{config, ...}:
with config.constants; let
  userSecret = "mail/${userName}/password";
  vaultwardenSecret = "mail/vaultwarden/password";
in {
  mailserver = {
    enable = true;
    fqdn = "mail.${domain}";
    domains = [domain];

    loginAccounts = {
      "${postMaster}" = {
        aliases = ["trivial@${domain}"];
        hashedPasswordFile = config.sops.secrets.${userSecret}.path;
      };
      ${config.services.vaultwarden.config.SMTP_FROM}.hashedPasswordFile = config.sops.secrets.${vaultwardenSecret}.path;
    };

    certificateScheme = "acme";
    stateVersion = 3;
  };
  sops.secrets = {
    ${userSecret} = {};
    ${vaultwardenSecret} = {};
  };
}