diff --git a/lib/data/default.nix b/lib/data/default.nix
index b20f7f70..bce9b510 100644
--- a/lib/data/default.nix
+++ b/lib/data/default.nix
@@ -1,5 +1,6 @@
 {
   data.hosts = builtins.fromTOML (builtins.readFile ./hosts.toml);
   data.services = builtins.fromTOML (builtins.readFile ./services.toml);
+  data.mail = builtins.fromTOML (builtins.readFile ./mail.toml);
   data.tsNet = "coelacanth-dragon.ts.net";
 }
diff --git a/lib/data/mail.toml b/lib/data/mail.toml
new file mode 100644
index 00000000..93c7932c
--- /dev/null
+++ b/lib/data/mail.toml
@@ -0,0 +1,10 @@
+extUrl = "mail.pyrox.dev"
+extIPs = ["5.161.140.5", "2a01:4ff:f0:98bf:0:0:0:1"]
+# internal port is 40k+real mail port
+intSMTP = 40587
+intSMTPS = 40465
+intIMAP = 40143
+intIMAPS = 40993
+intManageSieve = 44190
+intHTTPS = 40443
+intHTTP = 40080
diff --git a/systems/x86_64-linux/prefect/default.nix b/systems/x86_64-linux/prefect/default.nix
index 0fad2842..4c60bbcc 100644
--- a/systems/x86_64-linux/prefect/default.nix
+++ b/systems/x86_64-linux/prefect/default.nix
@@ -19,6 +19,7 @@
     ./services/fail2ban.nix
     # ./services/headscale.nix
     ./services/mailserver
+    ./services/mailserver/stalwart
     # ./services/netdata.nix
     ./services/nginx
     ./services/prometheus.nix
diff --git a/systems/x86_64-linux/prefect/firewall.nix b/systems/x86_64-linux/prefect/firewall.nix
index 80e56ae1..f821ff16 100644
--- a/systems/x86_64-linux/prefect/firewall.nix
+++ b/systems/x86_64-linux/prefect/firewall.nix
@@ -14,10 +14,12 @@
       636
       993
       4130
+      4190
       6900
       8000
     ];
     allowedUDPPorts = [
+      80
       636
       4367
       6900
diff --git a/systems/x86_64-linux/prefect/secrets/secrets.nix b/systems/x86_64-linux/prefect/secrets/secrets.nix
index d029961e..b00a8297 100644
--- a/systems/x86_64-linux/prefect/secrets/secrets.nix
+++ b/systems/x86_64-linux/prefect/secrets/secrets.nix
@@ -32,4 +32,14 @@ in
     yubi-main
     yubi-back
   ];
+  "stalwart-secret-rsa.age".publicKeys = [
+    prefect
+    yubi-main
+    yubi-back
+  ];
+  "stalwart-secret-ed25519.age".publicKeys = [
+    prefect
+    yubi-main
+    yubi-back
+  ];
 }
diff --git a/systems/x86_64-linux/prefect/secrets/stalwart-secret-ed25519.age b/systems/x86_64-linux/prefect/secrets/stalwart-secret-ed25519.age
new file mode 100644
index 00000000..196e32c9
--- /dev/null
+++ b/systems/x86_64-linux/prefect/secrets/stalwart-secret-ed25519.age
@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 LcWOqQ iqNMs1zctbP+bDdN4c3RGhckhCvrTPJbcTHUQnu88ko
+x5T5SxnBpMRgAHbYY1YU0Yy7XVlGRZ2WnM7ICDFmjbE
+-> ssh-ed25519 ihSg8g g0enzjgGoNx7kHNuq7lSys3G3MeQeusWuRZ0oIrP0UE
+V6mXoy2LFKubv4f1Fwa0Wx15D7OI3FWeBovhDcuGaMQ
+-> ssh-rsa fFaiTA
+b9TNMiCUmYELGyGF5YzGR6KOA1w6dUteVArMlg1ZPn1HW2W/wrhhAEmTN/hAnEPR
+9AFTDJupQ/6aacyIUnQlkXjI7QZeVbKXJ39VHva1rTXCamAKAAjVBdzcLtEbl4Z5
+iZuv6bEDcggZ1/4PmvmMtH5ljkGZWmbRSXwSqn0xF2P9VY4QMVK86WWpobk+St1X
+EQqEDiGrPtgwHMCOfL1wb7lZD6t2wwMlRfnTee/5qDWTSDme6QYPsAFmJOpQGCYT
+BOQOlZegH/KCl7qai8qBOKwEWTVMbyblihCp4vaVTgpkOiHO6PM1HS4JrXMZJeDr
+30m8oeGT7/PoO14tWZvU2jCWGO/M6tiiif5I+cOymFnGCxmHPpuO/+GPOQ+f4bKb
+zw5hh6Bqpj9bp6QoTLfzzKnrpSk/n26e89nejha0iLDwP+QQyZZos9vss3B6Fkmu
+bZUuifW7eSuI7Y7l4RkuvCOEIJf+vkW7bF0e1BDpd6n5B9Jp/c5ghvWzgoyCyDud
+1Xf0UxiFM90AUR8ml3QtclaRewfMr/b69qgR2olwBVrctjC/CSXAJC3bih6LZLdA
+nKHWyqWjWfsxCPWZUmFHMcu1ogFVsnlEdr+UoYCN1oXMwZfgxQnkfLFfcLZFW3+a
+JeXgm10wb2+DpmltSi7fLgQOB5462VQ+SvnFFwWFRN8
+--- xB0nATcSCPeSRGpbNMeSuUCJ3rxQhruXmqczOcTvMj0
+�EՊ�[�7]COII�IU[1�:?�wfq�;m�+%9�������d}ՈQ!y
�����IVz;`�᭹�33L ;�Z� ���J�

kҕW<W,f2������"V������G<�q'0*���~!�7��&�
�-��i�e�e�'�^
\ No newline at end of file
diff --git a/systems/x86_64-linux/prefect/secrets/stalwart-secret-rsa.age b/systems/x86_64-linux/prefect/secrets/stalwart-secret-rsa.age
new file mode 100644
index 0000000000000000000000000000000000000000..202c8b7ea9782f415b3ec528ca02a3312bb3bf08
GIT binary patch
literal 4305
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUlNe=ff3{-HnEJ&`b
zEcY$S4GIk|$qVw$bIQnw@GUCN_pr>&jS37jv2-iXEX;Q`HsQ(&H>yYrbqu!*E(rB>
zjEeAea`ua=@+e3w3v<s)H_!7Z%S<tkD0KEMiA1+8Gb1?NB3&WV$Rw&Tv(&r7#H-9H
zD9qH~(kMMOD$&5#($O+KEyXl2)GgV~CA`elDVZy;Brzu>CD5_JvnZ;n$|TgqDWtqe
zKO@*Zthg$#s>(OQC9$l`Kd;cd+yG`<QE{R|np<LKh$C0IOJGT1j*D}$b9QA!gtk*w
zhLd?<fmxVSq-jNQM3r+vK~%PZb9ky{UQ&2)UWrqhnYK%=k$<RDkYz=-zF{$!OPFs!
ziHTFWXINCGzms9QV~AUUzP4XzcCv{<RJm_zs(!G3np1hQVR}`0q=|PyNqDAdM0sRc
zMtZVYVMbXXS6-A`j<ZimX;o@&c5aluX>Lxoe^H2sTW)D+M4~}xs#!!{P>GALk%vcW
zMns`!L0OVhSW;1Fq;Yv@S+bc=5?4V+X;ndShOtYOYejZxKzNZ`xpq)cxnEvnRza#q
zVqs8LMP*`DS(#UaPo`zMUu9ZIseZDrw_#+FM{a4Uu^CsGn|5WOzi&{kWuQ||p1yNx
zuy<f;MQ*5vd3b<_cZjQ(sj0uaQ--TyKw79#QgT#Uc|>?(V5V1To{6KYqd_uPN`a@p
zPkOR{xw~UXfnlI|iIaa)s#kh$ma}KDzfV+lN>Wm=MM{Wsa;bS*k-14uNvXd<KzdfD
zlTVdlu%$s7S582IaiB+8fl)wWgsZtrcA9fQWlBZ3Z+1w5i*uQ|VTDtMk%zlqS$3ko
zS9(rHak7zNU~pb(dPufMmXC8m3Rgg-nTctJf0lk!MV@g;kyCDAfO%P9ps9YDeqv5x
zQB`DqMR}5iS(1f8gno)=g<FzGx_@DQhF3&hzE?zXurHT^X_;lNMPWptMU|0zwwb$g
zVNi~DVVI$_UrL!vfVq=)VNq6&c~YiVm2+aMcY(flWPWgEctm2kd5(UVTWT6tV3eu0
zUuv0tL`aoWX^yd1Vo_#bhF^NPnSPaHVW?kNczIfKu7^>XzPq2Pn`N<=X}C$cSx#PZ
zxLI0pSf)V%mw~%+xl^G@k)u(tUu0o%R*rE<W@J%PK~<<(sArCTxpA6XRhXZCR6$ra
zm#(g^LPb!iSE@&@vq6zldALP>kXu2JUrB1dS(#s8c$TYIes+d`lyRhwfq8O1*FBGE
zSLVF_`Z9TCZmDfC?~zvr1U{9k{%FbDFzLiGl`k7M%dN0vaoDhQzjyM)<I+)VH_P8v
zS<kS27{fnHP(9SK$Yw!B_gj~lM+)v=^5v~}$z^de;t6D8Ec-b#yk={_-q@cTRJ)vS
zPuXNCfBgHhtE)JCY$Dc&9iOT7FHX(D^i_(ajnb81!A<YInQuM+C~Mhao_bqz{_Y;B
zfUOgie_6K*cnj^*|Fgo;^v3`7F$Qw^U)lv93l~JJT+?}LGON@)y{P3%8S0b7^AF7z
zE`Gb*GM(L@y-T1;s&10q8n%chalcoD$1FOKvP*5_cCOtX3^L1`9aKNHZe5!ty7;V7
z>z*U!oA+4ESk1rRGkF&CE4FFV`i|sH=ZxPf?#KB;pQY1UtSas`+Z3T~pZ4<3J>DVt
zxxaq7M;l{GL(@6-2VyVw+<U@gA0xkWN|R;KQKzck$xHhs3VO>_R?XYieqHF|RA%#k
z6D==waym!<3Q2SPvm>v^TL0hvm#h)fH`%|PbGVRyR!mWnC#Nx6{^HE_>iZ?F?dRP+
zv%>2E;|8<KI~D}LjhUbrx#Ry2tIwHS`@)|@F1J4Xr1oo;Etj8U^o-aynJEQtmj13v
zd3sT&rpI*ihlxCMoBE?yr_V3Wzn*1ycG_oA=l(@+I~ubl%uL%PGi}GK4@!q@)+<JL
zzI%7bb*tzU@7<!3Q%W8w%~o*l-JDYLQQF@!t@HL>)_Ze5{ykB=RBq<~(t{qsvyW}g
zsSUeO5Wl^B`uwAh53Q*%bv0!^-Q`nhFtM{x_y14%^;L|nY(2MsU2L^!ZrHu*GIMJ6
z!S+@)&7cpxu4mKc9{FOqW~*(O(*4!3ckF)gzF@OdH8>Hp<Y8L*Ypq-1p0Z2!ooSzV
z@%O3SyLw+N>rI+AMb&SDcVN<oM+;~6y^frr$=c0m;ga`v;*DL`-fpOP+I-UM;vUm$
zajP#(7x0-g_r$Lkev*Rs4$gPxu8(Xw8hlyf4C}L<oCyi5IR1HmmF~N@LC3W9j_9vt
zdQY<Qsv7v_OgcVKS8{%S;Wf^mJ(njiO0Jm`nd1@aa`@Y{Pa*%Gw#*cFG;^)G@VxeV
zOk`Knq$>;ep8ejp>=uJ>RLS1Z<560hbi~&*9zL<)wx@|~>k5s1KL6KF+a>+0G?QDd
zPWSk)3pZxAb>AqoI#9E!*{qsV%}bR>Mq60)=!z-neb+zdZq%Q1Bt@%P<(2+ofkj3f
znX@a4HXbugs(*Tpb@Otb=QotBPS5<a)j-~H*Nu-#KeGzs?4mfXoW655{)Acx%ieE}
zDa&>3!?hi*dz6=N53aRfJ-jR2clCvxuXJDEva|ZL+o0?ISN~(b#IEZ#75ul(F}kp$
z>|OtPPchR~&YN`P7|OY3M;%zO<mB?gRRudFJfi<Le|y|IX?x5Z4_1f2;%n7Xciv7}
z6>=yi>%z0@b#+bUPagc_YX1BsG|z!|YF|*iT;T+<*xe_*zE3S*6mGtl?dPk|-!;d(
zH6k~cUHji#E9hk|Q?PWhg6{H)KL2`O6R!gk)Rh7@Hss%!z51k~b*)a~f6uzDOAdvL
z7)i>eow?|h@;UW8yL{k*zZ+&VK1`Z0du#s0cDZXQlO7x2nR>)(ou_8thF_7D53=W<
zm^|r3)lchYt0NMtW2cJGo1)NSmzV2Ql3Ksj@WL~hFDw6ValIA8elS|KOIn2|__e!G
z>PBaW^XJ^|$EF$GJM-gE`tf@H_^=J{?;iVBl6Ss$a-)h>2LG;OoLtA|@;5A!xp*VA
zg5lYvgTI#fP1`)JMMf#B&t}VE%i!Fp;cf0>K7ER2vG2n*X3u5aTc?>}*O|!__q=~W
zrhx5TW0PO}M{Pc^a-F%(>dtXN_VSGrHu)3h+)4Pbs_)1DJ!S_Lu6A`Fy)5IAk$=Mc
z`-g|qe_WW*c*-iT>c-`i<)%?RTN59P-rqOv@X_VX9@5TcZ{{_!tWjC0(fW7aB9BeM
z2RWxcINfNXf0cpzvEw$sf9?Eox-)NaPJF%V)z%OTv3S>~_c`-p-mTN**`oh*&f#Un
zT}z%En*ZeK*Jftk2-jert7)yNOf?m(k;Z-M8E(#|OqJ)gB<IXHcVX`}VfKd{XRfDx
zD%q7kJ<o4Vp^oh4dLGj=uO{y1EH>>qX7cd&%alv^ET?&fn{l=MDpL5;b&bh4YPkqs
z8|S(heTnJH#cb2;CUf;>n0MFb&O3Rz>&f3XP5&hEqoNC6OxID^nHKWrOik_F60WJ!
z3@!#%3BS^4Jh^Al%ztOMRpu}_D;!8j64^4VZQ@kNg&*c+&ny*Qw9YMj{b~u<*M)48
zEgDv_Fuc%s{&)9_$}|h-Z;D9|6JrhhHvI~Uz20VVAi{k2=l=(fIOMnpY)P~HyXdv$
zl^>a}S@gH@Cvhz*^zU;!7q4TI7OZ2w+y3cn2FZzDUVct{-l+SjK0Z?2r!c4Yl$TXW
z_=NAWrc&lShDPzz&%Qcsmvs6Cx9OP+>LLX{wx7#fzBeUQpuctc?Z3IdD$8fTsJLNn
zw{O!*4aK`|wthFyh<|t`t+c_^c>R;j9|9BDCv9VR*uV3GZ_n%BeQv*aJ4L-ewEanG
ze^z<x^xVBor(+}^E;#ygXYptM;A0Uir&Q#t*I2wWonXruJ=Nvob{%d7F&Be1;(OZd
zUr0GlS-Qgff0*lZ-P0dq-!6>3#BCS5uI^UKUbjCtZg;#|<$1x#^ZVBLy<0Z(1k^s+
zaqH3H>AdxpW$&^Se)qjC^>{lk|Fcl}yDyinP0umZYT0JdQ24}s&7Z4=jF~q%gi4Z}
z_nw@UH6gNVx9RSgFYmqNe301xT9J9FLTJn3I|`w;DhUducd8Zyn+v^3oZ`Q;`K!_A
z1#@m2p1R~G#kSnUO55O2v-2c|A9e;;;w9fjmbpz>y2^iE;oZ+&qOoi%XHSl@+P|Dj
z+((bAe4=|fm+8TW6ScP7(|*5i_n{k1zbl>>PDz=RWno!(&gbyKdB=qrUY`$UmlBuQ
zUp_l6qJ(`7r_rRjmsi!4FJh~H-~9aGL5?TZmWgbedTpH-eA41wq<p(2?1z2ZuAk;v
zU&Zn-9AthmBYCg*PbI&@<~s!5`!open)c;*Q|q(rxZ9ntZmKo-Dzj?z-99SP)F^&v
z&jQ7H+*vy|{<!x(tCi_~XlkLszQ^01$mg92_LVn1yea$4=5&d_hU@*MZiSx?6_9o@
z`n8ueRb=kEiero_L6tuWl54ai<{Iv*otjs2gD0`JNBQu<1)HQE>HJ`0bc##1b`HFK
zsweQhh##}v6?>0!v0Nr|PcuCIKPlbZD=+&(xZ;-W^X$CWf2fVx&3d7|#fQ0bi>57)
z#OzQh?e=55)jR4!{A;tCkF#Iwvz@7<@^?mKcEl~C-)kP4_sfV~x|{c5)q6$rSBE}K
zy==!cA!lkt>GXzpW1jZMr)#<IuX-$yzN)`WsQGn%^_NYRd-Bdc+FZZtqUN^)7FTNJ
z++UoE%f7GTztxlPa9U-Tb7=d_+WH=yH*R<Cs^5I2Z~Hs{NXgRk$8{_`QUi5dr#!rE
zzN_bj%lU&71LI!a<C(-c|C%RbxkMVz<D_4Q?Ml>FOO*G>B%O>YoaA1>{n>Apx0%BN
zX#*B<MGlX+iO1boE`Pgf*!*qBZFg_mW}WvnT?U5LVR8q8x^5nC^eYulIBK!oC~p4^
zj{|RHCKgWAKD_FAlKAf;Zd3l}49c_m{#MoReHwKB;OfhhZ=PIyC!Qn7c!6wItmTRa
z_jP-Zzg~D)hrd6ITi~e60n?2^0tMBtEOy=fZ?R8Hk3s+N>RH!x3o@Rr-+kh!>go-3
zj~zBgSz4A(Q2Q}6eFx8pwsZ2C_xAOO9Eo+bI2V$?T`^mwNIjPCTkSzH@g+~sZTvJp
zBK=5W@!eC)($Wi)l9gAUan(&)e<!eO*Q#F%iQc!$h3;!>Y|ZDMmy?-r<%h<N2$P@2
z7IS|@i@a5g*}G!V7J;~j7oYq);F+eqFyf}y1p%E;T<?o2#6*5B=swn_SLN4m<Fyd~
zr*5}{ohM~$g=9+#KBri<oC)9H;P)(VLP4g=-^9JlhN4T4D9gU7kGy-VV+Wu5^=FG!
zv^GzimUQI!CD{Y^0oiMfZD$|<zj5=A%#w)tzAvX5G^>4CK6Rt=PB+aJJerfwba-#F
zaGkaIkgcpyiHpp|A1@boUy+Vj%<O8lm*vqaPd^d+*H^EG^W4mTaeht5>BwJvim6+D
zTyLGKJ-lgYE^p<LIjx_rJlJ)O`~DH$m3Q<0?%)2!;<>%U<BESzUYkeW*!II%_rJ4M
z@~M{<lTWz4dFW8!l_c^)dfN4!N8758m%sNp)jDH(<V&xB>03M&Xha-y+b;0=?80!B
zfC`8I=hl^qv+eTf)DT*rpv-P7vGMY>rlg9)GcVVzXe#^L;4FH5`@BvTE5_#9l{c<W
z^4K4>WMyOPsxU8=a|>7=7HkThW5h1rc=+&?>PdG`<fU#ll@u*MaWnD;V@9g(3=!sE
zPN_?Bk|n1ssrg-HBG>7WyLji#-yWhSmB)-ypRC$*)+$8xZumkErA5*HfB*Yk0RWE)
Bx^@5n

literal 0
HcmV?d00001

diff --git a/systems/x86_64-linux/prefect/services/caddy.nix b/systems/x86_64-linux/prefect/services/caddy.nix
index eb07bb84..af6b28bc 100644
--- a/systems/x86_64-linux/prefect/services/caddy.nix
+++ b/systems/x86_64-linux/prefect/services/caddy.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, ... }:
 let
   pns = lib.py.data.services;
-  # mail = lib.py.data.mail;
+  mail = lib.py.data.mail;
   marvin = "http://${lib.py.data.hosts.marvin.ts.ip4}";
   marvinIP = lib.py.data.hosts.marvin.ts.ip4;
   tsNet = lib.py.data.tsNet;
@@ -118,20 +118,6 @@ in
         '';
       };
 
-      # MTA-STS Setup for mailserver
-      "mta-sts.pyrox.dev" = {
-        extraConfig = ''
-          header Content-Type text/plain; charset=utf-8
-          respond /.well-known/mta-sts.txt <<END
-              version: STSv1
-              mode: enforce
-              mx: mail.pyrox.dev
-              mx:mail2.pyrox.dev
-              max_age: 2419200
-              END 200
-        '';
-      };
-
       # Yourmother.website
       "yourmother.website" = {
         extraConfig = ''
@@ -271,11 +257,22 @@ in
           reverse_proxy ${marvin}:${toString pns.pinchflat.port}
         '';
       };
-      # "mail.pyrox.dev:80" = {
-      #   extraConfig = ''
-      #     reverse_proxy ${marvin}:${mail.intHTTP}
-      #   '';
-      # };
+
+      "http://mail.pyrox.dev" = {
+        serverAliases = [
+          "http://mta-sts.pyrox.dev"
+          "http://autodiscover.pyrox.dev"
+          "http://autoconfig.pyrox.dev"
+        ];
+        extraConfig = ''
+          reverse_proxy 127.0.0.1:${toString mail.intHTTP} {
+            transport http {
+              proxy_protocol v2
+            }
+          }
+
+        '';
+      };
     };
     # Mail Config
     globalConfig = ''
@@ -283,44 +280,98 @@ in
         ref refs/heads/pages
         refresh_period 10m
       }
+      servers :80 {
+        listener_wrappers {
+          layer4 {
+            @maildomains http host mail.pyrox.dev mta-sts.pyrox.dev autoconfig.pyrox.dev autodiscover.pyrox.dev
+            route @maildomains {
+              subroute {
+                @a http
+                route @a {
+                  proxy {
+                    proxy_protocol v2
+                    upstream 127.0.0.1:${toString mail.intHTTP}
+                  }
+                }
+              }
+            }
+          }
+          http_redirect
+        }
+      }
+      servers :443 {
+        listener_wrappers {
+          layer4 {
+            @maildomains tls sni mail.pyrox.dev mta-sts.pyrox.dev autoconfig.pyrox.dev autodiscover.pyrox.dev
+            route @maildomains {
+              proxy {
+                proxy_protocol v2
+                upstream 127.0.0.1:${toString mail.intHTTPS}
+              }
+            }
+          }
+          tls
+        }
+      }
       layer4 {
         :22 {
           @a ssh
           route @a {
-            proxy ${marvinIP}:2222
+            proxy {
+              upstream ${marvinIP}:2222
+            }
+          }
+        }
+        :2025 {
+          route {
+            proxy {
+              proxy_protocol v2
+              upstream 127.0.0.1:40025
+            }
+          }
+        }
+        :2143 {
+          route {
+            proxy {
+              proxy_protocol v2
+              upstream 127.0.0.1:${toString mail.intIMAP}
+            }
+          }
+        }
+        :2465 {
+          route {
+            proxy {
+              proxy_protocol v2
+              upstream 127.0.0.1:${toString mail.intSMTPS}
+            }
+          }
+        }
+        :2587 {
+          route {
+            proxy {
+              proxy_protocol v2
+              upstream 127.0.0.1:${toString mail.intSMTP}
+            }
+          }
+        }
+        :2993 {
+          route {
+            proxy {
+              proxy_protocol v2
+              upstream 127.0.0.1:${toString mail.intIMAPS}
+            }
+          }
+        }
+        :24190 {
+          route {
+            proxy {
+              proxy_protocol v2
+              upstream 127.0.0.1:${toString mail.intManageSieve}
+            }
           }
         }
       }
     '';
-    # TODO: Move the below section to global options once stalwart is working
-    # extraConfig = ''
-    #   layer4 {
-    #     0.0.0.0:465 {
-    #       route {
-    #         proxy {
-    #           proxy_protocol v2
-    #           upstream ${marvinIP}:mail.intSMTPS}
-    #         }
-    #       }
-    #     }
-    #     0.0.0.0:993 {
-    #       route {
-    #         proxy {
-    #           proxy_protocol v2
-    #           upstream ${marvinIP}:mail.intIMAPS}
-    #         }
-    #       }
-    #     }
-    #     0.0.0.0:4190 {
-    #       route {
-    #         proxy {
-    #           proxy_protocol v2
-    #           upstream ${marvinIP}:mail.intManageSieve}
-    #         }
-    #       }
-    #     }
-    #   }
-    # '';
   };
   systemd.services.caddy.serviceConfig.CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
   systemd.services.caddy.serviceConfig.AmbientCapabilities = "CAP_NET_BIND_SERVICE";
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix
new file mode 100644
index 00000000..6e7ed064
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix
@@ -0,0 +1,17 @@
+{ cfg }:
+{
+  letsencrypt = {
+    directory = "https://acme-staging-v02.api.letsencrypt.org/directory";
+    challenge = "http-01";
+    contact = [ "pyrox@pyrox.dev" ];
+    domains = [
+      "mail.pyrox.dev"
+      "mta-sts.pyrox.dev"
+      "autoconfig.pyrox.dev"
+      "autodiscover.pyrox.dev"
+    ];
+    cache = "${cfg.dataDir}/acme/certs";
+    renew-before = "30d";
+    default = true;
+  };
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/auth.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/auth.nix
new file mode 100644
index 00000000..0ef38174
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/auth.nix
@@ -0,0 +1,22 @@
+{ ifThen, otherwise }:
+let
+  relVer = [
+    (ifThen "listener = 'smtp'" "relaxed")
+    (otherwise "disable")
+  ];
+in
+{
+  dkim = {
+    sign = [
+      (ifThen "sender_domain = 'pyrox.dev'" "'rsa'")
+      (ifThen "sender_domain = 'pyrox.dev'" "'ed25519'")
+      (otherwise false)
+    ];
+  };
+  spf.verify.ehlo = relVer;
+  spf.verify.mail-from = relVer;
+  dmarc.verify = relVer;
+  iprev.verify = relVer;
+  arc.seal = "'ed25519'";
+  arc.verify = "relaxed";
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/auto-ban.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/auto-ban.nix
new file mode 100644
index 00000000..e9d13c26
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/auto-ban.nix
@@ -0,0 +1,25 @@
+# Strict Auto-ban
+# https://stalw.art/docs/server/auto-ban
+{
+  auth.rate = "15/1d";
+  abuse.rate = "15/1d";
+  loiter.rate = "15/1d";
+  scan = {
+    rate = "20/1d";
+    paths = [
+      "*.php*"
+      "*.cgi*"
+      "*.asp*"
+      "*/wp-*"
+      "*/php*"
+      "*/cgi-bin*"
+      "*xmlrpc*"
+      "*../*"
+      "*/..*"
+      "*joomla*"
+      "*wordpress*"
+      "*drupal*"
+      "/.git*"
+    ];
+  };
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/calendar.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/calendar.nix
new file mode 100644
index 00000000..43244bef
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/calendar.nix
@@ -0,0 +1,25 @@
+# Calendar settings
+# https://stalw.art/docs/collaboration/calendar
+{
+  max-recurrence-expansions = 2048;
+  # 512 KiB
+  max-size = 524288;
+  max-attendees-per-instance = 20;
+  default.href-name = "default";
+  default.display-name = "Personal";
+  # Scheduling
+  # https://stalw.art/docs/collaboration/scheduling
+  scheduling.enable = true;
+  # 1 MiB
+  scheduling.inbound.max-size = 1048576;
+  scheduling.outbound.max-recipients = 100;
+  scheduling.inbox.auto-expunge = "30d";
+  scheduling.http-rsvp.enable = true;
+  scheduling.http-rsvp.expiration = "7d";
+  # Notifications
+  # https://stalw.art/docs/collaboration/notifications
+  alarms.enable = true;
+  alarms.minimum-interval = "1h";
+  alarms.from.name = "PyroNet Calendars";
+  alarms.from.email = "calendar-notifs@pyrox.dev";
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix
new file mode 100644
index 00000000..86aa61e7
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix
@@ -0,0 +1,181 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  d = lib.py.data.mail;
+  cfg = config.services.stalwart-mail;
+  sec = config.age.secrets;
+  creds = config.services.stalwart-mail.credentials;
+  isAuthenticated = d: {
+    "if" = "!is_empty(authenticated_as)";
+    "then" = d;
+  };
+  otherwise = d: {
+    "else" = d;
+  };
+  ifThen = f: d: {
+    "if" = f;
+    "then" = d;
+  };
+  smSecret = {
+    owner = "stalwart-mail";
+    group = "stalwart-mail";
+  };
+in
+{
+  services.stalwart-mail = {
+    enable = true;
+    dataDir = "/var/lib/stalwart";
+    credentials = {
+      rsa_private_key = sec.stalwart-secret-rsa.path;
+      ed25519_private_key = sec.stalwart-secret-ed25519.path;
+    };
+    settings = {
+      tracer.stdout.level = "debug";
+      config = {
+        local-keys = [
+          "acme.*"
+          "asn.*"
+          "auth.*"
+          "authentication.*"
+          "auto-ban.*"
+          "calendar.*"
+          "certificate.*"
+          "changes.*"
+          "cluster.*"
+          "config.*"
+          "contacts.*"
+          "directory.*"
+          "http.*"
+          "imap.*"
+          "jmap.*"
+          "queue.*"
+          "report.*"
+          "resolver.*"
+          "server.*"
+          "session.*"
+          "storage.*"
+          "store.*"
+          "tracer.*"
+          "webadmin.*"
+          "form.*"
+          "email.*"
+          "spam-filter.*"
+        ];
+      };
+      server = import ./server.nix { inherit d; };
+      # ACME for certs, using TLS-ALPN-01 Challenges(one fewer ports open)
+      # https://stalw.art/docs/server/tls/acme/configuration
+      acme = import ./acme.nix { inherit cfg; };
+      # HTTP Configuration
+      # https://stalw.art/docs/http/overview
+      http = {
+        url = "'https://${d.extUrl}'";
+        hsts = true;
+      };
+      # Disable HTTP Forms submission
+      # https://stalw.art/docs/http/form-submission
+      form.enable = false;
+      # Storage Settings
+      # https://stalw.art/docs/storage/overview
+      store = {
+        data = {
+          type = "rocksdb";
+          path = "${cfg.dataDir}/db";
+          purge.frequency = "0 3 *";
+        };
+        blob = {
+          type = "fs";
+          path = "${cfg.dataDir}/blobs";
+          depth = 2;
+          compression = "lz4";
+          purge.frequency = "0 4 *";
+        };
+        db.path = "${cfg.dataDir}/db2";
+      };
+      storage = {
+        data = "data";
+        blob = "blob";
+        fts = "data";
+        lookup = "data";
+        directory = "default";
+      };
+      directory = {
+        default = {
+          type = "internal";
+          store = "data";
+        };
+      };
+      # ASN/GeoIP Lookups
+      # https://stalw.art/docs/server/asn
+      asn = {
+        type = "dns";
+        separator = "|";
+        zone.ipv4 = "origin.asn.cymru.com";
+        zone.ipv6 = "origin6.asn.cymru.com";
+        index.asn = 0;
+        index.asn-name = 1;
+        index.country = 2;
+      };
+      auto-ban = import ./auto-ban.nix;
+      # JMAP Settings
+      # https://stalw.art/docs/email/jmap
+      jmap = {
+        mailbox.max-depth = 10;
+        mailbox.max-name-length = 255;
+        # 50 MB
+        email.max-attachment-size = 50 * 1000 * 1000;
+        # 75 MB
+        email.max-size = 75 * 1000 * 1000;
+        email.parse.max-items = 10;
+      };
+      imap = import ./imap.nix;
+      # Maintainance
+      # https://stalw.art/docs/email/maintenance
+      email.auto-expunge = "180d";
+      changes.max-history = 10000;
+      session = import ./session.nix { inherit isAuthenticated otherwise; };
+      queue = import ./queue.nix { inherit d ifThen otherwise; };
+      # DNS Settings
+      # https://stalw.art/docs/mta/outbound/dns
+      resolver = {
+        custom = [
+          "tls://dns11.quad9.net"
+          "tcp://1.1.1.1"
+        ];
+        concurrency = 2;
+        preserve-intermediates = true;
+        timeout = "5s";
+        attempts = 3;
+        edns = true;
+      };
+      report = import ./report.nix { inherit d; };
+      calendar = import ./calendar.nix;
+      # Authentication
+      auth = import ./auth.nix { inherit ifThen otherwise; };
+      # Contacts
+      # https://stalw.art/docs/collaboration/contact
+      contacts = {
+        # 512 KiB
+        max-size = 524288;
+        default.href-name = "default";
+        default.display-name = "Contacts";
+      };
+      # Spam Filtering
+      # https://stalw.art/docs/spamfilter/overview
+      spam-filter = {
+        card-is-ham = true;
+      };
+    };
+  };
+  age.secrets = {
+    stalwart-secret-rsa = smSecret // {
+      file = ../../../secrets/stalwart-secret-rsa.age;
+    };
+    stalwart-secret-ed25519 = smSecret // {
+      file = ../../../secrets/stalwart-secret-ed25519.age;
+    };
+  };
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/imap.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/imap.nix
new file mode 100644
index 00000000..9741a0b8
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/imap.nix
@@ -0,0 +1,42 @@
+# https://stalw.art/docs/email/imap
+{
+  # 50 MiB
+  request.max-size = 52428800;
+  auth.max-failures = 3;
+  auth.allow-plain-text = false;
+  folders =
+    let
+      folder = {
+        create = true;
+        subscribe = true;
+      };
+    in
+    {
+      inbox = folder // {
+        name = "Inbox";
+      };
+      drafts = folder // {
+        name = "Drafts";
+      };
+      sent = folder // {
+        name = "Sent";
+      };
+      trash = folder // {
+        name = "Trash";
+      };
+      archive = folder // {
+        name = "Archive";
+      };
+      junk = folder // {
+        name = "Junk";
+      };
+      shared = {
+        name = "Shared Folders";
+        create = true;
+        subscribe = false;
+      };
+    };
+  timeout.authenticated = "30m";
+  timeout.anonymous = "1m";
+  timeout.idle = "30m";
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/queue.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/queue.nix
new file mode 100644
index 00000000..80bb1b6e
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/queue.nix
@@ -0,0 +1,97 @@
+{
+  d,
+  ifThen,
+  otherwise,
+}:
+# Queue Management
+# https://stalw.art/docs/mta/outbound/overview
+{
+  # Virtual Queues
+  # https://stalw.art/docs/mta/outbound/queue
+  virtual.default.threads-per-node = 100;
+  virtual.admin.threads-per-node = 10;
+  virtual.local.threads-per-node = 100;
+  # Schedules
+  # https://stalw.art/docs/mta/outbound/schedule
+  schedule =
+    let
+      queue = {
+        retry = [
+          "1m"
+          "2m"
+          "5m"
+          "10m"
+          "15m"
+          "30m"
+          "1h"
+          "2h"
+        ];
+        notify = [
+          "1d"
+          "3d"
+        ];
+        max-attempts = 15;
+      };
+    in
+    {
+      default = queue // {
+        queue-name = "default";
+      };
+      admin = queue // {
+        queue-name = "admin";
+      };
+      local = queue // {
+        queue-name = "local";
+      };
+    };
+  # Routes
+  # https://stalw.art/docs/mta/outbound/routing
+  route = {
+    local.type = "local";
+    remote = {
+      type = "mx";
+      ip-lookup = "ipv6_then_ipv4";
+      tls.implicit = false;
+      tls.allow-invalid-certs = false;
+    };
+  };
+  # Strategies
+  # https://stalw.art/docs/mta/outbound/strategy
+  strategy = {
+    schedule = [
+      (ifThen "is_local_domain('', rcpt_domain)" "'local'")
+      (ifThen "source = 'dsn'" "'admin'")
+      (ifThen "source = 'report'" "'admin'")
+      (ifThen "source = 'autogenerated'" "'admin'")
+      (otherwise "'default'")
+    ];
+    route = [
+      (ifThen "is_local_domain('', rcpt_domain)" "'local'")
+      (otherwise "'remote'")
+    ];
+    connection = "'default'";
+    tls = "'default'";
+  };
+  # Remote Connection
+  # https://stalw.art/docs/mta/outbound/connection
+  connection.default = {
+    ehlo-hostname = d.extUrl;
+    source-ips = d.extIPs;
+    timeout = {
+      connect = "3m";
+      greeting = "3m";
+      ehlo = "3m";
+      mail-from = "3m";
+      rcpt-to = "3m";
+      data = "10m";
+    };
+  };
+  tls.default = {
+    dane = "optional";
+    mta-sts = "optional";
+    starttls = "optional";
+    allow-invalid-certs = false;
+    timeout.tls = "3m";
+    timeout.mta-sts = "3m";
+  };
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/report.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/report.nix
new file mode 100644
index 00000000..0e527f01
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/report.nix
@@ -0,0 +1,64 @@
+{ d }:
+# Reports
+# https://stalw.art/docs/mta/reports/overview
+{
+  domain = "pyrox.dev";
+  submitter = "'${d.extUrl}'";
+  analysis = {
+    addresses = [
+      "dmarc@"
+      "reports@"
+      "spf@"
+      "dkim@"
+      "abuse@"
+    ];
+    forward = true;
+    store = "30d";
+  };
+  dsn = {
+    from-name = "'PyroNet Mail'";
+    from-address = "'mail@pyrox.dev'";
+    sign = "['rsa', 'ed25519']";
+  };
+  dkim = {
+    from-name = "'PyroNet Mail Reports'";
+    from-address = "'noreply-dkim@pyrox.dev'";
+    subject = "'DKIM Authentication Failure Report'";
+    sign = "['rsa', 'ed25519']";
+    send = "1/1d";
+  };
+  spf = {
+    from-name = "'PyroNet Mail Reports'";
+    from-address = "'noreply-spf@pyrox.dev'";
+    subject = "'SPF Authentication Failure Report'";
+    sign = "['rsa', 'ed25519']";
+    send = "1/1d";
+  };
+  dmarc = {
+    from-name = "'PyroNet Mail Reports'";
+    from-address = "'noreply-dmarc@pyrox.dev'";
+    subject = "'DMARC Authentication Failure Report'";
+    sign = "['rsa', 'ed25519']";
+    send = "1/1d";
+    aggregate = {
+      from-name = "'DMARC Report'";
+      from-address = "'noreply-dmarc@pyrox.dev'";
+      org-name = "'PyroNet Mail'";
+      contact-info = "'pyrox@pyrox.dev'";
+      send = "daily";
+      # 25 MiB
+      max-size = 26214400;
+      sign = "['rsa', 'ed25519']";
+    };
+  };
+  tls.aggregate = {
+    from-name = "'PyroNet Mail Reports'";
+    from-address = "'noreply-tls@pyrox.dev'";
+    org-name = "'PyroNet Mail'";
+    contact-info = "'pyrox@pyrox.dev'";
+    send = "daily";
+    # 25 MiB
+    max-size = 26214400;
+    sign = "['rsa', 'ed25519']";
+  };
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/server.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/server.nix
new file mode 100644
index 00000000..539da5b8
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/server.nix
@@ -0,0 +1,68 @@
+{ d }:
+{
+  hostname = d.extUrl;
+  # TLS
+  # https://stalw.art/docs/server/tls/overview
+  tls = {
+    enable = true;
+    implicit = false;
+    ignore-client-order = true;
+  };
+  # Listeners
+  # https://stalw.art/docs/server/listener
+  listener = {
+    smtp = {
+      bind = [
+        "[::]:${toString d.intSMTP}"
+        "[::]:40025"
+      ];
+      protocol = "smtp";
+      # Explicit TLS
+      tls.implicit = false;
+    };
+    smtps = {
+      bind = "[::]:${toString d.intSMTPS}";
+      protocol = "smtp";
+      # Implicit TLS
+      tls.implicit = true;
+    };
+    imap = {
+      bind = "[::]:${toString d.intIMAP}";
+      protocol = "imap";
+      # Explicit TLS
+      tls.implicit = false;
+    };
+    imaps = {
+      bind = "[::]:${toString d.intIMAPS}";
+      protocol = "imap";
+      # Implicit TLS
+      tls.implicit = true;
+    };
+    managesieve = {
+      bind = "[::]:${toString d.intManageSieve}";
+      protocol = "managesieve";
+      # Explicit TLS
+      tls.implicit = false;
+    };
+    https = {
+      bind = "[::]:${toString d.intHTTPS}";
+      protocol = "http";
+      # Implicit TLS
+      tls.implicit = true;
+    };
+    http = {
+      bind = "[::]:${toString d.intHTTP}";
+      protocol = "http";
+      # Implicit TLS
+      tls.implicit = false;
+    };
+  };
+  # Proxy Protocol from Caddy
+  # Only accepts proxy protocol from Tailscale IP Ranges
+  # https://tailscale.com/kb/1015/100.x-addresses
+  # https://tailscale.com/kb/1033/ip-and-dns-addresses
+  proxy.trusted-networks = [
+    "fd7a:115c:a1e0::/48"
+    "100.64.0.0/10"
+  ];
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/session.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/session.nix
new file mode 100644
index 00000000..2d1d3d11
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/session.nix
@@ -0,0 +1,42 @@
+{ isAuthenticated, otherwise }:
+# MTA Settings
+# https://stalw.art/docs/mta/overview
+{
+  # Inbound
+  # https://stalw.art/docs/mta/inbound/overview
+  # # EHLO Stage
+  # # https://stalw.art/docs/mta/inbound/ehlo
+  ehlo = {
+    require = true;
+  };
+  # # RCPT Stage
+  # # https://stalw.art/docs/mta/inbound/rcpt
+  rcpt = {
+    relay = [
+      (isAuthenticated true)
+      (otherwise false)
+    ];
+    subaddressing = true;
+  };
+  extensions =
+    let
+      ifAuthed = [
+        (isAuthenticated true)
+        (otherwise false)
+      ];
+    in
+    {
+      pipelining = true;
+      chunking = true;
+      requiretls = true;
+      no-soliciting = "";
+      dsn = ifAuthed;
+      deliver-by = [
+        (isAuthenticated "15d")
+        (otherwise false)
+      ];
+      mt-priority = false;
+      vrfy = ifAuthed;
+      expn = ifAuthed;
+    };
+}
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix
new file mode 100644
index 00000000..771b5d20
--- /dev/null
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix
@@ -0,0 +1,41 @@
+let
+  headers = [
+    "From"
+    "To"
+    "Cc"
+    "Date"
+    "Subject"
+    "Message-ID"
+    "Organization"
+    "MIME-Version"
+    "Content-Type"
+    "In-Reply-To"
+    "References"
+    "List-Id"
+    "User-Agent"
+    "Thread-Topic"
+    "Thread-Index"
+  ];
+in
+{
+  rsa = {
+    inherit headers;
+    private-key = "%{file:/run/credentials/stalwart-mail.service/rsa_private_key}";
+    domain = "pyrox.dev";
+    selector = "rsa-default";
+    algorithm = "rsa-sha256";
+    canonicalization = "relaxed/relaxed";
+    expire = "10d";
+    report = true;
+  };
+  ed25519 = {
+    inherit headers;
+    private-key = "%{file:/run/credentials/stalwart-mail.service/ed25519_private_key}";
+    domain = "pyrox.dev";
+    selector = "default";
+    algorithm = "ed25519-sha256";
+    canonicalization = "relaxed/relaxed";
+    expire = "10d";
+    report = true;
+  };
+}