Check release version compat

To move into a better position to align this project with nixpkgs
unstable breaking changes we now default to require a matching nixpkgs
release.

default.nix

@@ -41,6 +41,21 @@ in
   options.mailserver = {
     enable = mkEnableOption "nixos-mailserver";
 
+    enableNixpkgsReleaseCheck = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to check for a release mismatch between NixOS mailserver and
+        Nixpkgs.
+
+        Using mismatched versions is likely to cause compatibility issues
+        and may require migrations that make an eventual rollback tricky.
+
+        It is therefore highly recommended to use a release of NixOS mailserver
+        that corresponds with your chosen release of Nixpkgs.
+      '';
+    };
+
     stateVersion = mkOption {
       type = types.nullOr types.ints.positive;
       default = null;

mail-server/assertions.nix

@@ -3,7 +3,34 @@
   lib,
   ...
 }:
+
+let
+  mailserverRelease = "25.11";
+  nixpkgsRelease = lib.trivial.release;
+  releaseMismatch =
+    config.mailserver.enableNixpkgsReleaseCheck && mailserverRelease != nixpkgsRelease;
+in
+
 {
+  warnings = lib.optional releaseMismatch ''
+    You are using
+
+      NixOS Mailserver version ${mailserverRelease} and
+      Nixpkgs version ${nixpkgsRelease}.
+
+    Using mismatched versions is likely to cause compatibility issues
+    and may require migrations that make an eventual rollback tricky.
+
+    It is therefore highly recommended to use a release of
+    NixOS mailserver that corresponds with your chosen release of Nixpkgs.
+
+    If you insist then you can disable this warning by adding
+
+      mailserver.enableNixpkgsReleaseCheck = false;
+
+    to your configuration.
+  '';
+
   # We guard all assertions by requiring mailserver to be actually enabled
   assertions = lib.optionals config.mailserver.enable (
     [