msmtp: add msmtp for service mail notifications using sendmail

.sops.yaml

···
     key_groups:
       - age:
         - *lutea
-
+  - path_regex: secrets/lilu.yaml$
+    key_groups:
+      - age:
+        - *lily
+        - *lutea

modules/msmtp.nix

···
+{ config, pkgs, ... }:
+{
+  sops = {
+    secrets = {
+      "y6d-smtp/user".sopsFile = ../secrets/lilu.yaml;
+      "y6d-smtp/pass".sopsFile = ../secrets/lilu.yaml;
+    };
+    templates.msmtp-user.content = ''
+      user ${config.sops.placeholder."y6d-smtp/user"}
+    '';
+  };
+
+  programs.msmtp = {
+    enable = true;
+    defaults = {
+      tls = true;
+      tls_starttls = false;
+      port = 465;
+      logfile = "/var/log/msmtp.log";
+      from = "%F";
+    };
+    accounts.default = {
+      auth = true;
+      host = "smtp.purelymail.com";
+      eval = "${pkgs.coreutils}/bin/cat ${config.sops.templates.msmtp-user.path}";
+      passwordeval = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."y6d-smtp/pass".path}";
+    };
+  };
+}

secrets/lilu.yaml

···
+y6d-smtp:
+    user: ENC[AES256_GCM,data:IZK759k1/F6v,iv:Aj92dOU58OU1zCcCsKeaHzsvWePRo6s8sE5mMMwM4DM=,tag:1V12iaPqjroNBQfaJHlP5Q==,type:str]
+    pass: ENC[AES256_GCM,data:q6bhty/EUUYIV+VQ9ZLHNjODOqA=,iv:aJ2+ToXQGLmZtO06ZXBwa6OGt7qil/mSbBG4VI6muRU=,tag:zn4mzLC7+qh40lP07ZEzPQ==,type:str]
+sops:
+    age:
+        - recipient: age1amaa55e7nusv904a9ucfvtnjlw4srtet42suehey6u3yc4t2xc5sdldepj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwTzVOd1J6MC9CNngwMmwx
+            NFdKODdFa3BEdGhrK1ZWd0FFdmJyZmxOVFFFCnRsOC9YeDBIRGUrdnlXUDI5dkJt
+            V2l6a0JldXpwSjZoSWl5NEhaN29IeXcKLS0tIENudEZwcWNKZU45YWpqWjg5N281
+            TDJTcmxZckRMMHFNQTM4eUhXRWdjeGMKaxFPulpG7hqzjGx9UicetztDbDT6gPuI
+            vuyNaQviUCfpxyLXHNk2zgeuLEX7inKKdBi9mH/uhcNJ1n8NGmlEVQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1p55em5e3uk3fprj2mpum7ulrslcqgly63pjsyw2yv6hx99trdsnsvvv9ex
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3NGlOU21ZRjFzeVJOdWJi
+            d2FPai85N05zRTRGUGM5dnFDUnEzT1c0SVhnCnF3VS9pSmFWNEt6cmMzeDhwRGJj
+            ck1BMG1jdFVHVG5Icm0xMUtBZmFKNU0KLS0tIEZ0T0JJV1Y3ZEZKQUx6elp2K05j
+            cm43OGNYd1ZnbEM0NjVYY3ZOdi94Sk0Kn8jz57CaoCE3ceFv1TNsYdqW83sqxYiy
+            4X21omXCeqpRG5DC2QyAJQE/93lBhsHKIMCraNMaOycPlVQYdyTviA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-08-05T22:10:59Z"
+    mac: ENC[AES256_GCM,data:Bqymx8fJKDcpr8GfP3fK+PPNivhPCyBx6yiybje0MOwMP4Qrc06YeYyktvV0z0MvPqOf31FMXMYbwYjuWOgUPKCsFC9QGLcshAnD9qG7LxX+5PaonFCk0LAUW5NABluGSkTViM6wCywqoSUB9BC8xnw8kSrMO7yXzJghIr6rusw=,iv:BmOKCn+p14ZKSAsn+nDQYWlPZsJFJEjGMyKuz9d9IY4=,tag:CpVMaMywwLVQYKFMx5l6WA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2