{config, ...}: {
  mailserver = {
    enable = true;
    stateVersion = 3;
    fqdn = "mail.${config.networking.domain}";
    domains = ["${config.networking.domain}"];
    x509.useACMEHost = config.mailserver.fqdn;
    loginAccounts = {
      "test@${config.networking.domain}" = {
        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-test-pw.path;
      };
      "admin@${config.networking.domain}" = {
        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-admin-pw.path;
        aliases = ["@${config.networking.domain}"];
      };
    };
  };
  services.nginx = {
    enable = true;
    virtualHosts = {
      "mail.${config.networking.domain}" = {
        forceSSL = true;
        enableACME = true;
      };
    };
  };
  security.acme = {
    acceptTerms = true;
    defaults.email = "mtgmonket@gmail.com";
  };
}