{ inputs, ... }:
{
  den.aspects.mailserver = {
    nixos = {
      imports = [ inputs.nixos-mailserver.nixosModules.default ];

      security.acme = {
        acceptTerms = true;
        defaults.email = "security@bug.tools";

        certs."mx.bug.tools" = {
          listenHTTP = "1360";
        };
      };

      mailserver = {
        enable = true;

        stateVersion = 4;

        fqdn = "mx.bug.tools";
        domains = [ "bug.tools" ];

        x509.useACMEHost = "mx.bug.tools";

        fullTextSearch = {
          enable = true;
          autoIndex = true;
          fallback = false;
        };

        accounts = {
          "bug@bug.tools" = {
            hashedPasswordFile = "/home/bug/mailserver/bug.passwd";
            aliases = [
              "admin@bug.tools"
              "security@bug.tools"
              "google@bug.tools"
              "apple@bug.tools"
              "roblox@bug.tools"
              "twitch@bug.tools"
              "discord@bug.tools"
              "github@bug.tools"
              "matrix@bug.tools"
              "git@bug.tools"
              "contact@bug.tools"
              "claude@bug.tools"
              "rumble@bug.tools"
              "bambu@bug.tools"
              "soulframe@bug.tools"
              "vortex@bug.tools"
              "codex@bug.tools"
              "tailscale@bug.tools"
            ];
          };

          "pare@bug.tools" = {
            hashedPasswordFile = "/home/bug/mailserver/pare.passwd";
          };

          "poop@bug.tools" = {
            hashedPasswordFile = "/home/bug/mailserver/pare.passwd";
          };
        };
      };

      den.tunnels = [
        "mail"
        "email"
      ];

      services.roundcube = {
        enable = true;
        hostName = "mail.bug.tools";
        extraConfig = ''
          $config['imap_host'] = 'ssl://localhost:993';
          $config['imap_conn_options'] = [
            'ssl' => ['verify_peer' => false, 'verify_peer_name' => false]
          ];
          $config['smtp_host'] = 'ssl://localhost:465';
          $config['smtp_conn_options'] = [
            'ssl' => ['verify_peer' => false, 'verify_peer_name' => false]
          ];
          $config['smtp_user'] = "%u";
          $config['smtp_pass'] = "%p";
          $config['username_domain'] = 'bug.tools';
        '';
      };

      services.nginx.enable = true;

      services.nginx.virtualHosts."mail.bug.tools" = {
        forceSSL = false;
        enableACME = false;

        listen = [
          {
            addr = "0.0.0.0";
            port = 8088;
          }
        ];
      };
    };
  };
}