{...}: {
  config.flake.modules.homeManager.mail = {
    lib,
    config,
    pkgs,
    ...
  }: let
    default_account_params = {
      realName = "Aner Zakobar";
      mbsync = {
        enable = true;
        create = "maildir";
        remove = "both";
        expunge = "both";
      };
      msmtp.enable = true;
    };
    default_gmail_params =
      default_account_params
      // {
        flavor = "gmail.com";
      };
    default_smtp = {
      tls = {
        enable = true;
        useStartTls = true;
        certificatesFile = "/etc/ssl/certs/ca-certificates.crt";
      };
    };
  in {
    config = {
      azos.mail.enable = true;

      # mbsync's PassCmd shells out to `pass`, which needs the GPG smartcard to
      # decrypt -- only meaningful to gate on when the smartcard/YubiKey setup
      # is actually in play.
      azos.mail.presenceCheckCommand = lib.mkIf config.azos.encryption.yubikey.enable "${pkgs.azos-card-present}/bin/azos-card-present";

      accounts.email.accounts = {
        gmail =
          default_gmail_params
          // {
            address = "anerisgreat@gmail.com";
            userName = "anerisgreat";
            passwordCommand = "pass mbsync/anerisgreat@gmail.com | head -1";
          };
        bgu =
          default_gmail_params
          // {
            address = "anerz@post.bgu.ac.il";
            userName = "anerz@post.bgu.ac.il";
            passwordCommand = "pass mbsync/anerz@post.bgu.ac.il | head -1";
          };
        zakobar =
          default_account_params
          // {
            address = "aner@zakobar.com";
            primary = true;
            userName = "aner@zakobar.com";
            imap = {host = "mail.privateemail.com";};
            smtp =
              default_smtp
              // {
                port = 587;
                host = "mail.privateemail.com";
              };
            passwordCommand = "pass privateemail.com | head -1";
          };
      };
    };
  };
}