]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/dovecot.nix
Add 1 git-crypt collaborator
[sourcephile-nix.git] / hosts / mermet / dovecot.nix
1 { inputs, pkgs, lib, config, system, host, ... }:
2 let
3 inherit (builtins) toString toFile readFile;
4 inherit (lib) types;
5 inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
6 inherit (config) networking;
7 inherit (config.services) dovecot2 postfix openldap;
8
9 # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
10 stateDir = "/var/lib/dovecot";
11
12 sieve_pipe_bin_dir = pkgs.buildEnv {
13 name = "sieve_pipe_bin_dir";
14 pathsToLink = [ "/bin" ];
15 paths = [
16 learn-spam
17 learn-ham
18 ];
19 };
20 learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
21 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
22 '';
23 learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
24 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
25 '';
26
27 dovecot-virtual = pkgs.buildEnv {
28 name = "dovecot-virtual";
29 pathsToLink = [ "/" ];
30 paths = [
31 dovecot-virtual-all
32 dovecot-virtual-recents
33 ];
34 };
35 dovecot-virtual-all = pkgs.writeTextFile {
36 name = "dovecot-virtual-all";
37 destination = "/All/dovecot-virtual";
38 text = ''
39 *
40 all
41 '';
42 };
43 dovecot-virtual-recents = pkgs.writeTextFile {
44 name = "dovecot-virtual-recents";
45 destination = "/Recents/dovecot-virtual";
46 text = ''
47 *
48 all younger 172800
49 '';
50 };
51 dovecot-virtual-pop3 = pkgs.writeTextFile {
52 name = "dovecot-virtual-pop3";
53 destination = "/pop3/INBOX/dovecot-virtual";
54 text = ''
55 All
56 All+*
57 all
58 '';
59 };
60 in
61 {
62 imports = [
63 dovecot/sourcephile.fr.nix
64 dovecot/autogeree.net.nix
65 ];
66 environment.systemPackages = [
67 pkgs.dovecot_pigeonhole
68 ];
69 users.groups.acme.members = [ dovecot2.user ];
70 systemd.services.dovecot2 = {
71 after = [
72 "postfix.service"
73 "openldap.service"
74 ];
75 /*
76 preStart = ''
77 # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
78 install -D -d -m 0771 \
79 -o "${dovecot2.user}" \
80 -g "${dovecot2.group}" \
81 ${stateDir}/mail
82 '';
83 */
84 preStart = ''
85 ln -fns -t ${stateDir}/virtual/ \
86 ${dovecot-virtual-all}/All \
87 ${dovecot-virtual-recents}/Recents
88 '';
89 serviceConfig = {
90 #ExecStart = lib.mkForce "${pkgs.utillinux}/bin/setarch x86_64 --addr-no-randomize /bin/sh -c 'LD_PRELOAD=${pkgs.gcc-unwrapped.lib}/lib/libasan.so ${pkgs.dovecot}/sbin/dovecot -F'";
91 # Dovecot2 does not work with environment.memoryAllocator.provider="scudo"
92 # https://wiki.dovecot.org/Design/Memory
93 # Scudo ERROR: CHECK failed at /build/compiler-rt-7.1.0.src/lib/scudo/../sanitizer_common/sanitizer_allocator_primary64.h:
94 # 644 ((beg)) == ((address_range.MapOrDie(beg, size))) (4398046511092, 4398046507008)
95 BindReadOnlyPaths = [ "/dev/null:/etc/ld-nix.so.preload" ];
96 StateDirectory = ["dovecot/virtual"];
97 };
98 };
99 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
100 networking.nftables.ruleset = ''
101 add rule inet filter net2fw tcp dport 993 counter accept comment "IMAPS"
102 #add rule inet filter net2fw tcp dport 995 counter accept comment "POP3S"
103 add rule inet filter net2fw tcp dport 4190 counter accept comment "Sieve"
104 '';
105 fileSystems."/var/lib/dovecot" = {
106 device = "rpool/var/mail";
107 fsType = "zfs";
108 };
109 services.sanoid.datasets."rpool/var/mail" = {
110 use_template = [ "snap" ];
111 daily = 7;
112 };
113 services.dovecot2 = {
114 enable = true;
115 modules = [
116 pkgs.dovecot_pigeonhole
117 pkgs.dovecot_fts_xapian
118 ];
119 enablePAM = false;
120 enableImap = true;
121 enableLmtp = true;
122 enablePop3 = false;
123 protocols = [ "sieve" ];
124 # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
125 # Here INDEX and CONTROL are separated,
126 # it's not useful since there is no quota at the filesystem level
127 # it's just to let this possibility later on.
128 mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
129 createMailUser = false;
130 mailUser = "";
131 mailGroup = "";
132 sslServerCert = null;
133 sieveScripts = {
134 global = dovecot/sieve/global;
135 };
136 extraConfig = ''
137 auth_verbose = no
138 auth_debug = no
139 mail_debug = no
140 verbose_ssl = no
141 log_timestamp = "%Y-%m-%d %H:%M:%S "
142
143 ssl = required
144 ssl_dh = <${inputs.secrets + "/openssl/dh.pem"}
145 ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
146 ssl_prefer_server_ciphers = yes
147 ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
148 ssl_key = </var/lib/acme/${networking.domain}/key.pem
149 #ssl_ca = <''${caPath}
150 #ssl_verify_client_cert = yes
151 # FIXME: change to TLSv1.3 when supported by K-9 Mail
152 ssl_min_protocol = TLSv1.2
153
154 listen = *
155 mail_home = ${stateDir}/home/%d/%n
156 # Read multiple mails in parallel, improves performance
157 mail_prefetch_count = 20
158 # Default VSZ (virtual memory size) limit for service processes. This is mainly
159 # intended to catch and kill processes that leak memory before they eat up everything.
160 # Increased for fts_xapian.
161 default_vsz_limit = 1G
162
163 # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
164 # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
165 # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
166 # when in fact, storing the password in the directory server using a Salted SHA-2 hash
167 # and transmitting the clear text password over a secure connection
168 # is more secure than having the directory server store the password in clear text
169 # or in a reversible encryption scheme.
170 # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
171 # Use doveadm pw -s SSHA
172 # or doveadm pw -s PBKDF2 -r 10000
173 # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
174 auth_mechanisms = plain login
175 auth_username_format = %Ln
176 service auth {
177 user = ${dovecot2.user}
178 # auth_socket_path points to this userdb socket by default. It's typically
179 # used by dovecot-lda, doveadm, possibly imap process, etc.
180 # Users that have access to this socket are able to get a list
181 # of all usernames and get results of everyone's userdb lookups.
182 unix_listener auth-userdb {
183 user = ${dovecot2.user}
184 group = ${dovecot2.group}
185 mode = 0660
186 }
187 unix_listener /var/lib/postfix/queue/private/auth {
188 user = ${postfix.user}
189 group = ${postfix.group}
190 mode = 0660
191 }
192 }
193 service auth-worker {
194 user = ${dovecot2.user}
195 }
196 auth_cache_verify_password_with_worker = yes
197 # SEE: http://wiki2.dovecot.org/Quota/FS
198 # NOTE: postfix does not supply a client cert.
199 auth_ssl_require_client_cert = no
200 #auth_ssl_username_from_cert = yes
201 # NOTE: lowercase the username, help with LDAP?
202 auth_username_format = %Lu
203 # NOTE: sync with LDAP's data.
204 first_valid_uid = 1000
205 disable_plaintext_auth = yes
206
207 userdb {
208 driver = ldap
209 # A different path than passdb's args enables non-blocking LDAP requests
210 args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
211 default_fields =
212 override_fields =
213 }
214
215 # No dirty syncs for maildir: locations which may be used directly by neomutt
216 maildir_very_dirty_syncs = no
217 namespace Inbox {
218 type = private
219 inbox = yes
220 hidden = no
221 list = yes
222 prefix =
223 separator = +
224 }
225 namespace Shared {
226 type = shared
227 #list = children
228 # NOTE: always listed in the LIST command.
229 list = yes
230 # NOTE: how to access the other users' mailboxes.
231 # NOTE: %var expands to the logged in user's variable, while
232 # %%var expands to the other users' variables.
233 # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
234 location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
235 prefix = Partages+%%n+
236 separator = +
237 subscriptions = yes
238 }
239 mail_plugins = $mail_plugins virtual
240 namespace Virtual {
241 prefix = Virtual+
242 separator = +
243 hidden = no
244 list = yes
245 subscriptions = no
246 location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
247 }
248
249 mail_plugins = $mail_plugins acl
250 plugin {
251 acl = vfile:/etc/dovecot/acl/global
252 acl_anyone = allow
253 # NOTE: to let users LIST mailboxes shared by other users,
254 # Dovecot needs a shared mailbox dictionary.
255 # FIXME: %d not working with userdb ldap
256 acl_shared_dict = file:${stateDir}/acl/%d/acl.db
257 }
258
259 mail_plugins = $mail_plugins fts fts_xapian
260 plugin {
261 # WARNING: doveadm fts rescan is buggy, it will delete the index:
262 # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
263 # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
264 plugin = fts fts_xapian
265 fts = xapian
266 fts_autoindex = yes
267 fts_autoindex_exclude = \Junk
268 fts_autoindex_exclude2 = \Trash
269 fts_enforced = yes
270 # 2 and 20 are the NGram values for header fields, which means the
271 # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
272 # Full words are also added by default.
273 fts_xapian = partial=2 full=20 attachments=1 verbose=0
274 fts_languages = en fr
275 #fts_dovecot_fs = posix:prefix=%h/fts/
276 }
277
278 mail_plugins = $mail_plugins quota
279 plugin {
280 quota = maildir:User quota
281 quota_rule = *:storage=256M
282 quota_rule2 = Trash:storage=+64M
283 quota_max_mail_size = 20M
284 #quota_exceeded_message = </path/to/quota_exceeded_message.txt
285 quota_warning = storage=95%% quota-warning 95 %u
286 quota_warning2 = storage=80%% quota-warning 80 %u
287 quota_warning3 = -storage=100%% quota-warning below %u
288 }
289
290 protocol lda {
291 hostname = ${networking.domain}
292 mail_plugins = $mail_plugins sieve
293 postmaster_address = root+dovecot+lda@${networking.domain}
294 syslog_facility = mail
295 }
296 lda_mailbox_autocreate = yes
297 lda_mailbox_autosubscribe = yes
298
299 protocol lmtp {
300 mail_plugins = $mail_plugins sieve
301 postmaster_address = root+dovecot+lmtp@${networking.domain}
302 }
303 service lmtp {
304 process_min_avail = ${toString host.CPUs}
305 unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
306 user = ${postfix.user}
307 group = ${postfix.group}
308 mode = 0600
309 }
310 }
311 plugin {
312 # Let extension.sieve do the handling of the detail
313 #lmtp_save_to_detail_mailbox = yes
314 recipient_delimiter = ${postfix.recipientDelimiter}
315 }
316
317 service imap {
318 # Most of the memory goes to mmap()ing files.
319 # You may need to increase this limit if you have huge mailboxes.
320 #vsz_limit =
321 process_limit = 1024
322 }
323 service imap-login {
324 #inet_listener imap {
325 # address = 127.0.0.1
326 # port = 143
327 # ssl = no
328 #}
329 inet_listener imaps {
330 port = 993
331 ssl = yes
332 }
333 }
334 # Store METADATA information within user's HOME directory
335 mail_attribute_dict = file:%h/dovecot-attributes
336 # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
337 imapc_features = $imapc_features fetch-headers
338 protocol imap {
339 #mail_max_userip_connections = 10
340 mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
341 imap_metadata = yes
342
343 # DOC: https://wiki.dovecot.org/MailboxSettings
344 # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
345 # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
346 imap_capability = +SPECIAL-USE
347
348 namespace Inbox {
349 mailbox "Archives" {
350 auto = subscribe
351 special_use = \Archive
352 }
353 mailbox "Drafts" {
354 auto = no
355 special_use = \Drafts
356 }
357 mailbox "Brouillons" {
358 auto = subscribe
359 special_use = \Drafts
360 }
361 mailbox "Junk" {
362 auto = no
363 #autoexpunge = 30d
364 special_use = \Junk
365 }
366 mailbox "Spams" {
367 auto = no
368 special_use = \Junk
369 }
370 mailbox "Spam" {
371 auto = no
372 special_use = \Junk
373 }
374 mailbox "Pourriels" {
375 auto = no
376 special_use = \Junk
377 }
378 mailbox "Pourriel" {
379 auto = no
380 special_use = \Junk
381 }
382 mailbox "Sent" {
383 auto = no
384 special_use = \Sent
385 }
386 mailbox "Sent Items" {
387 auto = no
388 special_use = \Sent
389 }
390 mailbox "Sent Messages" {
391 auto = no
392 special_use = \Sent
393 }
394 mailbox "Envoyés" {
395 auto = no
396 special_use = \Sent
397 }
398 mailbox "Trash" {
399 auto = no
400 special_use = \Trash
401 #autoexpunge = 30d
402 }
403 mailbox "Corbeille" {
404 auto = no
405 special_use = \Trash
406 }
407 }
408 namespace Virtual {
409 mailbox All {
410 auto = no
411 comment = All messages from all mailboxes
412 # This flag is confused with \Archives by K9-Mail
413 special_use = \All
414 }
415 mailbox Recents {
416 auto = no
417 comment = All messages from all mailboxes, arrived in the past 48h
418 }
419 }
420 }
421 plugin {
422 sieve_plugins = sieve_imapsieve sieve_extprograms
423 sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
424 #sieve_extensions = +editheader
425 sieve = file:~/sieve;active=~/active.sieve
426 sieve_default = file:${stateDir}/sieve/global/default.sieve
427 sieve_default_name = main
428 sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
429 sieve_max_script_size = 1M
430 sieve_quota_max_scripts = 0
431 sieve_quota_max_storage = 10M
432 #sieve_spamtest_max_value = 10
433 #sieve_spamtest_status_header = X-Spam-Score
434 #sieve_spamtest_status_type = strlen
435 #sieve_user_log = ~/sieve.log
436 # Enables support for user Sieve scripts in IMAP
437 #imapsieve_url = sieve://mail.${networking.domain}:4190
438
439 # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
440 imapsieve_mailbox1_name = *
441 imapsieve_mailbox1_causes = FLAG
442 imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
443
444 # From elsewhere to Junk folder
445 imapsieve_mailbox2_name = Pourriel
446 imapsieve_mailbox2_causes = COPY APPEND
447 imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
448
449 # From Junk folder to elsewhere
450 imapsieve_mailbox3_name = *
451 imapsieve_mailbox3_from = Pourriel
452 imapsieve_mailbox3_causes = COPY
453 imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
454 }
455 protocol sieve {
456 # Maximum number of ManageSieve connections allowed for a user from each IP address.
457 # NOTE: The username is compared case-sensitively.
458 mail_max_userip_connections = 10
459
460 # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
461 # the IMPLEMENTATION capability that the dovecot reports to clients.
462 # For example: 'Cyrus timesieved v2.2.13'
463 managesieve_implementation_string = Dovecot Pigeonhole
464
465 # The maximum number of compile errors that are returned to the client upon script
466 # upload or script verification.
467 managesieve_max_compile_errors = 5
468
469 #mail_max_userip_connections = 10
470 #managesieve_implementation_string = Dovecot Pigeonhole
471 managesieve_max_compile_errors = 5
472 #managesieve_max_line_length = 65536
473 #managesieve_notify_capability = mailto
474 #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
475 }
476 service managesieve-login {
477 inet_listener sieve {
478 port = 4190
479 #ssl = yes
480 }
481
482 # Number of connections to handle before starting a new process. Typically
483 # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
484 # is faster. <doc/wiki/LoginProcess.txt>
485 service_count = 1
486
487 # Number of processes to always keep waiting for more connections.
488 process_min_avail = 0
489
490 # If you set service_count=0, you probably need to grow this.
491 #vsz_limit = 64M
492 }
493
494 service quota-warning {
495 executable = script ${
496 pkgs.writeShellScript "quota-warning" ''
497 set -eu
498 PERCENT=$1
499 USER=$2
500 cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
501 "plugin/quota=maildir:User quota:noenforcing"
502 From: root+docevot@${networking.domain}
503 Subject: [WARNING] your mailbox is now $PERCENT% full.
504
505 Please remove some mails to make room for new ones.
506 EOF
507 ''
508 }
509 # use some unprivileged user for executing the quota warnings
510 user = ${dovecot2.user}
511 unix_listener quota-warning {
512 }
513 }
514
515 protocol pop3 {
516 mail_plugins = $mail_plugins virtual
517 #mail_max_userip_connections = 10
518 # Virtual namespace for the virtual INBOX.
519 # Use a global directory for dovecot-virtual files.
520 #namespace Inbox {
521 # hidden = yes
522 # list = no
523 # location = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
524 # prefix = pop3+
525 #}
526 pop3_client_workarounds =
527 pop3_fast_size_lookups = yes
528 pop3_lock_session = yes
529 pop3_no_flag_updates = yes
530 # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
531 pop3_uidl_format = %g
532 }
533 service pop3 {
534 process_limit = 1024
535 }
536 service pop3-login {
537 inet_listener pop3s {
538 port = 995
539 ssl = yes
540 }
541 }
542 '';
543 };
544 }