{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.khscodes.infrastructure.mailserver;
  fqdn = config.khscodes.networking.fqdn;
in
{
  options.khscodes.infrastructure.mailserver = {
    enable = lib.mkEnableOption "Enables setting up stuff for a mail server";
    domains = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [ ];
    };
  };
  imports = [
    # inputs.simple-nixos-mailserver.nixosModules.mailserver
    ./admin_password.nix
    ./acme.nix
    ./dmarc.nix
    ./dane.nix
    ./dkim.nix
    ./mta-sts.nix
    ./spf.nix
    ./tls-rpt.nix
    ./prometheus.nix
    ./openid-connect.nix
    ./ldap.nix
    ./package/nixos-module.nix
  ];
  config = lib.mkIf cfg.enable {
    services.stalwart-mail = {
      enable = true;
      package = pkgs.callPackage ./package/package.nix { };
      settings = {
        config = {
          local-keys =
            # defaults
            [
              "store.*"
              "directory.*"
              "tracer.*"
              "!server.blocked-ip.*"
              "!server.allowed-ip.*"
              "server.*"
              "authentication.fallback-admin.*"
              "cluster.*"
              "config.local-keys.*"
              "storage.data"
              "storage.blob"
              "storage.lookup"
              "storage.fts"
              "storage.directory"
              "certificate.*"
            ]
            # KHS addded
            ++ [
              "http.*"
              "lookup.default.*"
            ];
        };
        http = {
          url = "'https://${fqdn}'";
          use-x-forwarded = true;
        };
        server = {
          hostname = fqdn;
          tls = {
            enable = true;
            certificate = "default";
            implicit = true;
            ignore-client-order = true;
          };
          listener = {
            smtp = {
              protocol = "smtp";
              bind = "[::]:25";
            };
            submissions = {
              bind = "[::]:465";
              protocol = "smtp";
              tls.implicit = true;
            };
            imaps = {
              bind = "[::]:993";
              protocol = "imap";
              tls.implicit = true;
            };
            management = {
              bind = "[::]:8080";
              url = "https://${fqdn}";
              protocol = "http";
            };
          };
        };
        lookup.default = {
          hostname = fqdn;
          domain = "kaareskovgaard.net";
        };
      };
    };
    # TODO: Include a similiar rule for openstack
    khscodes.infrastructure.hetzner-instance.extraFirewallRules = [
      {
        direction = "out";
        protocol = "tcp";
        port = 25;
        destination_ips = [
          "0.0.0.0/0"
          "::/0"
        ];
        description = "smtp";
      }
    ];
    khscodes.infrastructure.provisioning.pre.modules = [
      (
        { ... }:
        {
          khscodes.cloudflare.dns.mxRecords = (
            lib.lists.map (domain: {
              fqdn = domain;
              priority = 10;
              content = fqdn;
              ttl = 600;
            }) cfg.domains
          );
          khscodes.cloudflare.dns.srvRecords = lib.lists.flatten (
            lib.lists.map (domain: [
              {
                fqdn = "_imaps._tcp.${domain}";
                content = fqdn;
                priority = 0;
                weight = 1;
                port = 993;
                ttl = 600;
              }
              {
                fqdn = "_submissions._tcp.${domain}";
                content = fqdn;
                priority = 0;
                weight = 1;
                port = 465;
                ttl = 600;
              }
            ]) cfg.domains
          );
        }
      )
    ];
    networking.firewall.allowedTCPPorts = [
      25
      465
      993
    ];
  };
}
