diff --git a/bundles/postfix/files/main.cf b/bundles/postfix/files/main.cf
new file mode 100644
index 0000000..08532bc
--- /dev/null
+++ b/bundles/postfix/files/main.cf
@@ -0,0 +1,63 @@
+# See /usr/share/postfix/main.cf.dist for a commented, more complete version
+
+
+# Debian specific:  Specifying a file name will cause the first
+# line of that file to be used as the name.  The Debian default
+# is /etc/mailname.
+#myorigin = /etc/mailname
+
+smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
+biff = no
+
+# appending .domain is the MUA's job.
+append_dot_mydomain = no
+
+# Uncomment the next line to generate "delayed mail" warnings
+#delay_warning_time = 4h
+
+readme_directory = no
+
+# TLS parameters
+smtpd_tls_cert_file = /etc/letsencrypt/live/mail.sublimity.de/fullchain.pem
+smtpd_tls_key_file = /etc/letsencrypt/live/mail.sublimity.de/privkey.pem
+smtpd_use_tls=yes
+<%text>
+smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
+smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+</%text>
+
+# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
+# information on enabling SSL in the smtp client.
+
+smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
+myhostname = mail.sublimity.de
+alias_maps = hash:/etc/aliases
+alias_database = hash:/etc/aliases
+myorigin = /etc/mailname
+mydestination = mail.sublimity.de, localhost.localdomain, localhost
+relayhost =
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
+mailbox_size_limit = 0
+recipient_delimiter = +
+inet_interfaces = all
+inet_protocols = all
+virtual_mailbox_domains = psql:/etc/postfix/virtual_mailbox_domains.cf
+virtual_mailbox_maps = psql:/etc/postfix/virtual_mailbox_maps.cf
+virtual_alias_maps = psql:/etc/postfix/virtual_alias_maps.cf,psql:/etc/postfix/email2email.cf
+virtual_transport = lmtp:unix:private/dovecot-lmtp
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
+smtpd_sasl_auth_enable = yes
+smtpd_tls_security_level = may
+smtpd_tls_auth_only = yes
+message_size_limit = 1000000000
+smtpd_milters = unix:/spamass/spamass.sock
+milter_connect_macros = i j {daemon_name} v {if_name} _
+policyd-spf_time_limit = 3600
+
+smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,check_policy_service unix:private/policyd-spf
+#  reject_rbl_client dnsbl.sorbs.net
+#  reject_rbl_client bl.spamcop.net
+#  reject_rbl_client zen.spamhaus.org
+#  reject_rbl_client dnsbl1.uceprotect.net
+#  reject_unauth_destination
diff --git a/bundles/postfix/files/master.cf b/bundles/postfix/files/master.cf
new file mode 100644
index 0000000..3ad0e3d
--- /dev/null
+++ b/bundles/postfix/files/master.cf
@@ -0,0 +1,132 @@
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master" or
+# on-line: http://www.postfix.org/master.5.html).
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+smtp      inet  n       -       -       -       -       smtpd
+#smtp      inet  n       -       -       -       1       postscreen
+#smtpd     pass  -       -       -       -       -       smtpd
+#dnsblog   unix  -       -       -       -       0       dnsblog
+#tlsproxy  unix  -       -       -       -       0       tlsproxy
+#submission inet n       -       -       -       -       smtpd
+#  -o syslog_name=postfix/submission
+#  -o smtpd_tls_security_level=encrypt
+#  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#  -o smtpd_client_restrictions=$mua_client_restrictions
+#  -o smtpd_helo_restrictions=$mua_helo_restrictions
+#  -o smtpd_sender_restrictions=$mua_sender_restrictions
+#  -o smtpd_recipient_restrictions=
+#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+
+submission inet n       -       -       -       -       smtpd
+  -o syslog_name=postfix/submission
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+
+#smtps     inet  n       -       -       -       -       smtpd
+#  -o syslog_name=postfix/smtps
+#  -o smtpd_tls_wrappermode=yes
+#  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#  -o smtpd_client_restrictions=$mua_client_restrictions
+#  -o smtpd_helo_restrictions=$mua_helo_restrictions
+#  -o smtpd_sender_restrictions=$mua_sender_restrictions
+#  -o smtpd_recipient_restrictions=
+#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+#628       inet  n       -       -       -       -       qmqpd
+pickup    unix  n       -       -       60      1       pickup
+cleanup   unix  n       -       -       -       0       cleanup
+qmgr      unix  n       -       n       300     1       qmgr
+#qmgr     unix  n       -       n       300     1       oqmgr
+tlsmgr    unix  -       -       -       1000?   1       tlsmgr
+rewrite   unix  -       -       -       -       -       trivial-rewrite
+bounce    unix  -       -       -       -       0       bounce
+defer     unix  -       -       -       -       0       bounce
+trace     unix  -       -       -       -       0       bounce
+verify    unix  -       -       -       -       1       verify
+flush     unix  n       -       -       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       -       -       -       smtp
+relay     unix  -       -       -       -       -       smtp
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       -       -       -       showq
+error     unix  -       -       -       -       -       error
+retry     unix  -       -       -       -       -       error
+discard   unix  -       -       -       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       -       -       -       lmtp
+anvil     unix  -       -       -       -       1       anvil
+scache    unix  -       -       -       -       1       scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop  unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix  -       n       n       -       -       pipe
+#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp      unix  -       n       n       -       -       pipe
+  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail    unix  -       n       n       -       -       pipe
+  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp     unix  -       n       n       -       -       pipe
+  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix	-	n	n	-	2	pipe
+  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman   unix  -       n       n       -       -       pipe
+  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+  ${nexthop} ${user}
+policyd-spf  unix  -       n       n       -       0       spawn
+    user=policyd-spf argv=/usr/bin/policyd-spf
diff --git a/bundles/postfix/files/virtual_alias_maps.cf b/bundles/postfix/files/virtual_alias_maps.cf
new file mode 100644
index 0000000..0519fb4
--- /dev/null
+++ b/bundles/postfix/files/virtual_alias_maps.cf
@@ -0,0 +1,5 @@
+hosts = ${host}
+dbname = ${name}
+user = ${user}
+password = ${password}
+query = SELECT destination FROM redirections LEFT JOIN domains ON redirections.domain_id = domains.id WHERE CONCAT_WS('@', redirections.source, domains.name) = '%s'
diff --git a/bundles/postfix/files/virtual_mailbox_domains.cf b/bundles/postfix/files/virtual_mailbox_domains.cf
new file mode 100644
index 0000000..70bd62a
--- /dev/null
+++ b/bundles/postfix/files/virtual_mailbox_domains.cf
@@ -0,0 +1,5 @@
+hosts = ${host}
+dbname = ${name}
+user = ${user}
+password = ${password}
+query = SELECT 1 FROM domains WHERE name='%s'
diff --git a/bundles/postfix/files/virtual_mailbox_maps.cf b/bundles/postfix/files/virtual_mailbox_maps.cf
new file mode 100644
index 0000000..04abb68
--- /dev/null
+++ b/bundles/postfix/files/virtual_mailbox_maps.cf
@@ -0,0 +1,5 @@
+hosts = ${host}
+dbname = ${name}
+user = ${user}
+password = ${password}
+query = SELECT 1 FROM users LEFT JOIN domains ON users.domain_id=domains.id WHERE CONCAT_WS('@', users.user, domains.name) = '%s'
diff --git a/bundles/postfix/files/virtual_redirects.cf b/bundles/postfix/files/virtual_redirects.cf
new file mode 100644
index 0000000..ee0aed4
--- /dev/null
+++ b/bundles/postfix/files/virtual_redirects.cf
@@ -0,0 +1,5 @@
+hosts = ${host}
+dbname = ${name}
+user = ${user}
+password = ${password}
+query = SELECT CONCAT_WS('@', users.user, domains.name) AS email FROM users JOIN domains ON users.domain_id = domains.id WHERE CONCAT_WS('@', users.user, domains.name)='%s'
diff --git a/bundles/postfix/items.py b/bundles/postfix/items.py
new file mode 100644
index 0000000..70f18f2
--- /dev/null
+++ b/bundles/postfix/items.py
@@ -0,0 +1,46 @@
+assert node.has_bundle('postgresql')
+
+file_options = {
+    'triggers': [
+        'svc_systemd:postfix:restart',
+    ],
+    'needed_by': [
+        'svc_systemd:postfix',
+    ],
+}
+
+files = {
+    '/etc/postfix/main.cf': {
+        'content_type': 'mako',
+        **file_options,
+    },
+    '/etc/postfix/master.cf': {
+        **file_options,
+    },
+    '/etc/postfix/virtual_alias_maps.cf': {
+        'content_type': 'mako',
+        'context': node.metadata.get('postfix/database'),
+        **file_options,
+    },
+    '/etc/postfix/virtual_mailbox_domains.cf': {
+        'content_type': 'mako',
+        'context': node.metadata.get('postfix/database'),
+        **file_options,
+    },
+    '/etc/postfix/virtual_mailbox_maps.cf': {
+        'content_type': 'mako',
+        'context': node.metadata.get('postfix/database'),
+        **file_options,
+    },
+    '/etc/postfix/virtual_redirects.cf': {
+        'content_type': 'mako',
+        'context': node.metadata.get('postfix/database'),
+        **file_options,
+    },
+}
+
+svc_systemd['postfix'] = {
+    'needs': [
+        'postgres_db:mailserver',
+    ],
+}
diff --git a/bundles/postfix/metadata.py b/bundles/postfix/metadata.py
new file mode 100644
index 0000000..8940904
--- /dev/null
+++ b/bundles/postfix/metadata.py
@@ -0,0 +1,29 @@
+database_password = repo.vault.password_for(f'{node.name} db mailserver')
+
+defaults = {
+    'apt': {
+        'packages': {
+            'postfix': {},
+        }
+    },
+    'postfix': {
+        'database': {
+            'host': '127.0.0.1',
+            'name': 'mailserver',
+            'user': 'mailserver',
+            'password': database_password,
+        }
+    },
+    'postgresql': {
+        'roles': {
+            'mailserver': {
+                'password': database_password,
+            },
+        },
+        'databases': {
+            'mailserver': {
+                'owner': 'mailserver',
+            },
+        },
+    },
+}
diff --git a/groups/applications/mailserver.py b/groups/applications/mailserver.py
new file mode 100644
index 0000000..3a69be0
--- /dev/null
+++ b/groups/applications/mailserver.py
@@ -0,0 +1,6 @@
+{
+    'bundles': [
+        'postfix',
+        'postgresql',
+    ],
+}
diff --git a/groups/applications/webserver.py b/groups/applications/webserver.py
new file mode 100644
index 0000000..70fb0e8
--- /dev/null
+++ b/groups/applications/webserver.py
@@ -0,0 +1,6 @@
+{
+    'bundles': [
+        'nginx',
+        'letsencrypt',
+    ],
+}
diff --git a/nodes/backupserver.py b/nodes/home.backups.py
similarity index 100%
rename from nodes/backupserver.py
rename to nodes/home.backups.py
diff --git a/nodes/homeserver.py b/nodes/home.server.py
similarity index 100%
rename from nodes/homeserver.py
rename to nodes/home.server.py
diff --git a/nodes/gameserver.py b/nodes/htz.games.py
similarity index 100%
rename from nodes/gameserver.py
rename to nodes/htz.games.py
diff --git a/nodes/mailserver.py b/nodes/htz.mails.py
similarity index 91%
rename from nodes/mailserver.py
rename to nodes/htz.mails.py
index d870fc8..cdfe608 100644
--- a/nodes/mailserver.py
+++ b/nodes/htz.mails.py
@@ -2,10 +2,8 @@
     'hostname': '162.55.188.157',
     'groups': [
         'debian-10',
-    ],
-    'bundles': [
-        'nginx',
-        'letsencrypt',
+        'mailserver',
+        'webserver',
     ],
     'metadata': {
         'nginx': {