{ inputs, ... }:
{
  imports = [
    ./dkim.nix
    ./forgejo-user.nix
    inputs.simple-nixos-mailserver.nixosModules.mailserver
  ];
  khscodes.infrastructure.vault-server-approle.policy = {
    "forgejo/data/mailserver/*" = {
      capabilities = [ "read" ];
    };
  };
  khscodes.infrastructure.provisioning.pre.modules = [
    {
      khscodes.vault = {
        enable = true;
        mount.forgejo = {
          path = "forgejo";
          type = "kv";
          options = {
            version = "2";
          };
          description = "Secrets used for forgejo";
        };
      };
    }
  ];
  mailserver = {
    enable = true;
    fqdn = "kas.codes";
    domains = [ "kas.codes" ];
    loginAccounts = {
      "forgejo@kas.codes" = {
        hashedPasswordFile = "/var/lib/vault-agent/mailserver/users/forgejo.passwd.hash";
        sendOnly = true;
      };
    };
    certificateScheme = "acme";
    dkimKeyDirectory = "/var/lib/vault-agent/mailserver/dkim/";
    dkimSelector = "dkim_rsa";
    # Not sure we need to set this at all.
    dkimKeyBits = 2048;
  };
}
