{config, ...}: {
  age.secrets."bind_pw".file = ../secrets/bind_pw;

  mailserver = {
    stateVersion = 3;
    enable = true;
    fqdn = "distrust.network";
    domains = ["distrust.network"];
    certificateScheme = "acme";
    ldap = {
      enable = true;
      bind.dn = "cn=bind,ou=people,dc=distrust,dc=network";
      bind.passwordFile = config.age.secrets."bind_pw".path;
      searchBase = "ou=people,dc=distrust,dc=network";
      uris = ["ldap://localhost:3890"];
    };
  };
}