{ pkgs, lib, config, ... }:
let
  inherit (builtins) attrNames listToAttrs readFile;
  inherit (builtins.extraBuiltins) pass pass-chomp;
  inherit (lib) types;
  inherit (pkgs.lib) unlinesAttrs;
  inherit (config.services) postfix rspamd dovecot2;
in
{
imports = [
  rspamd/sourcephile.fr.nix
];
options = {
  services.rspamd.dkimSelectorMap = lib.mkOption {
    type = types.lines;
    default = "";
    description = ''Each line maps a domain to its active DKIM selector'';
    apply = s: pkgs.writeText "dkim_selectors.map" s;
  };
};
config = {
users.users."${rspamd.user}".extraGroups = [ "keys" ];
services.rspamd = {
  enable = true;
  debug = false;
  postfix.enable = postfix.enable;
  locals = {
    "dkim_signing.conf".text = ''
      selector_map = ${rspamd.dkimSelectorMap};
      path = "/run/keys/dkim.$domain.$selector.key";
      allow_username_mismatch = true;
    '';
    "arc.conf".text = ''
      selector_map = ${rspamd.dkimSelectorMap};
      path = "/run/keys/dkim.$domain.$selector.key";
      allow_username_mismatch = true;
    '';
    /*
    "logging.conf" = ''
      debug_modules = [“dkim_signing”]
    '';
    */
  };
  overrides = {
    "milter_headers.conf".text = ''
      extended_spam_headers = true;
    '';
    "actions.conf".text = ''
      reject     = 15; # Reject when reaching this score
      add_header =  6; # Add header when reaching this score
      greylist   =  4; # Apply greylisting when reaching this score (will emit `soft reject action`)
    '';
  };
  workers = {
    learner = {
      # Like controller but without a password, only the bindSockets' permissions
      type = "controller";
      includes = [ "$CONFDIR/worker-controller.inc" ];
      bindSockets = [
        { socket = "/run/rspamd/learner.sock";
          mode = "0660";
          owner = "${rspamd.user}";
          group = "${dovecot2.group}";
        }
      ];
      extraConfig = ''
      '';
    };
    controller = {
      includes = [ "$CONFDIR/worker-controller.inc" ];
      bindSockets = [
        "127.0.0.1:11334"
      ];
      extraConfig = ''
        #count = 1;
        #static_dir = "''${WWWDIR}";
        # USE: rspamadm pw
        password = "${pass-chomp "servers/mermet/rspamd/controller/hashedPassword"}";
      '';
    };
  };
};
/*
services.postfix.extraConfig = ''
  smtpd_milters = unix:/run/rspamd.sock
  milter_default_action = accept
'';
# Allow users to run 'rspamc' and 'rspamadm'.
environment.systemPackages = [ pkgs.rspamd ];
*/

/*
services.redis = {
  enable = true;
};
*/
};
}