{ pkgs, config, ... }:
let
  domain = "autogeree.net";
  domainSuffix = "dc=autogeree,dc=net";
in
{
  services.postfix = {
    extraAliases = ''
  '';
    virtual = ''
      root@${domain} julm+root@${domain}
    '';
    tls_server_sni_maps =
      let
        chain = [
          "/var/lib/acme/${domain}/key.pem"
          "/var/lib/acme/${domain}/fullchain.pem"
        ];
      in
      {
        "smtp.${domain}" = chain;
        "mail.${domain}" = chain;
      };
    config = {
      virtual_mailbox_domains = [ domain ];
      virtual_mailbox_maps = [
        # Map the main address and aliases to the main mail address.
        # This is checked by permit_auth_recipient
        ("ldap:" + pkgs.writeText "ldap-mail-${domain}.cf" ''
          domain           = ${domain}
          version          = 3
          debuglevel       = 0
          server_host      = ldapi://
          bind             = sasl
          sasl_mechs       = EXTERNAL
          search_base      = ou=posix,${domainSuffix}
          scope            = sub
          dereference      = 0
          query_filter     = (&(|(mail=%s)(mailAlias=%s))(mailEnabled=TRUE))
          result_format    = %s
          result_attribute = mail
        '')
      ];
      # Map MAIL FROM addresses to the SASL login names allowed to use it.
      smtpd_sender_login_maps = [
        ("ldap:" + pkgs.writeText "ldap-senders-${domain}.cf" ''
          domain           = ${domain}
          version          = 3
          debuglevel       = 0
          server_host      = ldapi://
          bind             = sasl
          sasl_mechs       = EXTERNAL
          search_base      = ou=posix,${domainSuffix}
          scope            = sub
          dereference      = 0
          query_filter     = (&(|(mail=%s)(mailAlias=%s))(mailEnabled=TRUE))
          result_format    = %s@${domain}
          result_attribute = uid
        '')
      ];
    };
  };
  security.acme.certs."${domain}" = {
    postRun = "systemctl try-restart postfix";
  };
  systemd.services.postfix = {
    wants = [ "openldap.service" "acme-selfsigned-${domain}.service" "acme-${domain}.service" ];
    after = [ "openldap.service" "acme-selfsigned-${domain}.service" ];
  };
}