hosts/mail: add SMTP relay configuration

Flake lock file updates:

• Updated input 'secrets':
    'git+ssh://git@git.vimium.com/jordan/nix-secrets.git?ref=refs/heads/master&rev=4e69a52227a61bf4bfbfd9b781bef4bf1fa0bd2b' (2025-02-24)
  → 'git+ssh://git@git.vimium.com/jordan/nix-secrets.git?ref=refs/heads/master&rev=175720e8761b9eb2e8616bee78825750d0600a69' (2025-05-26)

flake.lock

@@ -846,11 +846,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1740407512,
-        "narHash": "sha256-Hy+8DoWLZUFfls5XwaMGPDOck2dDKyIrEgo9T+AkjjU=",
+        "lastModified": 1748291697,
+        "narHash": "sha256-JR+fy+JcZgPqwvUUgtZoshjzFZQKYTTMuhOceat8MEs=",
         "ref": "refs/heads/master",
-        "rev": "4e69a52227a61bf4bfbfd9b781bef4bf1fa0bd2b",
-        "revCount": 29,
+        "rev": "175720e8761b9eb2e8616bee78825750d0600a69",
+        "revCount": 30,
         "type": "git",
         "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
       },

hosts/mail/mail.nix

@@ -23,7 +23,11 @@ in
     inputs.nixos-mailserver.nixosModule
   ];
 
-  age.secrets."passwords/users/jordan".file = "${inputs.secrets}/passwords/users/jordan.age";
+  age.secrets = {
+    "files/services/postfix/sasl_passwd".file =
+      "${inputs.secrets}/files/services/postfix/sasl_passwd.age";
+    "passwords/users/jordan".file = "${inputs.secrets}/passwords/users/jordan.age";
+  };
 
   services.roundcube = {
     enable = true;
@@ -71,4 +75,17 @@ in
       "abuse@vimium.com" = "jordan@vimium.com";
     };
   };
+
+  services.postfix.config = {
+    relayhost = "[mail.smtp2go.com]:2525";
+
+    smtp_sasl_auth_enable = "yes";
+    smtp_sasl_password_maps = "texthash:${
+      config.age.secrets."files/services/postfix/sasl_passwd".path
+    }";
+    smtp_sasl_security_options = "noanonymous";
+
+    smtp_destination_concurrency_limit = "20";
+    header_size_limit = "4096000";
+  };
 }