{
  config,
  lib,
  pkgs,
  ...
}:
with (import ./common.nix {inherit config;}); let
  cfg = config.mailsystem;
  nginxcfg = config.services.nginx;
  postfixCfg = config.services.postfix;
  redisCfg = config.services.redis.servers.rspamd;
  rspamdCfg = config.services.rspamd;

  genSystemdSocketCfg = name: socketPath: additionalUser: {
    description = "rspamd ${name} worker socket";
    listenStreams = [socketPath];
    requiredBy = ["rspamd.service"];
    socketConfig = {
      Service = "rspamd.service";
      SocketUser = rspamdCfg.user;
      SocketMode = 0600;
      ExecStartPost =
        lib.mkIf (additionalUser != "")
        ''${pkgs.acl.bin}/bin/setfacl -m "u:${additionalUser}:rw" "${socketPath}"'';
    };
  };
in {
  config = lib.mkIf cfg.enable {
    services.rspamd = {
      enable = true;
      overrides = {
        "classifier-bayes.conf" = {
          text = ''
            autolearn {
              spam_threshold = 6.0 # When to learn spam (score >= threshold)
              ham_threshold = -2.0 # When to learn ham (score <= threshold)
            }
          '';
        };
        "milter_headers.conf" = {
          text = ''
            # Add headers related to spam-detection
            extended_spam_headers = true;
          '';
        };
        "redis.conf" = {
          text = ''
            servers = "${redisCfg.unixSocket}";
          '';
        };
      };

      workers = {
        rspamd_proxy = {
          bindSockets = ["systemd:rspamd-proxy.socket"];
          count = 1; # Do not spawn too many processes of this type
          extraConfig = ''
            milter = yes; # Enable milter mode
            timeout = 120s; # Needed for Milter usually

            upstream "local" {
              default = yes; # Self-scan upstreams are always default
              self_scan = yes; # Enable self-scan
            }
          '';
        };

        controller = {
          count = 1;
          bindSockets = ["systemd:rspamd-controller.socket"];
          extraConfig = ''
            static_dir = "''${WWWDIR}"; # Serve the web UI static assets
          '';
        };
      };
    };

    systemd.sockets = {
      rspamd-proxy = genSystemdSocketCfg "proxy" rspamdProxySocket postfixCfg.user;
      rspamd-controller = genSystemdSocketCfg "controller" rspamdControllerSocket "";
    };

    systemd.services.rspamd = {
      requires = ["redis-rspamd.service"];
      after = ["redis-rspamd.service"];
    };
  };
}