diff --git a/modules/homelab/services/dawarich/default.nix b/modules/homelab/services/dawarich/default.nix
index b9a8e79d..91ad582b 100644
--- a/modules/homelab/services/dawarich/default.nix
+++ b/modules/homelab/services/dawarich/default.nix
@@ -152,7 +152,6 @@ in
 
     services.caddy.virtualHosts."${hosts.timeline}" = {
       extraConfig = ''
-        import auth_protected
         import reverse_proxy_common
         reverse_proxy localhost:${toString reverseProxyPort}
       '';
diff --git a/modules/homelab/services/immich/default.nix b/modules/homelab/services/immich/default.nix
index f1b18d7f..25984fa0 100644
--- a/modules/homelab/services/immich/default.nix
+++ b/modules/homelab/services/immich/default.nix
@@ -178,7 +178,6 @@ in
 
     services.caddy.virtualHosts."${hosts.immich}" = {
       extraConfig = ''
-        import auth_protected
         import reverse_proxy_common
 
         request_body {
diff --git a/modules/homelab/services/tandoor/README.md b/modules/homelab/services/tandoor/README.md
index 5ea37349..69b802c5 100644
--- a/modules/homelab/services/tandoor/README.md
+++ b/modules/homelab/services/tandoor/README.md
@@ -21,10 +21,11 @@ This creates the following containers on a `tandoor` bridge network:
 
 ## 1Password Secrets Required
 
-- `op://Homelab/Tandoor/Authentication/secret key` - Django SECRET_KEY
-- `op://Homelab/Tandoor/Database/password` - PostgreSQL password
-- `op://Homelab/Tandoor/Authentication/OIDC client secret` - OIDC client secret (if OIDC is enabled)
-- `op://Homelab/Backup/Tandoor/password` - Backup encryption key
+- `op://HomeLab/Tandoor/Authentication/secret key` - Django SECRET_KEY
+- `op://HomeLab/Tandoor/Database/password` - PostgreSQL password
+- `op://HomeLab/Tandoor/Authentication/OIDC client secret` - OIDC client secret (if OIDC is enabled)
+- `op://HomeLab/Tandoor/Resend/api key` - Resend API key for SMTP
+- `op://HomeLab/Backup/Tandoor/password` - Backup encryption key
 
 ## OIDC Authentication
 
diff --git a/modules/homelab/services/tandoor/default.nix b/modules/homelab/services/tandoor/default.nix
index 69ad652c..58ad36c2 100644
--- a/modules/homelab/services/tandoor/default.nix
+++ b/modules/homelab/services/tandoor/default.nix
@@ -12,6 +12,7 @@ let
   tandoorDataDir = "/var/lib/data/tandoor";
 
   hosts = config.flake.meta.reverse-proxy.hosts;
+  domain = config.flake.meta.reverse-proxy.domain;
   reverseProxyPort = config.flake.meta.reverse-proxy.ports.tandoor;
   tandoorImage = "ghcr.io/tandoorrecipes/recipes:2.6.13";
   tandoorPort = 8080;
@@ -113,25 +114,31 @@ in
       };
       tandoorSecretKey = {
         path = "/run/secrets/tandoor/secret_key";
-        reference = "op://Homelab/Tandoor/Authentication/secret key";
+        reference = "op://HomeLab/Tandoor/Authentication/secret key";
         owner = tandoorUser;
         group = tandoorGroup;
       };
       tandoorDbPassword = {
         path = "/run/secrets/tandoor/db_password";
-        reference = "op://Homelab/Tandoor/Database/password";
+        reference = "op://HomeLab/Tandoor/Database/password";
         owner = tandoorUser;
         group = tandoorGroup;
       };
       tandoorOidcClientSecret = {
         path = "/run/secrets/tandoor/oidc_client_secret";
-        reference = "op://Homelab/Tandoor/Authentication/OIDC client secret";
+        reference = "op://HomeLab/Tandoor/Authentication/OIDC client secret";
+        owner = tandoorUser;
+        group = tandoorGroup;
+      };
+      tandoorResendApiKey = {
+        path = "/run/secrets/tandoor/resend_api_key";
+        reference = "op://HomeLab/Tandoor/Resend/api key";
         owner = tandoorUser;
         group = tandoorGroup;
       };
       backupTandoorEncryptionKey = {
         path = "/run/secrets/tandoor/backup_encryption_key";
-        reference = "op://Homelab/Backup/Tandoor/password";
+        reference = "op://HomeLab/Backup/Tandoor/password";
         owner = tandoorUser;
         group = tandoorGroup;
       };
@@ -146,7 +153,6 @@ in
 
     services.caddy.virtualHosts."${hosts.recipes}" = {
       extraConfig = ''
-        import auth_protected
         import reverse_proxy_common
         reverse_proxy localhost:${toString reverseProxyPort}
       '';
@@ -240,6 +246,11 @@ in
           environment = {
             ALLOWED_HOSTS = ".localhost,127.0.0.1,[::1],${hosts.recipes}";
             DB_ENGINE = "django.db.backends.postgresql";
+            DEFAULT_FROM_EMAIL = "tandoor@${domain}";
+            EMAIL_HOST = "smtp.resend.com";
+            EMAIL_HOST_USER = "resend";
+            EMAIL_PORT = 587;
+            EMAIL_USE_TLS = 1;
             HIDE_LOGIN_FORM = 1;
             POSTGRES_HOST = "db";
             POSTGRES_DB = tandoorDbName;
@@ -251,6 +262,7 @@ in
           };
 
           secrets = {
+            EMAIL_HOST_PASSWORD = osConfig.services.onepassword-secrets.secretPaths.tandoorResendApiKey;
             FDC_API_KEY = osConfig.services.onepassword-secrets.secretPaths.tandoorFDCApiKey;
             SECRET_KEY = osConfig.services.onepassword-secrets.secretPaths.tandoorSecretKey;
             POSTGRES_PASSWORD = osConfig.services.onepassword-secrets.secretPaths.tandoorDbPassword;