commit 8606dd12308335c069d804c0e7827960e6bcd163
parent 6accf887b5bc3ad32a98f93424bdcabb1a7ac7bb
Author: MTRNord <mtrnord1@gmail.com>
Date: Wed, 9 Apr 2025 20:21:00 +0200
Enable email verification
Diffstat:
3 files changed, 60 insertions(+), 8 deletions(-)
diff --git a/apps/2024_cluster/secrets/irc.yaml b/apps/2024_cluster/secrets/irc.yaml
@@ -5,7 +5,9 @@ metadata:
namespace: irc
type: Opaque
stringData:
- password: ENC[AES256_GCM,data:JpwnlR+R4O0b7fVyzh51XOggeqvzr2hokerSAgLZWBaZj85O1BGZY/c4jEnqn+g3DxApNd5rrpjuChuaZy7Eqg==,iv:eCwTnJnnCafI17fQlI07vBVI7GcelTwcfOslggzDTqo=,tag:LO6B2mL6/WsAagj1pYzEAg==,type:str]
+ password: ENC[AES256_GCM,data:c/igNUJgwfwgqBmrxfZ1dHFzbJVB0IHsO5edVme6quqAwsfFRWTbhiEgLslHuVcZ6Fq5O1dpsg9WubX1dVDflQ==,iv:+WdJ2cvhw+2rt9+GHxBHqdgHxRoDpeJ7Uzwt3dEJYxQ=,tag:1j2ukrJTN50UNchPC9+5Ig==,type:str]
+ emailUser: ENC[AES256_GCM,data:qW47V4IKu0tlVPjq4NM+DpQZERJLUy4P6NLIppdp,iv:+L2pr3aiye4RlpSLTIO06eCWTgLma4qIxmIsYBK8ZfU=,tag:JFfEFDQ0m7rrOOwiOLtM9w==,type:str]
+ emailPassword: ENC[AES256_GCM,data:I0sepvBc0EMHE6UGXiPgq2KkQ2hmWlNyPJndTvXMxZgV+pFM6LuYhSUfjo6R6nPGCxkdktJa9LzXzzCiXiu80w==,iv:l2FO6g1371dxv+Q7c+Kxhh6eeaI3Ei9/T6+HdG8TZNk=,tag:qVLEIXxnr6ynrR5i+66HVQ==,type:str]
sops:
kms: []
gcp_kms: []
@@ -15,14 +17,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRmc3YXh4dEYrTjczMVpZ
- U0lMeERpVlY3endXRER1S1FtWjBjSEFuaEhJCmZYTk1mMHRhVldidjdIYVdvN1d1
- dDdzNndWdWJIZlAxSjNvc2RsRUp4dDQKLS0tIHkzbkZpUzZOenB6b0dUSm9XdEtB
- cm1Cd1lsZGtKa29rMmFGQTcrVmV3U3MKUBCIvT2JDh/38UcwGgFXx7Ow/nqnINmc
- iOr4cXl8yjU4RP6Cq0L1f/ibRPfGutOFo4SjgSqm7CLckjPmJ7br7Q==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrdUJsWEtlYVd5aDhQc1BK
+ RWJlSTNuVzYvLzEyRU4xYWxXS1RxWEFqS3pVCnBqamY0Yy9UYkM3MGFvSWtvOUhu
+ YTJMaE92cTVFOWxEaWx2NGtyYXllZ28KLS0tIDZCRU9CWmNZampvNUt4eElsRDMw
+ T1QxNHF3aWRlLzNVZUhjOWpodDJxeUEKaw+pdv02iGWAZrN2sMeWBjjz3+mshWlL
+ tS9DFIRC3up8zDQ/xlxX1DqYkuiUkIDzm8ToHHnUz8eMnMazD9cj1w==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-04-09T17:03:54Z"
- mac: ENC[AES256_GCM,data:EiPm13lRimo+691Jc4TuaMBAl+EZVN/TO9QBSDkZo9yeOxgjvhHVXndEzROqj2bOFk2x4eHlSrXuUhlSjp9RSnvJbKIJkc7sE9BGLutqTbwewYcQDe2mqHJ/DzpchmSK8RjzqCANz88VBAf4Hg5BMH5kcWbvEzQzFhcTCPMbn0M=,iv:ZuonCaRnh/TZVpFGns4CXHXKT2tZ+X2hJ1le69US7P8=,tag:Rycco6OrsH3d0wXaZDGrwQ==,type:str]
+ lastmodified: "2025-04-09T18:19:31Z"
+ mac: ENC[AES256_GCM,data:LaM9joafJzzJwogEQeOJM2iQknEFpyAEGXTsSPHVHEbKrfKbSDCRlbbFtE6tJAQcdRQJMV2cXROWujFJAyJljkM1f5V9h4MwskHjFswYKrogXNHahdP+KRAiIG8Dtsoz1i6rQAXN36hlz0B8/bO+eGM5SyB32ZKaUXkjT6Rjz7E=,iv:oEj8+1XkVX02si6DXNBFz3VnmaZuoMG39HV8ATgqzKY=,tag:WaEOGlnrI0n6oq4w3lm1dQ==,type:str]
pgp: []
encrypted_regex: ^(root_password|pgdb_password|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
diff --git a/apps/base/irc/files/ircd.yaml b/apps/base/irc/files/ircd.yaml
@@ -247,6 +247,46 @@ accounts:
bcrypt-cost: 9
# length of time a user has to verify their account before it can be re-registered
verify-timeout: "32h"
+
+ # options for email verification of account registrations
+ email-verification:
+ enabled: true
+ sender: "support@midnightthoughts.space"
+ require-tls: true
+ helo-domain: "irc.midnightthoughts.space" # defaults to server name if unset
+ # set to `tcp4` to force sending over IPv4, `tcp6` to force IPv6:
+ # protocol: "tcp4"
+ # set to force a specific source/local IPv4 or IPv6 address:
+ # local-address: "1.2.3.4"
+ # options to enable DKIM signing of outgoing emails (recommended, but
+ # requires creating a DNS entry for the public key):
+ # dkim:
+ # domain: "my.network"
+ # selector: "20200229"
+ # key-file: "dkim.pem"
+ # to use an MTA/smarthost instead of sending email directly:
+ mta:
+ server: mail.midnightthoughts.space
+ port: 465
+ #username: "admin"
+ #password: "hunter2"
+ implicit-tls: true # TLS from the first byte, typically on port 465
+ # addresses that are not accepted for registration:
+ address-blacklist:
+ # - "*@mailinator.com"
+ address-blacklist-syntax: "glob" # change to "regex" for regular expressions
+ # file of newline-delimited address blacklist entries (no enclosing quotes)
+ # in the above syntax (i.e. either globs or regexes). supersedes
+ # address-blacklist if set:
+ # address-blacklist-file: "/path/to/address-blacklist-file"
+ timeout: 60s
+ # email-based password reset:
+ password-reset:
+ enabled: true
+ # time before we allow resending the email
+ cooldown: 1h
+ # time for which a password reset code is valid
+ timeout: 1d
# throttle account login attempts (to prevent either password guessing, or DoS
# attacks on the server aimed at forcing repeated expensive bcrypt computations)
login-throttling:
diff --git a/apps/base/irc/resources.yaml b/apps/base/irc/resources.yaml
@@ -59,6 +59,16 @@ spec:
secretKeyRef:
name: irc-db
key: password
+ - name: ERGO__ACCOUNTS__REGISTRATION__EMAIL_VERIFICATION__MTA__USERNAME
+ valueFrom:
+ secretKeyRef:
+ name: irc-db
+ key: emailUser
+ - name: ERGO__ACCOUNTS__REGISTRATION__EMAIL_VERIFICATION__MTA__PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: irc-db
+ key: emailPassword
- name: config-reloader
# image is based on busybox which includes inotifyd + pkill
image: ghcr.io/ergochat/ergo
