{ pkgs, lib, config, ... }:
let
  inherit (builtins) attrNames listToAttrs readFile;
  inherit (builtins.extraBuiltins) pass pass-chomp;
  inherit (lib) types;
  inherit (pkgs.lib) unlinesAttrs;
  inherit (config.services) postfix rspamd dovecot2 redis;
  inherit (config.users) users;
in
{
imports = map (d: import (./rspamd + "/${d}.nix") {domain=d;}) [
  "sourcephile.fr"
  "autogeree.net"
];
options = {
  services.rspamd.dkimSelectorMap = lib.mkOption {
    type = types.lines;
    default = "";
    description = ''Each line maps a domain to its active DKIM selector'';
    apply = s: pkgs.writeText "dkim_selectors.map" s;
  };
};
config = {
users.users."${rspamd.user}".extraGroups = [
  "keys"
  users.redis.group
];
services.rspamd = {
  enable = true;
  debug = false;
  postfix.enable = postfix.enable;
  locals = {
    "dkim_signing.conf".text = ''
      selector_map = ${rspamd.dkimSelectorMap};
      path = "/run/keys/dkim.$domain.$selector.key";
      allow_username_mismatch = true;
    '';
    "arc.conf".text = ''
      selector_map = ${rspamd.dkimSelectorMap};
      path = "/run/keys/dkim.$domain.$selector.key";
      allow_username_mismatch = true;
    '';
    "redis.conf".text = ''
      servers = "${redis.unixSocket}";
      db = "1";
    '';
    "classifier-bayes.conf".text = ''
      users_enabled = false;
      backend = "redis";
      servers = "${redis.unixSocket}";
      database = "1";
      autolearn = true;
      cache {
        backend = "redis";
      }
      new_schema = true;
      statfile {
        BAYES_HAM {
          spam = false;
        }
        BAYES_SPAM {
          spam = true;
        }
      }
    '';
    /*
    "logging.conf" = ''
      debug_modules = [“dkim_signing”]
    '';
    */
  };
  overrides = {
    "milter_headers.conf".text = ''
      extended_spam_headers = true;
    '';
    "actions.conf".text = ''
      reject     = 15; # Reject when reaching this score
      add_header =  6; # Add header when reaching this score
      greylist   =  4; # Apply greylisting when reaching this score (will emit `soft reject action`)
    '';
  };
  workers = {
    learner = {
      # Like controller but without a password, only the bindSockets' permissions
      type = "controller";
      includes = [ "$CONFDIR/worker-controller.inc" ];
      bindSockets = [
        { socket = "/run/rspamd/learner.sock";
          mode = "0660";
          owner = "${rspamd.user}";
          group = "${dovecot2.group}";
        }
      ];
      extraConfig = ''
      '';
    };
    controller = {
      includes = [ "$CONFDIR/worker-controller.inc" ];
      bindSockets = [
        "127.0.0.1:11334"
      ];
      extraConfig = ''
        #count = 1;
        #static_dir = "''${WWWDIR}";
        # USE: rspamadm pw
        password = "${pass-chomp "servers/mermet/rspamd/controller/hashedPassword"}";
      '';
    };
  };
};
/*
services.postfix.extraConfig = ''
  smtpd_milters = unix:/run/rspamd.sock
  milter_default_action = accept
'';
# Allow users to run 'rspamc' and 'rspamadm'.
environment.systemPackages = [ pkgs.rspamd ];
*/
};
}