feat(hetzner): fix SMTP on virtualcam website and rm opencode

result

@@ -1 +0,0 @@
-/nix/store/3rwh3r83dmni3kkfmfnrh36lv0pb2zxn-nixos-system-debian-4gb-fsn1-1-24.05.20241230.b134951

servers/hetzner/hosts/hetzner/default.nix

@@ -20,7 +20,6 @@
     ../../modules/services/backup.nix
     ../../modules/services/stalwart.nix
     ../../modules/services/virtualcam.nix
-    ../../modules/system/opencode.nix
   ];
 
   # Only 4GB RAM — limit nix builds to one core at a time to avoid OOM

servers/hetzner/modules/services/stalwart.nix

@@ -262,7 +262,12 @@ in {
 
   systemd.services.stalwart-cert-perm = {
     description = "Grant stalwart read access to its TLS private key";
-    after = ["tlsa-update.service" "stalwart.service"];
+    # Belt-and-suspenders: tlsa-update already chgrps the key after every sync;
+    # this guarantees the group grant also exists at first boot, before stalwart
+    # starts (previously ordered after stalwart, so a fresh sync could leave a
+    # root:root key and webadmin reload would fail with EACCES).
+    after = ["tlsa-update.service"];
+    before = ["stalwart.service"];
     partOf = ["tlsa-update.service"];
     wantedBy = ["multi-user.target"];
     path = [pkgs.coreutils];

servers/hetzner/modules/services/tlsa-updater.nix

@@ -33,6 +33,10 @@
     #    users.
     install -D -m 0644 "$SRC_CERT" "$DST_CERT"
     install -D -m 0640 "$SRC_KEY"  "$DST_KEY"
+    # Stalwart reads the key as user "stalwart" via %{file:...}%; regrant the
+    # group immediately so every sync leaves it readable (0640 root:stalwart)
+    # and webadmin config reload never fails with EACCES.
+    chgrp stalwart "$DST_KEY"
 
     # 2) TLSA 3 1 1 = SHA-256 of the certificate's SubjectPublicKeyInfo (SPKI),
     #    NOT the whole certificate. Matching type 1 = SHA-256 of the SPKI DER.

servers/hetzner/modules/services/virtualcam.nix

@@ -4,7 +4,7 @@
   unstablePkgs,
   ...
 }: let
-  rev = "0e7135918c251ce6bcc2ead1d3f4cf0075ae2c55";
+  rev = "3b45cc1233f11a40a756b371c9e2813c78a1ca82";
   apiRev = "a73f4c4be840444072b0a7f5458438a34b470ea9";
 
   # Private repositories are fetched over SSH (port 2222). nix-daemon runs as
@@ -88,7 +88,7 @@
     chmod 0600 "${envFile}"
     ${pkgs.sops}/bin/sops --decrypt --input-type yaml --output-type yaml ${secretsFile} |
       ${pkgs.gnused}/bin/sed -nE \
-        's/^virtualcam_license_signing_key: (.*)/LICENSE_SIGNING_KEY=\1/p; s/^virtualcam_admin_token: (.*)/ADMIN_TOKEN=\1/p' \
+        's/^virtualcam_license_signing_key: (.*)/LICENSE_SIGNING_KEY=\1/p; s/^virtualcam_admin_token: (.*)/ADMIN_TOKEN=\1/p; s/^virtualcam_smtp_pass: (.*)/SMTP_PASS=\1/p' \
         >> "${envFile}"
   '';
 
@@ -233,10 +233,10 @@ in {
             "APP_URL=https://virtualcam.severijnse.eu"
             "PAYMENTS_MODE=shkeeper"
             "ADMIN_EMAILS=jory@severijnse.eu"
-            "SMTP_HOST=localhost"
+            "SMTP_HOST=mail.severijnse.eu"
             "SMTP_PORT=587"
-            "SMTP_USER=jory@severijnse.eu"
-            "SMTP_FROM=noreply@severijnse.eu"
+            "SMTP_USER=no-reply@severijnse.eu"
+            "SMTP_FROM=no-reply@severijnse.eu"
             "NODE_ENV=production"
             "NEXT_TELEMETRY_DISABLED=1"
             "HOME=/var/lib/virtualcam"

servers/hetzner/modules/system/opencode.nix

@@ -1,10 +0,0 @@
-{pkgs, ...}: {
-  environment.systemPackages = [
-    (pkgs.writeShellScriptBin "opencode" ''
-      exec /home/admin/.local/bin/opencode "$@"
-    '')
-  ];
-
-  programs.fish.shellInit = ''
-  '';
-}

servers/hetzner/secrets/secrets.yaml

@@ -6,6 +6,7 @@ wg_admin_password: ENC[AES256_GCM,data:X/+YJoNoFFU7P/2HCpTI,iv:FXDS3xuFB9jxjpQhs
 virtualcam_license_signing_key: ENC[AES256_GCM,data:zk8YDER9d9mBOdXgEKKC6dubSMfz6UMMb758ZC9SvjkYIv+R2EVd+CJwL93MCs0l62lUDxoBDCgTLbKM55kcaThkkqfgZCYPrndXevYZ7kquNQEMkoYg/pyGAWhAQ9trvT5QXfBES9UDdYi6J9taCVKCofutiMEdoJM8olgUwKsP4i+fbt3idYkdWNGelastPnvTuUK/M3/dOKR5eheiy5oIntG+sECOz/2eKHJ8cU3ja18uAEwcpd9VojuOa0fvfui8AujQcMZNSMv8VsLGnoR854iX3g1MvHkTBSzv3qaDzRC54MueXYR4WOzm0o+yv6Otmw1n9trWtk+WLUimmiKxDdW6nSFaddeisWzy47+QYzrSsd7iovNYEIHnW4kpnT5W2g5lwaJwA0J0pBOqvV9gziv8oBNeEbLurBxi78KwHBqG,iv:svx+hC4tS26xqI05+yo6N2d3uHzO7ULM0e76dMbShjs=,tag:EJ9fjHEi1wUhLkxy8sexww==,type:str]
 virtualcam_admin_token: ENC[AES256_GCM,data:JC5zSFBCoEapxv/Kcs4VXk3HAkiqwXVrCv1rlqFsXVx3LGspnQdzjOIahlM=,iv:GRVfMNGkwC3xXR00ww29rFbhTrpuViad+H05yDhR9BA=,tag:OBnxBD/8KU4mn17FFTcdng==,type:str]
 git_ssh_key_b64: ENC[AES256_GCM,data:LaUcR005w9iCd/DifDhzLM7tU4AuTiFM802gMU1HMtvFN2iSffucaFJWxpKv2zFxDxz0QpA3XwM1M5yJC4K3YFMxPkPXcWLYN4yHcc1yXuoB3SseQXjcJnPMqZvJfVYhHep+6CVVlVDQs1Y+miBvbAhrvCEblwUu5LhD7yvoJLwTnEpT15WGDvqezzYKzNSyQGNRa8KPjsD/7gJN3RyUPzKo6GsrIp8d8eOTuCZwEcJVDKE0ACXs4V6cd+akqIWZkNPyilnMTuK5cqg2YuqSpwu9NncKED6SjmPiozPKKgTVaWhNCRJUTBfIw85fdXizvq7PNbNRxxBsscAWd0ixXiLqg1RTipfv85wL4Nru3r3qcQGAWmOpTHKW5fA9kR4ygdNxEVkOgQ70m9U0wev+vdIJUoRYj09Ikobej370NKppOP6+oeEDE7NpkFH7tzRk1oHtwoc1dwP9Kq1T8XdxttCKFyb1pAJ6gMdMThCfJlC9/Uu/WYbYVu5bCj6BAmrdrmhbPrsEOylBeC9j9RhyRrFEqLd8AZ01Zg8oKcj9WtCWEMf9Y4biv2xE43JbBGRvLAx3sH9MRplu2hN2W/bRxa/EPj9GHgbUjScDBkm/QVbMeV+QOgi09sCHDTeSX3BHdZ8ZLNjuNUwYnWZq4lPix0iYS5MufiixNdQmncPeHq0UuBtVifEl2Jmjq1COLyeAQe47AKQ5zDjT91xtBRZVZEVk0kGBYHtBEJ9ezPwckSw=,iv:cbIpwwhmyJVvvTMB95YBzt+RQLOji6yJh+SpcJc3Q1Y=,tag:t8WxU1IPDfkB8muTdBLUhg==,type:str]
+virtualcam_smtp_pass: ENC[AES256_GCM,data:D5kDTQP9/YV5BjAWeTn0G2zKe+s=,iv:7dZJprrs0S2ECtbDQuvhUWsU0Xzpld5/XZqdbyefg0o=,tag:uWe811KAisBJ5M1EhJjrcQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -39,8 +40,8 @@ sops:
             MHJrVVpDYWdJNmxtUkozSzR4Nmt3R28KrhYi830HUFAPfg8WvPad7BAuNe1mYOWt
             WEFIquuX/H/N+y/7uQcBDbvnBzyropE1hW8aNrxSKMeawvQZWNXkZA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-15T14:55:25Z"
-    mac: ENC[AES256_GCM,data:M8Br3hpJdAtaIku07AnnnR/A3zoZLEE+njE+BX7XBaaTvjcLMs6TKUl79EMlpXLQIXR2nchrf7dE3qlqxnbotw0WjhCOW7KHJskv/nTq5ZO7yQW817whAF7clDmQVhuA0teOGqwY3MKzZ5+2BUmsBLREkH3ZIQ7x/IgWyL/WUJE=,iv:960gzieWk4S1Wily3Kh32lKPbteFToXT5g8/Dp/pDOU=,tag:vDi1L5N/G/Wcyqtl18oG7w==,type:str]
+    lastmodified: "2026-08-15T15:47:14Z"
+    mac: ENC[AES256_GCM,data:I28P0NVocgflBTd27KrVOV2Nh5cUpuv8yL13Z54dFron3g27j0sr5PJMc7ZzTkHvKrU+gwBxPBmldh/q3QB50Mz3bK4S3b8O5hPp7xR4mc3ajQwMPaqLj7A6aeXsixIQVDfZEHtXpWB4DKaA8FLYKOZBAXhW2f1SGWnVJwKqn9M=,iv:fMlP/VxGN3y+d0unBA87qfUaT51MIQsAKsuEXTv3qDg=,tag:yjaSL1ymvdpGDuy7OdANZA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1