{ config, pkgs, lib, ... }:

# make sure no update befor changing this parameter
assert lib.versionOlder lib.version "20.09";

let release = "nixos-20.09";

in {
  imports = [
    (builtins.fetchTarball {
      url =
        "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz";
      # This hash needs to be updated
      sha256 = "0000000000000000000000000000000000000000000000000000";
    })
  ];

  mailserver = {
    enable = true;
    fqdn = "mail.ingolf-wagner.de";
    domains = [ "ingolf-wagner.de" ];

    # A list of all login accounts. To create the password hashes, use
    # nix-shell -p mkpasswd --run 'mkpasswd -m sha-512 "super secret password"'
    loginAccounts = {
      "root@ingolf-wagner.com" = {
        hashedPassword = lib.fileContents
          <secrets/mailserver/hashedPasswords/root_at_ingolf-wagner.de>;
        #aliases = [
        #  "postmaster@gaykraft.com"
        #];
        # Make this user the catchAll address for domains
        catchAll = [ "ingol-wagner.de" ];
      };
    };

    # Extra virtual aliases. These are email addresses that are forwarded to
    # loginAccounts addresses.
    #extraVirtualAliases = {
    # address = forward address;
    #"abuse@example.com" = "user1@example.com";
    #};

    # Use Let's Encrypt certificates. Note that this needs to set up a stripped
    # down nginx and opens port 80.
    certificateScheme = 3;

    # Enable IMAP and POP3
    enableImap = false;
    enablePop3 = true;
    enableImapSsl = false;
    enablePop3Ssl = true;

    # Enable the ManageSieve protocol
    enableManageSieve = true;

    # whether to scan inbound emails for viruses (note that this requires at least
    # 1 Gb RAM for the server. Without virus scanning 256 MB RAM should be plenty)
    virusScanning = false;
  };
}