diff --git a/dns/domains/rubenhensen.nl.yaml b/dns/domains/rubenhensen.nl.yaml
index 9d1dc20..a7549f9 100644
--- a/dns/domains/rubenhensen.nl.yaml
+++ b/dns/domains/rubenhensen.nl.yaml
@@ -7,10 +7,6 @@ records:
     expire: 300
     type: A
     content: "46.224.26.65"
-  - name: stalwart
-    expire: 300
-    type: A
-    content: "46.224.26.65"
   - name: "phocaslustrum"
     expire: 300
     type: A
@@ -58,7 +54,7 @@ records:
   - name: "@"
     expire: 300
     type: MX
-    content: "10 stalwart.rubenhensen.nl."
+    content: "10 mail.rubenhensen.nl."
   - name: "202603e._domainkey"
     expire: 300
     type: TXT
@@ -75,7 +71,7 @@ records:
     expire: 300
     type: TXT
     content: "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApBm+QIOPtVAWlnpcd1Sh/FjTLU4oXNdyYMZ4uo+uj+8PkewhzN+6gb9CD/M6NB8Wa+8kchcVlziB1GD4z07QAAJg8pGSs1UZ7Ggfp7RgE6CkiPvMxAE6PkP9mBKcPH9YFR0xQaoi0BHQD1EKmPq2vXOc3BFtgkoeO+Myo6ELenpf17Iv6PcBxyLBOBnnFB4Uhos8qJ8qHb+hHhL6wR8sxk+OAPLXDWVRtrTXvOrlDoRBjz9X0xKdyE3aOQ6xg+qHusVIszLFz8iO6L5ia/rtwnm9v92NR9g0r3/lJE3AJFYqKIF7kPcdjyowvuUjlpDQedXSaEkytGzc84JbkHE+jQIDAQAB"
-  - name: stalwart
+  - name: mail
     expire: 300
     type: TXT
     content: "v=spf1 a ra=postmaster -all"
@@ -86,39 +82,39 @@ records:
   - name: "_jmap._tcp"
     expire: 300
     type: SRV
-    content: "0 1 443 stalwart.rubenhensen.nl."
+    content: "0 1 443 mail.rubenhensen.nl."
   - name: "_caldavs._tcp"
     expire: 300
     type: SRV
-    content: "0 1 443 stalwart.rubenhensen.nl."
+    content: "0 1 443 mail.rubenhensen.nl."
   - name: "_carddavs._tcp"
     expire: 300
     type: SRV
-    content: "0 1 443 stalwart.rubenhensen.nl."
+    content: "0 1 443 mail.rubenhensen.nl."
   - name: "_imaps._tcp"
     expire: 300
     type: SRV
-    content: "0 1 993 stalwart.rubenhensen.nl."
+    content: "0 1 993 mail.rubenhensen.nl."
   - name: "_submissions._tcp"
     expire: 300
     type: SRV
-    content: "0 1 465 stalwart.rubenhensen.nl."
+    content: "0 1 465 mail.rubenhensen.nl."
   - name: "_submission._tcp"
     expire: 300
     type: SRV
-    content: "0 1 587 stalwart.rubenhensen.nl."
+    content: "0 1 587 mail.rubenhensen.nl."
   - name: autoconfig
     expire: 300
     type: CNAME
-    content: "stalwart.rubenhensen.nl."
+    content: "mail.rubenhensen.nl."
   - name: autodiscover
     expire: 300
     type: CNAME
-    content: "stalwart.rubenhensen.nl."
+    content: "mail.rubenhensen.nl."
   - name: mta-sts
     expire: 300
     type: CNAME
-    content: "stalwart.rubenhensen.nl."
+    content: "mail.rubenhensen.nl."
   - name: "_mta-sts"
     expire: 300
     type: TXT
@@ -131,35 +127,35 @@ records:
     expire: 300
     type: TXT
     content: "v=TLSRPTv1; rua=mailto:postmaster@rubenhensen.nl"
-  - name: "_25._tcp.stalwart"
+  - name: "_25._tcp.mail"
     expire: 300
     type: TLSA
     content: "3 0 1 7926a9616cea1a7fb851fbdab631b2b2f6f71d3a775178d3288e539b9f53b18d"
-  - name: "_25._tcp.stalwart"
+  - name: "_25._tcp.mail"
     expire: 300
     type: TLSA
     content: "3 0 2 2218e33f102e805841f2f6a368e6416d884a8658cd9f45ef9b28c233dc6803320cff976e8ffdb1c0603a7abe60ccf78de422c31753b6cece8bc7ec1b80de5b66"
-  - name: "_25._tcp.stalwart"
+  - name: "_25._tcp.mail"
     expire: 300
     type: TLSA
     content: "3 1 1 e473431a9f296a8d93dfbed7c6c9485d6dadf7b460879edc0fe905183fe78a41"
-  - name: "_25._tcp.stalwart"
+  - name: "_25._tcp.mail"
     expire: 300
     type: TLSA
     content: "3 1 2 4c6cdab2a9cad307ba5b77ef34bde0cc2846b3d27aef6ce9625c56ef11b5c9cd1ede662c3afa759a3190e6317df494564ac83e4bfe3e6467f3c1bf307d781d4a"
-  - name: "_25._tcp.stalwart"
+  - name: "_25._tcp.mail"
     expire: 300
     type: TLSA
     content: "2 0 1 aeb1fd7410e83bc96f5da3c6a7c2c1bb836d1fa5cb86e708515890e428a8770b"
-  - name: "_25._tcp.stalwart"
+  - name: "_25._tcp.mail"
     expire: 300
     type: TLSA
     content: "2 0 2 e18f3d6ccbc578f025c3c7c29ed7bffe1b8eef5b1f839c17298dcf218303d2a63e305f6c1f489691774a18bad836035e5af2de1fc42a3a26cfe9e530f92e3855"
-  - name: "_25._tcp.stalwart"
+  - name: "_25._tcp.mail"
     expire: 300
     type: TLSA
     content: "2 1 1 cbbc559b44d524d6a132bdac672744da3407f12aae5d5f722c5f6c7913871c75"
-  - name: "_25._tcp.stalwart"
+  - name: "_25._tcp.mail"
     expire: 300
     type: TLSA
     content: "2 1 2 7d779dd26d37ca5a72fd05f1b815a06078c8e09777697c651fbe012c8d2894e048fcfe24160ee1562602240b6bef44e00f2b7340c84546d6110842bbdeb484a7"
diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix
index 380ce84..cafc560 100644
--- a/nix-infra-machine/nodes/node001.nix
+++ b/nix-infra-machine/nodes/node001.nix
@@ -19,7 +19,7 @@
   security.acme = {
     acceptTerms = true;
     defaults.email = "admin@rubenhensen.nl";
-    certs."stalwart.rubenhensen.nl" = {
+    certs."mail.rubenhensen.nl" = {
       group = "stalwart-mail";
       reloadServices = [ "stalwart-mail" ];
       webroot = "/var/lib/acme/acme-challenge";
@@ -38,7 +38,7 @@
   # Serve ACME challenges via nginx on port 80
   services.nginx = {
     enable = true;
-    virtualHosts."stalwart.rubenhensen.nl" = {
+    virtualHosts."mail.rubenhensen.nl" = {
       listen = [
         { addr = "0.0.0.0"; port = 80; }
         { addr = "[::]"; port = 80; }
@@ -95,7 +95,7 @@
     enable = true;
     settings = {
       server = {
-        hostname = "stalwart.rubenhensen.nl";
+        hostname = "mail.rubenhensen.nl";
         listener = {
           smtp = {
             bind = "[::]:25";
@@ -128,8 +128,8 @@
       };
 
       certificate.default = {
-        cert = "%{file:/var/lib/acme/stalwart.rubenhensen.nl/fullchain.pem}%";
-        private-key = "%{file:/var/lib/acme/stalwart.rubenhensen.nl/key.pem}%";
+        cert = "%{file:/var/lib/acme/mail.rubenhensen.nl/fullchain.pem}%";
+        private-key = "%{file:/var/lib/acme/mail.rubenhensen.nl/key.pem}%";
       };
 
       storage = {
@@ -137,7 +137,7 @@
         fts = "rocksdb";
         blob = "rocksdb";
         lookup = "rocksdb";
-        directory = "authentik";
+        directory = "internal";
       };
 
       store.rocksdb = {
@@ -158,29 +158,10 @@
         enable = true;
       };
 
-      directory.authentik = {
-        type = "ldap";
-        url = "ldap://ldap.rubenhensen.nl:389";
-        timeout = "30s";
-        tls.enable = false;
-        base-dn = "DC=ldap,DC=goauthentik,DC=io";
-
-        bind.dn = "cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io";
-        bind.secret = "%{file:/run/credentials/stalwart-mail.service/ldap_bind_password}%";
-        bind.auth.method = "lookup";
-
-        filter = {
-          name = "(&(objectClass=user)(|(cn=?)(mail=?)(mailAliases=?)))";
-          email = "(&(objectClass=user)(|(mail=?)(mailAliases=?)))";
-        };
-
-        attributes = {
-          name = "cn";
-          class = "objectClass";
-          email = "mail";
-          email-alias = "mailAliases";
-          groups = "memberOf";
-        };
+      oauth.oidc = {
+        issuer-url = "https://authentik.rubenhensen.nl/application/o/stalwart/";
+        client-id = "%{file:/run/credentials/stalwart-mail.service/oidc-client-id}%";
+        client-secret = "%{file:/run/credentials/stalwart-mail.service/oidc-client-secret}%";
       };
 
       signature."rsa" = {
@@ -220,7 +201,8 @@
 
   systemd.services.stalwart-mail.serviceConfig.LoadCredentialEncrypted = [
     "stalwart-admin-password:/root/secrets/[%%secrets/stalwart-admin-password%%]"
-    "ldap_bind_password:/root/secrets/[%%secrets/ldap_bind_password%%]"
+    "oidc-client-id:/root/secrets/[%%secrets/oidc-client-id%%]"
+    "oidc-client-secret:/root/secrets/[%%secrets/oidc-client-secret%%]"
     "dkim-rsa.key:/root/secrets/[%%secrets/dkim-rsa.key%%]"
     "dkim-ed25519.key:/root/secrets/[%%secrets/dkim-ed25519.key%%]"
   ];