26 files changed, 376 insertions, 25 deletions
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/generate b/tests/common/acme/certs/generate
index 0d6258e..0d6258e 100755
--- a/tests/by-name/em/email-dns/nodes/acme/certs/generate
+++ b/tests/common/acme/certs/generate
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/generate.ca b/tests/common/acme/certs/generate.ca
index 92832c5..92832c5 100755
--- a/tests/by-name/em/email-dns/nodes/acme/certs/generate.ca
+++ b/tests/common/acme/certs/generate.ca
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/generate.client b/tests/common/acme/certs/generate.client
index 5930298..5930298 100755
--- a/tests/by-name/em/email-dns/nodes/acme/certs/generate.client
+++ b/tests/common/acme/certs/generate.client
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/output/acme.test.cert.pem b/tests/common/acme/certs/output/acme.test.cert.pem
index 687101d..687101d 100644
--- a/tests/by-name/em/email-dns/nodes/acme/certs/output/acme.test.cert.pem
+++ b/tests/common/acme/certs/output/acme.test.cert.pem
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/output/acme.test.key.pem b/tests/common/acme/certs/output/acme.test.key.pem
index 06195b8..06195b8 100644
--- a/tests/by-name/em/email-dns/nodes/acme/certs/output/acme.test.key.pem
+++ b/tests/common/acme/certs/output/acme.test.key.pem
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/output/acme.test.template b/tests/common/acme/certs/output/acme.test.template
index 320a170..320a170 100644
--- a/tests/by-name/em/email-dns/nodes/acme/certs/output/acme.test.template
+++ b/tests/common/acme/certs/output/acme.test.template
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/output/ca.cert.pem b/tests/common/acme/certs/output/ca.cert.pem
index 0fa9d14..0fa9d14 100644
--- a/tests/by-name/em/email-dns/nodes/acme/certs/output/ca.cert.pem
+++ b/tests/common/acme/certs/output/ca.cert.pem
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/output/ca.key.pem b/tests/common/acme/certs/output/ca.key.pem
index 64263bc..64263bc 100644
--- a/tests/by-name/em/email-dns/nodes/acme/certs/output/ca.key.pem
+++ b/tests/common/acme/certs/output/ca.key.pem
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/output/ca.template b/tests/common/acme/certs/output/ca.template
index a2295d8..a2295d8 100644
--- a/tests/by-name/em/email-dns/nodes/acme/certs/output/ca.template
+++ b/tests/common/acme/certs/output/ca.template
diff --git a/tests/by-name/em/email-dns/nodes/acme/certs/snakeoil-certs.nix b/tests/common/acme/certs/snakeoil-certs.nix
index aeb6dfc..aeb6dfc 100644
--- a/tests/by-name/em/email-dns/nodes/acme/certs/snakeoil-certs.nix
+++ b/tests/common/acme/certs/snakeoil-certs.nix
diff --git a/tests/by-name/em/email-dns/nodes/acme/client.nix b/tests/common/acme/client.nix
index 2b870e8..2b870e8 100644
--- a/tests/by-name/em/email-dns/nodes/acme/client.nix
+++ b/tests/common/acme/client.nix
diff --git a/tests/common/acme/default.nix b/tests/common/acme/default.nix
new file mode 100644
index 0000000..e7869c2
--- /dev/null
+++ b/tests/common/acme/default.nix
@@ -0,0 +1,44 @@
+{pkgs}: let
+  add_pebble_ca_certs = pkgs.writeShellScript "fetch-and-set-ca" ''
+    set -xe
+
+    # Fetch the randomly generated ca certificate
+    curl https://acme.test:15000/roots/0 > /tmp/ca.crt
+    curl https://acme.test:15000/intermediates/0 >> /tmp/ca.crt
+
+    # Append it to the various system stores
+    # The file paths are from <nixpgks>/modules/security/ca.nix
+    for cert_path in "ssl/certs/ca-certificates.crt" "ssl/certs/ca-bundle.crt" "pki/tls/certs/ca-bundle.crt"; do
+      cert_path="/etc/$cert_path"
+
+      mv "$cert_path" "$cert_path.old"
+      cat "$cert_path.old" > "$cert_path"
+      cat /tmp/ca.crt >> "$cert_path"
+    done
+
+    export NIX_SSL_CERT_FILE=/tmp/ca.crt
+    export SSL_CERT_FILE=/tmp/ca.crt
+
+    # TODO
+    # # P11-Kit trust source.
+    # environment.etc."ssl/trust-source".source = "$${cacertPackage.p11kit}/etc/ssl/trust-source";
+  '';
+in {
+  prepare = clients: extra:
+  # The parens are needed for the syntax highlighting to work.
+    ( # python
+      ''
+        # Start dependencies for the other services
+        start_all()
+
+        acme.wait_for_unit("pebble.service")
+        name_server.wait_for_unit("nsd.service")
+
+        with subtest("Add pebble ca key to all services"):
+          for node in [name_server, ${builtins.concatStringsSep "," clients}]:
+            node.wait_until_succeeds("curl https://acme.test:15000/roots/0")
+            node.succeed("${add_pebble_ca_certs}")
+      ''
+    )
+    + extra;
+}
diff --git a/tests/by-name/em/email-dns/nodes/acme/default.nix b/tests/common/acme/server.nix
index 236ba6a..997c944 100644
--- a/tests/by-name/em/email-dns/nodes/acme/default.nix
+++ b/tests/common/acme/server.nix
@@ -1,28 +1,5 @@
-# The certificate for the ACME service is exported as:
-#
-#   config.test-support.acme.caCert
-#
-# This value can be used inside the configuration of other test nodes to inject
-# the test certificate into security.pki.certificateFiles or into package
-# overlays.
-#
-# {
-#   acme = { nodes, lib, ... }: {
-#     imports = [ ./common/acme/server ];
-#     networking.nameservers = lib.mkForce [
-#       nodes.mydnsresolver.networking.primaryIPAddress
-#     ];
-#   };
-#
-#   dnsmyresolver = ...;
-# }
-#
-# Keep in mind, that currently only _one_ resolver is supported, if you have
-# more than one resolver in networking.nameservers only the first one will be
-# used.
-#
-# Also make sure that whenever you use a resolver from a different test node
-# that it has to be started _before_ the ACME service.
+# Add this node as acme server.
+# This also needs a DNS server.
 {
   config,
   pkgs,
diff --git a/tests/common/dns/client.nix b/tests/common/dns/client.nix
new file mode 100644
index 0000000..52f3267
--- /dev/null
+++ b/tests/common/dns/client.nix
@@ -0,0 +1,10 @@
+{
+  lib,
+  nodes,
+  ...
+}: {
+  networking.nameservers = lib.mkForce [
+    nodes.name_server.networking.primaryIPAddress
+    nodes.name_server.networking.primaryIPv6Address
+  ];
+}
diff --git a/tests/common/dns/server.nix b/tests/common/dns/server.nix
new file mode 100644
index 0000000..0c8d72c
--- /dev/null
+++ b/tests/common/dns/server.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  nodes,
+  ...
+}: {
+  imports = [
+    ../../../modules
+  ];
+
+  networking.nameservers = lib.mkForce [
+    nodes.name_server.networking.primaryIPAddress
+    nodes.name_server.networking.primaryIPv6Address
+  ];
+
+  vhack = {
+    dns = {
+      enable = true;
+      openFirewall = true;
+      interfaces = [
+        nodes.name_server.networking.primaryIPAddress
+        nodes.name_server.networking.primaryIPv6Address
+      ];
+
+      zones = {
+        "acme.test" = {
+          SOA = {
+            nameServer = "ns";
+            adminEmail = "admin@server.com";
+            serial = 2025012301;
+          };
+          useOrigin = false;
+
+          A = [
+            nodes.acme.networking.primaryIPAddress
+          ];
+          AAAA = [
+            nodes.acme.networking.primaryIPv6Address
+          ];
+        };
+      };
+    };
+  };
+}
diff --git a/tests/common/email/dkim/alice.com/private.age b/tests/common/email/dkim/alice.com/private.age
new file mode 100644
index 0000000..cb590c6
--- /dev/null
+++ b/tests/common/email/dkim/alice.com/private.age
@@ -0,0 +1,11 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSA3bVJS
+NjBTaitjUEhxMVZmejI1L3Fmd0xGK3ZFVlM2eVBaellDYWs3ZW5nClZOckc5cFFZ
+dVlXYmxWZXpQU3lPTnlwTC9KUGNZak9VVS9aNzVEaFkrUG8KLT4gUy1ncmVhc2UK
+Y21CMkZlQVdUUHVIclRpMk5yNmRTb3lwUVQzTWM2a0YwSjhUQU1kbTRqK1lrVUtk
+ZkVVCi0tLSByRDVCeTJIK2JQWittWjlUWklSOWJaenluL1FLdXN2ZEM4bVlnU2U1
+RFk0CiAxOLq5ePeM8MemSES9Q86mBix3hooazHZZ7xCIQKnLvZmiHWCKUYw83PWl
+QpmWI7S3wgdguOncKirQccJbNtVLYb/noYEBA1y7lOzO1FELPcFgevtB3kt5EAOA
+6OaPsFKSsz71t++K011dgFUcnYmOtrqiQeKKEkZ0gey4+jNwf4buDygdiPOL/fQS
+uJiIUwsLPqZI/FQ=
+-----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/alice.com/public b/tests/common/email/dkim/alice.com/public
new file mode 100644
index 0000000..be30723
--- /dev/null
+++ b/tests/common/email/dkim/alice.com/public
@@ -0,0 +1 @@
+LviKY6SBD2mtLJlUTon9AkWPYzB2D+Ivk0XnJOalAZM=
+\ No newline at end of file
diff --git a/tests/common/email/dkim/bob.com/private.age b/tests/common/email/dkim/bob.com/private.age
new file mode 100644
index 0000000..70eddca
--- /dev/null
+++ b/tests/common/email/dkim/bob.com/private.age
@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSAvSmk4
+YlQ3SElud2c3TWgxaUZCaC9mYytlbmNVdlVRcS9VTjlneFBBQ2hrCnE3b1dNdytR
+Z0l5dVlMYUhVT0ZIMkFBYkNRKzZ6U1pBYStJTUJsNUEvN28KLT4gcX5kMWtnXi1n
+cmVhc2UgczdieGAKNjNwRmVMYmN2cE5LaGFEOS9QZHFtaVhtZXI4dTFpazZhdUN4
+bUZ0cjQ4Y09nOVRjM2IzTGgweS9NbHkxMXlMSwpjdWhQekk0a0VnMTNFTXdjTmdl
+bHluNDZWT0R5L25zbXlTL3l3NnRuTWhtNWs0dVByMWQ2TlEKLS0tIEZMK2dqRktZ
+Y0hlN2l0ZVB4c3Exd3NsanRuTitrVklaaS9ZTU5ZWVF0cGsKuTNM9zBVFmOHkEqx
+jMZaJQd/XqA4WzOi/iFi4WmDUDb8XcVsS0s/37fyZfeMW3YjoCzDb/treKMXyTDC
+8l5N/xMG20UGC/Z16W24c/MXMFzpDLuFrjHiUtpQvBzwi6JUDMlKC8t0YWNcqQRr
+2vu7qij0XgasxrGDg86hoc72YmYPmpHnE86O1il0PWy9sDRlkn6Ah/DUNg==
+-----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/bob.com/public b/tests/common/email/dkim/bob.com/public
new file mode 100644
index 0000000..915188c
--- /dev/null
+++ b/tests/common/email/dkim/bob.com/public
@@ -0,0 +1 @@
+6USjzSE5zuUNrMdgsjAHFnq0BRKmyZh2IoXFHBCv3To=
+\ No newline at end of file
diff --git a/tests/by-name/em/email-dns/secrets/dkim/gen_key.sh b/tests/common/email/dkim/gen_key.sh
index 1e090f4..48b4434 100755
--- a/tests/by-name/em/email-dns/secrets/dkim/gen_key.sh
+++ b/tests/common/email/dkim/gen_key.sh
@@ -1,6 +1,8 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -p rage -p openssl -p dash -i dash --impure
 
+# shellcheck shell=dash
+
 cd "$(dirname "$0")" || {
     echo "No basedir?!"
     exit 1
diff --git a/tests/common/email/dkim/mail.server1/private.age b/tests/common/email/dkim/mail.server1/private.age
new file mode 100644
index 0000000..a97c70b
--- /dev/null
+++ b/tests/common/email/dkim/mail.server1/private.age
@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSBndElV
+WFFTcEZpTGwrTUg5WHk1MElLSU5ZZWp1NU5ocit4VGtnM09KZFNBCjNvaWVPR3Zt
+RG14N2E3b0RwK21IUzBZZmg1UzFwakMwTVVOdDgrTTd4U1UKLT4geD9OYm0tZ3Jl
+YXNlIDwgcjkKQUJtaDlVbzk3Slk3S1ozNS9STGwrdzhvWTlodWgxNVd1WVRadTV5
+VmFVUmRmSTV3ckIzYmpQYUFsMUxkdGNzUgo1UXozYzBCK3UxU1BPSnlvVVVxQjI2
+QVdWY0tBbUg1R3p5NmNaZ2RiVGNlL3pWN3FHZU5QOEN2VVdraDBzM1R2CgotLS0g
+TElGejJDYUk4WlhxajdXekI4S0tUMVlrNmdxelpjUnBUa1VCU2krSFloawpUfMj8
+iqVP45yV8fON6fDUur6q/UYqTaaHhCW07LTsBZQpReG8LA+PiOhHw1TmPSJlc/JH
+yEkwLachwvLGCGEO2yoFUFhYwoNhl3vrBsuDLXpqfNuoPrg3wcFXBdrg9zBjZ5Pc
+C/rdzpysjW/52gKRCdGgFj2WyTW2wO2yVmmUk1RWhMabmdd+XLkKhynaMtWsBF0j
+NQ3F
+-----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/mail.server1/public b/tests/common/email/dkim/mail.server1/public
new file mode 100644
index 0000000..6c9e653
--- /dev/null
+++ b/tests/common/email/dkim/mail.server1/public
@@ -0,0 +1 @@
+3/bsVrnWag3eMCuj78VpsHDQSONi97fIzY+WPKvAYWM=
+\ No newline at end of file
diff --git a/tests/common/email/dkim/mail.server2/private.age b/tests/common/email/dkim/mail.server2/private.age
new file mode 100644
index 0000000..fbd88fc
--- /dev/null
+++ b/tests/common/email/dkim/mail.server2/private.age
@@ -0,0 +1,11 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFJzZ1dwUSBTcktS
+L0ovODhxd2tyWFdINWRtbXNNYksyNzl6RUxRcTU2T251eVNhQlg4CjVzTVpnc0FC
+eHBNaUtEQnJVRXVpTjg2c3gxcC90VXJ3cUJVaHZJY1pnb00KLT4gKDEkKS1ncmVh
+c2UgYnYqQSBAVSU+CnVRbkRhdUhRS0Z6NGIybll1WVdmSmxzS0lxYlAwSXp0TnA4
+anRDSmQKLS0tIGxxSXRaM0lKeXRoeHFxWW9qN3Y1OE55b1FBVGJTZzB2RmFmZVk5
+eW94aW8KleHhm6fKalehWR0IfHYiC+0bsm0SeYjnJeA60hePdwikmr0QQv5D2xCX
+Nf2QRuai/BpsiJpnvKUiP1uwkm5x6a2Zgwa7t8BwJ7SHqD4oJ+VgCsWMffLs55uC
+A1pKLRmAI26cNt7oibVxNSCCuxZRWeCn+xAsQ393jVCUuDW2FkgyDsKFYHvKRpnC
+BNfwDWWHJ+pifPPrqg==
+-----END AGE ENCRYPTED FILE-----
diff --git a/tests/common/email/dkim/mail.server2/public b/tests/common/email/dkim/mail.server2/public
new file mode 100644
index 0000000..40b6ff7
--- /dev/null
+++ b/tests/common/email/dkim/mail.server2/public
@@ -0,0 +1 @@
+QmbJbp/b671OCOQa0Qx1XGl7c1jzFuASuzBr1f5ATpE=
+\ No newline at end of file
diff --git a/tests/common/email/functions.nix b/tests/common/email/functions.nix
new file mode 100644
index 0000000..7be1bfa
--- /dev/null
+++ b/tests/common/email/functions.nix
@@ -0,0 +1,224 @@
+{
+  pkgs,
+  vhackPackages,
+}: {
+  scripts = {
+    expectNoNewMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --verbose >&2 || [ "$?" -eq 1 ] || {
+        echo "Mail was not empty" >&2
+        exit 1
+      }
+    '';
+    expectNewMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --verbose >&2 || [ "$?" -ne 1 ] || {
+        echo "No new mail" >&2
+        exit 1
+      }
+    '';
+    expectNewSpamMail = pkgs.writeShellScript "assert-empty-emails" ''
+      set -xe
+
+      # fetchmail returns EXIT_CODE 1 when no new mail
+      fetchmail --folder JUNK --verbose >&2 || [ "$?" -ne 1 ] || {
+        echo "No new spam mail" >&2
+        exit 1
+      }
+    '';
+  };
+
+  mkMailServer = serverName: userName: {
+    config,
+    lib,
+    nodes,
+    ...
+  }: {
+    age.identityPaths = ["${../../common/email/hostKey}"];
+
+    systemd.tmpfiles.rules = [
+      #-      path                     mode user group - content
+      "f     /passwords/${userName}    777  root root  - ${userName}-password"
+    ];
+
+    age.secrets = {
+      "mailDkim" = {
+        file = ../../common/email/dkim + "/${serverName}/private.age";
+        mode = "600";
+        owner = "rspamd";
+        group = "rspamd";
+      };
+    };
+
+    # Disable rspamd. rspamd can't do the dns lookups in the sandbox for
+    # determining if something is spam or not. Therefore it just rejects every mail with
+    # 'Try again later.'.
+    # services.rspamd.enable = lib.mkForce false;
+    # users.users.rspamd.group = "rspamd";
+    # users.groups.rspamd = {};
+    #
+    # services.postfix.settings.main = {
+    #   smtpd_milters = lib.mkForce [];
+    #   non_smtpd_milters = lib.mkForce [];
+    # };
+    # mailserver.dkim.enable = false;
+    services = {
+      rspamd = {
+        locals = {
+          "asn.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+          "rbl.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+          "greylist.conf".text = lib.mkForce ''
+            enabled = false;
+          '';
+        };
+      };
+    };
+
+    # This DNS resolver is only there for rspamd (and apparently not even needed). But it
+    # also removes our own name server changes, so the test node could no longer find
+    # e.g. `acme.test` and so on.
+    # See: https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/work_items/100
+    mailserver.localDnsResolver = false;
+
+    vhack = {
+      mail = {
+        enable = true;
+        fqdn = serverName;
+        domains = [
+          serverName
+        ];
+
+        security.dkimKeys."${serverName}" = {
+          dkimPrivateKeyPath = config.age.secrets."mailDkim".path;
+          dkimPublicKey =
+            builtins.readFile (../../common/email/dkim + "/${serverName}/public");
+          keyAlgorithm = "rsa-sha-256";
+        };
+
+        accounts = {
+          "${userName}@${serverName}" = {
+            passwordFile = "/passwords/${userName}";
+          };
+        };
+      };
+    };
+  };
+
+  mkDnsZone = serverName: {config, ...}: let
+    cfg = config.vhack.mail;
+
+    keyAlgoToKeyType = keyAlgo:
+      if keyAlgo == "ed25519-sha256"
+      then "ed25519"
+      else if keyAlgo == "rsa-sha-256" || keyAlgo == "rsa-sha-1"
+      then "rsa"
+      else builtins.throw "Impossible";
+  in {
+    "${serverName}" = {
+      MX = [
+        {
+          preference = 10;
+          exchange = "${serverName}.";
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.1
+      # https://www.rfc-editor.org/rfc/rfc6376.html#section-7.5
+      DKIM = [
+        {
+          selector = "mail";
+          k = keyAlgoToKeyType cfg.security.dkimKeys."${serverName}".keyAlgorithm;
+          p = cfg.security.dkimKeys."${serverName}".dkimPublicKey;
+          s = ["email"];
+          t = ["s"];
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc7489.html#section-6.3
+      DMARC = [
+        {
+          adkim = "strict";
+          aspf = "strict";
+          fo = ["0" "1" "d" "s"];
+          p = "quarantine";
+          rua = "admin@vhack.eu";
+          ruf = ["admin@vhack.eu"];
+        }
+      ];
+
+      # https://www.rfc-editor.org/rfc/rfc7208.html
+      # NOTE(@bpeetz): This server might not be directly sending mail, but it is still required for
+      # the SMTP EHLO check. <2025-02-25>
+      TXT = [
+        (builtins.concatStringsSep " "
+          [
+            "v=spf1" # The version.
+            "+mx" # Allow mail from this domain MX record.
+            "-all" # Reject all other emails if the previous mechanism did not match.
+          ])
+      ];
+    };
+  };
+
+  mkUser = user: mailServer: {nodes, ...}: {
+    environment.systemPackages = [
+      vhackPackages.fetchmail-common-name
+      pkgs.msmtp
+      pkgs.procmail
+    ];
+
+    users.users."${user}" = {isNormalUser = true;};
+
+    systemd.tmpfiles.rules = [
+      "d /home/${user}/mail         0700 ${user} users - -"
+      "L /home/${user}/.fetchmailrc -    -       -     - /etc/homeSetup/.fetchmailrc"
+      "L /home/${user}/.procmailrc  -    -       -     - /etc/homeSetup/.procmailrc"
+      "L /home/${user}/.msmtprc     -    -       -     - /etc/homeSetup/.msmtprc"
+    ];
+
+    environment.etc = {
+      "homeSetup/.fetchmailrc" = {
+        text = ''
+          poll "${mailServer}" protocol IMAP
+            username "${user}@${mailServer}"
+            password "${user}-password"
+            ssl
+            mda procmail;
+        '';
+        mode = "0600";
+        inherit user;
+      };
+      "homeSetup/.procmailrc" = {
+        text = ''
+          DEFAULT=$HOME/mail
+        '';
+        mode = "0600";
+        inherit user;
+      };
+      "homeSetup/.msmtprc" = {
+        text = ''
+          account        ${user}
+          host           ${mailServer}
+          domain         ${mailServer}
+          port           465
+          from           ${user}@${mailServer}
+          user           ${user}@${mailServer}
+          password       ${user}-password
+          auth           on
+          tls            on
+          tls_starttls   off
+        '';
+        mode = "0600";
+        inherit user;
+      };
+    };
+  };
+}
diff --git a/tests/by-name/em/email-dns/secrets/hostKey b/tests/common/email/hostKey
index 79c9d6c..79c9d6c 100644
--- a/tests/by-name/em/email-dns/secrets/hostKey
+++ b/tests/common/email/hostKey