{
  khscodes.infrastructure.vault-server-approle.policy = {
    "forgejo/data/mailserver/users/*" = {
      capabilities = [ "read" ];
    };
  };
  khscodes.services.vault-agent.templates = [
    {
      contents = ''
        {{- with secret "forgejo/data/mailserver/users/forgejo" -}}
        {{ .Data.data.hashed_password }}
        {{- end -}}
      '';
      destination = "/var/lib/vault-agent/mailserver/users/forgejo.passwd.hash";
      perms = "0600";
      owner = "rspamd";
      group = "rspamd";
      restartUnits = [
        "rspamd.service"
        "postfix.service"
      ];
    }
  ];
  khscodes.infrastructure.provisioning.pre.modules = [
    (
      { config, ... }:
      {
        terraform.required_providers.random = {
          source = "hashicorp/random";
          version = "3.7.2";
        };
        provider.random = { };

        resource.random_password.forgejo_mail_passwd = {
          length = 48;
          numeric = true;
          lower = true;
          upper = true;
          special = false;
        };

        resource.vault_kv_secret_v2.forgejo_email_user_password = {
          mount = config.khscodes.vault.output.mount.forgejo.path;
          name = "mailserver/users/forgejo";
          data_json = ''
            {
              "hashed_password": ''${ jsonencode(resource.random_password.forgejo_mail_passwd.bcrypt_hash) },
              "password": ''${ jsonencode(resource.random_password.forgejo_mail_passwd.result) }
            }
          '';
        };
      }
    )
  ];
}
