From 6ab89d09b781dddb8db3a85ca598b6e67ee3c236 Mon Sep 17 00:00:00 2001
From: "Lennart J. Kurzweg (Nx2)" <git@nx2.site>
Date: Mon, 4 May 2026 03:30:43 +0200
Subject: [PATCH] email smtp2go&google relay 2

---
 sops-secrets.yaml                    |  6 ++++--
 system-modules/networking.nix        | 12 ++++++-----
 system-modules/nx2site.nix           |  4 ++--
 system-modules/nx2site/maddy.nix     | 30 ++++++++++++++++++++++++++++
 system-modules/nx2site/nextcloud.nix | 21 +++++++++++++------
 system-modules/nx2site/proxy.nix     | 20 ++++++++++++++-----
 6 files changed, 73 insertions(+), 20 deletions(-)

diff --git a/sops-secrets.yaml b/sops-secrets.yaml
index 882065d..91057e3 100644
--- a/sops-secrets.yaml
+++ b/sops-secrets.yaml
@@ -63,6 +63,8 @@ nx2site:
         georg_password: ENC[AES256_GCM,data:HD/DtGfrS2KqScF8My6q/lyucec=,iv:d99SO2/H/fSKu4G+xsFHbH5rAaG2AttBejM6Rlgx/D8=,tag:gxlQGttzVNLE/sBqf5nZpQ==,type:str]
         tessa_password: ENC[AES256_GCM,data:qD4eivgDKG4Du892gr/83KPw8URgVw==,iv:TZTiXZzNmDmZ+jj5nvlr7Zs+Re0a53SxLjAypTsudIA=,tag:XclXS4ooziPRpl+0oehx+Q==,type:str]
         shared_password: ENC[AES256_GCM,data:W8MUZdqJAzRtcIAZ7PFOs524AVU=,iv:n3hXLl5uByE5c2MEl81fd4LOO+jlUbapavQfq9uMxyQ=,tag:PDbTbnXrveLgUgddpKoEJQ==,type:str]
+    smtp2go:
+        nextcloud_api_key: ENC[AES256_GCM,data:rkQJxBTYPuovkzEH6NGf9LpcLIJBpRY=,iv:tfsmdOPIkeNfQCm2LES04/9Ryk8sfaeimCrgrRmO9ng=,tag:PXo//OYnw5GWJTPKYmvspQ==,type:str]
 USERTrust:
     ECC: ENC[AES256_GCM,data:yVSxTKRhXXPwfY7STz4YOWjgBSINYG4zjISQ/9Q9Zn1gZl/wbDQjSk7prN5fSn9aVH46TbT2mPlRDt7jcfbEZ5JmUnIfDZ7JqrAukOxy7wLAF+m4R7/KdLmdM3xJ6cnH6Tm3KQjRPL26zN4BD3T1oqNw/NPxlfqWeMrjMYZSktmoNAwAjntIqrnoXIuEPKvAsqIbg+SLvrSo05DhDy48c16jSi5zzfQ9M4fEgsugw8y7BWF/eAooLsvnpinc3Ek0XpSy2QJoD9plaW0z1lUT/UFmVVZsLDejb5hbzOnklhjSgE8S7wO4Zmvnu3It5M1YATSR5PsaG7QqaP1w6dd2DdvSnfeVeS28AdgVnOUM2MwJsgTWlvtol6ErIxaUf3n3+PAXTubhH37auOoMDeFeu1lAAe2lKiQcCtpE9gy1dkZ3vSZO6eHq7REo1qauao2LrrgBfPS0p0nhMBjOiORDI06JkNwDFBktjBI9JFHBNfd/CMrgXhfsxujbVxFSD6VD7DxBb3TDgOAm5GS6YJVC5bxQx038GnHorBsUBeR6BzpxG/lrNcBdNaHKqjngBbQmYR/skbLlrJblDyXdI4Xyh55Eogz28rwT5HhjoWOGjAk9P2qk9QAqKcWuRXsS77jRIeD59cqq9EKDRzixEJntCvxxsS1LLYBG4vmzXk4qgb1vGUgNKUaVXPNjXX2ueaLtkEMkx9sMmKcyKLzLoD3/yPYEiUTwCoXaNf3o4OUrvli7mW7qzGrqXTQtQfOd7fMGupgjtR68dEQxP2M/J1725phvSUQNx8SuERMOwzHwd7Yt/Z5TKJ+B/m7uxYyVeo9QYlkHrjVAVLmHc6qnKGVZrSGSkdVVr4dksOc7gyB28MP7JZRADCnHq7+1jhRMCiOT51I/ZyrqWtTqDNBFATCeDDWF7qZcrzWq4GrWm2dmWwQlUm5lW7+MsVgrFowjnbbjwcWy2ROIPiiC3cQ7ztxqXMZZjHUVDa4OC19d4vsDETphTuFQtNHTWGnps/phrV5X5QfIC5nmrHqeyJR2YRNb1M/IZMD1nWFvDJG0B46ES03YaIrQYt46HK3Pd25arssGS+Gzx8p65NTriRBp+KAkGf8dN9+/bECHI8coWKXpi31Uu1GoN4tf0f3OoQtpq2mCF9wz9B/cl/j7jBVKN1/OPqmd/IWr737eYQLeJ/XOKs3W5+5bdnl5I0ewaipPYelUY/ZNWCMN91U8PInGrThnASRdCkNMPOzU56MIBj3gFWn/DIq/kaFpf5CFq3Zvniy5HIf/+ZyLhMH4v7O4GSgMCcomEXLlQJZ9K4ZPHo1IYfHJqi0OEfmZageDkRrD9434ByYibg1wJRVvZfUbh4HJjgIrf1yZhTAe4DVBpYnf7wuJIw0HkNRu4piiNw8LIh2ga+f36iDs5Nl0qaZtMR3gLUBiMxrLS3Yakuof+xcglzfVMo8YBD90qBFKke7OUi7CQCZw6orE/EJ8pxDTWL4sedcv/OowKo4xqh5PtUBAOljs7i1z/zHtr4Cr64SH6DW/2vp7gYA62+BPrbhSRJbW6wkWR2hWn4pYJLirKwUBasO1Iewpj6ps3if5IKVrv6kfFoFYfLF8cEpIDjek61OU15tjXRMZENR0vSQRAm9D92VGCXcD3gnW34jF+i6HnArPF8hJ8vDIAb7LYf0xuCZ0JU8QNIUqSdHIcH/GAZGNHAP2EBV+Xbffw9rIycPM4JUIPvbUNVnXsR4+Hc1URd1FkTDlvQEE3lWlPVtcbChbg/221OdKVewi4YwXFWQV45fbwsZX05FGunVBr+/G0SEGeJ25kud9YbP/C2K1i/GQeGw5ItOmThpkXr2X/OyonnFSXnYQjy6fwEBnAX2KPVTqY7T8OxgAj7UT63Niv+w68uoay/pgyuAUBKOQ3t4HmfXPaKm0bYNQNt0r8CTLIxqFxJZxJ1syTqnMXLOdowWpDpDszFHQChiFAOuBwK61dYjUC/OHFlxDkLKkKe38EuWdBCyGqHPfj7m23+h/E09u1WzwksUk9jm6DfyTAoz/MZGsbm9pSQl22qzC3og2SwUi+smgCSrcojp4q0W92onAAxe3siPAPIPpt1Gj8GRvkImHQ/rNQkgiJ4jJfN3epiJgBJ+YCGIByivV0XFLB/9UVu7Vw554/nG9BlfKJ9h0G7VPQgd5MJGvkLqJzCrPh6QyK9uOjbJLO4dWkmaL3oZr4IVbwGk3NXZ7oef7A4RFOHDDevJintMLz1ZOkaaJKWe6YoijmAC2tQNGMIoRw6YcLjcmVPJz12W+6MEPH3YOdUl3b/NnfScuTVYBSP0cFXlDwg/rphUD7oykohsLtPOWhYW/GWvAdV4iwZpzQ0yFHasYGiERPytDKmRffoILDoTOn4HGVVCQaGnm/o7pl5BU4hFQOzvUC4C4LYRwpsz7EaRp0Y3Qqt4S2Xc/k0E0W3XU+sVNSvoBgweNhDlKaefjjSSjDNza6l9fTS3XPTprrEhMU7CvDjpsC8vfd5QTiNDxC7XGJEa0FTiCr2Xyz3YM5c8jWOk1hNOcSvJ1GvZhUWw0pX/HaihI49WQqA4/4GtLfG9f5TkCsLanj0wzVLM7XntN5ol0H5R69nJ5mPLIGXsErG9A/Xai9ol9joVUIJVRwLx8iJEyGx8m1pyOENjOkudgnKFryoWsNGbQo6G+0JEvEAjUuApkYNJvqKNRKrw+GSjxRZtewo8V9rC5a6nsUOPK/U5WaF5UMxu/L4fk8jQltcBRhQpuPZboEo6KNmUzMsK3aweMrQdHnLDlOIoJiDqj9ySPv2C3aeVoKWiscQ==,iv:GS5GMpbxeweqwjUvOzqg59xBOzNZqrL5t7RjsFjpucM=,tag:j0MaMw71fnRHxeydlqAaww==,type:str]
     RSA: ENC[AES256_GCM,data:pgCzxri1wLZbl5e/KeVvtHRRe0XkdB8GLp2UbQOlJ9hRvRerJ6r8VhSSDh5vfySL6ow4urXzTG5oZwOcXeZgb+DgT3ZFS+npPvbzcc8T/hU8C5tVXYdqdLJHLXAmVG2nbkuIE6z7Bu8SngBZx1jXNBBl2W4vO6GcL0naNj2IyT+1nGhwuNdn4iMMTIjZhlF81PwYRY/TzcljyST4FZc4u/55oSUNrb8Z7KmhkrmaHNPFACTXiXli/zrPKfisztRvZZLfRZ57067/fiOTdwxXyiSxsh+oKRG8JlvdLQvjZ9tMGagzAafEyWVYyrVJIRBme9Uy4HtG/uOZ39gXVE+D8sh1GWftrmvjXPO2OdD/tIa6kskfZNWWFoEOtiRcKH+fuBTe7/ezjzqJA0qZvfwduXqkfVbNcS3YRNRM3jpLwGHDEv2hnVqn4bjB5We/1KBMCtbrHtAc26M3AepeAUy+ka1xW5WO9LsZ5ck1gnFrV5bkFWDr+evBRUuiId5QuAifkDsKlqLsWAeWFpgc7DdjUrpRG0yry8PFEOZP7w7D2/AEeoGc1dMDgX95mvs+0EmA4lutmt2fF14QZJwzhH39/TLGrRmjrohqJ0kD+h8XykBt1JbOPg91dnxmEJuESPNAxhotrj8xuuklvyLKAcfWWRJ1NIvbG6rmlL+m1x+2hUVw9gVGzyGaaSLOqG/6kHwIV2v+ZvCm+n3JBle+ooSi9mxgefVvJc28hSdC5SvNN0KyDvAY32NgOqYFPrvwx4QHxdm6D5jHXOoFEAkN4duSmDwmVGUq9fL5ds4v815a2Fgn2IZB1l82mLFgy4xaBPlbjrqRnuhgpRRbKu+eSNh13lTEwbrEKJfL89cX1Q9N4Y9aK/I7nq9lfybZ+XYXfoLU+7yXZ6gmm2hw6EkwvmAg1zPnoec5hCOZxotPYByvROOK4TyBCWoF2w+5vmSatZdodLwyoNWSsqtpowWHImCH/UZZ5NkBs0pWOnLBSuP32nFN5GN+0y1EKq+4AxL3pwutpo2iMAFlXI5lu5S4fP6nreZUsYqpp9QpwQtmSbU3iMC4bMSHA4LrhLSCfa3AClVirB4xabCnDWDa8tD5j40Zy0gqk289/qbcmmNC9RpTzrI3aag/hZx4eKjb92Ma5s4E2FZL0BQVrdQ8vD0yuhIaU0qp0ahU1D0/H+HS6Gsi1mfWsfNhsSBBDW0IVC/+8zFxvWYysbVPJJj7m7JY0IwW1yKzPvPnMdkWVS8OcJoODa97V15TaXt7yAstmCVYGZS9qc6VurF5MqQM6c4PluJXPyMlZAwQojrnaCuGuljXpmot5M62MvNMdh4psfa0Y1YiCWjer8XtmYhVvzQPepD/YhsouMrCRGD5pxaXozhoS1bUVD9ReBQb9Gg2sQr8MEQ8oNB/a6fLmNwqY7IWmk9pAhBmk5ng120LS5q+3vjj/hw9+Dz6Ojp6BAVNGs1us5YW86GSSlqVmLew4p+HBiYQyhFCmi9p1WIjrNyT/oHUDYGreL2A6NEo6aePPYeVtbNEYi0UahEscGUrqu953MV+PpbanJI7WHKpHek3Nsdgwyel4V9wjgxSpLWvfwj7QqXL8Xngoyd/4FL+G9MvLc3cDYhIFAryBvqRgXrwRk3CkAijzpk/2hui0qlhmDza8KRpfo/4bwz0i4d/wRyWe3+24WY1CjPkDzclc3VZVQDiSg6KsUQvGnc6Wv1+awjE2kA18j3NR4RYBXgxEflj5Ft2BLG6rq+RakLguXDCAMQA4hcx1L+ThDCdn09c58H9Uc/GRLE5uuFRgLB5UtsQimGXuXzxsA3YIN3CijT6NJTKH9WCvQ4tZnk0Jq73rq4oynTCbZBVPgQi5SrfD1Zr0eXgmirLQZFCEV4EqNrtheZ+vqTkWf7rrvG04C6QqLIHWttdsL3ejfB6ddfwM/sou1JmmgTzEo52CCYf1otKNQwD+shx7Xcrm17vu+v57q6bOQrbeBNb/MDPm8qH4/J89NgSKHO8kzvfAm2qWxmr+90Of0cxVT5l7IdnOBCuYSHgTLIALgTmLmKvPm9l/pOjfIQZmvJ7Alo/eqKfcPw6uwoSDn/5+Pj1c9p2ub1CwRZKZlnULQLI0uyw5eQGceOsuivjO6iQjsk4iGecvlGYwZtlqidz359zCysMSuKrXS+XNGT1xy7fmnyct72HJvSeyq8bSNSAEc/iW+ia9n1GJDj4vW84v/zwi0dm1s/qKnq5M2m/pUvZembcOK/1vY0tsD2McTqIjgKPDS0UO3lgEr8vHFok5kJrU3rVV8iJeLHv3oCzKvjgR9jjqdlceRjSJarVFz1lSxenzoVq0JcH2cde2yQ3vdPusEd2LZC2tVYgqPprp/zOSbWsJPq57eiUl/UX2vOuNAV28HXVIuDqs27q2BOlUvBLCirIurjlONXpdRybN3dtevk/lIel0aRU5L5g9Mr1zhtHsoo6WI0In+RzFsD63AsBNDoufVmXgHr0G/bZLwPCdk1xCeEKv1Bq4fpappx8iEQv5GtwZBkPh8N8D0+ngbccx5N0pMcL2BM/HqeRDXR1Tw72EVEG8Bx4Twue5NBi6rtlfDnDvAj524fylSMSPgab8zq3tY9DnIci3ajnRYpIO3uDgH5cbMxqEb6gnpQNkzVUk0yJXR8nvS8qT6TbryX94howqnrID/8HQZ13ja2d8pW4Sro4+xI9WFFSx8bFSeBjhj4nzyvsyam9nJGDJnuYtNEod/CBMjkRPbBq1doske2twYLudoEObY3FXdZJ5VfiD/zGKXPHjL+pd9L8V2QFicazwE4CcIDoSaOr44VADVwh/Iu6Wr1fVZvmSRPmorlRS4DnUDXEC4dl+C2Z9JhxuL9CEoin+k6yILXsBcRrp2LrRs0U6IW2rVrrtD9MzBosjOGflVABVGhCA4q0LOWF+/5NonHaeB3E0mntFyTvuGTEN2fhnrpW86UERIXOySKTm6nN6BcgmvozgGKQ49jdzuzqVjfWGI9isL9UBNmkamrqbYmdqpoIiWycS7Aeyfh6XWMR+zEjeImqvdF8RQs7Ro9MJWj5Bm5bXs+gaLV4vzNj9/ZzzHZs/UmkBWEPtYs/5KO89Xj9lHBSVfE1c/sM6iDaGLOeO1v2MAIecOoMvIjBJ/YilYJmyywuILjxGN25jlyPVEy5DWnUOSIln6G9eyDjs3VLNsITXFH1co+M2KhDr9sQqJ5lKBitpZUsl/4KI2uiAXm7+kuQOn/27NDBZ0PdW8cwyVg2tirGJDvkmDH1umCas5/OhDEfu7+N9oW6wMpZCeR2lJwS0nTSEkk2Gis7WisgB7j9yY0evOeSecaKaq9RFxg2T3qJ9QR+ZssCXacezSZm/PTa2BByHeHJJ/P6p/f+rg+hziMkESOqx6C4BgGeEZKTAdwTyRfNmsp4bdg9XcqZAgnhtSHb24qAf7Upd/ttwS496H8HdS5bTrmSr8/JvwIKy+rs+id7CzcKYc2HEq0FSUt473Vb3s7kS2YDiqnGW7BRLIPDMApLuCDYeFfHExZhdtbX7O415herG52VffHfAoVfr+DQfipqkDUqno7+coZxthnBY1e8V4bJTcul36CO/sB2vP2/4yfzv/HSuviVVRLY58cGBVk9lSiTBQao3+N/f8a23k1wqEFy60uL4jW4X9swgFed8Q48kAUq9SSfxnKHeQrKrvo9rPHGcetrCC2GQP1u0gHD1TV4F1JGloN8MhMlBGtwBGhOIFcQvUomiTqNrDCobqOqcLUJuVL7jZ+Saw6CiH1QJrSQZ5QuCW9XHoOOgvZzdPqEGuSb6nky2OQ1EjLMQtp7SsrwYp32lkWJ9RY3OUk3LLvTM8Exxg56nDqiOopg0GaWAhf4H4MTrAlssM69epH+5SaJyUEhweg5BZP3mY9FnnkdhG7W9JeDQXu1JOhSm7Td0ForDAoznBcID3SacOCbeSAqtGRBZGxnXFN01MTmUnA7Sy+Sm1WoN+o9u28ttG372sVavQlDZvM+9qXr15hcXt/IYscnbpgw0L7DrcZ4RWb8ATtOov8zhtlwB7QvDQ1LX2g2+5Ag2QcuQJmAYH731XnctUsrCmPKfCVh3CzdNS7DH90bli3cC4t+fpAuAXVNh5wPrCEb9Xco/WUKYe6XNS0Z/xi7PbGBH0s6ThYNzCFbwH4e4CDwD8uP7UA6iL+Uuts5Cz5Fcm7WMqPDFYFAdcA38fOWpXqVRYo6Dan8x/RNAPVNko6MnwXeq061jz7XTk6zEpNymxgjNPJRgcvhItfDHtrGpUqSIJxkQv0g3wppXnWlNX6zGIelUJmLkWuJUJfbznXTdkCr+oF5vwuauwO8iCx/h+7AZBD61w47BmRQLLdDP5I2ptdbrIN4ygouDUVE6bwiw2nhBZuR9ufzcO+WyWNHt5h/N5IuErH/5QcfJOBVRcJYuyFgEWrFax7fiwMCzgKhxN0x1WHa7F8gxGNTIGG9QVNf/6tpYVCAao4pQGErxKVqfVQ1374zbsFSy5PF0oyW5ueEQOVJ82RBjwYtLjX2gXY56nfdLy+D22S3XEHeHLLLg16Vtkf4Twmvzkxjc/YfN2vxu8d5tFbHnyanicj3SBgiiZLvg5iDwjtfONFQ6oX0vfoJ7B5xBsnxiLptx+HPN2onwsF/e7pCl0cTRTLO8Jt7Z8Ob0FYcmd31R2d8paemcIRzfgsqS2JWtJBckAqeQit+Gn+U82aKGew+1FVjlGUrwTO6Q6ztXh75B71V3urA65MaLRX5/7t3nGE8FKip+KfG+yTCHu0F411obb8TME+YwBfz8M4kDUBVtmFUrXEEF9aYD/atxxF02yB/ABPybB6Zcyo5r/U6P0G6jVUGXn3hgQkl1OzkQt06aH/J/LwMN271gc8whsV3pfZC3YfQ3212BAviAshfPyNtHPkShpu6fx5iVDoaL5LHS/A1K7kQ5yya4ECCndpTpF1rYamNVw9a5m64Tma3AGFORy6ZQfaHcV2w0RUs3P3ZXGPcuE2VKeTLLGG43W/FbqGAvxjax2j3qGtZ99Ox85ZAVu5O6PvZSvGSpUW6ebGTCsAgSz5h8V8TfWpaQtR0RrjuzGWoWiW5R2VqfmmIQcn34+t2GgfkZB5QH/o7S5z86UL05dLzdyXXyxIn5sWi0Q1B3yAjFCOVstaAr92fGfx+JHOrMFFKu+bLBpez8lE6f+h4HHzTDVnIB1Zb7d3wNwLVk7PmFy6NeByj0kmjY3Ts5pWctWAAQkI+nOtuM4o101AwCMdMfj3M/mr1J7OWy3Rxgaj58IknfPJpeoMhgkvu66WrkgS3XZE6e/n55sPkGHSDMcHTm2364+oJOSMzDUAJgGjDt9Jvalo1wruDA5pPF4F6y/F/8njO8qkoXnuWRG5BpzO66LwDTDOcUCCFzym6eRBnLo9sGbGZxlvRRSHwIRMa80tcqZqbAuVeW+2/PiSMN7zhzLTNdzhaC4cIOuilcdat1+//+qI3OWC5y9sti3qGuHO1U8rhSOw8Laac7JgOGCo3FkekHe8PaFF8jSDliQnodO8rGCY36xHTQkUsQjb+5ginp/dBIAUIR3QxXsMaxP/yBLpRbvFhD3DeOJRQXWdLijTcxAxLhTIPav2WC1mwyve+Jd0djTajSBgSzPzHW5ajUBaol+dVJeCD9HqiOrUMEmcMQFZZcA+RCJdIOvkKlt/sAnhQ4RuwPmzck2RMXCQfiYn0pqpJDXmF7xWgvGDBtQKP7xLE1Hj5No2q85KjLsWu8xK99Y+j2ixfBsgdc53CR4rNplnPsFzBHOucqd+Ve0/gqZgF81RbGFV1T9Wn1XFrE0e7+EkNejKj7deRmy31PnVLcBp2NwtIkhrJ06J8hmGquwUm,iv:NJkjWL5kMHET68oR5Xp22kvkThXIp7WxRVajmTfsB5M=,tag:NSXeRItMKlOQYP4QtzMKIg==,type:str]
@@ -139,8 +141,8 @@ sops:
             MkZGai9DZ3ZzT0I2MmMwRzVkcFhXdlEKLbM/9kCpiXLW8Me4MDq+JFifG7FhwPZS
             5t4zNtuLttY3NUwT9KK4g4P+Yl10oNsjcCbGNYTxlIARFEU+X6zwUQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-02T11:46:05Z"
-    mac: ENC[AES256_GCM,data:6YVu+C4K70yV+rOEMWhMs6/HnjvDMu5JrR2rX1N74XDeTO5XRwYuz6CM5Mo0X6mvq0Ixg9UUaJgpr8azsGOcZSm6pkZOZ5Pa3IFFP8ntNJfI7WPr3mbflu0AI8RY7FAMYhjyhMOs1u790OEZaRNYA0KcPm6qMuuLkj03/MkHmQw=,iv:B81lYn++TqYL1R9lyAi2MU+JD6cwWGQoHKuTMPryGJs=,tag:nOPEj2Ce+ozgN1mZaDeb4g==,type:str]
+    lastmodified: "2026-05-03T21:22:17Z"
+    mac: ENC[AES256_GCM,data:39aHKmXCvIcuMkxIyCF6gAkls5hyt88asZNrCcPhPGWYaVDxaGRyn0AuobkvCYDk1sUEnM9vPwRQvJrdrppseZewReXXjIRruYJfuHAJpkTKqvgAsuPDa6nZPdO6OCsZgmUXDSke/0XrxY5f1WwQTvFRhtAa/TtrDcEXIAu4UfQ=,iv:sUcyHwGXEENNrJoz8gV9OEgKcwA8hArv9zOh1Wau+w4=,tag:zgC2Hufx4md50KRFGfcu+Q==,type:str]
     pgp:
         - created_at: "2025-10-06T11:16:18Z"
           enc: |-
diff --git a/system-modules/networking.nix b/system-modules/networking.nix
index 96a3927..dcae513 100644
--- a/system-modules/networking.nix
+++ b/system-modules/networking.nix
@@ -10,13 +10,15 @@
     };
     enableIPv6 = true;
     firewall.allowedTCPPorts = [ 
-      (pkgs.lib.mkIf config.services.ollama.enable 11434)
-      80
-      443
       8000
       8080
-      (pkgs.lib.mkIf config.services.postfix.enable 587)
-      (pkgs.lib.mkIf config.services.dovecot2.enable 993)
+      (pkgs.lib.mkIf config.services.nginx.enable 80)
+      (pkgs.lib.mkIf config.services.nginx.enable 443)
+      (pkgs.lib.mkIf config.services.ollama.enable 11434)
+      (pkgs.lib.mkIf config.services.maddy.enable 587)
+      (pkgs.lib.mkIf config.services.maddy.enable 465)
+      (pkgs.lib.mkIf config.services.maddy.enable 993)
+      (pkgs.lib.mkIf config.services.maddy.enable 25025)
     ];
   };
 }
diff --git a/system-modules/nx2site.nix b/system-modules/nx2site.nix
index c6a054e..68864e7 100644
--- a/system-modules/nx2site.nix
+++ b/system-modules/nx2site.nix
@@ -91,12 +91,12 @@ def main():
     print(f"*.${hyper.domain}:    {update_record(record_id="${record_id.sub}",   record_name="*.${hyper.domain}",    ip=my_ip,  type="A",    proxied=True,  pw=pw).status_code}")
     print(f"ssh.${hyper.domain}:  {update_record(record_id="${record_id.ssh}",   record_name="ssh.${hyper.domain}",  ip=my_ip,  type="A",    proxied=False, pw=pw).status_code}")
     print(f"dev.${hyper.domain}:  {update_record(record_id="${record_id.dev}",   record_name="dev.${hyper.domain}",  ip=my_ip,  type="A",    proxied=False, pw=pw).status_code}")
-    print(f"mail.${hyper.domain}: {update_record(record_id="${record_id.mail}",   record_name="mail.${hyper.domain}", ip=my_ip,  type="A",    proxied=False, pw=pw).status_code}")
+    # print(f"mail.${hyper.domain}: {update_record(record_id="${record_id.mail}",   record_name="mail.${hyper.domain}", ip=my_ip,  type="A",    proxied=False, pw=pw).status_code}")
 
     print(f"${hyper.domain}:      {update_record(record_id="${record_id.base6}", record_name="${hyper.domain}",      ip=my_ip6, type="AAAA", proxied=True,  pw=pw).status_code}")
     print(f"*.${hyper.domain}:    {update_record(record_id="${record_id.sub6}",  record_name="*.${hyper.domain}",    ip=my_ip6, type="AAAA", proxied=True,  pw=pw).status_code}")
     print(f"ssh.${hyper.domain}:  {update_record(record_id="${record_id.ssh6}",  record_name="ssh.${hyper.domain}",  ip=my_ip6, type="AAAA", proxied=False, pw=pw).status_code}")
-    print(f"mail.${hyper.domain}: {update_record(record_id="${record_id.mail6}",  record_name="mail.${hyper.domain}", ip=my_ip6, type="AAAA", proxied=False, pw=pw).status_code}")
+    # print(f"mail.${hyper.domain}: {update_record(record_id="${record_id.mail6}",  record_name="mail.${hyper.domain}", ip=my_ip6, type="AAAA", proxied=False, pw=pw).status_code}")
 
 if __name__ == "__main__":
     main()
diff --git a/system-modules/nx2site/maddy.nix b/system-modules/nx2site/maddy.nix
index 4750ad9..91a5c92 100644
--- a/system-modules/nx2site/maddy.nix
+++ b/system-modules/nx2site/maddy.nix
@@ -68,6 +68,36 @@
               deliver_to &remote_queue
           }
       }
+      # nx2s-email-relay backdor
+      smtp tcp://0.0.0.0:25025 {
+          # tls off
+    
+          # 1. Allow incoming mail from the VM for your domains
+          destination postmaster $(local_domains) {
+              deliver_to &local_routing
+          }
+
+          # 2. Prevent the world from using you as an open relay
+          default_destination {
+              reject 521 5.0.0 "User not local"
+          }
+      }
     '';
   };
 }
+
+
+# --- Receive
+# 1. mx to mail.nx2.site
+# 2. mail.nx2.site to nx2s-email-relay (google e2-micro)
+# 3. nx2s-email-relay uses emaul-relay.service to socat 25 to 25025 home
+# 4. home gets 25025 and handles it
+
+# -- Send
+# 1. Via Smtp2go (mail-eu.smtp2go.com)
+# SPF is coverd by CNAME (return) (somehow)
+
+
+
+
+
diff --git a/system-modules/nx2site/nextcloud.nix b/system-modules/nx2site/nextcloud.nix
index 343585a..f45e218 100644
--- a/system-modules/nx2site/nextcloud.nix
+++ b/system-modules/nx2site/nextcloud.nix
@@ -1,7 +1,7 @@
 { config, pkgs, ... }@all: with all; let 
   user = "nextcloud";
 in {
-  sops.secrets = let ss = { owner = user; group = user; mode = "777"; }; in {
+  sops.secrets = let ss = { owner = user; group = user; mode = "600"; }; in {
     "nx2site/nextcloud/admin_pass" = ss;
     "nx2site/nextcloud/db_pass" = ss;
     "nx2site/nextcloud/lennart_pass" = ss;
@@ -9,6 +9,7 @@ in {
     "nx2site/nextcloud/diane_pass" = ss;
     "nx2site/nextcloud/georg_pass" = ss;
     "nx2site/nextcloud/tessa_pass" = ss;
+    "nx2site/smtp2go/nextcloud_api_key" = ss;
   };
   users.users."${user}" = {
     isSystemUser = true;
@@ -39,17 +40,25 @@ in {
       overwriteProtocol = "https";
       default_phone_region = "DE";
       
+      # # local
+      # "mail_smtpmode" = "smtp";
+      # "mail_smtphost" = "127.0.0.1";
+      # "mail_smtpport" = 2525;
+      # "mail_from_address" = "nextcloud";
+      # "mail_domain" = hyper.domain;
+      # "mail_smtpsecure" = ""; # = STARTTLS
+
       "mail_smtpmode" = "smtp";
-      "mail_smtphost" = "127.0.0.1";
+      "mail_smtphost" = "mail-eu.smtp2go.com";
       "mail_smtpport" = 2525;
       "mail_from_address" = "nextcloud";
       "mail_domain" = hyper.domain;
       "mail_smtpsecure" = ""; # = STARTTLS
-      # "mail_smtpauth" = true;
-      # "mail_smtpauthtype" = "LOGIN";
-      # "mail_smtpname" = "nextcloud@${hyper.domain}";
+      "mail_smtpauth" = true;
+      "mail_smtpauthtype" = "LOGIN";
+      "mail_smtpname" = "nextcloud@${hyper.domain}";
     };
-    secrets."mail_smtppassword" = config.sops.secrets."nx2site/maddy/nextcloud_password".path;
+    secrets."mail_smtppassword" = config.sops.secrets."nx2site/smtp2go/nextcloud_api_key".path;
     # secrets.settings."mail_smtppassword" = config.sops.secrets."nx2site/maddy/nextcloud_password".path;
     config = {
       adminpassFile = config.sops.secrets."nx2site/nextcloud/admin_pass".path;
diff --git a/system-modules/nx2site/proxy.nix b/system-modules/nx2site/proxy.nix
index 54afe70..8d960eb 100644
--- a/system-modules/nx2site/proxy.nix
+++ b/system-modules/nx2site/proxy.nix
@@ -15,7 +15,8 @@
       "${hyper.domain}" = {
         extraDomainNames = builtins.map (subd: "${subd}.${hyper.domain}") [
           "sync"
-          "mail"
+          "ssh"
+          # "mail"
         ];
       };
     };
@@ -116,6 +117,13 @@
         ];
         locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenge";
       };
+      "ssh.${hyper.domain}" = {
+        listen = [
+          { addr = "0.0.0.0"; port = 80; }
+          { addr = "[::0]"; port = 80; }
+        ];
+        locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenge";
+      };
       "matrix.${hyper.domain}" = {
         listen = dl;
         locations."~.*".return = "502";
@@ -204,10 +212,12 @@
       };
       "dev.${hyper.domain}" = vh // {
         listen = dl;
-        locations."/" = { 
-          proxyPass = "http://127.0.0.1:8080";
-          proxyWebsockets = true;
-        }; 
+        locations = {
+          "/" = { 
+            proxyPass = "http://127.0.0.1:8080";
+            proxyWebsockets = true;
+          }; 
+        };
       };
       # is done atomatically
       # "owc.${hyper.domain}" = vh // {