13 files changed, 271 insertions, 59 deletions
diff --git a/tests/common/email/dkim/alice.com/private.age b/tests/common/email/dkim/alice.com/private.age
index 5415fdc..cb590c6 100644
--- a/tests/common/email/dkim/alice.com/private.age
+++ b/tests/common/email/dkim/alice.com/private.age
@@ -1,15 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3dkJqTFNjOUphUWpBTmUv
-MldLUUVtUWJWY2p4NGNDVlluWUdJNUVGTDBnCkRMZ3VsVGkvUUJsbUgrUHA5d1pY
-d3lvQkdsSnRxYWxSbGlkQUlnMEFiWncKLT4gWDI1NTE5IGljWDF2a3JqZHBzZC9J
-ZjlxSVdKQ0ErRGc1VVRTNE91RC8rR2ZhMlN5d28KYVNyMWZWSnZFNS9zWUdLS01T
-UkJLaGxqWmwySzdxRk5GVUZ4NFR1aXcxcwotPiBzc2gtZWQyNTUxOSBSc2dXcFEg
-alJlckZsT21YUUQrS05Xb25TeFJXUmFFTFl1U3NYOXZoWEZwa0Qrd2dnWQoxZVla
-TFV3VURsaUxZdUZVRkZhdXcyV3AzMTJCc1hXUDJlK2FPc0pIU2hvCi0+IFN6Nlc4
-R0dqLWdyZWFzZSBfIQpUdERFc2xwZGkwR2p3QW0vNlIyR0pYTkkyeU02ckw2RnEv
-bHE5TFQ4TlBaL3lNd1ZFbDRPZXo1RmpSeStWcjljCmFpV28KLS0tIEE2SURxTHdl
-RWt5NXZRT3hFUHpjSm1BdTlwZGM2NmQvNm5Pb0s4dW5pc2sKTKoHvkHEkuPkMTDw
-Un+0mSGY82ZxfpNuYH6YEjUYsXwAw4y0HFvsObc0XuYzCmQrBX8vLos0Sg5kzboT
-EU81RdjI1AQPwhd+jBIDNFpUzYZ/IaQsz7Yp3G1WDfkeYPk10IuzOJoeRjLC9HPa
-wfYCKZDhegV6n//kAxBGM0Q3MzyxO3eYJ+k3TaWnUPLnw+nFMAANgkYqfg==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSA3bVJS
+NjBTaitjUEhxMVZmejI1L3Fmd0xGK3ZFVlM2eVBaellDYWs3ZW5nClZOckc5cFFZ
+dVlXYmxWZXpQU3lPTnlwTC9KUGNZak9VVS9aNzVEaFkrUG8KLT4gUy1ncmVhc2UK
+Y21CMkZlQVdUUHVIclRpMk5yNmRTb3lwUVQzTWM2a0YwSjhUQU1kbTRqK1lrVUtk
+ZkVVCi0tLSByRDVCeTJIK2JQWittWjlUWklSOWJaenluL1FLdXN2ZEM4bVlnU2U1
+RFk0CiAxOLq5ePeM8MemSES9Q86mBix3hooazHZZ7xCIQKnLvZmiHWCKUYw83PWl
+QpmWI7S3wgdguOncKirQccJbNtVLYb/noYEBA1y7lOzO1FELPcFgevtB3kt5EAOA
+6OaPsFKSsz71t++K011dgFUcnYmOtrqiQeKKEkZ0gey4+jNwf4buDygdiPOL/fQS
+uJiIUwsLPqZI/FQ=
 -----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/alice.com/public b/tests/common/email/dkim/alice.com/public
index 0f3c3b2..be30723 100644
--- a/tests/common/email/dkim/alice.com/public
+++ b/tests/common/email/dkim/alice.com/public
@@ -1 +1 @@
-cLWzd3zg51ITME1Fnu16/h07lXIUxfhdLivktUMoVQs=
-\ No newline at end of file
+LviKY6SBD2mtLJlUTon9AkWPYzB2D+Ivk0XnJOalAZM=
+\ No newline at end of file
diff --git a/tests/common/email/dkim/bob.com/private.age b/tests/common/email/dkim/bob.com/private.age
index c07c997..70eddca 100644
--- a/tests/common/email/dkim/bob.com/private.age
+++ b/tests/common/email/dkim/bob.com/private.age
@@ -1,14 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmN0FHQ2ZhVEVpNnB1S2Zu
-T3JBS0xLUklKNUxKeENYeis3MUZHdUF1STFFCmdkTFQvcG9qWk55QjlEUDN2NGFa
-Ump1TW1xRUZ3K251bFJsaEMrTXd3VzgKLT4gWDI1NTE5IFF6ZGNJbWkrc1Z5M3Rk
-blpNUGpuNU0rZi9Ed2dicnM4WXhrbjdQVDFzeGsKd2V6clA0UjZWYmJxZytaa3B3
-T2drNkhiQVBKU2tOL2gxeGtjQnAra2NxawotPiBzc2gtZWQyNTUxOSBSc2dXcFEg
-Y2xrRDduWXo1Qk81VFMxMHZ0T3FhaXZXUm1VMDNhVGZscEJ6Q2owWXFCMApsMTQ4
-K2hGNm4ybGNkSTFOeHdwZnI5YjRZQm1uVC9xUEtRSjBxV0JKdERRCi0+IFlzLWdy
-ZWFzZSBbZztrCk1sWFhaZXNZOUhMbAotLS0gbkNRK2hkZ0dEZEkxeFVJKysyUUY3
-UWVBRjZoVXJCWk5YTEh4ZktpM1IwNArrxTAoCB+Ubb79nB53ZnbakCaDfrfLx7Oi
-Khq4CZh64r2LaQWFP0m5dhHWDF/8Fg+E42zbXN1KQwggz2h59EqI2ouOXmjiZeHN
-O50mfruF9xybdAFVIThEsjRTRQDPfO5qq6PI+g+w4s+S8kl6yp61t6z3y+zI3GGw
-RxCsY2uEn5naMuBMqkYL5dhA/G5deNMpUQ8rcRZw
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSAvSmk4
+YlQ3SElud2c3TWgxaUZCaC9mYytlbmNVdlVRcS9VTjlneFBBQ2hrCnE3b1dNdytR
+Z0l5dVlMYUhVT0ZIMkFBYkNRKzZ6U1pBYStJTUJsNUEvN28KLT4gcX5kMWtnXi1n
+cmVhc2UgczdieGAKNjNwRmVMYmN2cE5LaGFEOS9QZHFtaVhtZXI4dTFpazZhdUN4
+bUZ0cjQ4Y09nOVRjM2IzTGgweS9NbHkxMXlMSwpjdWhQekk0a0VnMTNFTXdjTmdl
+bHluNDZWT0R5L25zbXlTL3l3NnRuTWhtNWs0dVByMWQ2TlEKLS0tIEZMK2dqRktZ
+Y0hlN2l0ZVB4c3Exd3NsanRuTitrVklaaS9ZTU5ZWVF0cGsKuTNM9zBVFmOHkEqx
+jMZaJQd/XqA4WzOi/iFi4WmDUDb8XcVsS0s/37fyZfeMW3YjoCzDb/treKMXyTDC
+8l5N/xMG20UGC/Z16W24c/MXMFzpDLuFrjHiUtpQvBzwi6JUDMlKC8t0YWNcqQRr
+2vu7qij0XgasxrGDg86hoc72YmYPmpHnE86O1il0PWy9sDRlkn6Ah/DUNg==
 -----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/bob.com/public b/tests/common/email/dkim/bob.com/public
index ddea670..915188c 100644
--- a/tests/common/email/dkim/bob.com/public
+++ b/tests/common/email/dkim/bob.com/public
@@ -1 +1 @@
-3yrKD52yd5hBA6ue5uQVl7FXGK8UOlUE9Y+yCdBRfVQ=
-\ No newline at end of file
+6USjzSE5zuUNrMdgsjAHFnq0BRKmyZh2IoXFHBCv3To=
+\ No newline at end of file
diff --git a/tests/common/email/dkim/mail.server1/private.age b/tests/common/email/dkim/mail.server1/private.age
new file mode 100644
index 0000000..a97c70b
--- /dev/null
+++ b/tests/common/email/dkim/mail.server1/private.age
@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSBndElV
+WFFTcEZpTGwrTUg5WHk1MElLSU5ZZWp1NU5ocit4VGtnM09KZFNBCjNvaWVPR3Zt
+RG14N2E3b0RwK21IUzBZZmg1UzFwakMwTVVOdDgrTTd4U1UKLT4geD9OYm0tZ3Jl
+YXNlIDwgcjkKQUJtaDlVbzk3Slk3S1ozNS9STGwrdzhvWTlodWgxNVd1WVRadTV5
+VmFVUmRmSTV3ckIzYmpQYUFsMUxkdGNzUgo1UXozYzBCK3UxU1BPSnlvVVVxQjI2
+QVdWY0tBbUg1R3p5NmNaZ2RiVGNlL3pWN3FHZU5QOEN2VVdraDBzM1R2CgotLS0g
+TElGejJDYUk4WlhxajdXekI4S0tUMVlrNmdxelpjUnBUa1VCU2krSFloawpUfMj8
+iqVP45yV8fON6fDUur6q/UYqTaaHhCW07LTsBZQpReG8LA+PiOhHw1TmPSJlc/JH
+yEkwLachwvLGCGEO2yoFUFhYwoNhl3vrBsuDLXpqfNuoPrg3wcFXBdrg9zBjZ5Pc
+C/rdzpysjW/52gKRCdGgFj2WyTW2wO2yVmmUk1RWhMabmdd+XLkKhynaMtWsBF0j
+NQ3F
+-----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/mail.server1/public b/tests/common/email/dkim/mail.server1/public
new file mode 100644
index 0000000..6c9e653
--- /dev/null
+++ b/tests/common/email/dkim/mail.server1/public
@@ -0,0 +1 @@
+3/bsVrnWag3eMCuj78VpsHDQSONi97fIzY+WPKvAYWM=
+\ No newline at end of file
diff --git a/tests/common/email/dkim/mail.server2/private.age b/tests/common/email/dkim/mail.server2/private.age
new file mode 100644
index 0000000..fbd88fc
--- /dev/null
+++ b/tests/common/email/dkim/mail.server2/private.age
@@ -0,0 +1,11 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSBTcktS
+L0ovODhxd2tyWFdINWRtbXNNYksyNzl6RUxRcTU2T251eVNhQlg4CjVzTVpnc0FC
+eHBNaUtEQnJVRXVpTjg2c3gxcC90VXJ3cUJVaHZJY1pnb00KLT4gKDEkKS1ncmVh
+c2UgYnYqQSBAVSU+CnVRbkRhdUhRS0Z6NGIybll1WVdmSmxzS0lxYlAwSXp0TnA4
+anRDSmQKLS0tIGxxSXRaM0lKeXRoeHFxWW9qN3Y1OE55b1FBVGJTZzB2RmFmZVk5
+eW94aW8KleHhm6fKalehWR0IfHYiC+0bsm0SeYjnJeA60hePdwikmr0QQv5D2xCX
+Nf2QRuai/BpsiJpnvKUiP1uwkm5x6a2Zgwa7t8BwJ7SHqD4oJ+VgCsWMffLs55uC
+A1pKLRmAI26cNt7oibVxNSCCuxZRWeCn+xAsQ393jVCUuDW2FkgyDsKFYHvKRpnC
+BNfwDWWHJ+pifPPrqg==
+-----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/mail.server2/public b/tests/common/email/dkim/mail.server2/public
new file mode 100644
index 0000000..40b6ff7
--- /dev/null
+++ b/tests/common/email/dkim/mail.server2/public
@@ -0,0 +1 @@
+QmbJbp/b671OCOQa0Qx1XGl7c1jzFuASuzBr1f5ATpE=
+\ No newline at end of file
diff --git a/tests/common/email/dkim/mail1.server.com/private.age b/tests/common/email/dkim/mail1.server.com/private.age
deleted file mode 100644
index 8c5d3c3..0000000
--- a/tests/common/email/dkim/mail1.server.com/private.age
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOYXRiK29XallqZG1vc1Bl
-TlpFbk9WZmZIK1FrUHRIbmx6bEI5UkhJZUZ3Ck8zcHVGWHJjdG5wZnh0SDljc2F5
-WU1DMUNxdFdVQmRUMFNpa0VCSUkxZmsKLT4gWDI1NTE5IFhXREJyTVNueGp6YVg1
-b3FUemlodUMraWRMVnEyQTZqRlpKanhxdDBSMlkKYVNxcXFockpleGJBaU1iUUQ4
-bml2azlPSE9Jc0N0dDU2d1hYOXFpcnV2ZwotPiBzc2gtZWQyNTUxOSBSc2dXcFEg
-ZUVuOHZyM3pRcTZHKzFsV2VheDkrdml4NUVIWldQY1BqcGNpTG5lU2VrVQoydnVZ
-UHdpa1FmT3hNbHA1dll1dVFxS0VFanV3N3Y5Z1E5ejBiMkhRSHhRCi0+ICVuPzx1
-Ky1ncmVhc2UgYXY5PE43Om4KcWplaklGSXlMSk0yNktld21ucUdVS1dFVmt4NFhi
-VG5WYUNMUGdxZ0dta1F6RVpRRTdoek1WT0hwaC9CVEcyMworUQotLS0genJEN2Jq
-Y1JVbzc3NVFoSXAxSUxEQUZzZkRCcXNmSXBwZDB0eDMybE5NMApv3ghQF9tC00yI
-v7Sa9ZKrA8HDb/wpUn0X+D+ShLC95rW8+oPonN6gt+z+PoVUFvXwKsP/1I+D6z+B
-PRMurlvpspkIGlgi5S5H6brj9UJ7Pt61+Ld2/gaLevzCPy1QCmlAlqRKvZuZMUUR
-hWbmEXi8j56ClcxpVe62p+4GCI41T2cjAogi2C33dtviIcGedq9byD5tbVt4
------END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/mail1.server.com/public b/tests/common/email/dkim/mail1.server.com/public
deleted file mode 100644
index 4941b85..0000000
--- a/tests/common/email/dkim/mail1.server.com/public
+++ /dev/null
@@ -1 +0,0 @@
-quDd9+ogqiIUWybfegosFFkG7jAsblij2VrkuUXEzzY=
-\ No newline at end of file
diff --git a/tests/common/email/dkim/mail2.server.com/private.age b/tests/common/email/dkim/mail2.server.com/private.age
deleted file mode 100644
index d39631a..0000000
--- a/tests/common/email/dkim/mail2.server.com/private.age
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCRkl1SThtVnN3bUg4cmJL
-aXBBUU4yRE1DOGdYclg1UXVhS1Y0UTJPVVIwCjlSOXZJdVB0R0VxbGdUWHd5U2RO
-RGpFdUw4c3EyUFZNZUx4Mm5yeGNIeVUKLT4gWDI1NTE5IHc5K05EeE1xNnBHd1dS
-WDJwSTdzLys3MnRncmN0WWZjTWkvM0tqeWRRU1EKek13RGRsNUhadncxQ3V6ZFcv
-Ni9aMTFtRllFK0lvd2tidnRwUjE0V0d2OAotPiBzc2gtZWQyNTUxOSBSc2dXcFEg
-Mml5VEt5b3R3d09Gc1hzR2pRZzJFY3VHT0JwUnBaTTNIWG5QaGdsWkh4bwp1Nzdx
-dWxpbjdNRGZ6aThxM0d6a2MraklkSW03ek15YXRkSXVyaS96QlFjCi0+IDAkRDEp
-bC4tZ3JlYXNlCi9lUnduUFJreTdpMEU5ejZjS1JyWmJzRkZNRVdLbnRRZC81aldN
-c2FqTTgrNnFCSEYxQUhSQWxyMW9icCtQYkgKTUEKLS0tIDNmQkwwbjJiSldraDVw
-ZUs3SHNpU0pGWXRLSVBtZ0Y1QW5uT0N5bnpjek0KiujqGmiYB3hCso3u4uCtZuO3
-EmPPJkbHKPNyUQy1V/Bv+sjgPDQi/0y7UR759G91iNIYQB0fWg7njWsl8GNdJwXI
-YO+2utDKkrm0DowWNKpHX1KE1g93e0H5ZoptygLFtx8TWDP2i8R7JJqJ9QevSz6r
-Nwjj+d3HGTxA7WvAZnNdvyfHbRRdvW+6q0uIjS5zHXAs8YmepA==
------END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/mail2.server.com/public b/tests/common/email/dkim/mail2.server.com/public
deleted file mode 100644
index 5c4406d..0000000
--- a/tests/common/email/dkim/mail2.server.com/public
+++ /dev/null
@@ -1 +0,0 @@
-th9exwaYvoAjxW1tAj3k/VNLl5jKzSC/dxKrxM2mTZE=
-\ No newline at end of file
diff --git a/tests/common/email/functions.nix b/tests/common/email/functions.nix
new file mode 100644
index 0000000..7be1bfa
--- /dev/null
+++ b/tests/common/email/functions.nix
@@ -0,0 +1,224 @@
+{
+  pkgs,
+  vhackPackages,
+}: {
+  scripts = {
+    expectNoNewMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --verbose >&2 || [ "$?" -eq 1 ] || {
+        echo "Mail was not empty" >&2
+        exit 1
+      }
+    '';
+    expectNewMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --verbose >&2 || [ "$?" -ne 1 ] || {
+        echo "No new mail" >&2
+        exit 1
+      }
+    '';
+    expectNewSpamMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --folder JUNK --verbose >&2 || [ "$?" -ne 1 ] || {
+        echo "No new spam mail" >&2
+        exit 1
+      }
+    '';
+  };
+
+  mkMailServer = serverName: userName: {
+    config,
+    lib,
+    nodes,
+    ...
+  }: {
+    age.identityPaths = ["${../../common/email/hostKey}"];
+
+    systemd.tmpfiles.rules = [
+      #-      path                     mode user group - content
+      "f     /passwords/${userName}    777  root root  - ${userName}-password"
+    ];
+
+    age.secrets = {
+      "mailDkim" = {
+        file = ../../common/email/dkim + "/${serverName}/private.age";
+        mode = "600";
+        owner = "rspamd";
+        group = "rspamd";
+      };
+    };
+
+    # Disable rspamd. rspamd can't do the dns lookups in the sandbox for
+    # determining if something is spam or not. Therefore it just rejects every mail with
+    # 'Try again later.'.
+    # services.rspamd.enable = lib.mkForce false;
+    # users.users.rspamd.group = "rspamd";
+    # users.groups.rspamd = {};
+    #
+    # services.postfix.settings.main = {
+    #   smtpd_milters = lib.mkForce [];
+    #   non_smtpd_milters = lib.mkForce [];
+    # };
+    # mailserver.dkim.enable = false;
+    services = {
+      rspamd = {
+        locals = {
+          "asn.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+          "rbl.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+          "greylist.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+        };
+      };
+    };
+
+    # This DNS resolver is only there for rspamd (and apparently not even needed). But it
+    # also removes our own name server changes, so the test node could no longer find
+    # e.g. `acme.test` and so on.
+    # See: https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/work_items/100
+    mailserver.localDnsResolver = false;
+
+    vhack = {
+      mail = {
+        enable = true;
+        fqdn = serverName;
+        domains = [
+          serverName
+        ];
+
+        security.dkimKeys."${serverName}" = {
+          dkimPrivateKeyPath = config.age.secrets."mailDkim".path;
+          dkimPublicKey =
+            builtins.readFile (../../common/email/dkim + "/${serverName}/public");
+          keyAlgorithm = "rsa-sha-256";
+        };
+
+        accounts = {
+          "${userName}@${serverName}" = {
+            passwordFile = "/passwords/${userName}";
+          };
+        };
+      };
+    };
+  };
+
+  mkDnsZone = serverName: {config, ...}: let
+    cfg = config.vhack.mail;
+
+    keyAlgoToKeyType = keyAlgo:
+      if keyAlgo == "ed25519-sha256"
+      then "ed25519"
+      else if keyAlgo == "rsa-sha-256" || keyAlgo == "rsa-sha-1"
+      then "rsa"
+      else builtins.throw "Impossible";
+  in {
+    "${serverName}" = {
+      MX = [
+        {
+          preference = 10;
+          exchange = "${serverName}.";
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.1
+      # https://www.rfc-editor.org/rfc/rfc6376.html#section-7.5
+      DKIM = [
+        {
+          selector = "mail";
+          k = keyAlgoToKeyType cfg.security.dkimKeys."${serverName}".keyAlgorithm;
+          p = cfg.security.dkimKeys."${serverName}".dkimPublicKey;
+          s = ["email"];
+          t = ["s"];
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc7489.html#section-6.3
+      DMARC = [
+        {
+          adkim = "strict";
+          aspf = "strict";
+          fo = ["0" "1" "d" "s"];
+          p = "quarantine";
+          rua = "admin@vhack.eu";
+          ruf = ["admin@vhack.eu"];
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc7208.html
+      # NOTE(@bpeetz): This server might not be directly sending mail, but it is still required for
+      # the SMTP EHLO check. <2025-02-25>
+      TXT = [
+        (builtins.concatStringsSep " "
+          [
+            "v=spf1" # The version.
+            "+mx" # Allow mail from this domain MX record.
+            "-all" # Reject all other emails if the previous mechanism did not match.
+          ])
+      ];
+    };
+  };
+
+  mkUser = user: mailServer: {nodes, ...}: {
+    environment.systemPackages = [
+      vhackPackages.fetchmail-common-name
+      pkgs.msmtp
+      pkgs.procmail
+    ];
+
+    users.users."${user}" = {isNormalUser = true;};
+
+    systemd.tmpfiles.rules = [
+      "d /home/${user}/mail         0700 ${user} users - -"
+      "L /home/${user}/.fetchmailrc -    -       -     - /etc/homeSetup/.fetchmailrc"
+      "L /home/${user}/.procmailrc  -    -       -     - /etc/homeSetup/.procmailrc"
+      "L /home/${user}/.msmtprc     -    -       -     - /etc/homeSetup/.msmtprc"
+    ];
+
+    environment.etc = {
+      "homeSetup/.fetchmailrc" = {
+        text = ''
+          poll "${mailServer}" protocol IMAP
+            username "${user}@${mailServer}"
+            password "${user}-password"
+            ssl
+            mda procmail;
+        '';
+        mode = "0600";
+        inherit user;
+      };
+      "homeSetup/.procmailrc" = {
+        text = ''
+          DEFAULT=$HOME/mail
+        '';
+        mode = "0600";
+        inherit user;
+      };
+      "homeSetup/.msmtprc" = {
+        text = ''
+          account        ${user}
+          host           ${mailServer}
+          domain         ${mailServer}
+          port           465
+          from           ${user}@${mailServer}
+          user           ${user}@${mailServer}
+          password       ${user}-password
+          auth           on
+          tls            on
+          tls_starttls   off
+        '';
+        mode = "0600";
+        inherit user;
+      };
+    };
+  };
+}