{
  inputs,
  pkgs,
  config,
  ...
}: {
  imports = [
    inputs.nixos-mailserver.nixosModules.default
    ./reverse-proxy.nix
  ];
  mailserver = {
    enable = true;
    fqdn = "mail.moritz.place";
    domains = ["moritz.place"];

    fullTextSearch = {
      enable = true;
      # index new email as they arrive
      autoIndex = true;
      enforced = "body";
      memoryLimit = 500; # in MiB
    };

    loginAccounts = {
      "main@moritz.place" = {
        hashedPasswordFile = config.clan.core.vars.generators.mail-server.files.main-password-hash.path;
        aliases = ["@moritz.place"];
      };
    };

    # Use Let's Encrypt certificates. Note that this needs to set up a stripped
    # down nginx and opens port 80.
    certificateScheme = "acme";
    acmeCertificateName = "any.moritz.place";
  };

  clan.core.vars.generators.mail-server = {
    prompts.main-password.type = "hidden";
    prompts.main-password.persist = true;
    prompts.main-password.description = "You can autogenerate a password, if you leave this prompt blank.";
    files.main-password.deploy = false;
    files.main-password-hash = {};

    runtimeInputs = [
      pkgs.coreutils
      pkgs.xkcdpass
      pkgs.mkpasswd
    ];
    script = ''
      prompt_value=$(cat "$prompts"/main-password)
      if [[ -n "''${prompt_value-}" ]]; then
        echo "$prompt_value" | tr -d "\n" > "$out"/main-password
      else
        xkcdpass --numwords 3 --delimiter - --count 1 | tr -d "\n" > "$out"/main-password
      fi
      mkpasswd -s -m sha-512 < "$out"/main-password | tr -d "\n" > "$out"/main-password-hash
    '';
  };

  services.roundcube = {
    enable = true;
    hostName = "webmail.moritz.place";
    dicts = with pkgs.aspellDicts; [en de];
    extraConfig = ''
      # starttls needed for authentication, so the fqdn required to match
      # the certificate
      $config['smtp_host'] = "tls://${config.mailserver.fqdn}";
      $config['smtp_user'] = "%u";
      $config['smtp_pass'] = "%p";
    '';
  };
  services.nginx.virtualHosts."webmail.moritz.place".enableACME = false;
  services.nginx.virtualHosts."webmail.moritz.place".useACMEHost = "any.moritz.place";

  services.borgbackup.jobs = {
    mailDirectory = {
      paths = config.mailserver.mailDirectory;
      repo = "u461386-sub1@u461386.your-storagebox.de:mailDirectory";
      doInit = true;
      encryption = {
        mode = "repokey";
        passCommand = "cat ${config.clan.core.vars.generators.borg-mail-server.files.password.path}";
      };
      environment = {BORG_RSH = "ssh -i ${config.clan.core.vars.generators.borg-mail-server.files."ssh.id_ed25519".path} -p 23";};
      compression = "auto,zstd";
      startAt = "hourly";
      persistentTimer = true;
      prune.keep = {
        within = "1d"; # Keep all archives from the last day
        daily = 7;
        weekly = 3;
        monthly = 3;
      };
    };
  };

  clan.core.vars.generators.borg-mail-server = {
    prompts.password.persist = true;

    files."ssh.id_ed25519" = {};
    files."ssh.id_ed25519.pub".secret = false;
    runtimeInputs = [
      pkgs.coreutils
      pkgs.openssh
    ];
    script = ''
      ssh-keygen -t ed25519 -N "" -f "$out"/ssh.id_ed25519
    '';
  };
}