# legacy-email-proxy: a cleartext POP3 (110) and SMTP (25) front end for the
# Psion's built-in mail client, forwarded to authenticated IMAPS/SMTPS.
#
# The package, the systemd unit and its hardening all live upstream
# (https://code.emmathe.dev/lyrathorpe/legacy-email-proxy); this host only
# enables the service and points it at the credentials.
{ inputs, ... }:
{
  imports = [ inputs.legacy-email-proxy.nixosModules.default ];

  services.legacy-email-proxy = {
    enable = true;

    # The listeners are unauthenticated and unencrypted by design, so the
    # firewall is what confines them: ppp0 is trusted, wlan0 is not, and 110/25
    # are never opened there (./serial-ppp.nix). They stay on the default
    # 0.0.0.0 rather than the PPP address because 10.0.0.1 exists only while
    # the Psion is plugged in, and a bind-time dependency on a serial cable is
    # a restart loop waiting to happen.

    # Backend hostnames and credentials. Kept out of the Nix store: created on
    # the device, root-owned 0600. See ../../docs/hosts/pizero2w.md.
    environmentFile = "/var/lib/legacy-email-proxy/backend.env";
  };
}