{pkgs, ...}: {
  environment.systemPackages = [pkgs.hydroxide];
  networking.firewall.allowedTCPPorts = [1025 1143];

  systemd.services.hydroxide = {
    enable = true;
    wantedBy = [
      "multi-user.target"
    ];
    description = "A third-party, open-source ProtonMail bridge";

    serviceConfig = {
      User = "notoh";
      ExecStart = "${pkgs.hydroxide}/bin/hydroxide -disable-carddav serve";
      Restart = "always";
      RestartSec = 30;
    };
  };
}