diff --git a/flake.nix b/flake.nix
index d16cc28..0e8b497 100644
--- a/flake.nix
+++ b/flake.nix
@@ -60,33 +60,24 @@
     deploy.nodes = {
       desktop = {
         hostname = "10.0.0.2";
-        sshUser = "lilac";
-        magicRollbackTimeout = 120;
         profiles.system = {
           user = "root";
-          remoteBuild = false;
           path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
         };
       };
 
       vps = {
         hostname = "10.0.0.3";
-        sshUser = "lilac";
-        magicRollbackTimeout = 120;
         profiles.system = {
           user = "root";
-          remoteBuild = false;
           path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.vps;
         };
       };
 
-       backup = {
+      backup = {
         hostname = "10.0.0.4";
-        sshUser = "lilac";
-        magicRollbackTimeout = 120;
         profiles.system = {
           user = "root";
-          remoteBuild = false;
           path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup;
         };
       };
diff --git a/hosts/laptop.nix b/hosts/laptop.nix
index cff4e30..04b573f 100644
--- a/hosts/laptop.nix
+++ b/hosts/laptop.nix
@@ -7,12 +7,13 @@
   ];
 
   environment.systemPackages = with pkgs; [
-    mullvad-browser
-    signal-desktop
     discord
-    protonmail-desktop
-    steam
+    mullvad-browser
     obsidian
+    protonmail-desktop
+    signal-desktop
+    steam
+    thunderbird
   ];
 
   networking = {
diff --git a/hosts/vps.nix b/hosts/vps.nix
index c7dd50f..a0494cc 100644
--- a/hosts/vps.nix
+++ b/hosts/vps.nix
@@ -11,7 +11,7 @@
     
     firewall = {
       enable = true;
-      allowedTCPPorts = [ 80 443 ];
+      allowedTCPPorts = [ 25 80 443 587 993 ];
       allowedUDPPorts = [ 51820 ];
       trustedInterfaces = [ "wg0" ];
     };
@@ -44,7 +44,7 @@
         content = ''
           chain prerouting {
             type nat hook prerouting priority dstnat; policy accept;
-            iifname "enp1s0" tcp dport { 25, 80, 443, 993 } dnat to 10.0.0.2
+            iifname "enp1s0" tcp dport { 25, 80, 443, 587, 993 } dnat to 10.0.0.2
           }
           chain postrouting {
             type nat hook postrouting priority srcnat; policy accept;
diff --git a/modules/backup.nix b/modules/backup.nix
index fd7e6a5..799a913 100644
--- a/modules/backup.nix
+++ b/modules/backup.nix
@@ -4,7 +4,7 @@
   services.restic.backups.backup = {
     repository = "rest:http://10.0.0.4:8000/backup";
     initialize = true;
-    passwordFile = "/home/lilac/test-password";
+    passwordFile = config.sops.secrets.mxpass.path;
     paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
     timerConfig.OnCalendar = "03:30";
     pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
diff --git a/modules/mail.nix b/modules/mail.nix
index 87105c4..ac3024d 100644
--- a/modules/mail.nix
+++ b/modules/mail.nix
@@ -7,7 +7,7 @@
     ensureAccounts = [ "lilac@grasswren.net" ];
     ensureCredentials."lilac@grasswren.net".passwordFile = config.sops.secrets.mxpass.path;
 
-    secrets = [ config.sops.secrets.cftoken.path ];
+    secrets = [ config.sops.secrets.cftoken.path config.sops.secrets.s2guser.path config.sops.secrets.s2gpass.path ];
 
     tls = {
       loader = "acme";
@@ -39,6 +39,13 @@
         dsn mailbox.db
       }
 
+      target.smtp relay {
+        hostname $(hostname)
+        starttls yes
+        auth plain "{env:S2GUSER}" "{env:S2GPASS}"
+        targets tcp://mail.smtp2go.com:587
+      }
+
       smtp tcp://0.0.0.0:25 {
         default_source {
           destination grasswren.net {
@@ -53,6 +60,16 @@
         }
       }
 
+      submission tls://0.0.0.0:587 {
+        auth &local_authdb
+
+        default_source {
+          default_destination {
+            deliver_to &relay
+          }
+        }
+      }
+
       imap tls://0.0.0.0:993 {
         auth &local_authdb
         storage &local_mailboxes
diff --git a/modules/secrets.nix b/modules/secrets.nix
index 8bf67e6..7752a85 100644
--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -17,4 +17,18 @@
     mode = "0440";
     restartUnits = [ "maddy.service" ];
   };
+
+  sops.secrets.s2guser = {
+    owner = "maddy";
+    group = "maddy";
+    mode = "0440";
+    restartUnits = [ "maddy.service" ];
+  };
+
+  sops.secrets.s2gpass = {
+    owner = "maddy";
+    group = "maddy";
+    mode = "0440";
+    restartUnits = [ "maddy.service" ];
+  };
 }
diff --git a/secrets.yaml b/secrets.yaml
index 8733048..4a9288f 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -1,5 +1,8 @@
 cftoken: ENC[AES256_GCM,data:nxIZzGDkznGwf3FFDojSM740RMcNqv6FCUvY2h54eAFUB3/z34UIJCESauRsZMV+SpXy7AJc0XXujE7yHg==,iv:/8sQH4wJJOQGhSc8QkhrxVuMTqBRzULebCauVaL5fzY=,tag:skTdCNMTFAutaWl9fh+y4Q==,type:str]
 mxpass: ENC[AES256_GCM,data:dDTNmIfc378Kv4JL/id3b3+/v61cMEYX0QtA6p2+EIk=,iv:W0EO+Ft63q8GYCmqd442oTeeaBKWWQqCoY8jhqfKfFE=,tag:GNCj/FUOk7G0DTvrYBZurw==,type:str]
+bupass: ENC[AES256_GCM,data:SCOVtcSqWvNAaq60OM3eWB5ZeEGlnrSQXyyMEWa6h/1d3N4kiw==,iv:Ql3/wkw/WCyj7PLKYdvHhlipONqQNmWLqBG4WaV1v18=,tag:VodWimuyVMw87iVhO67Sfw==,type:str]
+s2guser: ENC[AES256_GCM,data:N5hSuHWxRUzRxz5SQdt1UOavsEkR,iv:MBtQ8vGN4yV3D4/mCuxFDv3ULEIcaPkqh24fjPwQcLM=,tag:l+jGaE69rtWLbWu6/nftMg==,type:str]
+s2gpass: ENC[AES256_GCM,data:s+8cRussPxSiDANzwxkYIP2nNTpOBGxV,iv:ovtYGBfNouOaYAZ4dulmdHxdkqyPf4UuvSKI74ICmlg=,tag:cdratFiO3U0VO7AReY8EyA==,type:str]
 sops:
     age:
         - enc: |
@@ -20,7 +23,7 @@ sops:
             hf9QRDmVWjp9NEStovhWRfjUxJyHNHMOB5XNBjcFcDKrYNaYoz4i3w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ttmws269mrs30f65qwky5rzkwuq0dcfgrhgegxr7u9x9ty2nqfxq9v8dwu
-    lastmodified: "2026-09-25T18:29:05Z"
-    mac: ENC[AES256_GCM,data:ogyYh/cu3aAQhOzuQ6fbN9UeWOR7IKAQWcDhfKEo7gr4shpQwxRSUx0kLjj/buJfa8+l0cO0TodH23CfQE++xjFAy7m6lgIPTrAX0OQ/6QAaFCB0HV4ifwZ+l3yod4CCD3MEx6E5irsb1xyrz4lEQdlywyWIp6Zc3XKuSEpdOdg=,iv:EiZvFZhQgmJgAA+RBC+/0QPkp3ssbzbWaQ+lfrPhJPo=,tag:SFGlHRfsgc6zev3dDXxBow==,type:str]
+    lastmodified: "2026-09-30T04:37:56Z"
+    mac: ENC[AES256_GCM,data:2tT5VQfVtkuWONRr3n+f1hjDKDWN6kwWnvfA/y/Aq3QgpDBti+eIxfSLcoJeSQlFVZKSD9GCCD8XNKh7zd2V4q66alnaUkU/SUEEbX0i3SZurGuSswxkkmfYfIjsd3XM7qP/idrbGfeWXsrZqvcemY3UWfft2StpzYxCN9pIpX8=,iv:lLqgK4I8K9A9KTzTyS1Qn+4Fi/EJP7CEMnYW2dh6uTc=,tag:Cl0xgKF6hEDbA1SM/oygMg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3