{
  inputs,
  config,
  ...
}:
{
  imports = [
    "${inputs.self}/nix/profiles/nixos/hetzner-server.nix"
    # ./testuser.nix
  ];
  khscodes.infrastructure.provisioning.pre.modules = [
    (
      { ... }:
      {
        khscodes.vault = {
          enable = true;
          mount."mx.kaareskovgaard.net" = {
            path = "mx.kaareskovgaard.net";
            type = "kv";
            options = {
              version = "2";
            };
            description = "Secrets used for mx.kaareskovgaard.net";
          };
        };
      }
    )
  ];
  khscodes.infrastructure = {
    kanidm-client-application = {
      enable = true;
      appName = "dovecot";
      secretOwner = "dovecot2";
      perms = "0644";
    };
    hetzner-instance = {
      enable = true;
      mapRdns = true;
      server_type = "cax11";
    };
    mailserver = {
      enable = true;
      domains = [
        "agerlin-skovgaard.dk"
        "agerlinskovgaard.dk"
      ];
      dkim = {
        vault = {
          mount = "mx.kaareskovgaard.net";
          prefixPath = "dkim";
        };
      };
      ldap = {
        mount = "kanidm";
        path = "ldap/dovecot";
      };
    };
  };
  services.roundcube = {
    enable = true;
    hostName = "mail.kaareskovgaard.net";
    configureNginx = true;
    extraConfig = ''
      # starttls needed for authentication, so the fqdn required to match
      # the certificate
      $config['smtp_host'] = "ssl://${config.khscodes.networking.fqdn}";
      $config['imap_host'] = "ssl://${config.khscodes.networking.fqdn}";
      $config['oauth_provider'] = 'generic';
      $config['oauth_provider_name'] = 'Kanidm';
      $config['oauth_client_id'] = 'dovecot';
      $config['oauth_client_secret'] = file_get_contents("${config.khscodes.infrastructure.kanidm-client-application.secretFile}");
      $config['oauth_auth_uri'] = 'https://login.kaareskovgaard.net/ui/oauth2';
      $config['oauth_token_uri'] = 'https://login.kaareskovgaard.net/oauth2/token';
      $config['oauth_identity_uri'] = 'https://login.kaareskovgaard.net/oauth2/openid/dovecot/userinfo';
      $config['oauth_identity_fields'] = ['preferred_username'];
      $config['oauth_scope'] = 'email openid profile';
      # Don't show login dialog, just redirect to oauth login page
      # $config['oauth_login_redirect'] = true;
    '';
  };
  khscodes.services.nginx = {
    enable = true;
    virtualHosts."mail.kaareskovgaard.net" = { };
  };
  khscodes.networking.fqdn = "mx.kaareskovgaard.net";
  system.stateVersion = "25.05";
}
