{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.services.mbrts;

  accountSubmodule = {
    options = {
      name = lib.mkOption {
        type = lib.types.str;
        description = "Account name (used for state file and mbsync channel).";
      };
      maildirPath = lib.mkOption {
        type = lib.types.str;
        description = "Path to the local Maildir root for this account.";
      };
      mbsyncAccount = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        description = "mbsync channel/group name. Defaults to account name.";
      };
      passwordCommand = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        description = "Shell command that prints the JMAP bearer token.";
      };
      tokenFile = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        description = "Path to a file containing the JMAP bearer token.";
      };
      tokenEnv = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        description = "Environment variable containing the JMAP bearer token.";
      };
    };
  };

  toAccountConfig = a:
    {
      name = a.name;
      maildir_path = a.maildirPath;
    }
    // lib.optionalAttrs (a.mbsyncAccount != null) {mbsync_account = a.mbsyncAccount;}
    // lib.optionalAttrs (a.passwordCommand != null) {password_command = a.passwordCommand;}
    // lib.optionalAttrs (a.tokenFile != null) {token_file = a.tokenFile;}
    // lib.optionalAttrs (a.tokenEnv != null) {token_env = a.tokenEnv;};

  yamlFormat = pkgs.formats.yaml {};

  configFile = yamlFormat.generate "mbrts-config.yaml" {
    log_level = cfg.logLevel;
    accounts = map toAccountConfig cfg.accounts;
  };
in {
  options.services.mbrts = {
    enable = lib.mkEnableOption "mbrts real-time JMAP mail delivery";

    package = lib.mkOption {
      type = lib.types.package;
      default = pkgs.mbrts;
      description = "The mbrts package to use.";
    };

    logLevel = lib.mkOption {
      type = lib.types.enum ["debug" "info" "warn" "error"];
      default = "info";
      description = "Log verbosity level.";
    };

    accounts = lib.mkOption {
      type = lib.types.listOf (lib.types.submodule accountSubmodule);
      default = [];
      description = "Mail accounts to watch.";
    };
  };

  config = lib.mkIf cfg.enable {
    systemd.user.services.mbrts = {
      Unit = {
        Description = "mbrts real-time JMAP mail delivery";
        After = ["network-online.target"];
        Wants = ["network-online.target"];
      };
      Service = {
        ExecStart = "${cfg.package}/bin/mbrts --config ${configFile}";
        Restart = "on-failure";
        RestartSec = "10s";
      };
      Install = {
        WantedBy = ["default.target"];
      };
    };
  };
}