Add email support with notmuch, mbsync, and msmtp

Set up complete email workflow in Emacs using:
- notmuch for email indexing and UI
- mbsync for IMAP synchronization from proton.johnogle.info
- msmtp for SMTP sending via port 25 with PLAIN auth
- systemd timer for automatic sync every 5 minutes

Configuration includes:
- New email role at home/roles/email with all mail tools
- Doom Emacs notmuch module enabled with saved searches
- Secure credential retrieval via rbw from Bitwarden
- Fixed systemd service PATH to access rbw-agent
- TLS/STARTTLS for secure connections

Email role enabled on nix-book (laptop-compact profile).

flake.nix

@@ -220,5 +220,21 @@
         }
       ];
     };
+
+    # Flake apps
+    apps = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ] (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+        update-doomemacs = pkgs.writeShellScriptBin "update-doomemacs" ''
+          export PATH="${pkgs.lib.makeBinPath [ pkgs.curl pkgs.jq pkgs.nix pkgs.git pkgs.gnused pkgs.gnugrep pkgs.coreutils ]}:$PATH"
+          ${builtins.readFile ./scripts/update-doomemacs.sh}
+        '';
+      in {
+        update-doomemacs = {
+          type = "app";
+          program = "${update-doomemacs}/bin/update-doomemacs";
+        };
+      }
+    );
   };
 }

home/home-laptop-compact.nix

@@ -14,6 +14,7 @@
     desktop.enable = true;
     development.enable = true;
     communication.enable = true;
+    email.enable = true;
     kdeconnect.enable = true;
     media.enable = true;
     sync.enable = true;

home/roles/default.nix

@@ -8,6 +8,7 @@
     ./communication
     ./desktop
     ./development
+    ./email
     ./gaming
     ./kdeconnect
     ./kubectl

home/roles/emacs/default.nix

@@ -8,8 +8,8 @@ let
   doomEmacs = pkgs.fetchFromGitHub {
     owner = "doomemacs";
     repo = "doomemacs";
-    rev = "8f55404781edacf66fa330205533b002de3fb5ee";
-    sha256 = "sha256-vHwgENjip2+AFzs4oZfnKEAJKwf5Zid7fakImvxxQUw=";
+    rev = "762f47805ac2a6411e11747f86f7c19a03da326e";
+    sha256 = "sha256-0w0eXGB2cgxu/hr5wTiJSZDJw0NF+fZvLbzEylH5URU=";
   };
 
   # Shared emacs packages

home/roles/emacs/doom/config.el

@@ -159,6 +159,32 @@
   (dolist (module '("bbdb" "buffer" "elisp" "emacs" "gnus" "os" "search-and-replace" "url"))
     (gptel-tool-library-load-module module)))
 
+;; Notmuch email configuration
+(after! notmuch
+  (setq notmuch-search-oldest-first nil
+        notmuch-show-logo nil
+        notmuch-fcc-dirs "proton/Sent"
+
+        ;; User identity
+        user-mail-address "john@ogle.fyi"
+        user-full-name "John Ogle"
+
+        ;; Sending mail via msmtp
+        message-send-mail-function 'message-send-mail-with-sendmail
+        sendmail-program (executable-find "msmtp")
+        message-sendmail-envelope-from 'header
+        mail-envelope-from 'header
+        mail-specify-envelope-from t
+
+        ;; Saved searches for quick access
+        notmuch-saved-searches
+        '((:name "inbox"   :query "tag:inbox"                    :key "i")
+          (:name "unread"  :query "tag:unread"                   :key "u")
+          (:name "flagged" :query "tag:flagged"                  :key "f")
+          (:name "sent"    :query "tag:sent"                     :key "t")
+          (:name "drafts"  :query "tag:draft"                    :key "d")
+          (:name "all"     :query "*"                            :key "a"))))
+
 ;; Whenever you reconfigure a package, make sure to wrap your config in an
 ;; `after!' block, otherwise Doom's defaults may override your settings. E.g.
 ;;

home/roles/emacs/doom/init.el

@@ -177,7 +177,7 @@
 
        :email
        ;;(mu4e +org +gmail)
-       ;;notmuch
+       notmuch
        ;;(wanderlust +gmail)
 
        :app

home/roles/email/default.nix

@@ -0,0 +1,128 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.home.roles.email;
+in
+{
+  options.home.roles.email = {
+    enable = mkEnableOption "Enable email with notmuch, mbsync, and msmtp";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      isync      # provides mbsync for IMAP sync
+      msmtp      # for SMTP sending
+      notmuch    # email indexing and search
+      openssl    # for certificate management
+    ];
+
+    # Ensure Mail directory exists
+    home.file."Mail/.keep".text = "";
+
+    # mbsync configuration
+    home.file.".mbsyncrc".text = ''
+      # IMAP Account Configuration
+      IMAPAccount proton
+      Host proton.johnogle.info
+      Port 143
+      User john@ogle.fyi
+      PassCmd "${pkgs.rbw}/bin/rbw get proton.johnogle.info"
+      TLSType STARTTLS
+      AuthMechs PLAIN
+
+      # Remote Storage
+      IMAPStore proton-remote
+      Account proton
+
+      # Local Storage
+      MaildirStore proton-local
+      Path ~/Mail/
+      Inbox ~/Mail/INBOX
+      SubFolders Verbatim
+
+      # Channel Configuration - Sync All
+      Channel proton
+      Far :proton-remote:
+      Near :proton-local:
+      Patterns *
+      Create Both
+      Expunge Both
+      SyncState *
+    '';
+
+    # Notmuch configuration
+    home.file.".notmuch-config".text = ''
+      [database]
+      path=${config.home.homeDirectory}/Mail
+
+      [user]
+      name=John Ogle
+      primary_email=john@ogle.fyi
+
+      [new]
+      tags=unread;inbox;
+      ignore=
+
+      [search]
+      exclude_tags=deleted;spam;
+
+      [maildir]
+      synchronize_flags=true
+    '';
+
+    # msmtp configuration
+    home.file.".msmtprc".text = ''
+      # Default settings
+      defaults
+      auth           plain
+      tls            on
+      tls_starttls   on
+      tls_trust_file /etc/ssl/certs/ca-certificates.crt
+      logfile        ${config.home.homeDirectory}/.msmtp.log
+
+      # Proton mail account
+      account        proton
+      host           proton.johnogle.info
+      port           25
+      from           john@ogle.fyi
+      user           john@ogle.fyi
+      passwordeval   rbw get proton.johnogle.info
+
+      # Set default account
+      account default : proton
+    '';
+
+    # Systemd service for mail sync
+    systemd.user.services.mbsync = {
+      Unit = {
+        Description = "Mailbox synchronization service";
+        After = [ "network-online.target" ];
+        Wants = [ "network-online.target" ];
+      };
+      Service = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.bash}/bin/bash -c '${pkgs.isync}/bin/mbsync -a && ${pkgs.notmuch}/bin/notmuch new'";
+        Environment = "PATH=${pkgs.rbw}/bin:${pkgs.coreutils}/bin";
+        StandardOutput = "journal";
+        StandardError = "journal";
+      };
+    };
+
+    # Systemd timer for automatic sync
+    systemd.user.timers.mbsync = {
+      Unit = {
+        Description = "Mailbox synchronization timer";
+      };
+      Timer = {
+        OnBootSec = "2min";
+        OnUnitActiveSec = "5min";
+        Unit = "mbsync.service";
+      };
+      Install = {
+        WantedBy = [ "timers.target" ];
+      };
+    };
+  };
+}

packages/claude-code/default.nix

@@ -5,24 +5,24 @@
 }:
 
 let
-  version = "2.0.53";
+  version = "2.0.75";
 
   srcs = {
     aarch64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-arm64/claude";
-      sha256 = "28c3ad73a20f3ae7ab23efa24d45a9791ccbe071284f1622d4e5e2b89c4a15b7";
+      sha256 = "a96eb18218e112486b7ecebd1551d927ffb310ab5fb06d2e8db25fb31367537e";
     };
     x86_64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-x64/claude";
-      sha256 = "a27f7b75a51514658640432a0afec8be130673eb7dbecc9a4d742527dd85d29a";
+      sha256 = "e27313053d3268a0bc1e0080f8c2ef7155325f0a95e72971163eef698a71e829";
     };
     x86_64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-x64/claude";
-      sha256 = "9c4cc19e207fb6bf7ea140a1580d5ed0dd0a481af471f23614d5a140a4abf1c6";
+      sha256 = "62160f8766681d8c933e9133398d3dde6ad0df08038881a66eddb993b4b6a33f";
     };
     aarch64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-arm64/claude";
-      sha256 = "a5d4044034f3b63c38379bc2dd4067a4dd3c8ec48965ba8e66e3623774a93b72";
+      sha256 = "681fbd1a84b2de883dc954441693766b43ea4faafb3e72b88c99a33645cd3507";
     };
   };
 

scripts/update-doomemacs.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Configuration
+OWNER="doomemacs"
+REPO="doomemacs"
+FILE="home/roles/emacs/default.nix"
+# Use current working directory as repo root (allows running from anywhere in the repo)
+REPO_ROOT="${REPO_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+TARGET_FILE="$REPO_ROOT/$FILE"
+
+echo -e "${GREEN}Updating DoomEmacs to latest commit...${NC}"
+
+# Check if file exists
+if [[ ! -f "$TARGET_FILE" ]]; then
+    echo -e "${RED}Error: $TARGET_FILE not found${NC}"
+    exit 1
+fi
+
+# Get the default branch first
+echo "Fetching repository information..."
+DEFAULT_BRANCH=$(curl -s "https://api.github.com/repos/$OWNER/$REPO" | jq -r '.default_branch')
+
+if [[ -z "$DEFAULT_BRANCH" ]] || [[ "$DEFAULT_BRANCH" == "null" ]]; then
+    echo -e "${RED}Error: Failed to fetch default branch${NC}"
+    exit 1
+fi
+
+# Get the latest commit SHA from GitHub
+echo "Fetching latest commit SHA from $DEFAULT_BRANCH branch..."
+LATEST_SHA=$(curl -s "https://api.github.com/repos/$OWNER/$REPO/commits/$DEFAULT_BRANCH" | jq -r '.sha')
+
+if [[ -z "$LATEST_SHA" ]] || [[ "$LATEST_SHA" == "null" ]]; then
+    echo -e "${RED}Error: Failed to fetch latest commit SHA${NC}"
+    exit 1
+fi
+
+echo -e "Latest commit: ${YELLOW}$LATEST_SHA${NC}"
+
+# Get current SHA from file
+CURRENT_SHA=$(grep -oP 'rev = "\K[^"]+' "$TARGET_FILE")
+echo -e "Current commit: ${YELLOW}$CURRENT_SHA${NC}"
+
+if [[ "$CURRENT_SHA" == "$LATEST_SHA" ]]; then
+    echo -e "${GREEN}Already up to date!${NC}"
+    exit 0
+fi
+
+# Update the rev field
+echo "Updating rev in $FILE..."
+sed -i "s/rev = \".*\"/rev = \"$LATEST_SHA\"/" "$TARGET_FILE"
+
+# Fetch the new sha256 hash using nix-prefetch
+echo "Fetching new sha256 hash..."
+NEW_SHA256=$(nix-prefetch-url --unpack "https://github.com/$OWNER/$REPO/archive/$LATEST_SHA.tar.gz" 2>/dev/null)
+
+if [[ -z "$NEW_SHA256" ]]; then
+    echo -e "${RED}Error: Failed to fetch sha256 hash${NC}"
+    # Revert the rev change
+    sed -i "s/rev = \".*\"/rev = \"$CURRENT_SHA\"/" "$TARGET_FILE"
+    exit 1
+fi
+
+# Convert to SRI hash format
+SRI_HASH=$(nix hash to-sri --type sha256 "$NEW_SHA256")
+echo -e "New sha256: ${YELLOW}$SRI_HASH${NC}"
+
+# Update the sha256 field
+sed -i "s|sha256 = \".*\"|sha256 = \"$SRI_HASH\"|" "$TARGET_FILE"
+
+echo -e "${GREEN}Successfully updated DoomEmacs!${NC}"
+echo -e "  Old commit: ${YELLOW}$CURRENT_SHA${NC}"
+echo -e "  New commit: ${YELLOW}$LATEST_SHA${NC}"
+echo -e "  New sha256: ${YELLOW}$SRI_HASH${NC}"
+echo ""
+echo "You can now rebuild your system with the updated DoomEmacs."