{
  config,
  pkgs,
  ...
}: {
  imports = [
    (builtins.fetchTarball {
      url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-25.05/nixos-mailserver-nixos-25.05.tar.gz";
      sha256 = "0jpp086m839dz6xh6kw5r8iq0cm4nd691zixzy6z11c4z2vf8v85";
    })
  ];

  # simple-nixos-mailserver
  # DOCS: https://nixos-mailserver.readthedocs.io/en/latest
  mailserver = {
    enable = true;
    # stateVersion = 3;
    # Manually open the firewall instead
    openFirewall = false;
    virusScanning = false; # expensive memory usage

    fqdn = "mail.imbored.dev";
    domains = ["imbored.dev"];

    # NOTE: generate hashes with `mkpasswd -sm bcrypt`
    loginAccounts = {
      "me@imbored.dev" = {
        aliases = ["emile@imbored.dev"];
        hashedPasswordFile = let
          CWD = builtins.getEnv "PWD";
        in "${CWD}/secrets/passwd/me";
      };
    };

    certificateScheme = "acme-nginx";
  };
}