{
  kubernetes.resources = {
    deployments.inbucket = {
      metadata.labels.app = "inbucket";

      spec = {
        selector.matchLabels.app = "inbucket";

        template = {
          metadata.labels.app = "inbucket";

          spec = {
            containers.inbucket = {
              image = "inbucket/inbucket:edge";

              # TODO: investigate the use of named ports.
              ports = [
                {
                  containerPort = 9000;
                  protocol = "TCP";
                }
                {
                  containerPort = 2500;
                  protocol = "TCP";
                }
              ];
            };
          };
        };
      };
    };

    services = {
      inbucket-web.spec = {
        selector.app = "inbucket";

        ports = [{
          protocol = "TCP";
          port = 80;
          targetPort = 9000;
        }];
      };

      inbucket-email.spec = {
        type = "LoadBalancer";
        loadBalancerIP = "192.168.30.130";
        selector.app = "inbucket";

        ports = [{
          port = 25;
          targetPort = 2500;
        }];
      };
    };

    ingresses.inbucket = {
      metadata.annotations = {
        "cert-manager.io/cluster-issuer" = "letsencrypt";
        "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
      };

      spec = {
        ingressClassName = "traefik";

        rules = [{
          host = "inbucket.kun.is";

          http.paths = [{
            path = "/";
            pathType = "Prefix";

            backend.service = {
              name = "inbucket-web";
              port.number = 80;
            };
          }];
        }];

        tls = [{
          secretName = "inbucket-tls";
          hosts = [ "inbucket.kun.is" ];
        }];
      };
    };
  };
}