessionVariables = {
         DOCUMENT_DIR_WORK = lib.mkForce "${homeDir}/Documents/Work";
+      } // lib.optionalAttrs (!config.swarselsystems.isPublic) {
+        SWARSEL_MAIL_ALL = lib.mkForce allMailAddresses;
+        SWARSEL_MAIL_WORK = lib.mkForce mailAddress;
       };
 
       accounts.email.accounts.work =
         let
-          inherit (nixosConfig.repo.secrets.local.work) mailAddress mailName;
+          inherit (nixosConfig.repo.secrets.local.work) mailName;
         in
         {
           primary = false;