{ lib, ... }:
with lib; {
  options.local.pki.chains =
    let
      chainType = mkOption {
        type = types.path;
        readOnly = true;
      };
    in
    {
      mail-fullchain-crl = chainType;
    };

  config.local.pki.chains = {
    # Orden de concatenación de mail-fullchain-crl.crt:
    # - Issuing CA cert
    # - Issuing CA CRL
    # - Intermediate CA cert
    # - Intermediate CA CRL
    # - Root CA cert
    # - Root CA CRL
    mail-fullchain-crl = ./mail-fullchain-crl.crt;
  };
}