{ config, lib, pkgs, ... }:

{
  services.maddy = {
    enable = true;

    ensureAccounts = [ "lilac@grasswren.net" ];
    ensureCredentials."lilac@grasswren.net".passwordFile = config.sops.secrets.mxpass.path;

    secrets = [ config.sops.secrets.cftoken.path ];

    tls = {
      loader = "acme";
      extraConfig = ''
        email lilac@grasswren.net
        agreed
        challenge dns-01
        dns cloudflare {
          api_token "{env:CFTOKEN}"
        }
      '';
    };

    config = ''
      hostname grasswren.net

      auth.pass_table authdb {
          table sql_table {
              driver sqlite3
              table_name passwords
              dsn auth.db
          }
      }

      storage.imapsql mailbox {
        driver sqlite3
        dsn mailbox.db
      }

      smtp tcp://0.0.0.0:25 {
        default_source {
          destination grasswren.net {
            modify {
              replace_rcpt regexp ".*" "lilac@grasswren.net"
            }
            deliver_to &mailbox
          }
          default_destination {
            reject 550 5.1.1 "No Such User"
          }
        }
      }

      imap tls://0.0.0.0:993 {
        auth &authdb
        storage &mailbox
      }
    '';
  };
}