{
  config,
  pkgs,
  lib,
  sec,
  ...
}:
let
  inherit (config.machine.forgejo) domain;
  address = "noreply@${domain}";
in
with lib;
mkIf config.machine.mail.enable {
  services.forgejo = {
    secrets = {
      mailer.PASSWD = sec."mail/servicePassword".path;
    };
    settings.mailer = {
      ENABLED = true;
      FROM = address;
      USER = address;
      SMTP_ADDR = config.machine.mail.fqdn;
      SMTP_PORT = 465;
      PROTOCOL = "smtps";
      SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
      SEND_AS_PLAIN_TEXT = true;
    };
  };

  mailserver = {
    domains = [ domain ];
    accounts.${address} = {
      hashedPasswordFile = sec."mail/serviceHashedPassword".path;
      aliases = [ ];
      sendOnly = true;
    };
  };
}