{
  config,
  lib,
  inputs,
  masterDomain,
  ...
}:
let
  cfg = config.os.srv.mailserver;
in
{
  options.os.srv.mailserver.enable = lib.mkEnableOption "enables mailserver scanning";
  imports = [ inputs.nixos-mailserver.nixosModules.mailserver ];
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = config.os.srv.sops.enable;
        message = "Required for password secure password storing";
      }
      {
        assertion = config.os.srv.lldap.enable;
        message = "required for user accounts";
      }
    ];
    mailserver = {
      enable = true;
      fqdn = "mail.${masterDomain}";
      domains = [ masterDomain ];

      # TODO setup ldap
      ldap = {
        enable = true;
        uris = [ "ldap://127.0.0.1:3890" ];
        base = "ou=people,dc=yourdomain,dc=com";

        bind = {
          dn = "uid=mail-service,ou=people,dc=yourdomain,dc=com";
          passwordFile = "/var/src/secrets/ldap-mail-password";
        };

        attributes = {
          username = "uid";
          mail = "mail";
          password = "userPassword";
          uuid = "entryUUID";
        };

        dovecot = {
          userFilter = "(|(mail=%{user})(uid=%{user}))";
          passFilter = "(uid=%{user})";
        };

        postfix = {
          filter = "(mail=%s)";
        };
      };
    };
  };
}