{ config, lib, pkgs, ... }:

{
  services.maddy = {
    enable = true;

    ensureAccounts = [ "lilac@grasswren.net" ];
    ensureCredentials."lilac@grasswren.net".passwordFile = config.sops.secrets.mxpass.path;

    secrets = [ config.sops.secrets.cftoken.path config.sops.secrets.s2guser.path config.sops.secrets.s2gpass.path ];

    tls = {
      loader = "acme";
      extraConfig = ''
        hostname $(hostname)
        email lilac@grasswren.net
        agreed
        challenge dns-01
        dns cloudflare {
          api_token "{env:CFTOKEN}"
        }
      '';
    };

    primaryDomain = "grasswren.net";
    hostname = "grasswren.net";

    config = ''
      auth.pass_table local_authdb {
        table sql_table {
          driver sqlite3
          table_name passwords
          dsn auth.db
        }
      }

      storage.imapsql local_mailboxes {
        driver sqlite3
        dsn mailbox.db
      }

      target.smtp relay {
        hostname $(hostname)
        starttls yes
        auth plain "{env:S2GUSER}" "{env:S2GPASS}"
        targets tcp://mail.smtp2go.com:587
      }

      smtp tcp://0.0.0.0:25 {
        default_source {
          destination grasswren.net {
            modify {
              replace_rcpt regexp ".*" "lilac@grasswren.net"
            }
            deliver_to &local_mailboxes
          }
          default_destination {
            reject 550 5.1.1 "No Such User"
          }
        }
      }

      submission tls://0.0.0.0:587 {
        auth &local_authdb

        default_source {
          default_destination {
            deliver_to &relay
          }
        }
      }

      imap tls://0.0.0.0:993 {
        auth &local_authdb
        storage &local_mailboxes
      }
    '';
  };
}