hosts/mermet/dovecot.nix

   1 { pkgs, lib, config, host, ... }:
   2 let
   3   inherit (builtins) toString;
   4   inherit (config) networking;
   5   inherit (config.services) dovecot2 postfix;
   6
   7   stateDir = "/var/lib/dovecot";
   8
   9   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  10     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  11   '';
  12   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  13     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  14   '';
  15
  16   dovecot-virtual = pkgs.buildEnv { name = "dovecot-virtual"; pathsToLink = [ "/" ]; paths = [ dovecot-virtual-all dovecot-virtual-recents ]; };
  17   dovecot-virtual-all = pkgs.writeTextFile { name = "dovecot-virtual-all"; destination = "/All/dovecot-virtual"; text = '' * all ''; };
  18   dovecot-virtual-recents = pkgs.writeTextFile {
  19     name = "dovecot-virtual-recents";
  20     destination = "/Recents/dovecot-virtual";
  21     text = ''
  22       *
  23         all younger 172800
  24     '';
  25   };
  26 in
  27 {
  28   imports = [
  29     dovecot/sourcephile.fr.nix
  30     dovecot/autogeree.net.nix
  31   ];
  32   environment.systemPackages = [
  33     pkgs.dovecot_pigeonhole
  34   ];
  35   users.groups.acme.members = [ dovecot2.user ];
  36   systemd.services.dovecot2 = {
  37     after = [
  38       "postfix.service"
  39       "openldap.service"
  40     ];
  41     /*
  42       preStart = ''
  43       # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
  44       install -D -d -m 0771 \
  45        -o "${dovecot2.user}" \
  46        -g "${dovecot2.group}" \
  47        ${stateDir}/mail
  48       '';
  49     */
  50     preStart = ''
  51       ln -fns -t ${stateDir}/virtual/ \
  52         ${dovecot-virtual-all}/All \
  53         ${dovecot-virtual-recents}/Recents
  54     '';
  55     serviceConfig = {
  56       #ExecStart = lib.mkForce "${pkgs.utillinux}/bin/setarch x86_64 --addr-no-randomize /bin/sh -c 'LD_PRELOAD=${pkgs.gcc-unwrapped.lib}/lib/libasan.so ${pkgs.dovecot}/sbin/dovecot -F'";
  57       # Dovecot2 does not work with environment.memoryAllocator.provider="scudo"
  58       # https://wiki.dovecot.org/Design/Memory
  59       # Scudo ERROR: CHECK failed at /build/compiler-rt-7.1.0.src/lib/scudo/../sanitizer_common/sanitizer_allocator_primary64.h:
  60       # 644 ((beg)) == ((address_range.MapOrDie(beg, size))) (4398046511092, 4398046507008)
  61       BindReadOnlyPaths = [ "/dev/null:/etc/ld-nix.so.preload" ];
  62       StateDirectory = [ "dovecot/virtual" ];
  63     };
  64   };
  65   #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  66   networking.nftables.ruleset = ''
  67     table inet filter {
  68       chain input-net {
  69         tcp dport imaps counter accept comment "dovecot: IMAPS"
  70         #tcp dport 995 counter accept comment "dovecot: POP3S"
  71         tcp dport sieve counter accept comment "dovecot: Sieve"
  72       }
  73     }
  74   '';
  75   fileSystems."/var/lib/dovecot" = {
  76     device = "rpool/var/mail";
  77     fsType = "zfs";
  78   };
  79   services.sanoid.datasets."rpool/var/mail" = {
  80     use_template = [ "snap" ];
  81     daily = 7;
  82   };
  83   services.dovecot2 = {
  84     enable = true;
  85     modules = [
  86       pkgs.dovecot_pigeonhole
  87       # Commented out because it uses too much disk space
  88       #pkgs.dovecot_fts_xapian
  89     ];
  90     enablePAM = false;
  91     enableImap = true;
  92     enableLmtp = true;
  93     enablePop3 = false;
  94     protocols = [ "sieve" ];
  95     # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
  96     # Here INDEX and CONTROL are separated,
  97     # it's not useful since there is no quota at the filesystem level
  98     # it's just to let this possibility later on.
  99     mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
 100     createMailUser = false;
 101     mailUser = "";
 102     mailGroup = "";
 103     sslServerCert = null;
 104     sieve = {
 105       plugins = [
 106         #"sieve_extprograms"
 107         "sieve_imapsieve"
 108       ];
 109       extensions = [
 110         "copy"
 111         "envelope"
 112         "environment"
 113         "fileinto"
 114         "imap4flags"
 115         "imapsieve"
 116         "include"
 117         "mailbox"
 118         "subaddress"
 119         "variables"
 120         "vnd.dovecot.environment"
 121       ];
 122       globalExtensions = [
 123         "vnd.dovecot.pipe"
 124       ];
 125       pipeBins = builtins.map lib.getExe [
 126         learn-ham
 127         learn-spam
 128       ];
 129       scripts = {
 130         global = dovecot/sieve/global;
 131       };
 132     };
 133     mailPlugins = {
 134       globally.enable = [
 135         "virtual"
 136         "acl"
 137         "quota"
 138         #"fts"
 139         #"fts_xapian"
 140       ];
 141       perProtocol = {
 142         lda.enable = [ "sieve" ];
 143         lmtp.enable = [ "sieve" ];
 144         imap.enable = [ "imap_acl" "imap_quota" "imap_sieve" "virtual" ];
 145         pop3.enable = [ "virtual" ];
 146       };
 147     };
 148     extraConfig = ''
 149       #auth_verbose = yes
 150       #auth_debug = yes
 151       #mail_debug = yes
 152       #verbose_ssl = yes
 153       log_timestamp = "%Y-%m-%d %H:%M:%S "
 154
 155       ssl = required
 156       ssl_dh = <${dovecot/dh4096.pem}
 157       ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 158       ssl_prefer_server_ciphers = yes
 159       ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
 160       ssl_key = </var/lib/acme/${networking.domain}/key.pem
 161       #ssl_ca = <''${caPath}
 162       #ssl_verify_client_cert = yes
 163       # FIXME: change to TLSv1.3 when supported by K-9 Mail
 164       ssl_min_protocol = TLSv1.2
 165
 166       listen = *
 167       mail_home = ${stateDir}/home/%d/%n
 168       # Read multiple mails in parallel, improves performance
 169       mail_prefetch_count = 20
 170
 171       # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
 172       # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
 173       # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
 174       # when in fact, storing the password in the directory server using a Salted SHA-2 hash
 175       # and transmitting the clear text password over a secure connection
 176       # is more secure than having the directory server store the password in clear text
 177       # or in a reversible encryption scheme.
 178       # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
 179       # Use doveadm pw -s SSHA
 180       # or doveadm pw -s PBKDF2 -r 10000
 181       # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
 182       auth_mechanisms = plain login
 183       auth_username_format = %Ln
 184       service auth {
 185         user = ${dovecot2.user}
 186         # auth_socket_path points to this userdb socket by default. It's typically
 187         # used by dovecot-lda, doveadm, possibly imap process, etc.
 188         # Users that have access to this socket are able to get a list
 189         # of all usernames and get results of everyone's userdb lookups.
 190         unix_listener auth-userdb {
 191           user  = ${dovecot2.user}
 192           group = ${dovecot2.group}
 193           mode  = 0660
 194         }
 195         unix_listener /var/lib/postfix/queue/private/auth {
 196           user  = ${postfix.user}
 197           group = ${postfix.group}
 198           mode  = 0660
 199         }
 200       }
 201       service auth-worker {
 202         user = ${dovecot2.user}
 203       }
 204       auth_cache_verify_password_with_worker = yes
 205       # SEE: http://wiki2.dovecot.org/Quota/FS
 206       # NOTE: postfix does not supply a client cert.
 207       auth_ssl_require_client_cert = no
 208       #auth_ssl_username_from_cert = yes
 209       # NOTE: lowercase the username, help with LDAP?
 210       auth_username_format = %Lu
 211       # NOTE: sync with LDAP's data.
 212       first_valid_uid = 1000
 213       disable_plaintext_auth = yes
 214
 215       userdb {
 216         driver = ldap
 217         # A different path than passdb's args enables non-blocking LDAP requests
 218         args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
 219         default_fields =
 220         override_fields =
 221       }
 222
 223       # No dirty syncs for maildir: locations which may be used directly by neomutt
 224       maildir_very_dirty_syncs = no
 225       namespace Inbox {
 226         type      = private
 227         inbox     = yes
 228         hidden    = no
 229         list      = yes
 230         prefix    =
 231         separator = +
 232       }
 233       namespace Shared {
 234         type = shared
 235         #list = children
 236         # NOTE: always listed in the LIST command.
 237         list = yes
 238         # NOTE: how to access the other users' mailboxes.
 239         # NOTE: %var expands to the logged in user's variable, while
 240         #       %%var expands to the other users' variables.
 241         # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 242         location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
 243         prefix = Partages+%%n+
 244         separator = +
 245         subscriptions = yes
 246       }
 247       namespace Virtual {
 248         prefix = Virtual+
 249         separator = +
 250         hidden = no
 251         list = yes
 252         subscriptions = no
 253         location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 254       }
 255
 256       plugin {
 257         acl = vfile:/etc/dovecot/acl/global
 258         acl_anyone = allow
 259         # NOTE: to let users LIST mailboxes shared by other users,
 260         #       Dovecot needs a shared mailbox dictionary.
 261         # FIXME: %d not working with userdb ldap
 262         acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 263       }
 264
 265       # Default VSZ (virtual memory size) limit for service processes. This is mainly
 266       # intended to catch and kill processes that leak memory before they eat up everything.
 267       # Increased for fts_xapian.
 268       #default_vsz_limit = 1G
 269       #plugin {
 270       #  # WARNING: doveadm fts rescan is buggy, it will delete the index:
 271       #  # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
 272       #  # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
 273       #  plugin = fts fts_xapian
 274       #  fts = xapian
 275       #  fts_autoindex = yes
 276       #  fts_autoindex_exclude = \Junk
 277       #  fts_autoindex_exclude2 = \Trash
 278       #  fts_enforced = yes
 279       #  # 2 and 20 are the NGram values for header fields, which means the
 280       #  # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 281       #  # Full words are also added by default.
 282       #  fts_xapian = partial=2 full=20 attachments=1 verbose=0
 283       #  fts_languages = en fr
 284       #  #fts_dovecot_fs = posix:prefix=%h/fts/
 285       #}
 286
 287       plugin {
 288         quota = maildir:User quota
 289         quota_rule = *:storage=256M
 290         quota_rule2 = Trash:storage=+64M
 291         quota_max_mail_size = 20M
 292         #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 293         quota_warning  = storage=95%% quota-warning 95 %u
 294         quota_warning2 = storage=80%% quota-warning 80 %u
 295         quota_warning3 = -storage=100%% quota-warning below %u
 296       }
 297
 298       protocol lda {
 299         hostname = ${networking.domain}
 300         postmaster_address = root+dovecot+lda@${networking.domain}
 301         syslog_facility = mail
 302       }
 303       lda_mailbox_autocreate = yes
 304       lda_mailbox_autosubscribe = yes
 305
 306       protocol lmtp {
 307         postmaster_address = root+dovecot+lmtp@${networking.domain}
 308       }
 309       service lmtp {
 310         process_min_avail = ${toString host.CPUs}
 311         unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 312           user  = ${postfix.user}
 313           group = ${postfix.group}
 314           mode  = 0600
 315         }
 316       }
 317       plugin {
 318         # Let extension.sieve do the handling of the detail
 319         #lmtp_save_to_detail_mailbox = yes
 320         recipient_delimiter = ${postfix.recipientDelimiter}
 321       }
 322
 323       service imap {
 324         # Most of the memory goes to mmap()ing files.
 325         # You may need to increase this limit if you have huge mailboxes.
 326         #vsz_limit =
 327         process_limit = 1024
 328       }
 329       service imap-login {
 330         #inet_listener imap {
 331         #  address = 127.0.0.1
 332         #  port    = 143
 333         #  ssl     = no
 334         #}
 335         inet_listener imaps {
 336           port = 993
 337           ssl  = yes
 338         }
 339       }
 340       # Store METADATA information within user's HOME directory
 341       mail_attribute_dict = file:%h/dovecot-attributes
 342       # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 343       imapc_features = $imapc_features fetch-headers
 344       protocol imap {
 345         #mail_max_userip_connections = 10
 346         imap_metadata = yes
 347
 348         # DOC: https://wiki.dovecot.org/MailboxSettings
 349         # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 350         # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 351         imap_capability = +SPECIAL-USE
 352
 353         namespace Inbox {
 354           mailbox "Archives" {
 355             auto = subscribe
 356             special_use = \Archive
 357           }
 358           mailbox "Drafts" {
 359             auto = no
 360             special_use = \Drafts
 361           }
 362           mailbox "Brouillons" {
 363             auto = subscribe
 364             special_use = \Drafts
 365           }
 366           mailbox "Junk" {
 367             auto = no
 368             #autoexpunge = 30d
 369             special_use = \Junk
 370           }
 371           mailbox "Spams" {
 372             auto = no
 373             special_use = \Junk
 374           }
 375           mailbox "Spam" {
 376             auto = no
 377             special_use = \Junk
 378           }
 379           mailbox "Pourriels" {
 380             auto = no
 381             special_use = \Junk
 382           }
 383           mailbox "Pourriel" {
 384             auto = no
 385             special_use = \Junk
 386           }
 387           mailbox "Sent" {
 388             auto = no
 389             special_use = \Sent
 390           }
 391           mailbox "Sent Items" {
 392             auto = no
 393             special_use = \Sent
 394           }
 395           mailbox "Sent Messages" {
 396             auto = no
 397             special_use = \Sent
 398           }
 399           mailbox "Envoyés" {
 400             auto = no
 401             special_use = \Sent
 402           }
 403           mailbox "Trash" {
 404             auto = no
 405             special_use = \Trash
 406             #autoexpunge = 30d
 407           }
 408           mailbox "Corbeille" {
 409             auto = no
 410             special_use = \Trash
 411           }
 412         }
 413         namespace Virtual {
 414           mailbox All {
 415             auto = no
 416             comment = All messages from all mailboxes
 417             # This flag is confused with \Archives by K9-Mail
 418             special_use = \All
 419           }
 420           mailbox Recents {
 421             auto = no
 422             comment = All messages from all mailboxes, arrived in the past 48h
 423           }
 424         }
 425       }
 426       plugin {
 427         sieve = file:~/sieve;active=~/active.sieve
 428         sieve_default = file:${stateDir}/sieve/global/default.sieve
 429         sieve_default_name = main
 430         sieve_max_script_size = 1M
 431         sieve_quota_max_scripts = 0
 432         sieve_quota_max_storage = 10M
 433         #sieve_spamtest_max_value = 10
 434         #sieve_spamtest_status_header = X-Spam-Score
 435         #sieve_spamtest_status_type = strlen
 436         #sieve_user_log = ~/active.sieve.log
 437         #sieve_trace_dir = ~/sieve-log
 438         #sieve_trace_level = matching
 439         # Enables support for user Sieve scripts in IMAP
 440         #imapsieve_url = sieve://mail.${networking.domain}:4190
 441
 442         # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 443         imapsieve_mailbox1_name = *
 444         imapsieve_mailbox1_causes = FLAG
 445         imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 446
 447         # From elsewhere to Junk folder
 448         imapsieve_mailbox2_name = Pourriel
 449         imapsieve_mailbox2_causes = COPY APPEND
 450         imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 451
 452         # From Junk folder to elsewhere
 453         imapsieve_mailbox3_name = *
 454         imapsieve_mailbox3_from = Pourriel
 455         imapsieve_mailbox3_causes = COPY
 456         imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 457       }
 458       protocol sieve {
 459         # Maximum number of ManageSieve connections allowed for a user from each IP address.
 460         # NOTE: The username is compared case-sensitively.
 461         mail_max_userip_connections = 10
 462
 463         # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 464         # the IMPLEMENTATION capability that the dovecot reports to clients.
 465         # For example: 'Cyrus timesieved v2.2.13'
 466         managesieve_implementation_string = Dovecot Pigeonhole
 467
 468         # The maximum number of compile errors that are returned to the client upon script
 469         # upload or script verification.
 470         managesieve_max_compile_errors = 5
 471
 472         #mail_max_userip_connections = 10
 473         #managesieve_implementation_string = Dovecot Pigeonhole
 474         managesieve_max_compile_errors = 5
 475         #managesieve_max_line_length = 65536
 476         #managesieve_notify_capability = mailto
 477         #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 478       }
 479       service managesieve-login {
 480         inet_listener sieve {
 481           port = 4190
 482           #ssl  = yes
 483         }
 484
 485         # Number of connections to handle before starting a new process. Typically
 486         # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 487         # is faster. <doc/wiki/LoginProcess.txt>
 488         service_count = 1
 489
 490         # Number of processes to always keep waiting for more connections.
 491         process_min_avail = 0
 492
 493         # If you set service_count=0, you probably need to grow this.
 494         #vsz_limit = 64M
 495       }
 496
 497       service quota-warning {
 498         executable = script ${
 499           pkgs.writeShellScript "quota-warning" ''
 500             set -eu
 501             PERCENT=$1
 502             USER=$2
 503             cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 504             "plugin/quota=maildir:User quota:noenforcing"
 505             From: root+docevot@${networking.domain}
 506             Subject: [WARNING] your mailbox is now $PERCENT% full.
 507
 508             Please remove some mails to make room for new ones.
 509             EOF
 510           ''
 511         }
 512         # use some unprivileged user for executing the quota warnings
 513         user = ${dovecot2.user}
 514         unix_listener quota-warning {
 515         }
 516       }
 517
 518       protocol pop3 {
 519         #mail_max_userip_connections = 10
 520         # Virtual namespace for the virtual INBOX.
 521         # Use a global directory for dovecot-virtual files.
 522         #namespace Inbox {
 523         #  hidden    = yes
 524         #  list      = no
 525         #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 526         #  prefix    = pop3+
 527         #}
 528         pop3_client_workarounds =
 529         pop3_fast_size_lookups = yes
 530         pop3_lock_session = yes
 531         pop3_no_flag_updates = yes
 532         # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 533         pop3_uidl_format = %g
 534       }
 535       service pop3 {
 536         process_limit = 1024
 537       }
 538       service pop3-login {
 539         inet_listener pop3s {
 540           port = 995
 541           ssl  = yes
 542         }
 543       }
 544     '';
 545   };
 546 }