non-critical-infra: migrate mjolnir to caliban

This makes umbriel a dedicated mailserver and moves mjolnir closer to the
homeserver it connects to.

Author: mweinelt

non-critical-infra/hosts/caliban/default.nix

@@ -11,6 +11,7 @@
     ../../modules/backup.nix
     ../../modules/element-web.nix
     ../../modules/matrix-synapse.nix
+    ../../modules/mjolnir.nix
     ../../modules/owncast.nix
     ../../modules/prometheus/node-exporter.nix
     ../../modules/vaultwarden.nix

non-critical-infra/hosts/umbriel/default.nix

@@ -6,7 +6,6 @@
     inputs.srvos.nixosModules.server
     inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
     ../../modules/common.nix
-    ../../modules/mjolnir.nix
     ../../modules/prometheus/node-exporter.nix
     ../../modules/mailserver
   ];

non-critical-infra/modules/mjolnir.nix

@@ -1,7 +1,7 @@
 { lib, ... }:
 {
-  sops.secrets.first-time-contribution-tagger-env = {
-    sopsFile = ../secrets/mjolnir-password.umbriel;
+  sops.secrets.mjolnir-password = {
+    sopsFile = ../secrets/mjolnir-password.caliban;
     format = "binary";
     path = "/var/keys/mjolnir.password";
     mode = "0640";

non-critical-infra/secrets/mjolnir-password.caliban

@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:grIvbuQ4QLcsMq+vJ2L3HR8wG4axM9WmEgHjbO/fvHcu,iv:Vyd1335Pg1i11fP2X2G2cyKMyM2/0uFuXO3T28Ml228=,tag:NA2nLx864A7SJAwvkVfj6w==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBteXZkeEt6WE1KdkZDUXhM\nOUtOVUFIMzgxUDFSWnpkTFVCM3BQZHY2aEVjCjYrRjZpaGxvZ1E5Ly9vazlINFp6\nNG4vMnlwZE04Q1JWa2pzcFZ5WXJDcjQKLS0tIElZU0JGZnlkTUs4QXU0UmpienFR\nVk1ESzROMURCalBSNWRaODYzVHN6ekUKMSc1M5L603f+Onx9japy2rgmVKgTcqzD\ni5CIX4LCCbB5YEWk6TqkXSGtEiShYwFNs7DcthmZyAFT/z+1k62TiA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUVZsR1kyVEtyd2VrZG5K\nRVhnV2kvTVVrV1F0d0VUUm1FaDJvZ3B3U1dVClJLY254RFcrSUhPWkQxMHk2UUV3\nR21HMkMyQ0hzWmI1MnhLUU5KeGlZTDQKLS0tIENVRWlpcFlRaHNDNFpibldaMmFF\naXRzYmVuZXZGTisycVF2NjA5RDFuQjAKs3zhqJKX0YNaD++eWNLgNh+dGAxPc3Cp\nS1g1LkZQE46ceiQRdz7h+lSoEyPfKDbV8510glHnqWSaEKd8WYY49g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXTG9qeW56WjlCczZyUy9h\nR09kTjZNbE1TQXBtYjZSdTZlSCtkbklVT2dnCkt4cEpSQ2l6WUg1TVVpK2VvdWNa\nYjFEeFRIWDJCekRxYk4wQmlSSlNQQk0KLS0tIGUyeS9GZUhnU2cvb21qMGp4OVVa\nRHNKWEpRbUt0V0JDbTNlN0EySlZUaGMK9grWJ8pZ8IRfCBOQsfFmKeL3/++KT3D1\nBApdOOOYZLc4rHeMHWHwH2J0AP+YYyVHsxQo2yknf2CS8imNI1figg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-03-13T17:36:44Z",
+		"mac": "ENC[AES256_GCM,data:f63uKmOODv1uI3r9flamhtcX+mM8O0B3LAbnhOD/XECrmRo/4iQT+eFmDXuwqBo4dVf0ITgKOnCTIviA6V7nMSUK5o5irOgqm+/rHarCn46zPaLMS+D6Pb8qtnuX4jF27+f4tqEcA1ux6Pjx817XjDnyv00wEGd+7dYbq7bTgNM=,iv:XNgzYq4ALDp+cIBHAzFMgJD+X2/XI6Y7b6IYIgaAB4Y=,tag:+Y/MUccCguCzKj6kpIoU6Q==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}