{
  config,
  inputs,
  lib,
  ...
}:
with lib; {
  imports = [inputs.simple-nixos-mailserver.nixosModule];

  ark.directories = with config.mailserver; [
    "/var/lib/dovecot"
    "/var/lib/postfix"
    config.security.dhparams.params.dovecot2.path
    dkimKeyDirectory
    mailDirectory
    sieveDirectory
  ];

  secrets = with config.mailserver; {
    dkim-key-azahi-cc = {
      file = "${inputs.self}/secrets/dkim-key-azahi-cc";
      path = "${dkimKeyDirectory}/${my.domain.azahi}.${dkimSelector}.key";
      owner = config.services.opendkim.user;
      inherit (config.services.opendkim) group;
    };
    dkim-key-rohan-net = {
      file = "${inputs.self}/secrets/dkim-key-rohan-net";
      path = "${dkimKeyDirectory}/${my.domain.rohan}.${dkimSelector}.key";
      owner = config.services.opendkim.user;
      inherit (config.services.opendkim) group;
    };
    dkim-key-gondor-net = {
      file = "${inputs.self}/secrets/dkim-key-gondor-net";
      path = "${dkimKeyDirectory}/${my.domain.gondor}.${dkimSelector}.key";
      owner = config.services.opendkim.user;
      inherit (config.services.opendkim) group;
    };
    dkim-key-shire-net = {
      file = "${inputs.self}/secrets/dkim-key-shire-net";
      path = "${dkimKeyDirectory}/${my.domain.shire}.${dkimSelector}.key";
      owner = config.services.opendkim.user;
      inherit (config.services.opendkim) group;
    };
  };

  nixfiles.modules = {
    acme.enable = true;
    redis.enable = true;
  };

  mailserver = let
    cert = config.certs.${my.domain.shire};
  in {
    enable = true;

    fqdn = config.networking.domain;
    domains = with my.domain; [azahi gondor rohan shire];

    localDnsResolver = false;

    certificateScheme = 1;
    certificateFile = "${cert.directory}/fullchain.pem";
    keyFile = "${cert.directory}/key.pem";

    lmtpSaveToDetailMailbox = "no";

    redis = with config.services.redis.servers.default; {
      address = bind;
      inherit port;
      password = requirePass;
    };

    loginAccounts = with my.domain; {
      "azahi@${shire}" = {
        hashedPassword = "@HASHED_PASSWORD@";
        aliases = [
          "@${azahi}"
          "@${rohan}"
          "@${gondor}"
          "abuse@${shire}"
          "admin@${shire}"
          "ceo@${shire}"
          "postmaster@${shire}"
          "root@${shire}"
        ];
      };
      "samwise@${shire}" = {
        hashedPassword = "@HASHED_PASSWORD@";
        aliases = ["chad@${shire}"];
        quota = "1G";
      };
    };
  };

  # https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues/241
  services.redis.servers.rspamd.enable = mkForce false;
  systemd.services.rspamd = {
    requires = mkForce ["redis-default.service"];
    after = mkForce ["redis-default.service"];
  };

  services.fail2ban.jails = {
    dovecot = ''
      enabled = true
      mode = aggressive
    '';
    postfix = ''
      enabled = true
      mode = aggressive
    '';
  };
}