wow

hosts/server/kazusa/services/caddy.nix

@@ -42,7 +42,7 @@
         "github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
         "github.com/neodyme-labs/user_agent_parse@v0.0.1"
       ];
-      hash = "sha256-YqOyHxPIKreCSkXfJUWTEFi+xOlIIiDqy3bYt7/A6Rg=";
+      hash = "sha256-z9/LF2gws+H0pKL6F62QfklD0W8DKWCccnXLOOs3+jY=";
     };
   };
 }

hosts/server/kazusa/services/mailserver.nix

@@ -9,12 +9,13 @@ let
   mailSecret = key: {
     sopsFile = ../secrets/mailserver.yaml;
     inherit key;
-    owner = "nginx";
-    group = "nginx";
+    # The OAuth client credentials are read by Roundcube's PHP-FPM pool,
+    # which runs as the dedicated `roundcube` user (not nginx).
+    owner = "roundcube";
+    group = "roundcube";
     mode = "0440";
     restartUnits = [
       "phpfpm-roundcube.service"
-      "dovecot.service"
     ];
   };