{ config, lib, pkgs, ... }:
{
  systemd.tmpfiles.rules = [
    "d /var/spool/postfix 0775 postfix postfix -"
    "d /var/spool/postfix/private 0770 postfix postfix -"
  ];
  services = let
    mailBase = "/var/spool/mail/vmail";
    saslSocket = "/var/spool/postfix/private/auth";
    sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
  in {
    redis.servers.rspamd = {
      enable = true;
      user = "rspamd";
    };
    rspamd = {
      enable = true;
      postfix.enable = true;
      locals."redis.conf".text = ''
        servers = "${config.services.redis.servers.rspamd.unixSocket}";
      '';
    };
    dovecot2 = {
      enable = true;
      settings = {
        ssl = "required";
        mail_gid = "vmail";
        mail_uid = "vmail";
        mail_path = mailBase;
        protocols.imap = true;
        mail_driver = "maildir";
        auth_mechanisms = [ "plain" ];
        dovecot_config_version = "2.4.5";
        dovecot_storage_version = "2.4.5";
        ssl_server_key_file = "${sslCertDir}/key.pem";
        ssl_server_cert_file = "${sslCertDir}/fullchain.pem";
        "passdb passwd-file".passwd_file_path = "/secrets/dovecot-pw";
        "service auth"."unix_listener ${saslSocket}" = {
          mode = "0660";
          user = "postfix";
          group = "postfix";
        };
      };
    };
    postfix = {
      enable = true;
      enableSubmission = true;
      virtualMapType = "regexp";
      virtual = "/.*@bogaledev.ru/ mail@bogaledev.ru";
      mapFiles = {
        smtp_passwd = "/secrets/smtp_passwd";
        mailbox = pkgs.writeText "mailbox" "mail@bogaledev.ru /";
      };
      settings.main = {
        smtpd_sasl_type = "dovecot";
        smtpd_sasl_path = saslSocket;
        smtp_sasl_auth_enable = "yes";
        smtpd_sasl_auth_enable = "yes";
        virtual_mailbox_base = mailBase;
        virtual_uid_maps = "static:1819";
        virtual_gid_maps = "static:1819";
        smtp_tls_security_level = "encrypt";
        smtpd_tls_security_level = "encrypt";
        relayhost = [ "smtp.resend.com:2587" ];
        virtual_mailbox_domains = "bogaledev.ru";
        smtp_sasl_tls_security_options = "noanonymous";
        virtual_mailbox_maps = "hash:/etc/postfix/mailbox";
        smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd";
        smtpd_tls_chain_files = [
          "${sslCertDir}/key.pem"
          "${sslCertDir}/fullchain.pem"
        ];
      };
    };
  };
}