{
  config,
  lib,
  sec,
  ...
}:
let
  inherit (config.machine.nextcloud)
    enable
    host
    ;
  address = "noreply@${host}";
in
with lib;
mkIf enable {
  services.nextcloud = {
    settings = {
      mail_smtpmode = "smtp";
      mail_sendmailmode = "smtp";
      mail_smtpsecure = "ssl";
      mail_domain = host;
      mail_from_address = "noreply";
      mail_smtpname = address;
      mail_smtphost = config.machine.mail.fqdn;
      mail_smtpport = 465;
      mail_smtpauth = true;
    };
    secrets = {
      mail_smtppassword = sec."mail/servicePassword".path;
    };
  };

  mailserver = {
    domains = [ host ];
    accounts.${address} = {
      hashedPasswordFile = sec."mail/serviceHashedPassword".path;
      aliases = [ ];
      sendOnly = true;
    };
  };
}