{ config, lib, pkgs, pr103973, ... }:
let
  passwords = import ../../../secrets/passwd.nix { };
in
{
  nixpkgs.overlays = [
    (final: prev: {
      rspamd = pr103973.rspamd;
    })
  ];


  mailserver = {
    enable = true;
    fqdn = "mail.yoctocell.xyz";
    domains = [ "yoctocell.xyz" ];

    loginAccounts = {
      "public@yoctocell.xyz" = {
        # mkpasswd -m sha-512
        hashedPassword = passwords.mail.publicPasswd;
        sieveScript = ''
          require ["variables", "envelope", "fileinto", "subaddress", "mailbox"];
          if anyof (header :contains ["List-Id"]
                      "<info-gnu-emacs.gnu.org>",
                    header :contains ["To","Cc"]
                      "info-gnu-emacs@gnu.org") {
            fileinto "list.emacs.announce";
          }
        '' + (builtins.readFile ./dovecot.sieve);
      };

      "private@yoctocell.xyz" = {
        # mkpasswd -m sha-512
        hashedPassword = passwords.mail.privatePasswd;
      };

      "lists@yoctocell.xyz" = {
        hashedPassword = passwords.mail.listsPasswd;
        sieveScript = ''
          require ["variables", "envelope", "fileinto", "subaddress", "mailbox"];
        
           if allof (header :matches ["Subject"]
             "Your confirmation is required to join*",
             header :contains ["To"] "lists@yoctocell.xyz") {
             fileinto "INBOX";
           }
           
           elsif allof (header :matches ["Subject"]
             "Welcome to the * list",
             header :contains ["To"] "lists@yoctocell.xyz") {
             fileinto "INBOX";
           }  

        '' + (builtins.readFile ./dovecot.sieve);
      };
    };

    mailboxes = {
      Trash = {
        auto = "no";
        specialUse = "Trash";
      };
      Junk = {
        auto = "subscribe";
        specialUse = "Junk";
      };
      Drafts = {
        auto = "subscribe";
        specialUse = "Drafts";
      };
      Sent = {
        auto = "subscribe";
        specialUse = "Sent";
      };
      Archive = {
        auto = "subscribe";
        specialUse = "Archive";
      };
    };

    # let's encrypt
    certificateScheme = 3;

    virusScanning = false;
  };

  networking.firewall.allowedTCPPorts = [ 465 993 ];
}