servers/mermet/dovecot.nix

   1 { pkgs, lib, config, system, ... }:
   2 let inherit (builtins) toString toFile;
   3     inherit (builtins.extraBuiltins) pass;
   4     inherit (lib) types;
   5     inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
   6     inherit (config) networking;
   7     inherit (config.services) dovecot2 postfix openldap;
   8     when        = x: y: if x == null then "" else y;
   9     extSep      = postfix.recipientDelimiter;
  10     dirSep      = extSep;
  11     # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
  12     stateDir    = "/var/lib/dovecot";
  13     mailDir     = "${stateDir}/mail";
  14     sieveDir    = "${stateDir}/sieve";
  15     authDir     = "${stateDir}/auth";
  16     authUser    = dovecot2.mailUser;  # TODO: php_roundcube
  17     authGroup   = dovecot2.mailGroup; # TODO: php_roundcube
  18     escapeGroup = lib.stringAsChars (c: if "a"<=c && c<="z"
  19                                         || "0"<=c && c<="9"
  20                                         || c=="-"
  21                                         then c else "_");
  22     domainGroup = escapeGroup "${networking.domainBase}";
  23     etc_dovecot = [
  24       { target = "dovecot/${networking.domain}/dovecot-ldap.conf";
  25         source = pkgs.writeText "dovecot-ldap.conf" ''
  26           ${lib.optionalString dovecot2.debug ''
  27             debug_level = 1
  28           ''}
  29
  30           # LDAP database
  31           uris = ldapi://
  32           base = ou=posix,${openldap.domainSuffix}
  33           scope = subtree
  34           deref = never
  35           # NOTE: sufficient for small systems and uses less resources.
  36           blocking = no
  37
  38           # LDAP auth
  39           sasl_bind = yes
  40           sasl_mech = EXTERNAL
  41           #dn = cn=admin,${openldap.domainSuffix}
  42           #dnpass = useless with sasl_mech=EXTERNAL
  43           auth_bind = no
  44           #auth_bind_userdn = cn=%n,ou=accounts,ou=posix,dc=${openldap.domainSuffix}
  45
  46           # dovecot passdb query
  47           # DOC: http://wiki2.dovecot.org/PasswordDatabase/ExtraFields
  48           pass_filter = (&(objectClass=posixAccount)(uid=%n)(mailEnabled=TRUE))
  49           # TODO: userdb_quota_rule=*:storage=
  50           pass_attrs = userPassword=password,\
  51                        uidNumber=userdb_uid,\
  52                        gidNumber=userdb_gid,\
  53                        mailGroupMember=userdb_mail_access_groups=${domainGroup},\
  54                        quotaBytes=userdb_quota_rule=*:bytes=%{ldap:quotaBytes},\
  55                        =user=%n@%d
  56                        #homeDirectory=userdb_home
  57           default_pass_scheme = CRYPT
  58
  59           # dovecot userdb query
  60           # DOC: http://wiki2.dovecot.org/UserDatabase/ExtraFields
  61           user_filter = (&(objectClass=posixAccount)(uid=%n)(mailEnabled=TRUE))
  62           #user_filter = (&(objectClass=inetOrgPerson)(uid=%n))
  63           #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid
  64           #user_attrs = mailHomeDirectory=home,\
  65           #              mailStorageDirectory=mail,\
  66           #              mailUidNumber=uid,\
  67           #              mailGidNumber=gid,\
  68           #              mailQuota=quota_rule=*:bytes=%$
  69
  70           # doveadm user query
  71           iterate_attrs = =user=%{ldap:uid}@${networking.domain}
  72           iterate_filter = (&(objectClass=posixAccount)(mailEnabled=TRUE))
  73         '';
  74       }
  75     ];
  76     dovecot-virtual = pkgs.writeTextFile {
  77       name = "dovecot-virtual";
  78       destination = "/pop3/INBOX/dovecot-virtual";
  79       text = ''
  80         all
  81         all+*
  82           all
  83       '';
  84     };
  85
  86     learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  87       exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  88     '';
  89     learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  90       exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  91     '';
  92     sieve_pipe_bin_dir = pkgs.buildEnv {
  93       name = "sieve_pipe_bin_dir";
  94       pathsToLink = [ "/bin" ];
  95       paths = [
  96         learn-spam
  97         learn-ham
  98       ];
  99     };
 100 in
 101 {
 102   imports = [
 103     dovecot/autoconfig.nix
 104   ];
 105   #services.postfix.mapFiles."transport-dovecot" =
 106   #  toFile "transport-dovecot"
 107   #   (unlines
 108   #     (lib.mapAttrsToList
 109   #       (dom: {...}: "${transportSubDomain}.${dom} lmtp:unix:private/dovecot-lmtp")
 110   #       dovecot2.domains));
 111   systemd.services.dovecot2 = {
 112     after = [
 113       "postfix.service"
 114       "openldap.service"
 115       "dovecot.${networking.domainBase}.key.pem-key.service"
 116     ];
 117     restartTriggers = map (f: f.source) etc_dovecot;
 118   };
 119   deployment.keys = {
 120     "dovecot.${networking.domainBase}.key.pem" = {
 121       text        = pass "x509/${networking.domainBase}/key.pem";
 122       user        = dovecot2.user;
 123       group       = "root";
 124       destDir     = "/run/keys/";
 125       permissions = "0400"; # WARNING: not enforced when deployment.storeKeysOnMachine = true
 126     };
 127   };
 128   environment.etc = etc_dovecot;
 129   users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
 130   services.dovecot2 = {
 131     enable    = true;
 132     debug     = true;
 133     mailUser  = "dovemail";
 134     mailGroup = "dovemail";
 135     modules   = [
 136       pkgs.dovecot_pigeonhole
 137       pkgs.dovecot_fts_xapian
 138     ];
 139     sieves = {
 140       global = {
 141         list = ''
 142           require
 143            [ "date"
 144            , "fileinto"
 145            , "mailbox"
 146            , "variables"
 147            ];
 148
 149           if currentdate :matches "year"  "*" { set "year"  "''${1}"; }
 150           if currentdate :matches "month" "*" { set "month" "''${1}"; }
 151
 152           if exists "List-ID" {
 153             if header :matches "List-ID" "*<*.*.*.*>*" {
 154               set "list"   "''${2}";
 155               set "domain" "''${4}";
 156             }
 157             elsif header :matches "List-ID" "*<*.*.*>*" {
 158               set "list"   "''${2}";
 159               set "domain" "''${3}";
 160             }
 161             fileinto :create "Listes+''${domain}+''${list}+''${year}+''${month}";
 162             stop;
 163            }
 164         '';
 165         spam = ''
 166           require [ "imap4flags" ];
 167
 168           if header :contains "X-Spam-Level" "***" {
 169             addflag "Junk";
 170           }
 171         '';
 172         extension = ''
 173           require
 174            [ "envelope"
 175            , "fileinto"
 176            , "mailbox"
 177            , "subaddress"
 178            , "variables"
 179            ];
 180           if envelope :matches :detail "TO" "*" {
 181             set "extension" "''${1}";
 182           }
 183           if not string :is "''${extension}" "" {
 184             fileinto :create "Plus+''${extension}";
 185             stop;
 186           }
 187         '';
 188         spam-or-ham = ''
 189           require ["vnd.dovecot.pipe", "copy", "imapsieve", "variables", "imap4flags", "environment"];
 190
 191           if environment :is "imap.changedflags" "Junk" {
 192             if hasflag :is "Junk" {
 193               pipe :copy :try "learn-spam.sh";
 194             } elsif not hasflag :is "Junk" {
 195               pipe :copy :try "learn-ham.sh";
 196             }
 197           }
 198         '';
 199         report-spam = ''
 200           require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];
 201
 202           if environment :matches "imap.user" "*" {
 203             set "username" "''${1}";
 204           }
 205
 206           pipe :copy :try "learn-spam.sh" [ "''${username}" ];
 207         '';
 208         report-ham = ''
 209           require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];
 210
 211           if environment :matches "imap.mailbox" "*" {
 212             set "mailbox" "''${1}";
 213           }
 214
 215           if string "''${mailbox}" "Trash" {
 216             stop;
 217           }
 218
 219           if environment :matches "imap.user" "*" {
 220             set "username" "''${1}";
 221           }
 222
 223           pipe :copy :try "learn-ham.sh" [ "''${username}" ];
 224         '';
 225       };
 226     };
 227     configFile = toString ( pkgs.writeText "dovecot.conf" ''
 228       passdb {
 229         driver = ldap
 230         args = /etc/dovecot/${networking.domain}/dovecot-ldap.conf
 231         default_fields = userdb_mail_access_groups=${domainGroup}
 232         override_fields =
 233       }
 234       userdb {
 235         driver = prefetch
 236       }
 237       userdb {
 238         # NOTE: this userdb is only used by lda.
 239         driver = ldap
 240         args = /etc/dovecot/${networking.domain}/dovecot-ldap.conf
 241         default_fields = mail_access_groups=${domainGroup}
 242         override_fields =
 243         skip = found
 244       }
 245       #passdb {
 246       #  driver = passwd-file
 247       #  args   = scheme=crypt username_format=%n ${authDir}/%d/passwd
 248       #}
 249       #userdb {
 250       #  # NOTE: this userdb is only used by lda.
 251       #  driver = passwd-file
 252       #  args = username_format=%n ${authDir}/%d/passwd
 253       #  #default_fields = home=${mailDir}/%d/%n
 254       #  skip = found
 255       #}
 256       # Store METADATA information within user's HOME directory
 257       mail_attribute_dict = file:%h/dovecot-attributes
 258       # If needed, may be overrided by userdb_mail
 259       mail_home = ${mailDir}/%d/%n
 260       # NOTE: if needed, may be overrided by userdb_mail
 261       # NOTE: INDEX and CONTROL are on a partition without quota, as explain in the doc.
 262       # SEE: http://wiki2.dovecot.org/Quota/FS
 263       mail_location = maildir:${mailDir}/%d/%n/mail.d:LAYOUT=fs:UTF-8:INDEX=${stateDir}/index/%d/%n:INDEXPVT=${stateDir}/index/%d/%n:CONTROL=${stateDir}/control/%d/%n
 264       auth_mechanisms = plain login
 265       # NOTE: postfix does not supply a client cert.
 266       auth_ssl_require_client_cert = no
 267       #auth_ssl_username_from_cert = yes
 268       auth_verbose = yes
 269       # NOTE: lowercase the username, help with LDAP?
 270       auth_username_format = %Lu
 271       ${lib.optionalString dovecot2.debug ''
 272         auth_debug  = yes
 273         mail_debug  = yes
 274         verbose_ssl = yes
 275       ''}
 276       default_internal_user = ${dovecot2.user}
 277       default_internal_group = ${dovecot2.group}
 278       disable_plaintext_auth = yes
 279       # NOTE: sync with LDAP's data.
 280       first_valid_uid = 1000
 281       lda_mailbox_autocreate = yes
 282       lda_mailbox_autosubscribe = yes
 283       listen = *
 284       log_timestamp = "%Y-%m-%d %H:%M:%S "
 285       #maildir_copy_with_hardlinks = yes
 286       namespace inbox {
 287         # NOTE: here because protocol sieve {namespace inbox{}} does not seem to work.
 288         type      = private
 289         inbox     = yes
 290         location  =
 291         list      = yes
 292         prefix    =
 293         separator = ${dirSep}
 294       }
 295       namespace {
 296         type = shared
 297         #list = children
 298         # NOTE: always listed in the LIST command.
 299         list = yes
 300         # NOTE: how to access the other users' mailboxes.
 301         # NOTE: %var expands to the logged in user's variable, while
 302         #       %%var expands to the other users' variables.
 303         # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 304         location = maildir:${mailDir}/%%d/%%n/mail.d:LAYOUT=fs:INDEX=${stateDir}/index/%%d/%%n/Shared:INDEXPVT=${stateDir}/index/%d/%n/Shared/%%n:CONTROL=${stateDir}/control/%d/%n/Shared
 305         prefix = Partages+%%n+
 306         separator = ${dirSep}
 307         subscriptions = yes
 308       }
 309       # Default VSZ (virtual memory size) limit for service processes. This is mainly
 310       # intended to catch and kill processes that leak memory before they eat up everything.
 311       # Increased for fts_xapian.
 312       default_vsz_limit = 1G
 313       mail_plugins = $mail_plugins acl quota virtual fts fts_xapian
 314       #mail_uid = ${dovecot2.mailUser}
 315       #mail_gid = ${dovecot2.mailGroup}
 316         # NOTE: each user has a dedicated (uid,gid) pair
 317       #mail_privileged_group = mail
 318       #mail_access_groups =
 319       plugin {
 320         plugin = fts fts_xapian
 321
 322         acl = vfile:/etc/dovecot/acl/global.d
 323         acl_anyone = allow
 324         # NOTE: to let users LIST mailboxes shared by other users,
 325         #       Dovecot needs a shared mailbox dictionary.
 326         # FIXME: %d not working with userdb ldap
 327         acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 328
 329         fts = xapian
 330         fts_autoindex = yes
 331         fts_autoindex_exclude = \Junk
 332         fts_autoindex_exclude2 = \Trash
 333         fts_enforced = yes
 334         # 2 and 20 are the NGram values for header fields, which means the
 335         # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 336         # Full words are also added by default.
 337         fts_xapian = partial=2 full=20 verbose=${if dovecot2.debug then "2" else "1"}
 338
 339         quota = maildir:User quota
 340         quota_rule = *:storage=256M
 341         quota_rule2 = Trash:storage=+64M
 342         quota_max_mail_size = 20M
 343         #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 344         quota_warning  = storage=95%% quota-warning 95 %u
 345         quota_warning2 = storage=80%% quota-warning 80 %u
 346         quota_warning3 = -storage=100%% quota-warning below %u
 347
 348         recipient_delimiter = ${extSep}
 349
 350         #sieve_default = file:${mailDir}/%u/default.sieve
 351         #sieve_default_name = default
 352         sieve_after  = ${sieveDir}/after.d/
 353         sieve_before = ${sieveDir}/before.d/
 354         sieve = file:~/sieve.d;active=~/sieve
 355         #sieve_extensions = +editheader
 356         sieve_global = ${sieveDir}/global.d/
 357         sieve_max_script_size = 1M
 358         sieve_quota_max_scripts = 0
 359         sieve_quota_max_storage = 10M
 360         sieve_spamtest_max_value = 10
 361         sieve_spamtest_status_header = X-Spam-Score
 362         sieve_spamtest_status_type = strlen
 363         sieve_user_log = /var/log/dovecot/%d/sieve.%n.log
 364         sieve_plugins = sieve_imapsieve sieve_extprograms
 365         sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
 366         sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
 367         # Enables support for user Sieve scripts in IMAP
 368         #imapsieve_url = sieve://mail.${networking.domain}:4190
 369
 370         # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 371         imapsieve_mailbox1_name = *
 372         imapsieve_mailbox1_causes = FLAG
 373         imapsieve_mailbox1_before = file:${sieveDir}/global.d/spam-or-ham.sieve
 374
 375         # From elsewhere to Junk folder
 376         imapsieve_mailbox2_name = Pourriel
 377         imapsieve_mailbox2_causes = COPY APPEND
 378         imapsieve_mailbox2_before = file:${sieveDir}/global.d/report-spam.sieve
 379
 380         # From Junk folder to elsewhere
 381         imapsieve_mailbox3_name = *
 382         imapsieve_mailbox3_from = Pourriel
 383         imapsieve_mailbox3_causes = COPY
 384         imapsieve_mailbox3_before = file:${sieveDir}/global.d/report-ham.sieve
 385       }
 386       # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 387       imapc_features = $imapc_features fetch-headers
 388       # Read multiple mails in parallel, improves performance
 389       mail_prefetch_count = 20
 390       service quota-warning {
 391         executable = script ${
 392           pkgs.writeScript "quota-warning" ''
 393             #!/bin/sh -eu
 394             PERCENT=$1
 395             USER=$2
 396             cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 397             "plugin/quota=maildir:User quota:noenforcing"
 398             From: postmaster@${networking.domain}
 399             Subject: [WARNING] your mailbox is now $PERCENT% full.
 400
 401             Please remove some mails to make room for new ones.
 402             EOF
 403           ''
 404         }
 405         # use some unprivileged user for executing the quota warnings
 406         user = ${dovecot2.user}
 407         unix_listener quota-warning {
 408         }
 409       }
 410       protocol imap {
 411         #mail_max_userip_connections = 10
 412         mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve
 413         # DOC: https://wiki.dovecot.org/MailboxSettings
 414         # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 415         # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 416         imap_capability = +SPECIAL-USE
 417         namespace inbox {
 418           inbox = yes
 419           location =
 420           list = yes
 421           prefix =
 422           separator = ${dirSep}
 423           mailbox "Archive" {
 424             auto = no
 425             special_use = \Archive
 426           }
 427           mailbox "Archives" {
 428             auto = no
 429             special_use = \Archive
 430           }
 431           mailbox "Drafts" {
 432             auto = no
 433             special_use = \Drafts
 434           }
 435           mailbox "Brouillons" {
 436             auto = no
 437             special_use = \Drafts
 438           }
 439           mailbox "Junk" {
 440             auto = no
 441             #autoexpunge = 30d
 442             special_use = \Junk
 443           }
 444           mailbox "Spams" {
 445             auto = no
 446             special_use = \Junk
 447           }
 448           mailbox "Spam" {
 449             auto = no
 450             special_use = \Junk
 451           }
 452           mailbox "Pourriels" {
 453             auto = no
 454             special_use = \Junk
 455           }
 456           mailbox "Pourriel" {
 457             auto = no
 458             special_use = \Junk
 459           }
 460           mailbox "Sent" {
 461             auto = no
 462             special_use = \Sent
 463           }
 464           mailbox "Sent Items" {
 465             auto = no
 466             special_use = \Sent
 467           }
 468           mailbox "Sent Messages" {
 469             auto = no
 470             special_use = \Sent
 471           }
 472           mailbox "Envoyés" {
 473             auto = no
 474             special_use = \Sent
 475           }
 476           mailbox "Trash" {
 477             auto = no
 478             special_use = \Trash
 479             #autoexpunge = 30d
 480           }
 481           mailbox "Corbeille" {
 482             auto = no
 483             special_use = \Trash
 484           }
 485         }
 486       }
 487       protocol lda {
 488         auth_socket_path = /var/run/dovecot/auth-userdb
 489         hostname         = ${networking.domain}
 490         info_log_path    =
 491         log_path         =
 492         mail_plugins     = $mail_plugins sieve
 493         namespace inbox {
 494           inbox     = yes
 495           location  =
 496           list      = yes
 497           prefix    =
 498           separator = ${dirSep}
 499         }
 500         postmaster_address = postmaster${extSep}dovecot${extSep}lda@${networking.domain}
 501         syslog_facility = mail
 502       }
 503       protocol lmtp {
 504         #info_log_path = /tmp/dovecot-lmtp.log
 505         mail_plugins = $mail_plugins sieve
 506         namespace inbox {
 507           inbox     = yes
 508           location  =
 509           list      = yes
 510           prefix    =
 511           separator = ${dirSep}
 512         }
 513         postmaster_address = postmaster${extSep}dovecot${extSep}lmtp@${networking.domain}
 514       }
 515       protocol pop3 {
 516         #mail_max_userip_connections = 10
 517         namespace all {
 518           # NOTE: used by ${dovecot-virtual}/pop3/INBOX/dovecot-virtual
 519           hidden    = yes
 520           list      = no
 521           location  =
 522           prefix    = all+
 523           separator = ${dirSep}
 524         }
 525         # Virtual namespace for the virtual INBOX.
 526         # Use a global directory for dovecot-virtual files.
 527         namespace inbox {
 528           inbox     = yes
 529           hidden    = yes
 530           list      = no
 531           location  = virtual:${dovecot-virtual}/pop3:INDEX=${stateDir}/index/%d/%n/POP3:LAYOUT=fs
 532           prefix    = pop3+
 533           separator = ${dirSep}
 534         }
 535         pop3_client_workarounds =
 536         pop3_fast_size_lookups = yes
 537         pop3_lock_session = yes
 538         pop3_no_flag_updates = yes
 539         # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 540         pop3_uidl_format = %g
 541       }
 542       protocol sieve {
 543         #mail_max_userip_connections = 10
 544         #managesieve_implementation_string = Dovecot Pigeonhole
 545         managesieve_max_compile_errors = 5
 546         #managesieve_max_line_length = 65536
 547         #managesieve_notify_capability = mailto
 548         #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 549       }
 550       # DOC: https://wiki2.dovecot.org/Pigeonhole/ManageSieve/Configuration
 551       protocol sieve {
 552         # Maximum number of ManageSieve connections allowed for a user from each IP address.
 553         # NOTE: The username is compared case-sensitively.
 554         mail_max_userip_connections = 10
 555
 556         # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 557         # the IMPLEMENTATION capability that the dovecot reports to clients.
 558         # For example: 'Cyrus timsieved v2.2.13'
 559         managesieve_implementation_string = Dovecot Pigeonhole
 560
 561         # The maximum number of compile errors that are returned to the client upon script
 562         # upload or script verification.
 563         managesieve_max_compile_errors = 5
 564       }
 565       protocols = imap lmtp pop3 sieve
 566       service lmtp {
 567         #executable = lmtp -L
 568         process_min_avail = 2
 569         unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 570           user  = ${postfix.user}
 571           group = ${postfix.group}
 572           mode  = 0600
 573         }
 574         #user = mail
 575       }
 576       service auth {
 577         # FIXME: may be user=dovecot-auth with LDAP?
 578         user = root
 579         unix_listener auth-userdb {
 580           user  = ${dovecot2.user}
 581           group = ${dovecot2.group}
 582           mode  = 0660
 583         }
 584         unix_listener /var/lib/postfix/queue/private/auth {
 585           user  = ${postfix.user}
 586           group = ${postfix.group}
 587           mode  = 0660
 588         }
 589       }
 590       service imap {
 591         # Most of the memory goes to mmap()ing files.
 592         # You may need to increase this limit if you have huge mailboxes.
 593         #vsz_limit =
 594         process_limit = 1024
 595       }
 596       service imap-login {
 597         #inet_listener imap {
 598         #  address = 127.0.0.1
 599         #  port    = 143
 600         #  ssl     = no
 601         #}
 602         inet_listener imaps {
 603           port = 993
 604           ssl  = yes
 605         }
 606       }
 607       service pop3 {
 608         process_limit = 1024
 609       }
 610       service pop3-login {
 611         inet_listener pop3s {
 612           port = 995
 613           ssl  = yes
 614         }
 615       }
 616       service managesieve-login {
 617         inet_listener sieve {
 618           port = 4190
 619           #ssl  = yes
 620         }
 621
 622         # Number of connections to handle before starting a new process. Typically
 623         # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 624         # is faster. <doc/wiki/LoginProcess.txt>
 625         service_count = 1
 626
 627         # Number of processes to always keep waiting for more connections.
 628         process_min_avail = 0
 629
 630         # If you set service_count=0, you probably need to grow this.
 631         #vsz_limit = 64M
 632       }
 633       ssl = required
 634       ssl_dh = <${../../../sec/openssl/dh.pem}
 635       ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 636       ssl_cert = <${loadFile (../../../sec + "/openssl/${networking.domainBase}/cert.self-signed.pem")}
 637       ssl_key = </run/keys/dovecot.${networking.domainBase}.key.pem
 638       #ssl_ca = <''${caPath}
 639       #ssl_verify_client_cert = yes
 640     '' );
 641       #${lib.concatMapStringsSep "\n"
 642       #    (dom: ''
 643       #      local_name mail.${dom} {
 644       #        #ssl_ca   = <''${caPath}
 645       #        ssl_cert = <${x509.cert dom}
 646       #        ssl_key  = <${x509.key dom}
 647       #        }
 648       #    '')
 649       #    dovecot2.domains
 650       #}
 651   };
 652 }