{moduleWithSystem, ...}: {
  flake.nixosModules.containerMail = moduleWithSystem ({pkgs, ...}: {config, ...}: {
    # Containers
    virtualisation.oci-containers.containers."mailserver" = {
      image = "ghcr.io/docker-mailserver/docker-mailserver:latest";
      environment = {
        "DEFAULT_RELAY_HOST" = "[smtp-relay.brevo.com]:587";
        "DOMAINNAME" = "voidarc.co.uk";
        "ENABLE_CLAMAV" = "1";
        "ENABLE_FAIL2BAN" = "1";
        "ENABLE_POSTFIX_VIRTUAL_TRANSPORT" = "1";
        "ENABLE_POSTGREY" = "1";
        "ENABLE_SPAMASSASSIN" = "1";
        "HOSTNAME" = "mail.voidarc.co.uk";
        "ONE_DIR" = "1";
        "PERMIT_DOCKER" = "network";
        "POSTMASTER_ADDRESS" = "postmaster@voidarc.co.uk";
        "SPOOF_PROTECTION" = "1";
        "SSL_DOMAIN" = "mail.voidarc.co.uk";
        "SSL_TYPE" = "letsencrypt";
      };
      environmentFiles = [config.sops.templates."mail.env".path];
      volumes = [
        "/containers/mail/config:/tmp/docker-mailserver:rw"
        "/containers/mail/maildata:/var/mail:rw"
        "/containers/mail/mailstate:/var/mail-state:rw"
        "/etc/letsencrypt:/etc/letsencrypt:rw"
        "/etc/localtime:/etc/localtime:ro"
      ];
      ports = [
        "25:25/tcp"
        "143:143/tcp"
        "465:465/tcp"
        "587:587/tcp"
        "993:993/tcp"
      ];
      log-driver = "journald";
      extraOptions = [
        "--cap-add=NET_ADMIN"
        "--hostname=mail.voidarc.co.uk"
        "--network-alias=mail"
        "--network=mail_default"
      ];
    };
    systemd.services."podman-mailserver" = {
      serviceConfig = {
        Restart = pkgs.lib.mkOverride 90 "always";
      };
      after = [
        "podman-network-mail_default.service"
      ];
      requires = [
        "podman-network-mail_default.service"
      ];
      partOf = [
        "podman-compose-mail-root.target"
      ];
      wantedBy = [
        "podman-compose-mail-root.target"
      ];
    };

    # Networks
    systemd.services."podman-network-mail_default" = {
      path = [pkgs.podman];
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
        ExecStop = "podman network rm -f mail_default";
      };
      script = ''
        podman network inspect mail_default || podman network create mail_default
      '';
      partOf = ["podman-compose-mail-root.target"];
      wantedBy = ["podman-compose-mail-root.target"];
    };

    # Root service
    # When started, this will automatically create all resources and start
    # the containers. When stopped, this will teardown all resources.
    systemd.targets."podman-compose-mail-root" = {
      unitConfig = {
        Description = "Root target generated by compose2nix.";
      };
      wantedBy = ["multi-user.target"];
    };
  });
}