{ lib, modulesPath, ... }: {
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
  ];

  deployment.targetHost = "mail.infra.forkos.org";

  bagel.services.mail.enable = true;
  bagel.sysadmin.enable = true;

  networking = {
    hostName = "mail";
    domain = "infra.forkos.org";
    dhcpcd.enable = false;
    useNetworkd = true;
    nameservers = [
      # hetzner
      "2a01:4ff:ff00::add:2"
      "2a01:4ff:ff00::add:1"
    ];
  };

  systemd.network = {
    networks = {
      "10-wan" = {
        matchConfig.Name = "enp1s0";
        address = [
          "49.13.86.172/32"
          "2a01:4f8:1c17:6866::1/64"
          "fe80::9400:3ff:feba:39b9/64"
        ];
        routes = [
          { Gateway = "fe80::1"; }
          { Destination = "172.31.1.1"; }
          {
            Gateway = "172.31.1.1";
            GatewayOnLink = true;
          }
        ];
        linkConfig.RequiredForOnline = "routable";
      };
    };
  };

  boot.loader.grub.device = "/dev/sda";
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
  boot.initrd.kernelModules = [ "nvme" ];
  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };

  system.stateVersion = "23.11";
}