{
  config,
  lib,
  pkgs,
  modulesPath,
  ...
}:
let
  generatedAliases = pkgs.writeText "generated-aliases" (
    lib.concatStringsSep "\n" (
      lib.mapCartesianProduct
        ({ aliases, domain }: "${aliases}@${domain}  root@test.htw.stura-dresden.de")
        {
          aliases = [
            "abuse"
            "hostmaster"
            "noreply"
            "postmaster"
            "webmaster"
          ];
          domain = config.mailserver.domains;
        }
    )
  );

in
{
  sops = {
    defaultSopsFile = ./secrets.sops.yml;
    secrets = {
      "ldap_passwd".owner = "dovecot2";
      "wireguard-key".owner = "systemd-network";
    };
  };
  imports = [
    "${modulesPath}/virtualisation/proxmox-lxc.nix"
  ];

  security.pam.loginLimits = [
    {
      domain = "*";
      type = "soft";
      item = "nofile";
      value = "8192";
    }
  ];

  networking = {
    hostName = "mail";
    domain = lib.mkForce "test.htw.stura-dresden.de";
    useDHCP = false;
    interfaces.ens18.ipv4.addresses = [
      {
        address = "141.56.51.95";
        prefixLength = 24;
      }
    ];

    defaultGateway = {
      address = "141.56.51.254";
      interface = "eth0";
    };
    wireguard = {
      enable = true;
      interfaces = {
        sturauplink = {
          privateKeyFile = config.sops.secrets."wireguard-key".path;
          ips = [
            "10.100.0.20/24"
            "fd28:6691:1921:6299::20/64"
          ];
          peers = [
            # mail.test.htw.stura-dresden.de
            {
              endpoint = "hetzner.test.htw.stura-dresden.de:51820";
              allowedIPs = [
                "10.100.0.1/24"
              ];
              publicKey = "Tg/SNniezzF4DUnvUl1/JxQwS18POrUR20UmkQDt+X0=";
            }
          ];
        };
      };
    };
  };

  services.nginx.virtualHosts = {
    "lists.${config.networking.domain}" = {
      enableACME = true;
      forceSSL = true;
      # locations."/" = {
      #   proxyPass = "http://127.0.0.1:18507";
      # };
    };
  };
  services.automx2 = {
    enable = true;
    domain = "${config.networking.domain}";
    settings = {
      automx2 = {
        db_uri = "sqlite:////var/lib/automx2/db.sqlite";
        proxy_count = 1;
      };
    };
  };
  services.mailman = {
    enable = true;
    hyperkitty = {
      enable = true;
    };
    serve.enable = true;
    webHosts = [
      "lists.${config.networking.domain}"
    ];
  };

  services.mailman.siteOwner = "mailman@${config.networking.domain}";
  mailserver = {
    enable = true;
    fqdn = "mail.${config.networking.domain}";
    domains = [
      "${config.networking.domain}"
      "lists.${config.networking.domain}"
    ];
    ldap = {
      enable = true;
      bind = {
        # dn = "cn=dovecot,ou=users,DC=test,DC=htw,DC=stura-dresden,DC=de";
        dn = "cn=dovecot,ou=users,dc=mail,dc=htw,dc=stura-dresden,dc=de";
        # passwordFile = "/var/lib/dovecot_ldap_passwd";
        passwordFile = config.sops.secrets.ldap_passwd.path;
      };
      dovecot = {
        userFilter = "(&(objectClass=posixAccount)(mail=%u))";
        passFilter = "(&(objectClass=posixAccount)(mail=%u))";
        userAttrs = "cn";
      };
      postfix = {
        filter = "(|(&(objectClass=posixAccount)(mail=%s))(&(objectClass=posixAccount)(cn=%s)))";
        mailAttribute = "mail";
        uidAttribute = "cn";
      };
      #searchBase = "DC=test,DC=htw,DC=stura-dresden,DC=de";
      searchBase = "dc=mail,dc=htw,dc=stura-dresden,dc=de";
      uris = [
        "ldap://auth.test.htw.stura-dresden.de:3389"
      ];
    };

    certificateScheme = "acme-nginx";
    enableImap = true;
    enableImapSsl = true;
    enableManageSieve = true;
    enableSubmission = true;
    enableSubmissionSsl = true;
    extraVirtualAliases = { };
    lmtpSaveToDetailMailbox = "no"; # DOS potential
    mailboxes = {
      Drafts = {
        auto = "subscribe";
        specialUse = "Drafts";
      };
      Sent = {
        auto = "subscribe";
        specialUse = "Sent";
      };
      Spam = {
        auto = "subscribe";
        specialUse = "Junk";
      };
      Trash = {
        auto = "subscribe";
        specialUse = "Trash";
      };
    };
    maxConnectionsPerUser = 10;
    messageSizeLimit = 10 * 1000 * 1024; # 10 MiB

    stateVersion = 3;
  };

  # services.dovecot2.mailLocation = lib.mkForce "maildir:/var/vmail/%n";
  services.postfix =
    let
      submissionOptions = {
        # hash:/etc/postfix/virtual,
        smtpd_sender_login_maps = lib.mkForce "ldap:/run/postfix/ldap-sender-login-map.cf";
        smtpd_client_restrictions = "permit_sasl_authenticated,reject";
      };
    in
    {
      masterConfig = {
        submission = {
          args = [ "-v" ];
        };
        submissions = {
          args = [ "-v" ];
        };
      };
      settings.main = {
        unknown_local_recipient_reject_code = 550;
        relay_domains = [
          "hash:/var/lib/mailman/data/postfix_domains"
        ];
        transport_maps = [
          "hash:/var/lib/mailman/data/postfix_lmtp"
        ];
        local_recipient_maps = [
          "hash:/var/lib/mailman/data/postfix_lmtp"
        ];
      };
      # mapFiles = {
      #   "valias" = lib.mkForce "/var/lib/postfix/valias";
      #   "virtual" = lib.mkForce "/var/lib/postfix/virtual";
      # };
      submissionOptions = submissionOptions;
      submissionsOptions = submissionOptions;
    };

  security.acme.acceptTerms = true;
  security.acme.defaults.email = "cert@stura.htw-dresden.de";

  networking.firewall.allowedTCPPorts = [
    25
    80
    443
    597
  ];

  system.stateVersion = "24.11";

}