Emma ThorpeandClaude Opus 5
fe540e1831
Build and publish container / build (pull_request) Successful in 7m8s
Package the proxy properly so it can be consumed outside a container, and without downstream users vendoring a package definition into their own configuration. - pyproject.toml: setuptools metadata with a `legacy-email-proxy` console script. Runtime dependencies are read dynamically from requirements.txt, so the Docker build and the package cannot drift apart. - proxy_server.run(): a synchronous entry point for the console script, since `main` is a coroutine and cannot be referenced by one directly. The `__main__` path is unchanged in behaviour. - package.nix / flake.nix: the package, an overlay, and a dev shell. The test suite runs as part of the build, so `nix flake check` covers it. - module.nix: a NixOS module exposing `services.legacy-email-proxy` with freeform `settings` (environment variables) and a separate `environmentFile` for credentials, so secrets stay out of the Nix store. Runs under DynamicUser with CAP_NET_BIND_SERVICE only while a listener needs a privileged port, and opens no firewall ports. The Dockerfile and its CI workflow are deliberately untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
41 lines
1.2 KiB
Nix
41 lines
1.2 KiB
Nix
{
|
|
lib,
|
|
python3Packages,
|
|
}:
|
|
python3Packages.buildPythonApplication {
|
|
pname = "legacy-email-proxy";
|
|
inherit ((lib.importTOML ./pyproject.toml).project) version;
|
|
pyproject = true;
|
|
|
|
# Only the files that affect the build, so editing the README or the CI
|
|
# workflow does not invalidate it.
|
|
src = lib.fileset.toSource {
|
|
root = ./.;
|
|
fileset = lib.fileset.unions [
|
|
./proxy_server.py
|
|
./pyproject.toml
|
|
./requirements.txt
|
|
./pytest.ini
|
|
./tests
|
|
];
|
|
};
|
|
|
|
build-system = [ python3Packages.setuptools ];
|
|
dependencies = [ python3Packages.aiosmtpd ];
|
|
|
|
nativeCheckInputs = [ python3Packages.pytestCheckHook ];
|
|
|
|
meta = {
|
|
description = "Unauthenticated POP3/SMTP front end proxied to authenticated IMAPS/SMTPS backends";
|
|
longDescription = ''
|
|
Exposes cleartext POP3 and SMTP to clients that cannot speak TLS or
|
|
modern authentication, and forwards them to an authenticated IMAPS/SMTPS
|
|
backend. The front-end listeners are unauthenticated by design and must
|
|
be confined to a trusted network.
|
|
'';
|
|
homepage = "https://code.emmathe.dev/lyrathorpe/legacy-email-proxy";
|
|
mainProgram = "legacy-email-proxy";
|
|
platforms = lib.platforms.unix;
|
|
};
|
|
}
|