]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/dovecot.nix
losurdo: move everything from the SD card to the NVMe
[sourcephile-nix.git] / servers / mermet / dovecot.nix
1 { pkgs, lib, config, system, ... }:
2 let
3 inherit (builtins) toString toFile readFile;
4 inherit (builtins.extraBuiltins) pass;
5 inherit (lib) types;
6 inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
7 inherit (config) networking;
8 inherit (config.services) dovecot2 postfix openldap;
9
10 # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
11 stateDir = "/var/lib/dovecot";
12
13 sieve_pipe_bin_dir = pkgs.buildEnv {
14 name = "sieve_pipe_bin_dir";
15 pathsToLink = [ "/bin" ];
16 paths = [
17 learn-spam
18 learn-ham
19 ];
20 };
21 learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
22 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
23 '';
24 learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
25 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
26 '';
27
28 dovecot-virtual = pkgs.buildEnv {
29 name = "dovecot-virtual";
30 pathsToLink = [ "/" ];
31 paths = [
32 dovecot-virtual-all
33 dovecot-virtual-recents
34 ];
35 };
36 dovecot-virtual-all = pkgs.writeTextFile {
37 name = "dovecot-virtual-all";
38 destination = "/All/dovecot-virtual";
39 text = ''
40 *
41 all
42 '';
43 };
44 dovecot-virtual-recents = pkgs.writeTextFile {
45 name = "dovecot-virtual-recents";
46 destination = "/Recents/dovecot-virtual";
47 text = ''
48 *
49 all younger 172800
50 '';
51 };
52 dovecot-virtual-pop3 = pkgs.writeTextFile {
53 name = "dovecot-virtual-pop3";
54 destination = "/pop3/INBOX/dovecot-virtual";
55 text = ''
56 All
57 All+*
58 all
59 '';
60 };
61 in
62 {
63 imports = [
64 dovecot/sourcephile.fr.nix
65 dovecot/autogeree.net.nix
66 ];
67 users.groups.acme.members = [ dovecot2.user ];
68 systemd.services.dovecot2 = {
69 after = [
70 "postfix.service"
71 "openldap.service"
72 ];
73 /*
74 preStart = ''
75 # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
76 install -D -d -m 0771 \
77 -o "${dovecot2.user}" \
78 -g "${dovecot2.group}" \
79 ${stateDir}/mail
80 '';
81 */
82 };
83 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
84 services.dovecot2 = {
85 enable = true;
86 modules = [
87 pkgs.dovecot_pigeonhole
88 pkgs.dovecot_fts_xapian
89 ];
90 enablePAM = false;
91 enableImap = true;
92 enableLmtp = true;
93 enablePop3 = false;
94 protocols = [ "sieve" ];
95 # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
96 # Here INDEX and CONTROL are separated,
97 # it's not useful since there is no quota at the filesystem level
98 # it's just to let this possibility later on.
99 mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
100 createMailUser = false;
101 mailUser = "";
102 mailGroup = "";
103 sslServerCert = null;
104 sieveScripts = {
105 global = dovecot/sieve/global;
106 };
107 extraConfig = ''
108 auth_verbose = no
109 auth_debug = no
110 mail_debug = no
111 verbose_ssl = no
112 log_timestamp = "%Y-%m-%d %H:%M:%S "
113
114 ssl = required
115 ssl_dh = <${../../../sec/openssl/dh.pem}
116 ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
117 ssl_prefer_server_ciphers = yes
118 ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
119 ssl_key = </var/lib/acme/${networking.domain}/key.pem
120 #ssl_ca = <''${caPath}
121 #ssl_verify_client_cert = yes
122
123 listen = *
124 # If needed, may be overrided by userdb_mail
125 mail_home = ${stateDir}/home/%d/%n
126 # Read multiple mails in parallel, improves performance
127 mail_prefetch_count = 20
128 # Default VSZ (virtual memory size) limit for service processes. This is mainly
129 # intended to catch and kill processes that leak memory before they eat up everything.
130 # Increased for fts_xapian.
131 default_vsz_limit = 1G
132
133 # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
134 # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
135 # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
136 # when in fact, storing the password in the directory server using a Salted SHA-2 hash
137 # and transmitting the clear text password over a secure connection
138 # is more secure than having the directory server store the password in clear text
139 # or in a reversible encryption scheme.
140 # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
141 # Use doveadm pw -s SSHA
142 # or doveadm pw -s PBKDF2 -r 10000
143 # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
144 auth_mechanisms = plain login
145 auth_username_format = %Ln
146 service auth {
147 user = ${dovecot2.user}
148 # auth_socket_path points to this userdb socket by default. It's typically
149 # used by dovecot-lda, doveadm, possibly imap process, etc.
150 # Users that have access to this socket are able to get a list
151 # of all usernames and get results of everyone's userdb lookups.
152 unix_listener auth-userdb {
153 user = ${dovecot2.user}
154 group = ${dovecot2.group}
155 mode = 0660
156 }
157 unix_listener /var/lib/postfix/queue/private/auth {
158 user = ${postfix.user}
159 group = ${postfix.group}
160 mode = 0660
161 }
162 }
163 service auth-worker {
164 user = ${dovecot2.user}
165 }
166 auth_cache_verify_password_with_worker = yes
167 # SEE: http://wiki2.dovecot.org/Quota/FS
168 # NOTE: postfix does not supply a client cert.
169 auth_ssl_require_client_cert = no
170 #auth_ssl_username_from_cert = yes
171 # NOTE: lowercase the username, help with LDAP?
172 auth_username_format = %Lu
173 # NOTE: sync with LDAP's data.
174 first_valid_uid = 1000
175 disable_plaintext_auth = yes
176
177 userdb {
178 driver = ldap
179 # A different path than passdb's args enables non-blocking LDAP requests
180 args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
181 default_fields =
182 override_fields =
183 }
184
185 # No dirty syncs for maildir: locations which may be used directly by neomutt
186 maildir_very_dirty_syncs = no
187 namespace Inbox {
188 type = private
189 inbox = yes
190 hidden = no
191 list = yes
192 prefix =
193 separator = +
194 }
195 namespace Shared {
196 type = shared
197 #list = children
198 # NOTE: always listed in the LIST command.
199 list = yes
200 # NOTE: how to access the other users' mailboxes.
201 # NOTE: %var expands to the logged in user's variable, while
202 # %%var expands to the other users' variables.
203 # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
204 location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
205 prefix = Partages+%%n+
206 separator = +
207 subscriptions = yes
208 }
209 mail_plugins = $mail_plugins virtual
210 namespace Virtual {
211 prefix = Virtual+
212 separator = +
213 hidden = no
214 list = yes
215 subscriptions = no
216 location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
217 }
218
219 mail_plugins = $mail_plugins acl
220 plugin {
221 acl = vfile:/etc/dovecot/acl/global
222 acl_anyone = allow
223 # NOTE: to let users LIST mailboxes shared by other users,
224 # Dovecot needs a shared mailbox dictionary.
225 # FIXME: %d not working with userdb ldap
226 acl_shared_dict = file:${stateDir}/acl/%d/acl.db
227 }
228
229 mail_plugins = $mail_plugins fts fts_xapian
230 plugin {
231 plugin = fts fts_xapian
232 fts = xapian
233 fts_autoindex = yes
234 fts_autoindex_exclude = \Junk
235 fts_autoindex_exclude2 = \Trash
236 fts_enforced = yes
237 # 2 and 20 are the NGram values for header fields, which means the
238 # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
239 # Full words are also added by default.
240 fts_xapian = partial=2 full=20 verbose=0
241 }
242
243 mail_plugins = $mail_plugins quota
244 plugin {
245 quota = maildir:User quota
246 quota_rule = *:storage=256M
247 quota_rule2 = Trash:storage=+64M
248 quota_max_mail_size = 20M
249 #quota_exceeded_message = </path/to/quota_exceeded_message.txt
250 quota_warning = storage=95%% quota-warning 95 %u
251 quota_warning2 = storage=80%% quota-warning 80 %u
252 quota_warning3 = -storage=100%% quota-warning below %u
253 }
254
255 protocol lda {
256 hostname = ${networking.domain}
257 mail_plugins = $mail_plugins sieve
258 postmaster_address = postmaster+dovecot+lda@${networking.domain}
259 syslog_facility = mail
260 }
261 lda_mailbox_autocreate = yes
262 lda_mailbox_autosubscribe = yes
263
264 protocol lmtp {
265 mail_plugins = $mail_plugins sieve
266 postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
267 }
268 service lmtp {
269 process_min_avail = ${toString config.nix.maxJobs}
270 unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
271 user = ${postfix.user}
272 group = ${postfix.group}
273 mode = 0600
274 }
275 }
276 plugin {
277 # Let extension.sieve do the handling of the detail
278 #lmtp_save_to_detail_mailbox = yes
279 recipient_delimiter = ${postfix.recipientDelimiter}
280 }
281
282 service imap {
283 # Most of the memory goes to mmap()ing files.
284 # You may need to increase this limit if you have huge mailboxes.
285 #vsz_limit =
286 process_limit = 1024
287 }
288 service imap-login {
289 #inet_listener imap {
290 # address = 127.0.0.1
291 # port = 143
292 # ssl = no
293 #}
294 inet_listener imaps {
295 port = 993
296 ssl = yes
297 }
298 }
299 # Store METADATA information within user's HOME directory
300 mail_attribute_dict = file:%h/dovecot-attributes
301 # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
302 imapc_features = $imapc_features fetch-headers
303 protocol imap {
304 #mail_max_userip_connections = 10
305 mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
306 imap_metadata = yes
307
308 # DOC: https://wiki.dovecot.org/MailboxSettings
309 # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
310 # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
311 imap_capability = +SPECIAL-USE
312
313 namespace Inbox {
314 mailbox "Archives" {
315 auto = subscribe
316 special_use = \Archive
317 }
318 mailbox "Drafts" {
319 auto = no
320 special_use = \Drafts
321 }
322 mailbox "Brouillons" {
323 auto = subscribe
324 special_use = \Drafts
325 }
326 mailbox "Junk" {
327 auto = no
328 #autoexpunge = 30d
329 special_use = \Junk
330 }
331 mailbox "Spams" {
332 auto = no
333 special_use = \Junk
334 }
335 mailbox "Spam" {
336 auto = no
337 special_use = \Junk
338 }
339 mailbox "Pourriels" {
340 auto = no
341 special_use = \Junk
342 }
343 mailbox "Pourriel" {
344 auto = no
345 special_use = \Junk
346 }
347 mailbox "Sent" {
348 auto = no
349 special_use = \Sent
350 }
351 mailbox "Sent Items" {
352 auto = no
353 special_use = \Sent
354 }
355 mailbox "Sent Messages" {
356 auto = no
357 special_use = \Sent
358 }
359 mailbox "Envoyés" {
360 auto = no
361 special_use = \Sent
362 }
363 mailbox "Trash" {
364 auto = no
365 special_use = \Trash
366 #autoexpunge = 30d
367 }
368 mailbox "Corbeille" {
369 auto = no
370 special_use = \Trash
371 }
372 }
373 namespace Virtual {
374 mailbox All {
375 auto = no
376 comment = All messages from all mailboxes
377 # This flag is confused with \Archives by K9-Mail
378 special_use = \All
379 }
380 mailbox Recents {
381 auto = no
382 comment = All messages from all mailboxes, arrived in the past 48h
383 }
384 }
385 }
386 plugin {
387 sieve_plugins = sieve_imapsieve sieve_extprograms
388 sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
389 #sieve_extensions = +editheader
390 sieve = file:~/sieve;active=~/active.sieve
391 sieve_default = file:${stateDir}/sieve/global/default.sieve
392 sieve_default_name = main
393 sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
394 sieve_max_script_size = 1M
395 sieve_quota_max_scripts = 0
396 sieve_quota_max_storage = 10M
397 #sieve_spamtest_max_value = 10
398 #sieve_spamtest_status_header = X-Spam-Score
399 #sieve_spamtest_status_type = strlen
400 #sieve_user_log = ~/sieve.log
401 # Enables support for user Sieve scripts in IMAP
402 #imapsieve_url = sieve://mail.${networking.domain}:4190
403
404 # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
405 imapsieve_mailbox1_name = *
406 imapsieve_mailbox1_causes = FLAG
407 imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
408
409 # From elsewhere to Junk folder
410 imapsieve_mailbox2_name = Pourriel
411 imapsieve_mailbox2_causes = COPY APPEND
412 imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
413
414 # From Junk folder to elsewhere
415 imapsieve_mailbox3_name = *
416 imapsieve_mailbox3_from = Pourriel
417 imapsieve_mailbox3_causes = COPY
418 imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
419 }
420 protocol sieve {
421 # Maximum number of ManageSieve connections allowed for a user from each IP address.
422 # NOTE: The username is compared case-sensitively.
423 mail_max_userip_connections = 10
424
425 # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
426 # the IMPLEMENTATION capability that the dovecot reports to clients.
427 # For example: 'Cyrus timesieved v2.2.13'
428 managesieve_implementation_string = Dovecot Pigeonhole
429
430 # The maximum number of compile errors that are returned to the client upon script
431 # upload or script verification.
432 managesieve_max_compile_errors = 5
433
434 #mail_max_userip_connections = 10
435 #managesieve_implementation_string = Dovecot Pigeonhole
436 managesieve_max_compile_errors = 5
437 #managesieve_max_line_length = 65536
438 #managesieve_notify_capability = mailto
439 #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
440 }
441 service managesieve-login {
442 inet_listener sieve {
443 port = 4190
444 #ssl = yes
445 }
446
447 # Number of connections to handle before starting a new process. Typically
448 # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
449 # is faster. <doc/wiki/LoginProcess.txt>
450 service_count = 1
451
452 # Number of processes to always keep waiting for more connections.
453 process_min_avail = 0
454
455 # If you set service_count=0, you probably need to grow this.
456 #vsz_limit = 64M
457 }
458
459 service quota-warning {
460 executable = script ${
461 pkgs.writeShellScript "quota-warning" ''
462 set -eu
463 PERCENT=$1
464 USER=$2
465 cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
466 "plugin/quota=maildir:User quota:noenforcing"
467 From: postmaster@${networking.domain}
468 Subject: [WARNING] your mailbox is now $PERCENT% full.
469
470 Please remove some mails to make room for new ones.
471 EOF
472 ''
473 }
474 # use some unprivileged user for executing the quota warnings
475 user = ${dovecot2.user}
476 unix_listener quota-warning {
477 }
478 }
479
480 protocol pop3 {
481 mail_plugins = $mail_plugins virtual
482 #mail_max_userip_connections = 10
483 # Virtual namespace for the virtual INBOX.
484 # Use a global directory for dovecot-virtual files.
485 #namespace Inbox {
486 # hidden = yes
487 # list = no
488 # location = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
489 # prefix = pop3+
490 #}
491 pop3_client_workarounds =
492 pop3_fast_size_lookups = yes
493 pop3_lock_session = yes
494 pop3_no_flag_updates = yes
495 # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
496 pop3_uidl_format = %g
497 }
498 service pop3 {
499 process_limit = 1024
500 }
501 service pop3-login {
502 inet_listener pop3s {
503 port = 995
504 ssl = yes
505 }
506 }
507 '';
508 };
509 }