{
  khscodes.infrastructure.vault-server-approle.policy = {
    "mail.kaareskovgaard.net/data/users/*" = {
      capabilities = [ "read" ];
    };
  };
  khscodes.services.vault-agent.templates = [
    {
      contents = ''
        {{- with secret "mail.kaareskovgaard.net/data/users/test" -}}
        {{ .Data.data.hashed_password }}
        {{- end -}}
      '';
      destination = "/run/secret/mailserver/users/test.passwd.hash";
      perms = "0600";
      owner = "rspamd";
      group = "rspamd";
      restartUnits = [
        "rspamd.service"
        "postfix.service"
      ];
    }
  ];
  systemd.services.postfix = {
    unitConfig = {
      ConditionPathExists = [ "/run/secret/mailserver/users/test.passwd.hash" ];
    };
  };

  systemd.services.rspamd = {
    unitConfig = {
      ConditionPathExists = [ "/run/secret/mailserver/users/test.passwd.hash" ];
    };
  };
  khscodes.infrastructure.provisioning.pre.modules = [
    (
      { config, ... }:
      {
        terraform.required_providers.random = {
          source = "hashicorp/random";
          version = "3.7.2";
        };
        provider.random = { };

        resource.random_password.test = {
          length = 48;
          numeric = true;
          lower = true;
          upper = true;
          special = false;
        };

        resource.vault_kv_secret_v2.test = {
          mount = config.khscodes.vault.output.mount."mail.kaareskovgaard.net".path;
          name = "users/test";
          data_json = ''
            {
              "hashed_password": ''${ jsonencode(resource.random_password.test.bcrypt_hash) },
              "password": ''${ jsonencode(resource.random_password.test.result) }
            }
          '';
        };
      }
    )
  ];
  mailserver.loginAccounts = {
    "test@agerlin-skovgaard.dk" = {
      hashedPasswordFile = "/run/secret/mailserver/users/test.passwd.hash";
    };
  };
}
