servers/mermet/dovecot.nix

   1 { pkgs, lib, config, system, ... }:
   2 let
   3   inherit (builtins) toString toFile;
   4   inherit (builtins.extraBuiltins) pass;
   5   inherit (lib) types;
   6   inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
   7   inherit (config) networking;
   8   inherit (config.services) dovecot2 postfix openldap;
   9
  10   # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
  11   stateDir    = "/var/lib/dovecot";
  12
  13   sieve_pipe_bin_dir = pkgs.buildEnv {
  14     name = "sieve_pipe_bin_dir";
  15     pathsToLink = [ "/bin" ];
  16     paths = [
  17       learn-spam
  18       learn-ham
  19     ];
  20   };
  21   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  22     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  23   '';
  24   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  25     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  26   '';
  27
  28   dovecot-virtual = pkgs.buildEnv {
  29     name = "dovecot-virtual";
  30     pathsToLink = [ "/" ];
  31     paths = [
  32       dovecot-virtual-all
  33       dovecot-virtual-recents
  34     ];
  35   };
  36   dovecot-virtual-all = pkgs.writeTextFile {
  37     name = "dovecot-virtual-all";
  38     destination = "/All/dovecot-virtual";
  39     text = ''
  40       *
  41         all
  42     '';
  43   };
  44   dovecot-virtual-recents = pkgs.writeTextFile {
  45     name = "dovecot-virtual-recents";
  46     destination = "/Recents/dovecot-virtual";
  47     text = ''
  48       *
  49         all younger 172800
  50     '';
  51   };
  52   dovecot-virtual-pop3 = pkgs.writeTextFile {
  53     name = "dovecot-virtual-pop3";
  54     destination = "/pop3/INBOX/dovecot-virtual";
  55     text = ''
  56       All
  57       All+*
  58         all
  59     '';
  60   };
  61 in
  62 {
  63 imports = [
  64   dovecot/autoconfig.nix
  65 ];
  66 systemd.services.dovecot2 = {
  67   after = [
  68     "postfix.service"
  69     "openldap.service"
  70     "${networking.domain}.key.pem-key.service"
  71   ];
  72 };
  73 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  74 services.dovecot2 = {
  75   enable    = true;
  76   modules   = [
  77     pkgs.dovecot_pigeonhole
  78     pkgs.dovecot_fts_xapian
  79   ];
  80   enablePAM = false;
  81   enableImap = true;
  82   enableLmtp = true;
  83   enablePop3 = true;
  84   protocols = [ "sieve" ];
  85   mailLocation = "sdbox:${stateDir}/mail/%d/%n/mail.d:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
  86   createMailUser = false;
  87   mailUser = "";
  88   mailGroup = "";
  89   sslServerCert = null;
  90   sieveScripts = {
  91     global = dovecot/sieve/global;
  92   };
  93   extraConfig = ''
  94     auth_verbose = no
  95     auth_debug = no
  96     mail_debug = yes
  97     verbose_ssl = no
  98     log_timestamp = "%Y-%m-%d %H:%M:%S "
  99
 100     ssl = required
 101     ssl_dh = <${../../../sec/openssl/dh.pem}
 102     ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 103     ssl_cert = <${loadFile (../../../sec + "/openssl/${networking.domain}/cert.self-signed.pem")}
 104     ssl_key = </run/keys/${networking.domain}.key.pem
 105     #ssl_ca = <''${caPath}
 106     #ssl_verify_client_cert = yes
 107
 108     listen = *
 109     # If needed, may be overrided by userdb_mail
 110     mail_home = ${stateDir}/mail/%d/%n
 111     # Read multiple mails in parallel, improves performance
 112     mail_prefetch_count = 20
 113     # Default VSZ (virtual memory size) limit for service processes. This is mainly
 114     # intended to catch and kill processes that leak memory before they eat up everything.
 115     # Increased for fts_xapian.
 116     default_vsz_limit = 1G
 117
 118     passdb {
 119       driver = ldap
 120       args = ${loadFile (dovecot/ldap + "/${networking.domainBase}.conf")}
 121       default_fields = userdb_mail_access_groups=${networking.domainBase}
 122       override_fields =
 123     }
 124     userdb {
 125       driver = prefetch
 126     }
 127     userdb {
 128       # NOTE: this userdb is only used by lda.
 129       driver = ldap
 130       args = ${loadFile (dovecot/ldap + "/${networking.domainBase}.conf")}
 131       default_fields = mail_access_groups=${networking.domainBase}
 132       override_fields =
 133       skip = found
 134     }
 135     service auth {
 136       # FIXME: may be user=dovecot-auth with LDAP?
 137       user = root
 138       unix_listener auth-userdb {
 139         user  = ${dovecot2.user}
 140         group = ${dovecot2.group}
 141         mode  = 0660
 142       }
 143       unix_listener /var/lib/postfix/queue/private/auth {
 144         user  = ${postfix.user}
 145         group = ${postfix.group}
 146         mode  = 0660
 147       }
 148     }
 149     auth_cache_verify_password_with_worker = yes
 150     # NOTE: if needed, may be overrided by userdb_mail
 151     # NOTE: INDEX and CONTROL are on a partition without quota, as explain in the doc.
 152     # SEE: http://wiki2.dovecot.org/Quota/FS
 153     auth_mechanisms = plain login
 154     # NOTE: postfix does not supply a client cert.
 155     auth_ssl_require_client_cert = no
 156     #auth_ssl_username_from_cert = yes
 157     # NOTE: lowercase the username, help with LDAP?
 158     auth_username_format = %Lu
 159     # NOTE: sync with LDAP's data.
 160     first_valid_uid = 1000
 161     disable_plaintext_auth = yes
 162
 163     #passdb {
 164     #  driver = passwd-file
 165     #  args   = scheme=crypt username_format=%n ${stateDir}/passwd/%d
 166     #}
 167     #userdb {
 168     #  # NOTE: this userdb is only used by LDA.
 169     #  driver = passwd-file
 170     #  args = username_format=%n ${stateDir}/passwd/%d
 171     #  #default_fields = home=${stateDir}/mail/%d/%n
 172     #  skip = found
 173     #}
 174
 175     # No dirty syncs for maildir: locations which may be used directly by neomutt
 176     maildir_very_dirty_syncs = no
 177     namespace Inbox {
 178       type      = private
 179       inbox     = yes
 180       hidden    = no
 181       list      = yes
 182       prefix    =
 183       separator = +
 184     }
 185     namespace Shared {
 186       type = shared
 187       #list = children
 188       # NOTE: always listed in the LIST command.
 189       list = yes
 190       # NOTE: how to access the other users' mailboxes.
 191       # NOTE: %var expands to the logged in user's variable, while
 192       #       %%var expands to the other users' variables.
 193       # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 194       location = sdbox:${stateDir}/mail/%%d/%%n/${stateDir}/mail.d:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/Shared:INDEX=${stateDir}/index/%%d/%%n/Shared:INDEXPVT=${stateDir}/index/%d/%n/Shared/%%n
 195       prefix = Partages+%%n+
 196       separator = +
 197       subscriptions = yes
 198     }
 199     mail_plugins = $mail_plugins virtual
 200     namespace Virtual {
 201       prefix = Virtual+
 202       separator = +
 203       hidden = no
 204       list = yes
 205       subscriptions = no
 206       location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 207     }
 208
 209     mail_plugins = $mail_plugins acl
 210     plugin {
 211       acl = vfile:/etc/dovecot/acl/global.d
 212       acl_anyone = allow
 213       # NOTE: to let users LIST mailboxes shared by other users,
 214       #       Dovecot needs a shared mailbox dictionary.
 215       # FIXME: %d not working with userdb ldap
 216       acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 217     }
 218
 219     mail_plugins = $mail_plugins fts fts_xapian
 220     plugin {
 221       plugin = fts fts_xapian
 222       fts = xapian
 223       fts_autoindex = yes
 224       fts_autoindex_exclude = \Junk
 225       fts_autoindex_exclude2 = \Trash
 226       fts_enforced = yes
 227       # 2 and 20 are the NGram values for header fields, which means the
 228       # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 229       # Full words are also added by default.
 230       fts_xapian = partial=2 full=20 verbose=0
 231     }
 232
 233     mail_plugins = $mail_plugins quota
 234     plugin {
 235       quota = maildir:User quota
 236       quota_rule = *:storage=256M
 237       quota_rule2 = Trash:storage=+64M
 238       quota_max_mail_size = 20M
 239       #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 240       quota_warning  = storage=95%% quota-warning 95 %u
 241       quota_warning2 = storage=80%% quota-warning 80 %u
 242       quota_warning3 = -storage=100%% quota-warning below %u
 243     }
 244
 245     protocol lda {
 246       auth_socket_path = /var/run/dovecot/auth-userdb
 247       hostname         = ${networking.domain}
 248       info_log_path    =
 249       log_path         =
 250       mail_plugins     = $mail_plugins sieve
 251       postmaster_address = postmaster+dovecot+lda@${networking.domain}
 252       syslog_facility = mail
 253     }
 254     lda_mailbox_autocreate = yes
 255     lda_mailbox_autosubscribe = yes
 256
 257     protocol lmtp {
 258       #info_log_path = /tmp/dovecot-lmtp.log
 259       mail_plugins = $mail_plugins sieve
 260       postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
 261     }
 262     service lmtp {
 263       #executable = lmtp -L
 264       process_min_avail = ${toString config.nix.maxJobs}
 265       unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 266         user  = ${postfix.user}
 267         group = ${postfix.group}
 268         mode  = 0600
 269       }
 270       #user = mail
 271     }
 272     plugin {
 273       # Let extension.sieve do the handling of the detail
 274       #lmtp_save_to_detail_mailbox = yes
 275       recipient_delimiter = ${postfix.recipientDelimiter}
 276     }
 277
 278     service imap {
 279       # Most of the memory goes to mmap()ing files.
 280       # You may need to increase this limit if you have huge mailboxes.
 281       #vsz_limit =
 282       process_limit = 1024
 283     }
 284     service imap-login {
 285       #inet_listener imap {
 286       #  address = 127.0.0.1
 287       #  port    = 143
 288       #  ssl     = no
 289       #}
 290       inet_listener imaps {
 291         port = 993
 292         ssl  = yes
 293       }
 294     }
 295     # Store METADATA information within user's HOME directory
 296     mail_attribute_dict = file:%h/dovecot-attributes
 297     # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 298     imapc_features = $imapc_features fetch-headers
 299     protocol imap {
 300       #mail_max_userip_connections = 10
 301       mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
 302       imap_metadata = yes
 303
 304       # DOC: https://wiki.dovecot.org/MailboxSettings
 305       # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 306       # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 307       imap_capability = +SPECIAL-USE
 308
 309       namespace Inbox {
 310         mailbox "Archives" {
 311           auto = subscribe
 312           special_use = \Archive
 313         }
 314         mailbox "Drafts" {
 315           auto = no
 316           special_use = \Drafts
 317         }
 318         mailbox "Brouillons" {
 319           auto = subscribe
 320           special_use = \Drafts
 321         }
 322         mailbox "Junk" {
 323           auto = no
 324           #autoexpunge = 30d
 325           special_use = \Junk
 326         }
 327         mailbox "Spams" {
 328           auto = no
 329           special_use = \Junk
 330         }
 331         mailbox "Spam" {
 332           auto = no
 333           special_use = \Junk
 334         }
 335         mailbox "Pourriels" {
 336           auto = no
 337           special_use = \Junk
 338         }
 339         mailbox "Pourriel" {
 340           auto = no
 341           special_use = \Junk
 342         }
 343         mailbox "Sent" {
 344           auto = no
 345           special_use = \Sent
 346         }
 347         mailbox "Sent Items" {
 348           auto = no
 349           special_use = \Sent
 350         }
 351         mailbox "Sent Messages" {
 352           auto = no
 353           special_use = \Sent
 354         }
 355         mailbox "Envoyés" {
 356           auto = no
 357           special_use = \Sent
 358         }
 359         mailbox "Trash" {
 360           auto = no
 361           special_use = \Trash
 362           #autoexpunge = 30d
 363         }
 364         mailbox "Corbeille" {
 365           auto = no
 366           special_use = \Trash
 367         }
 368       }
 369       namespace Virtual {
 370         mailbox All {
 371           auto = no
 372           comment = All messages from all mailboxes
 373           special_use = \All
 374         }
 375         mailbox Recents {
 376           auto = no
 377           comment = All messages from all mailboxes arrived in the past 48h
 378         }
 379       }
 380     }
 381     plugin {
 382       #sieve_default = file:${stateDir}/mail/%u/default.sieve
 383       #sieve_default_name = default
 384       sieve_plugins = sieve_imapsieve sieve_extprograms
 385       sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
 386       #sieve_extensions = +editheader
 387       sieve = file:~/sieve.d;active=~/sieve
 388       sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
 389       sieve_max_script_size = 1M
 390       sieve_quota_max_scripts = 0
 391       sieve_quota_max_storage = 10M
 392       #sieve_spamtest_max_value = 10
 393       #sieve_spamtest_status_header = X-Spam-Score
 394       #sieve_spamtest_status_type = strlen
 395       sieve_user_log = /var/log/dovecot/%d/sieve.%n.log
 396       # Enables support for user Sieve scripts in IMAP
 397       #imapsieve_url = sieve://mail.${networking.domain}:4190
 398
 399       # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 400       imapsieve_mailbox1_name = *
 401       imapsieve_mailbox1_causes = FLAG
 402       imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 403
 404       # From elsewhere to Junk folder
 405       imapsieve_mailbox2_name = Pourriel
 406       imapsieve_mailbox2_causes = COPY APPEND
 407       imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 408
 409       # From Junk folder to elsewhere
 410       imapsieve_mailbox3_name = *
 411       imapsieve_mailbox3_from = Pourriel
 412       imapsieve_mailbox3_causes = COPY
 413       imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 414     }
 415     protocol sieve {
 416       # Maximum number of ManageSieve connections allowed for a user from each IP address.
 417       # NOTE: The username is compared case-sensitively.
 418       mail_max_userip_connections = 10
 419
 420       # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 421       # the IMPLEMENTATION capability that the dovecot reports to clients.
 422       # For example: 'Cyrus timsieved v2.2.13'
 423       managesieve_implementation_string = Dovecot Pigeonhole
 424
 425       # The maximum number of compile errors that are returned to the client upon script
 426       # upload or script verification.
 427       managesieve_max_compile_errors = 5
 428
 429       #mail_max_userip_connections = 10
 430       #managesieve_implementation_string = Dovecot Pigeonhole
 431       managesieve_max_compile_errors = 5
 432       #managesieve_max_line_length = 65536
 433       #managesieve_notify_capability = mailto
 434       #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 435     }
 436     service managesieve-login {
 437       inet_listener sieve {
 438         port = 4190
 439         #ssl  = yes
 440       }
 441
 442       # Number of connections to handle before starting a new process. Typically
 443       # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 444       # is faster. <doc/wiki/LoginProcess.txt>
 445       service_count = 1
 446
 447       # Number of processes to always keep waiting for more connections.
 448       process_min_avail = 0
 449
 450       # If you set service_count=0, you probably need to grow this.
 451       #vsz_limit = 64M
 452     }
 453
 454     service quota-warning {
 455       executable = script ${
 456         pkgs.writeScript "quota-warning" ''
 457           #!/bin/sh -eu
 458           PERCENT=$1
 459           USER=$2
 460           cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 461           "plugin/quota=maildir:User quota:noenforcing"
 462           From: postmaster@${networking.domain}
 463           Subject: [WARNING] your mailbox is now $PERCENT% full.
 464
 465           Please remove some mails to make room for new ones.
 466           EOF
 467         ''
 468       }
 469       # use some unprivileged user for executing the quota warnings
 470       user = ${dovecot2.user}
 471       unix_listener quota-warning {
 472       }
 473     }
 474
 475     protocol pop3 {
 476       mail_plugins = $mail_plugins virtual
 477       #mail_max_userip_connections = 10
 478       # Virtual namespace for the virtual INBOX.
 479       # Use a global directory for dovecot-virtual files.
 480       #namespace Inbox {
 481       #  hidden    = yes
 482       #  list      = no
 483       #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 484       #  prefix    = pop3+
 485       #}
 486       pop3_client_workarounds =
 487       pop3_fast_size_lookups = yes
 488       pop3_lock_session = yes
 489       pop3_no_flag_updates = yes
 490       # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 491       pop3_uidl_format = %g
 492     }
 493     service pop3 {
 494       process_limit = 1024
 495     }
 496     service pop3-login {
 497       inet_listener pop3s {
 498         port = 995
 499         ssl  = yes
 500       }
 501     }
 502   '';
 503   #${lib.concatMapStringsSep "\n"
 504   #    (dom: ''
 505   #      local_name mail.${dom} {
 506   #        #ssl_ca   = <''${caPath}
 507   #        ssl_cert = <${x509.cert dom}
 508   #        ssl_key  = <${x509.key dom}
 509   #        }
 510   #    '')
 511   #    dovecot2.domains
 512   #}
 513 };
 514 #services.postfix.mapFiles."transport-dovecot" =
 515 #  toFile "transport-dovecot"
 516 #   (unlines
 517 #     (lib.mapAttrsToList
 518 #       (dom: {...}: "${transportSubDomain}.${dom} lmtp:unix:private/dovecot-lmtp")
 519 #       dovecot2.domains));
 520 }