wow

hosts/server/kazusa/services/mailserver.nix

@@ -9,12 +9,13 @@ let
   mailSecret = key: {
     sopsFile = ../secrets/mailserver.yaml;
     inherit key;
-    owner = "nginx";
-    group = "nginx";
+    # The OAuth client credentials are read by Roundcube's PHP-FPM pool,
+    # which runs as the dedicated `roundcube` user (not nginx).
+    owner = "roundcube";
+    group = "roundcube";
     mode = "0440";
     restartUnits = [
       "phpfpm-roundcube.service"
-      "dovecot.service"
     ];
   };