NETSetupRoles

Marker on a User whose Password is the dyndns provider secret (token or password) for the dns VM’s ddns-updater. Username = "DomainProvider" marker; the non-secret knobs (provider name, optional login username, secret key, host list) live in NETSetupConfig.DomainProvider. Picked up by NixTemplateFactory.BuildDomainProviderSecret. Public IP learned by curl echo on the dns VM (ipify → icanhazip), NOT cross-VLAN query.

Marker on a User whose credentials are the outbound smarthost (relay) for the mail VM. Picked up by NixTemplateFactory.BuildRelayFromUsers. Email field encodes the relay endpoint as relay@<host>[:<port>]; Username = SASL user; Password = SASL pw.