{...}: {
  virtualisation.oci-containers.containers.mailserver = {
    image = "ghcr.io/docker-mailserver/docker-mailserver:latest";
    autoStart = true;
    hostname = "mail.severijnse.eu";
    ports = [
      "25:25"
      "[::]:25:25"
      "143:143"
      "[::]:143:143"
      "465:465"
      "[::]:465:465"
      "587:587"
      "[::]:587:587"
      "993:993"
      "[::]:993:993"
    ];
    volumes = [
      "/home/admin/dms/mail-data/:/var/mail/:Z"
      "/home/admin/dms/mail-state/:/var/mail-state/:Z"
      "/home/admin/dms/mail-logs/:/var/log/mail/:Z"
      "/home/admin/dms/config/:/tmp/docker-mailserver/:Z"
      "/etc/localtime:/etc/localtime:ro"
      # On the running Debian, Caddy v2 stores certs at /home/admin/caddy/data/caddy/certificates/...
      # On NixOS, Caddy stores certs at /var/lib/caddy/certificates/...
      "/var/lib/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.severijnse.eu/:/etc/letsencrypt/live/mail.severijnse.eu/:ro"
    ];
    environment = {
      OVERRIDE_HOSTNAME = "";
      LOG_LEVEL = "info";
      SPOOF_PROTECTION = "1";
      MOVE_SPAM_TO_JUNK = "1";
    };
    environmentFiles = ["/home/admin/mailserver.env"];
    extraOptions = [
      "--label=com.centurylinklabs.watchtower.enable=true"
      "--dns=1.1.1.1"
      "--dns=8.8.8.8"
    ];
  };
}