hosts/mermet/dovecot.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   host,
   6   ...
   7 }:
   8 let
   9   inherit (builtins) toString;
  10   inherit (config) networking;
  11   inherit (config.services) dovecot2 postfix;
  12
  13   stateDir = "/var/lib/dovecot";
  14
  15   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  16     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  17   '';
  18   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  19     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  20   '';
  21
  22   dovecot-virtual = pkgs.buildEnv {
  23     name = "dovecot-virtual";
  24     pathsToLink = [ "/" ];
  25     paths = [
  26       dovecot-virtual-all
  27       dovecot-virtual-recents
  28     ];
  29   };
  30   dovecot-virtual-all = pkgs.writeTextFile {
  31     name = "dovecot-virtual-all";
  32     destination = "/All/dovecot-virtual";
  33     text = ''* all '';
  34   };
  35   dovecot-virtual-recents = pkgs.writeTextFile {
  36     name = "dovecot-virtual-recents";
  37     destination = "/Recents/dovecot-virtual";
  38     text = ''
  39       *
  40         all younger 172800
  41     '';
  42   };
  43 in
  44 {
  45   imports = [
  46     dovecot/sourcephile.fr.nix
  47     dovecot/autogeree.net.nix
  48   ];
  49   environment.systemPackages = [
  50     pkgs.dovecot_pigeonhole
  51   ];
  52   users.groups.acme.members = [ dovecot2.user ];
  53   systemd.services.dovecot2 = {
  54     after = [
  55       "postfix.service"
  56       "openldap.service"
  57     ];
  58     /*
  59       preStart = ''
  60       # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
  61       install -D -d -m 0771 \
  62        -o "${dovecot2.user}" \
  63        -g "${dovecot2.group}" \
  64        ${stateDir}/mail
  65       '';
  66     */
  67     preStart = ''
  68       ln -fns -t ${stateDir}/virtual/ \
  69         ${dovecot-virtual-all}/All \
  70         ${dovecot-virtual-recents}/Recents
  71     '';
  72     serviceConfig = {
  73       #ExecStart = lib.mkForce "${pkgs.utillinux}/bin/setarch x86_64 --addr-no-randomize /bin/sh -c 'LD_PRELOAD=${pkgs.gcc-unwrapped.lib}/lib/libasan.so ${pkgs.dovecot}/sbin/dovecot -F'";
  74       # Dovecot2 does not work with environment.memoryAllocator.provider="scudo"
  75       # https://wiki.dovecot.org/Design/Memory
  76       # Scudo ERROR: CHECK failed at /build/compiler-rt-7.1.0.src/lib/scudo/../sanitizer_common/sanitizer_allocator_primary64.h:
  77       # 644 ((beg)) == ((address_range.MapOrDie(beg, size))) (4398046511092, 4398046507008)
  78       BindReadOnlyPaths = [ "/dev/null:/etc/ld-nix.so.preload" ];
  79       StateDirectory = [ "dovecot/virtual" ];
  80     };
  81   };
  82   #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  83   networking.nftables.ruleset = ''
  84     table inet filter {
  85       chain input-net {
  86         tcp dport imaps counter accept comment "dovecot: IMAPS"
  87         #tcp dport 995 counter accept comment "dovecot: POP3S"
  88         tcp dport sieve counter accept comment "dovecot: Sieve"
  89       }
  90     }
  91   '';
  92   fileSystems."/var/lib/dovecot" = {
  93     device = "rpool/var/mail";
  94     fsType = "zfs";
  95   };
  96   services.sanoid.datasets."rpool/var/mail" = {
  97     use_template = [ "snap" ];
  98     daily = 7;
  99   };
 100   services.dovecot2 = {
 101     enable = true;
 102     enablePAM = false;
 103     enableImap = true;
 104     enableLmtp = true;
 105     enablePop3 = false;
 106     protocols = [ "sieve" ];
 107     # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
 108     # Here INDEX and CONTROL are separated,
 109     # it's not useful since there is no quota at the filesystem level
 110     # it's just to let this possibility later on.
 111     mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
 112     createMailUser = false;
 113     mailUser = "";
 114     mailGroup = "";
 115     sslServerCert = null;
 116     sieve = {
 117       plugins = [
 118         #"sieve_extprograms"
 119         "sieve_imapsieve"
 120       ];
 121       extensions = [
 122         "copy"
 123         "envelope"
 124         "environment"
 125         "fileinto"
 126         "imap4flags"
 127         "imapsieve"
 128         "include"
 129         "mailbox"
 130         "subaddress"
 131         "variables"
 132         "vnd.dovecot.environment"
 133       ];
 134       globalExtensions = [
 135         "vnd.dovecot.pipe"
 136       ];
 137       pipeBins = builtins.map lib.getExe [
 138         learn-ham
 139         learn-spam
 140       ];
 141       scripts = {
 142         global = dovecot/sieve/global;
 143       };
 144     };
 145     mailPlugins = {
 146       globally.enable = [
 147         "virtual"
 148         "acl"
 149         "quota"
 150         #"fts"
 151         #"fts_xapian"
 152       ];
 153       perProtocol = {
 154         lda.enable = [ "sieve" ];
 155         lmtp.enable = [ "sieve" ];
 156         imap.enable = [
 157           "imap_acl"
 158           "imap_quota"
 159           "imap_sieve"
 160           "virtual"
 161         ];
 162         pop3.enable = [ "virtual" ];
 163       };
 164     };
 165     extraConfig = ''
 166       #auth_verbose = yes
 167       #auth_debug = yes
 168       #mail_debug = yes
 169       #verbose_ssl = yes
 170       log_timestamp = "%Y-%m-%d %H:%M:%S "
 171
 172       ssl = required
 173       ssl_dh = <${dovecot/dh4096.pem}
 174       ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 175       ssl_prefer_server_ciphers = yes
 176       ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
 177       ssl_key = </var/lib/acme/${networking.domain}/key.pem
 178       #ssl_ca = <''${caPath}
 179       #ssl_verify_client_cert = yes
 180       # FIXME: change to TLSv1.3 when supported by K-9 Mail
 181       ssl_min_protocol = TLSv1.2
 182
 183       listen = *
 184       mail_home = ${stateDir}/home/%d/%n
 185       # Read multiple mails in parallel, improves performance
 186       mail_prefetch_count = 20
 187
 188       # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
 189       # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
 190       # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
 191       # when in fact, storing the password in the directory server using a Salted SHA-2 hash
 192       # and transmitting the clear text password over a secure connection
 193       # is more secure than having the directory server store the password in clear text
 194       # or in a reversible encryption scheme.
 195       # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
 196       # Use doveadm pw -s SSHA
 197       # or doveadm pw -s PBKDF2 -r 10000
 198       # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
 199       auth_mechanisms = plain login
 200       auth_username_format = %Ln
 201       service auth {
 202         user = ${dovecot2.user}
 203         # auth_socket_path points to this userdb socket by default. It's typically
 204         # used by dovecot-lda, doveadm, possibly imap process, etc.
 205         # Users that have access to this socket are able to get a list
 206         # of all usernames and get results of everyone's userdb lookups.
 207         unix_listener auth-userdb {
 208           user  = ${dovecot2.user}
 209           group = ${dovecot2.group}
 210           mode  = 0660
 211         }
 212         unix_listener /var/lib/postfix/queue/private/auth {
 213           user  = ${postfix.user}
 214           group = ${postfix.group}
 215           mode  = 0660
 216         }
 217       }
 218       service auth-worker {
 219         user = ${dovecot2.user}
 220       }
 221       auth_cache_verify_password_with_worker = yes
 222       # SEE: http://wiki2.dovecot.org/Quota/FS
 223       # NOTE: postfix does not supply a client cert.
 224       auth_ssl_require_client_cert = no
 225       #auth_ssl_username_from_cert = yes
 226       # NOTE: lowercase the username, help with LDAP?
 227       auth_username_format = %Lu
 228       # NOTE: sync with LDAP's data.
 229       first_valid_uid = 1000
 230       disable_plaintext_auth = yes
 231
 232       userdb {
 233         driver = ldap
 234         # A different path than passdb's args enables non-blocking LDAP requests
 235         args = ${
 236           pkgs.symlinkJoin {
 237             name = "ldap";
 238             paths = [ ./dovecot ];
 239           }
 240         }/ldap.conf
 241         default_fields =
 242         override_fields =
 243       }
 244
 245       # No dirty syncs for maildir: locations which may be used directly by neomutt
 246       maildir_very_dirty_syncs = no
 247       namespace Inbox {
 248         type      = private
 249         inbox     = yes
 250         hidden    = no
 251         list      = yes
 252         prefix    =
 253         separator = +
 254       }
 255       namespace Shared {
 256         type = shared
 257         #list = children
 258         # NOTE: always listed in the LIST command.
 259         list = yes
 260         # NOTE: how to access the other users' mailboxes.
 261         # NOTE: %var expands to the logged in user's variable, while
 262         #       %%var expands to the other users' variables.
 263         # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 264         location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
 265         prefix = Partages+%%n+
 266         separator = +
 267         subscriptions = yes
 268       }
 269       namespace Virtual {
 270         prefix = Virtual+
 271         separator = +
 272         hidden = no
 273         list = yes
 274         subscriptions = no
 275         location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 276       }
 277
 278       plugin {
 279         acl = vfile:/etc/dovecot/acl/global
 280         acl_anyone = allow
 281         # NOTE: to let users LIST mailboxes shared by other users,
 282         #       Dovecot needs a shared mailbox dictionary.
 283         # FIXME: %d not working with userdb ldap
 284         acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 285       }
 286
 287       # Default VSZ (virtual memory size) limit for service processes. This is mainly
 288       # intended to catch and kill processes that leak memory before they eat up everything.
 289       # Increased for fts_xapian.
 290       #default_vsz_limit = 1G
 291       #plugin {
 292       #  # WARNING: doveadm fts rescan is buggy, it will delete the index:
 293       #  # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
 294       #  # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
 295       #  plugin = fts fts_xapian
 296       #  fts = xapian
 297       #  fts_autoindex = yes
 298       #  fts_autoindex_exclude = \Junk
 299       #  fts_autoindex_exclude2 = \Trash
 300       #  fts_enforced = yes
 301       #  # 2 and 20 are the NGram values for header fields, which means the
 302       #  # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 303       #  # Full words are also added by default.
 304       #  fts_xapian = partial=2 full=20 attachments=1 verbose=0
 305       #  fts_languages = en fr
 306       #  #fts_dovecot_fs = posix:prefix=%h/fts/
 307       #}
 308
 309       plugin {
 310         quota = maildir:User quota
 311         quota_rule = *:storage=256M
 312         quota_rule2 = Trash:storage=+64M
 313         quota_max_mail_size = 20M
 314         #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 315         quota_warning  = storage=95%% quota-warning 95 %u
 316         quota_warning2 = storage=80%% quota-warning 80 %u
 317         quota_warning3 = -storage=100%% quota-warning below %u
 318       }
 319
 320       protocol lda {
 321         hostname = ${networking.domain}
 322         postmaster_address = root+dovecot+lda@${networking.domain}
 323         syslog_facility = mail
 324       }
 325       lda_mailbox_autocreate = yes
 326       lda_mailbox_autosubscribe = yes
 327
 328       protocol lmtp {
 329         postmaster_address = root+dovecot+lmtp@${networking.domain}
 330       }
 331       service lmtp {
 332         process_min_avail = ${toString host.CPUs}
 333         unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 334           user  = ${postfix.user}
 335           group = ${postfix.group}
 336           mode  = 0600
 337         }
 338       }
 339       plugin {
 340         # Let extension.sieve do the handling of the detail
 341         #lmtp_save_to_detail_mailbox = yes
 342         recipient_delimiter = ${postfix.recipientDelimiter}
 343       }
 344
 345       service imap {
 346         # Most of the memory goes to mmap()ing files.
 347         # You may need to increase this limit if you have huge mailboxes.
 348         #vsz_limit =
 349         process_limit = 1024
 350       }
 351       service imap-login {
 352         #inet_listener imap {
 353         #  address = 127.0.0.1
 354         #  port    = 143
 355         #  ssl     = no
 356         #}
 357         inet_listener imaps {
 358           port = 993
 359           ssl  = yes
 360         }
 361       }
 362       # Store METADATA information within user's HOME directory
 363       mail_attribute_dict = file:%h/dovecot-attributes
 364       # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 365       imapc_features = $imapc_features fetch-headers
 366       protocol imap {
 367         #mail_max_userip_connections = 10
 368         imap_metadata = yes
 369
 370         # DOC: https://wiki.dovecot.org/MailboxSettings
 371         # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 372         # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 373         imap_capability = +SPECIAL-USE
 374
 375         namespace Inbox {
 376           mailbox "Archives" {
 377             auto = subscribe
 378             special_use = \Archive
 379           }
 380           mailbox "Drafts" {
 381             auto = no
 382             special_use = \Drafts
 383           }
 384           mailbox "Brouillons" {
 385             auto = subscribe
 386             special_use = \Drafts
 387           }
 388           mailbox "Junk" {
 389             auto = no
 390             #autoexpunge = 30d
 391             special_use = \Junk
 392           }
 393           mailbox "Spams" {
 394             auto = no
 395             special_use = \Junk
 396           }
 397           mailbox "Spam" {
 398             auto = no
 399             special_use = \Junk
 400           }
 401           mailbox "Pourriels" {
 402             auto = no
 403             special_use = \Junk
 404           }
 405           mailbox "Pourriel" {
 406             auto = no
 407             special_use = \Junk
 408           }
 409           mailbox "Sent" {
 410             auto = no
 411             special_use = \Sent
 412           }
 413           mailbox "Sent Items" {
 414             auto = no
 415             special_use = \Sent
 416           }
 417           mailbox "Sent Messages" {
 418             auto = no
 419             special_use = \Sent
 420           }
 421           mailbox "Envoyés" {
 422             auto = no
 423             special_use = \Sent
 424           }
 425           mailbox "Trash" {
 426             auto = no
 427             special_use = \Trash
 428             #autoexpunge = 30d
 429           }
 430           mailbox "Corbeille" {
 431             auto = no
 432             special_use = \Trash
 433           }
 434         }
 435         namespace Virtual {
 436           mailbox All {
 437             auto = no
 438             comment = All messages from all mailboxes
 439             # This flag is confused with \Archives by K9-Mail
 440             special_use = \All
 441           }
 442           mailbox Recents {
 443             auto = no
 444             comment = All messages from all mailboxes, arrived in the past 48h
 445           }
 446         }
 447       }
 448       plugin {
 449         sieve = file:~/sieve;active=~/active.sieve
 450         sieve_default = file:${stateDir}/sieve/global/default.sieve
 451         sieve_default_name = main
 452         sieve_max_script_size = 1M
 453         sieve_quota_max_scripts = 0
 454         sieve_quota_max_storage = 10M
 455         #sieve_spamtest_max_value = 10
 456         #sieve_spamtest_status_header = X-Spam-Score
 457         #sieve_spamtest_status_type = strlen
 458         #sieve_user_log = ~/active.sieve.log
 459         #sieve_trace_dir = ~/sieve-log
 460         #sieve_trace_level = matching
 461         # Enables support for user Sieve scripts in IMAP
 462         #imapsieve_url = sieve://mail.${networking.domain}:4190
 463
 464         # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 465         imapsieve_mailbox1_name = *
 466         imapsieve_mailbox1_causes = FLAG
 467         imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 468
 469         # From elsewhere to Junk folder
 470         imapsieve_mailbox2_name = Pourriel
 471         imapsieve_mailbox2_causes = COPY APPEND
 472         imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 473
 474         # From Junk folder to elsewhere
 475         imapsieve_mailbox3_name = *
 476         imapsieve_mailbox3_from = Pourriel
 477         imapsieve_mailbox3_causes = COPY
 478         imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 479       }
 480       protocol sieve {
 481         # Maximum number of ManageSieve connections allowed for a user from each IP address.
 482         # NOTE: The username is compared case-sensitively.
 483         mail_max_userip_connections = 10
 484
 485         # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 486         # the IMPLEMENTATION capability that the dovecot reports to clients.
 487         # For example: 'Cyrus timesieved v2.2.13'
 488         managesieve_implementation_string = Dovecot Pigeonhole
 489
 490         # The maximum number of compile errors that are returned to the client upon script
 491         # upload or script verification.
 492         managesieve_max_compile_errors = 5
 493
 494         #mail_max_userip_connections = 10
 495         #managesieve_implementation_string = Dovecot Pigeonhole
 496         managesieve_max_compile_errors = 5
 497         #managesieve_max_line_length = 65536
 498         #managesieve_notify_capability = mailto
 499         #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 500       }
 501       service managesieve-login {
 502         inet_listener sieve {
 503           port = 4190
 504           #ssl  = yes
 505         }
 506
 507         # Number of connections to handle before starting a new process. Typically
 508         # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 509         # is faster. <doc/wiki/LoginProcess.txt>
 510         service_count = 1
 511
 512         # Number of processes to always keep waiting for more connections.
 513         process_min_avail = 0
 514
 515         # If you set service_count=0, you probably need to grow this.
 516         #vsz_limit = 64M
 517       }
 518
 519       service quota-warning {
 520         executable = script ${pkgs.writeShellScript "quota-warning" ''
 521           set -eu
 522           PERCENT=$1
 523           USER=$2
 524           cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 525           "plugin/quota=maildir:User quota:noenforcing"
 526           From: root+docevot@${networking.domain}
 527           Subject: [WARNING] your mailbox is now $PERCENT% full.
 528
 529           Please remove some mails to make room for new ones.
 530           EOF
 531         ''}
 532         # use some unprivileged user for executing the quota warnings
 533         user = ${dovecot2.user}
 534         unix_listener quota-warning {
 535         }
 536       }
 537
 538       protocol pop3 {
 539         #mail_max_userip_connections = 10
 540         # Virtual namespace for the virtual INBOX.
 541         # Use a global directory for dovecot-virtual files.
 542         #namespace Inbox {
 543         #  hidden    = yes
 544         #  list      = no
 545         #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 546         #  prefix    = pop3+
 547         #}
 548         pop3_client_workarounds =
 549         pop3_fast_size_lookups = yes
 550         pop3_lock_session = yes
 551         pop3_no_flag_updates = yes
 552         # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 553         pop3_uidl_format = %g
 554       }
 555       service pop3 {
 556         process_limit = 1024
 557       }
 558       service pop3-login {
 559         inet_listener pop3s {
 560           port = 995
 561           ssl  = yes
 562         }
 563       }
 564     '';
 565   };
 566 }