{ config, lib, pkgs, ... }:
let
  postfixDir = "/var/spool/postfix";
in {
  systemd.tmpfiles.rules = [
    "d ${postfixDir} 0700 postfix postfix -"
  ];
  services = let
    sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
  in {
    redis.servers.rspamd = {
      enable = true;
      user = "rspamd";
    };
    rspamd = {
      enable = true;
      postfix.enable = true;
      locals."redis.conf".text = ''
        servers = "${config.services.redis.servers.rspamd.unixSocket}";
      '';
    };
    postfix = {
      enable = true;
      enableSubmissions = true;
      virtualMapType = "regexp";
      mapFiles.smtp_passwd = "/secrets/smtp_passwd";
      virtual = "/.*@bogaledev.ru/ mail@bogaledev.ru";
      submissionsOptions = {
        smtpd_tls_wrappermode = true;
        smtpd_sasl_auth_enable = "yes";
        milter_macro_daemon_name = "ORIGINATING";
        smtpd_client_restrictions = "permit_sasl_authenticated,reject";
      };
      settings.main = {
        smtpd_sasl_type = "dovecot";
        smtp_tls_wrappermode = true;
        smtp_sasl_auth_enable = true;
        smtpd_sasl_auth_enable = true;
        smtp_tls_security_level = "verify";
        relayhost = [ "smtp.resend.com:2465" ];
        smtpd_sasl_path = "${postfixDir}/auth";
        virtual_mailbox_domains = "bogaledev.ru";
        smtp_sasl_tls_security_options = "noanonymous";
        smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd";
        virtual_transport = "lmtp:unix:${postfixDir}/dovecot-lmtp";
        smtpd_tls_chain_files = [ "${sslCertDir}/key.pem" "${sslCertDir}/fullchain.pem" ];
      };
    };
    dovecot2 = {
      enable = true;
      settings = {
        ssl = "required";
        mail_gid = "vmail";
        mail_uid = "vmail";
        mail_driver = "maildir";
        protocols = [ "imap" "lmtp" ];
        auth_mechanisms = [ "plain" ];
        dovecot_config_version = "2.4.5";
        dovecot_storage_version = "2.4.5";
        mail_path = "/var/spool/mail/vmail";
        ssl_server_key_file = "${sslCertDir}/key.pem";
        ssl_server_cert_file = "${sslCertDir}/fullchain.pem";
        "passdb passwd-file".passwd_file_path = "/secrets/dovecot-pw";
        "service auth"."unix_listener ${postfixDir}/auth" = {
          mode = "0600";
          user = "postfix";
          group = "postfix";
        };
        "service lmtp"."unix_listener ${postfixDir}/dovecot-lmtp" = {
          mode = "0600";
          user = "postfix";
          group = "postfix";
        };
        "namespace inbox" = let
          mailbox = name: {
            auto = "create";
            mailbox_special_use = "\\${name}";
          };
        in {
          inbox = true;
          "mailbox Sent" = mailbox "Sent";
          "mailbox Archive" = mailbox "Archive";
          "mailbox Flagged" = mailbox "Flagged";
          "mailbox Junk" = mailbox "Junk" // { mailbox_autoexpunge = "45d"; };
          "mailbox Trash" = mailbox "Trash" // { mailbox_autoexpunge = "45d"; };
        };
      };
    };
  };
}