{ pkgs, lib, config, ... }:
{
  mailserver = {
    enable = true;
    fqdn = "mx.surfsite.org";
    sendingFqdn = "mx.surfsite.org";
    domains = [
      "harald-hoyer.de"
      "hartwin-hoyer.de"
      "herward-hoyer.de"
      "meike-knutz.de"
      "gerlinde-hoyer.de"

      "hoyer.xyz"
      "nc.hoyer.xyz"
      "harald.hoyer.xyz"

      "varlink.org"
      "surfsite.org"
      "myprivacy.tools"
      "hoyer.social"
      "hoyer.world"
      "hoyer.photos"
      "harald.hoyer.photos"
      "hartwin.hoyer.photos"
      "mx.surfsite.org"
    ];

    extraVirtualAliases = {
      "max@hoyer.xyz" = [
        "harald@hoyer.xyz"
        "mh@hoyer.xyz"
      ];

      "felix@hoyer.xyz" = [
        "harald@hoyer.xyz"
        "mh@hoyer.xyz"
      ];

      "muh@hoyer.xyz" = [
        "harald@hoyer.xyz"
        "mh@hoyer.xyz"
      ];

      "kicker@surfsite.org" = [
        "harald@hoyer.xyz"
        "hartwin@hoyer.xyz"
      ];
    };
    # A list of all login accounts. To create the password hashes, use
    # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
    loginAccounts = {
      "mh@hoyer.xyz" = {
        hashedPasswordFile = "/home/harald/secrets/mh@hoyer.xyz";
        aliases = [
          "meike@harald-hoyer.de"
          "meike@meike-knutz.de"
          "meike.hoyer@meike-knutz.de"
          "meike@hoyer.xyz"
        ];
      };
      "alex@hoyer.xyz" = {
        hashedPasswordFile = "/home/hartwin/secrets/alex-mail";
        aliases = [
          "alex@hartwin-hoyer.de"
          "alex.hoyer@hartwin-hoyer.de"
          "alex@surfsite.org"
          "alex.hoyer@surfsite.org"
          "alexander@hoyer.xyz"
        ];
      };
      "jan@hoyer.xyz" = {
        hashedPasswordFile = "/home/hartwin/secrets/jan-mail";
        aliases = [
          "jan@hartwin-hoyer.de"
          "jan.hoyer@hartwin-hoyer.de"
          "jan@surfsite.org"
          "jan.hoyer@surfsite.org"
        ];
      };
      "hannah@hoyer.xyz" = {
        hashedPasswordFile = "/home/hartwin/secrets/hannah-mail";
        aliases = [
          "hannah@hartwin-hoyer.de"
          "hannah.hoyer@hartwin-hoyer.de"
          "hannah@surfsite.org"
          "hannah.hoyer@surfsite.org"
        ];
      };
      "steffi@hoyer.xyz" = {
        hashedPasswordFile = "/home/hartwin/secrets/steffi-mail";
        aliases = [
          "steffi@surfsite.org"
          "stefaniehoyer@surfsite.org"
          "stefanie.hoyer@surfsite.org"
          "stefanie.hoyer@hoyer.xyz"
          "stefanie@hoyer.xyz"
        ];
      };
      "hartwin@hoyer.xyz" = {
        hashedPasswordFile = "/home/hartwin/secrets/hartwin-mail";
        aliases = [
          "hartwin.hoyer@hartwin-hoyer.de"
          "mail@hartwin-hoyer.de"
          "hartwin@hartwin-hoyer.de"
          "youtube@hartwin-hoyer.de"
          "hartwin@nc.hoyer.xyz"
          "hartwin@hoyer.photos"
          "webmaster@hartwin.hoyer.photos"
        ];
      };
      "hhoyer@herward-hoyer.de" = {
        hashedPasswordFile = "/home/hhoyer/secrets/hhoyer-mail";
        aliases = [
          "herward@herward-hoyer.de"
          "herward@vs189018.vserver.de"
          "gua808@herward-hoyer.de"
          "mail@herward-hoyer.de"
          "herward.hoyer@herward-hoyer.de"
          "hhoyer@surfsite.org"
          "hhoyer@hoyer.xyz"
          "herward@hoyer.xyz"
          "herward@nc.hoyer.xyz"
        ];
      };
      "harald@hoyer.xyz" = {
        hashedPasswordFile = "/home/harald/secrets/harald@hoyer.xyz";
        aliases = [
          "harald@mx.surfsite.org"
          "root@mx.surfsite.org"

          "abuse@mx.surfsite.org"
          "abuse@surfsite.org"
          "abuse@hartwin-hoyer.de"
          "abuse@herward-hoyer.de"
          "abuse@meike-knutz.de"
          "abuse@gerlinde-hoyer.de"
          "abuse@hoyer.xyz"
          "abuse@harald.hoyer.xyz"
          "abuse@varlink.org"
          "abuse@myprivacy.tools"
          "abuse@hoyer.social"
          "abuse@hoyer.world"
          "abuse@hoyer.photos"

          "postmaster@mx.surfsite.org"
          "postmaster@surfsite.org"
          "postmaster@hartwin-hoyer.de"
          "postmaster@herward-hoyer.de"
          "postmaster@meike-knutz.de"
          "postmaster@gerlinde-hoyer.de"
          "postmaster@hoyer.xyz"
          "postmaster@harald.hoyer.xyz"
          "postmaster@varlink.org"
          "postmaster@myprivacy.tools"
          "postmaster@hoyer.social"
          "postmaster@hoyer.world"
          "postmaster@hoyer.photos"

          "webmaster@hoyer.xyz"
          "webmaster@surfsite.org"
          "webmaster@harald.hoyer.xyz"
          "webmaster@varlink.org"
          "webmaster@myprivacy.tools"
          "webmaster@hoyer.social"
          "webmaster@hoyer.world"
          "webmaster@hoyer.photos"
          "webmaster@harald.hoyer.photos"

          "admin@hoyer.xyz"
          "admin@harald.hoyer.xyz"
          "admin@nc.hoyer.xyz"
          "admin@mx.surfsite.org"
          "admin@hoyer.social"
          "admin@hoyer.world"
          "admin@hoyer.photos"

          "harald@surfsite.org"
          "harald@hoyer.xyz"
          "harald@nc.hoyer.xyz"
          "harald@varlink.org"
          "harald@myprivacy.tools"
          "harald@hoyer.world"
          "harald@hoyer.social"
          "harald@hoyer.photos"

          "@harald.hoyer.xyz"
          "@harald-hoyer.de"

          "paypal-harald@hoyer.xyz"
          "photo-harald@hoyer.xyz"

          "fb@surfsite.org"
          "freifunk@surfsite.org"
          "fbc@surfsite.org"
          "mine@surfsite.org"
          "bitcoin@surfsite.org"
          "bitcoin@hoyer.xyz"
          "roulette@surfsite.org"
          "github@surfsite.org"
          "mua@surfsite.org"
          "aliexpress@surfsite.org"

          # Max
          "max@hoyer.xyz"
          "max.hoyer@hoyer.xyz"
          "maximilian@hoyer.xyz"
          "maximilian.hoyer@hoyer.xyz"

          # Felix
          "felix@hoyer.xyz"
          "felix.hoyer@hoyer.xyz"
        ];
      };
    };
    certificateScheme = "acme";
  };

  services.roundcube = {
    enable = true;
    # this is the url of the vhost, not necessarily the same as the fqdn of
    # the mailserver
    hostName = "webmail.hoyer.xyz";
    extraConfig = ''
      # starttls needed for authentication, so the fqdn required to match
      # the certificate
      $config['smtp_server'] = "tls://${config.mailserver.fqdn}";
      $config['smtp_user'] = "%u";
      $config['smtp_pass'] = "%p";
    '';
  };
}