{ config, pkgs, lib, ...}: with lib;
  let
    cfg = config.services.skynet_email;
  in {

  imports = [
    ./dns.nix
  ];

  /*
  backups = [
    "/var/vmail"
    "/var/dkim"
  ];
  */

  options.services.skynet_email = {
    # options that need to be passed in to make this work

    enable = mkEnableOption "Skynet Email";

    host = {
      ip = mkOption {
        type = types.str;
      };

      name = mkOption {
        type = types.str;
      };
    };

    domain = mkOption {
      type = types.str;
      default = "ulcompsoc.ie";
      description = lib.mdDoc "domaino";
    };

    sub = mkOption {
      type = types.str;
      default = "mail";
      description = lib.mdDoc "mailserver subdomain";
    };

    ldap = {
      hosts = mkOption {
        type = types.listOf types.str;
        default = [
          "ldaps://sso.skynet.ie"
        ];
        description = lib.mdDoc "ldap domains";
      };

      base = mkOption {
        type = types.str;
        default = "dc=skynet,dc=ie";
        description = lib.mdDoc "where to find users";
      };

      searchBase = mkOption {
        type = types.str;
        default = "ou=users,${cfg.ldap.base}";
        description = lib.mdDoc "where to find users";
      };

      bind_dn = mkOption {
        type = types.str;
        default = "cn=admin,${cfg.ldap.base}";
        description = lib.mdDoc "where to find users";
      };

    };

  };

  config = mkIf cfg.enable {

    age.secrets.ldap_pw.file = ../secrets/ldap/pw.age;

    # set up dns record for it
    skynet_dns.records.external = [
      # basic one
      "mail A ${cfg.host.ip}"

       # SPF record
      ''${cfg.domain}.                 IN TXT "v=spf1 a:${cfg.sub}.${cfg.domain} -all"''

      # DKIM
      ''mail._domainkey.${cfg.domain}. IN TXT "v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDl8ptSASx37t5sfmU2d2Y6yi9AVrsNFBZDmJ2uaLa4NuvAjxGQCw4wx+1Jui/HOuKYLpntLsjN851wgPR+3i51g4OblqBDvcHn9NYgWRZfHj9AASANQjdsaAbkXuyKuO46hZqeWlpESAcD6a4Evam4fkm+kiZC0+rccb4cWgsuLwIDAQAB"''

      # DMARC
      ''_dmarc.${cfg.domain}.          IN TXT "v=DMARC1; p=none"''
    ];

    skynet_dns.records.reverse = [
      "${builtins.substring 9 3 cfg.host.ip} IN PTR ${cfg.sub}.${cfg.domain}."
    ];

    mailserver = {
      enable = true;
      fqdn = "${cfg.sub}.${cfg.domain}";
      domains = [
        cfg.domain
      ];

      #hierarchySeparator = "/";

      # 100MB max size
      messageSizeLimit = 100000000;

      #localDnsResolver = false;

      ldap = {
        enable = true;
        uris = cfg.ldap.hosts;
        bind = {
          dn = cfg.ldap.bind_dn;
          passwordFile = config.age.secrets.ldap_pw.path;
        };
        searchBase = cfg.ldap.searchBase;
        searchScope = "sub";


        dovecot = {
          #userAttrs = "uidNumber=uid,gidNumber=gid,skMail=mail";
          # use the set email account
          #userFilter = "(&(memberOf=cn=skynet-users,ou=groups,${cfg.ldap.base}))(uid=%n))";
          #userFilter = "(&(objectClass=posixAccount)(uid=%u))";
          userFilter = "(skMail=%u)";

          # "fix" until userAttrs is fixed
          #passAttrs = ''uid=user,userPassword=password
          #user_attrs = uidNumber=uid,gidNumber=gid,mail=/var/vmail/%u/%d
          #'';
          passFilter  = "(skMail=%u)";
        };

        postfix = {
          filter = "(skMail=%s)";

          # these may be reversed???
          # https://gist.github.com/calbrecht/bca39174f39a74e52a6d05bf630ad495
          uidAttribute = "skMail";
          mailAttribute = "skMail";
        };


      };


      # feckin spammers
      rejectRecipients = [

      ];

    };

    # tune the spam filter
    /*
    services.rspamd.extraConfig = ''
      actions {
        reject = null; # Disable rejects, default is 15
        add_header = 7; # Add header when reaching this score
        greylist = 4; # Apply greylisting when reaching this score
      }
    '';
    */
  };
}