{
  config,
  lib,
  sec,
  ...
}:
let
  inherit (config.machine.mail) enable;
in
with lib;
mkIf enable {
  systemd.tmpfiles.rules = [
    "C /var/dkim/default.private 0600 root root - - ${sec.dkim_default_private.path}"
  ];
}