{
  lib,
  config,
  ...
}: {
  services.roundcube = {
    enable = true;
    hostName = "roundcube.procopius.dk";
    extraConfig = ''
      # starttls needed for authentication, so the fqdn required to match
      # the certificate
      $config['smtp_host'] = "tls://${config.mailserver.fqdn}";
      $config['smtp_user'] = "%u";
      $config['smtp_pass'] = "%p";
    '';
  };

  services.nginx.virtualHosts."roundcube.procopius.dk" = {
    forceSSL = lib.mkForce false;
    enableACME = lib.mkForce false;
  };
}