{ depot, lib, ... }:
{
  imports = [
    ./imap.nix
    ./opendkim.nix
    ./postfix.nix
  ];

  security.acme.certs."mail.${depot.lib.meta.domain}" = {
    dnsProvider = "exec";
    webroot = lib.mkForce null;
    extraDomainNames = map (x: "${x}.${depot.lib.meta.domain}") [
      "mx"
      "imap"
      "smtp"
    ];
  };
}