servers/mermet/dovecot.nix

   1 { pkgs, lib, config, system, ... }:
   2 let
   3   inherit (builtins) toString toFile;
   4   inherit (builtins.extraBuiltins) pass;
   5   inherit (lib) types;
   6   inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
   7   inherit (config) networking;
   8   inherit (config.services) dovecot2 postfix openldap;
   9
  10   # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
  11   stateDir    = "/var/lib/dovecot";
  12
  13   sieve_pipe_bin_dir = pkgs.buildEnv {
  14     name = "sieve_pipe_bin_dir";
  15     pathsToLink = [ "/bin" ];
  16     paths = [
  17       learn-spam
  18       learn-ham
  19     ];
  20   };
  21   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  22     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  23   '';
  24   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  25     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  26   '';
  27
  28   dovecot-virtual = pkgs.buildEnv {
  29     name = "dovecot-virtual";
  30     pathsToLink = [ "/" ];
  31     paths = [
  32       dovecot-virtual-all
  33       dovecot-virtual-recents
  34     ];
  35   };
  36   dovecot-virtual-all = pkgs.writeTextFile {
  37     name = "dovecot-virtual-all";
  38     destination = "/All/dovecot-virtual";
  39     text = ''
  40       *
  41         all
  42     '';
  43   };
  44   dovecot-virtual-recents = pkgs.writeTextFile {
  45     name = "dovecot-virtual-recents";
  46     destination = "/Recents/dovecot-virtual";
  47     text = ''
  48       *
  49         all younger 172800
  50     '';
  51   };
  52   dovecot-virtual-pop3 = pkgs.writeTextFile {
  53     name = "dovecot-virtual-pop3";
  54     destination = "/pop3/INBOX/dovecot-virtual";
  55     text = ''
  56       All
  57       All+*
  58         all
  59     '';
  60   };
  61 in
  62 {
  63   imports = [
  64     dovecot/autoconfig.nix
  65   ];
  66   systemd.services.dovecot2 = {
  67     after = [
  68       "postfix.service"
  69       "openldap.service"
  70       "dovecot.${networking.domainBase}.key.pem-key.service"
  71     ];
  72   };
  73   deployment.keys = {
  74     "dovecot.${networking.domainBase}.key.pem" = {
  75       text        = pass "x509/${networking.domainBase}/key.pem";
  76       user        = dovecot2.user;
  77       group       = "root";
  78       destDir     = "/run/keys/";
  79       permissions = "0400"; # WARNING: not enforced when deployment.storeKeysOnMachine = true
  80     };
  81   };
  82   #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  83   services.dovecot2 = {
  84     enable    = true;
  85     modules   = [
  86       pkgs.dovecot_pigeonhole
  87       pkgs.dovecot_fts_xapian
  88     ];
  89     enablePAM = false;
  90     enableImap = true;
  91     enableLmtp = true;
  92     enablePop3 = true;
  93     protocols = [ "sieve" ];
  94     mailLocation = "sdbox:${stateDir}/mail/%d/%n/mail.d:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
  95     createMailUser = false;
  96     mailUser = "";
  97     mailGroup = "";
  98     sslServerCert = null;
  99     sieveScripts = {
 100       global = dovecot/sieve/global;
 101     };
 102     extraConfig = ''
 103       auth_verbose = no
 104       auth_debug = no
 105       mail_debug = yes
 106       verbose_ssl = no
 107       log_timestamp = "%Y-%m-%d %H:%M:%S "
 108
 109       ssl = required
 110       ssl_dh = <${../../../sec/openssl/dh.pem}
 111       ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 112       ssl_cert = <${loadFile (../../../sec + "/openssl/${networking.domainBase}/cert.self-signed.pem")}
 113       ssl_key = </run/keys/dovecot.${networking.domainBase}.key.pem
 114       #ssl_ca = <''${caPath}
 115       #ssl_verify_client_cert = yes
 116
 117       listen = *
 118       # If needed, may be overrided by userdb_mail
 119       mail_home = ${stateDir}/mail/%d/%n
 120       # Read multiple mails in parallel, improves performance
 121       mail_prefetch_count = 20
 122       # Default VSZ (virtual memory size) limit for service processes. This is mainly
 123       # intended to catch and kill processes that leak memory before they eat up everything.
 124       # Increased for fts_xapian.
 125       default_vsz_limit = 1G
 126
 127       passdb {
 128         driver = ldap
 129         args = ${loadFile (dovecot/ldap + "/${networking.domainBase}.conf")}
 130         default_fields = userdb_mail_access_groups=${networking.domainBase}
 131         override_fields =
 132       }
 133       userdb {
 134         driver = prefetch
 135       }
 136       userdb {
 137         # NOTE: this userdb is only used by lda.
 138         driver = ldap
 139         args = ${loadFile (dovecot/ldap + "/${networking.domainBase}.conf")}
 140         default_fields = mail_access_groups=${networking.domainBase}
 141         override_fields =
 142         skip = found
 143       }
 144       service auth {
 145         # FIXME: may be user=dovecot-auth with LDAP?
 146         user = root
 147         unix_listener auth-userdb {
 148           user  = ${dovecot2.user}
 149           group = ${dovecot2.group}
 150           mode  = 0660
 151         }
 152         unix_listener /var/lib/postfix/queue/private/auth {
 153           user  = ${postfix.user}
 154           group = ${postfix.group}
 155           mode  = 0660
 156         }
 157       }
 158       auth_cache_verify_password_with_worker = yes
 159       # NOTE: if needed, may be overrided by userdb_mail
 160       # NOTE: INDEX and CONTROL are on a partition without quota, as explain in the doc.
 161       # SEE: http://wiki2.dovecot.org/Quota/FS
 162       auth_mechanisms = plain login
 163       # NOTE: postfix does not supply a client cert.
 164       auth_ssl_require_client_cert = no
 165       #auth_ssl_username_from_cert = yes
 166       # NOTE: lowercase the username, help with LDAP?
 167       auth_username_format = %Lu
 168       # NOTE: sync with LDAP's data.
 169       first_valid_uid = 1000
 170       disable_plaintext_auth = yes
 171
 172       #passdb {
 173       #  driver = passwd-file
 174       #  args   = scheme=crypt username_format=%n ${stateDir}/passwd/%d
 175       #}
 176       #userdb {
 177       #  # NOTE: this userdb is only used by LDA.
 178       #  driver = passwd-file
 179       #  args = username_format=%n ${stateDir}/passwd/%d
 180       #  #default_fields = home=${stateDir}/mail/%d/%n
 181       #  skip = found
 182       #}
 183
 184       # No dirty syncs for maildir: locations which may be used directly by neomutt
 185       maildir_very_dirty_syncs = no
 186       namespace Inbox {
 187         type      = private
 188         inbox     = yes
 189         hidden    = no
 190         list      = yes
 191         prefix    =
 192         separator = +
 193       }
 194       namespace Shared {
 195         type = shared
 196         #list = children
 197         # NOTE: always listed in the LIST command.
 198         list = yes
 199         # NOTE: how to access the other users' mailboxes.
 200         # NOTE: %var expands to the logged in user's variable, while
 201         #       %%var expands to the other users' variables.
 202         # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 203         location = sdbox:${stateDir}/mail/%%d/%%n/${stateDir}/mail.d:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/Shared:INDEX=${stateDir}/index/%%d/%%n/Shared:INDEXPVT=${stateDir}/index/%d/%n/Shared/%%n
 204         prefix = Partages+%%n+
 205         separator = +
 206         subscriptions = yes
 207       }
 208       mail_plugins = $mail_plugins virtual
 209       namespace Virtual {
 210         prefix = Virtual+
 211         separator = +
 212         hidden = no
 213         list = yes
 214         subscriptions = no
 215         location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 216       }
 217
 218       mail_plugins = $mail_plugins acl
 219       plugin {
 220         acl = vfile:/etc/dovecot/acl/global.d
 221         acl_anyone = allow
 222         # NOTE: to let users LIST mailboxes shared by other users,
 223         #       Dovecot needs a shared mailbox dictionary.
 224         # FIXME: %d not working with userdb ldap
 225         acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 226       }
 227
 228       mail_plugins = $mail_plugins fts fts_xapian
 229       plugin {
 230         plugin = fts fts_xapian
 231         fts = xapian
 232         fts_autoindex = yes
 233         fts_autoindex_exclude = \Junk
 234         fts_autoindex_exclude2 = \Trash
 235         fts_enforced = yes
 236         # 2 and 20 are the NGram values for header fields, which means the
 237         # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 238         # Full words are also added by default.
 239         fts_xapian = partial=2 full=20 verbose=0
 240       }
 241
 242       mail_plugins = $mail_plugins quota
 243       plugin {
 244         quota = maildir:User quota
 245         quota_rule = *:storage=256M
 246         quota_rule2 = Trash:storage=+64M
 247         quota_max_mail_size = 20M
 248         #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 249         quota_warning  = storage=95%% quota-warning 95 %u
 250         quota_warning2 = storage=80%% quota-warning 80 %u
 251         quota_warning3 = -storage=100%% quota-warning below %u
 252       }
 253
 254       protocol lda {
 255         auth_socket_path = /var/run/dovecot/auth-userdb
 256         hostname         = ${networking.domain}
 257         info_log_path    =
 258         log_path         =
 259         mail_plugins     = $mail_plugins sieve
 260         postmaster_address = postmaster+dovecot+lda@${networking.domain}
 261         syslog_facility = mail
 262       }
 263       lda_mailbox_autocreate = yes
 264       lda_mailbox_autosubscribe = yes
 265
 266       protocol lmtp {
 267         #info_log_path = /tmp/dovecot-lmtp.log
 268         mail_plugins = $mail_plugins sieve
 269         postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
 270       }
 271       service lmtp {
 272         #executable = lmtp -L
 273         process_min_avail = ${toString config.nix.maxJobs}
 274         unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 275           user  = ${postfix.user}
 276           group = ${postfix.group}
 277           mode  = 0600
 278         }
 279         #user = mail
 280       }
 281       plugin {
 282         # Let extension.sieve do the handling of the detail
 283         #lmtp_save_to_detail_mailbox = yes
 284         recipient_delimiter = ${postfix.recipientDelimiter}
 285       }
 286
 287       service imap {
 288         # Most of the memory goes to mmap()ing files.
 289         # You may need to increase this limit if you have huge mailboxes.
 290         #vsz_limit =
 291         process_limit = 1024
 292       }
 293       service imap-login {
 294         #inet_listener imap {
 295         #  address = 127.0.0.1
 296         #  port    = 143
 297         #  ssl     = no
 298         #}
 299         inet_listener imaps {
 300           port = 993
 301           ssl  = yes
 302         }
 303       }
 304       # Store METADATA information within user's HOME directory
 305       mail_attribute_dict = file:%h/dovecot-attributes
 306       # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 307       imapc_features = $imapc_features fetch-headers
 308       protocol imap {
 309         #mail_max_userip_connections = 10
 310         mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
 311         imap_metadata = yes
 312
 313         # DOC: https://wiki.dovecot.org/MailboxSettings
 314         # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 315         # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 316         imap_capability = +SPECIAL-USE
 317
 318         namespace Inbox {
 319           mailbox "Archives" {
 320             auto = subscribe
 321             special_use = \Archive
 322           }
 323           mailbox "Drafts" {
 324             auto = no
 325             special_use = \Drafts
 326           }
 327           mailbox "Brouillons" {
 328             auto = subscribe
 329             special_use = \Drafts
 330           }
 331           mailbox "Junk" {
 332             auto = no
 333             #autoexpunge = 30d
 334             special_use = \Junk
 335           }
 336           mailbox "Spams" {
 337             auto = no
 338             special_use = \Junk
 339           }
 340           mailbox "Spam" {
 341             auto = no
 342             special_use = \Junk
 343           }
 344           mailbox "Pourriels" {
 345             auto = no
 346             special_use = \Junk
 347           }
 348           mailbox "Pourriel" {
 349             auto = no
 350             special_use = \Junk
 351           }
 352           mailbox "Sent" {
 353             auto = no
 354             special_use = \Sent
 355           }
 356           mailbox "Sent Items" {
 357             auto = no
 358             special_use = \Sent
 359           }
 360           mailbox "Sent Messages" {
 361             auto = no
 362             special_use = \Sent
 363           }
 364           mailbox "Envoyés" {
 365             auto = no
 366             special_use = \Sent
 367           }
 368           mailbox "Trash" {
 369             auto = no
 370             special_use = \Trash
 371             #autoexpunge = 30d
 372           }
 373           mailbox "Corbeille" {
 374             auto = no
 375             special_use = \Trash
 376           }
 377         }
 378         namespace Virtual {
 379           mailbox All {
 380             auto = no
 381             comment = All messages from all mailboxes
 382             special_use = \All
 383           }
 384           mailbox Recents {
 385             auto = no
 386             comment = All messages from all mailboxes arrived in the past 48h
 387           }
 388         }
 389       }
 390       plugin {
 391         #sieve_default = file:${stateDir}/mail/%u/default.sieve
 392         #sieve_default_name = default
 393         sieve_plugins = sieve_imapsieve sieve_extprograms
 394         sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
 395         #sieve_extensions = +editheader
 396         sieve = file:~/sieve.d;active=~/sieve
 397         sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
 398         sieve_max_script_size = 1M
 399         sieve_quota_max_scripts = 0
 400         sieve_quota_max_storage = 10M
 401         #sieve_spamtest_max_value = 10
 402         #sieve_spamtest_status_header = X-Spam-Score
 403         #sieve_spamtest_status_type = strlen
 404         sieve_user_log = /var/log/dovecot/%d/sieve.%n.log
 405         # Enables support for user Sieve scripts in IMAP
 406         #imapsieve_url = sieve://mail.${networking.domain}:4190
 407
 408         # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 409         imapsieve_mailbox1_name = *
 410         imapsieve_mailbox1_causes = FLAG
 411         imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 412
 413         # From elsewhere to Junk folder
 414         imapsieve_mailbox2_name = Pourriel
 415         imapsieve_mailbox2_causes = COPY APPEND
 416         imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 417
 418         # From Junk folder to elsewhere
 419         imapsieve_mailbox3_name = *
 420         imapsieve_mailbox3_from = Pourriel
 421         imapsieve_mailbox3_causes = COPY
 422         imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 423       }
 424       protocol sieve {
 425         # Maximum number of ManageSieve connections allowed for a user from each IP address.
 426         # NOTE: The username is compared case-sensitively.
 427         mail_max_userip_connections = 10
 428
 429         # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 430         # the IMPLEMENTATION capability that the dovecot reports to clients.
 431         # For example: 'Cyrus timsieved v2.2.13'
 432         managesieve_implementation_string = Dovecot Pigeonhole
 433
 434         # The maximum number of compile errors that are returned to the client upon script
 435         # upload or script verification.
 436         managesieve_max_compile_errors = 5
 437
 438         #mail_max_userip_connections = 10
 439         #managesieve_implementation_string = Dovecot Pigeonhole
 440         managesieve_max_compile_errors = 5
 441         #managesieve_max_line_length = 65536
 442         #managesieve_notify_capability = mailto
 443         #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 444       }
 445       service managesieve-login {
 446         inet_listener sieve {
 447           port = 4190
 448           #ssl  = yes
 449         }
 450
 451         # Number of connections to handle before starting a new process. Typically
 452         # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 453         # is faster. <doc/wiki/LoginProcess.txt>
 454         service_count = 1
 455
 456         # Number of processes to always keep waiting for more connections.
 457         process_min_avail = 0
 458
 459         # If you set service_count=0, you probably need to grow this.
 460         #vsz_limit = 64M
 461       }
 462
 463       service quota-warning {
 464         executable = script ${
 465           pkgs.writeScript "quota-warning" ''
 466             #!/bin/sh -eu
 467             PERCENT=$1
 468             USER=$2
 469             cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 470             "plugin/quota=maildir:User quota:noenforcing"
 471             From: postmaster@${networking.domain}
 472             Subject: [WARNING] your mailbox is now $PERCENT% full.
 473
 474             Please remove some mails to make room for new ones.
 475             EOF
 476           ''
 477         }
 478         # use some unprivileged user for executing the quota warnings
 479         user = ${dovecot2.user}
 480         unix_listener quota-warning {
 481         }
 482       }
 483
 484       protocol pop3 {
 485         mail_plugins = $mail_plugins virtual
 486         #mail_max_userip_connections = 10
 487         # Virtual namespace for the virtual INBOX.
 488         # Use a global directory for dovecot-virtual files.
 489         #namespace Inbox {
 490         #  hidden    = yes
 491         #  list      = no
 492         #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 493         #  prefix    = pop3+
 494         #}
 495         pop3_client_workarounds =
 496         pop3_fast_size_lookups = yes
 497         pop3_lock_session = yes
 498         pop3_no_flag_updates = yes
 499         # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 500         pop3_uidl_format = %g
 501       }
 502       service pop3 {
 503         process_limit = 1024
 504       }
 505       service pop3-login {
 506         inet_listener pop3s {
 507           port = 995
 508           ssl  = yes
 509         }
 510       }
 511     '';
 512     #${lib.concatMapStringsSep "\n"
 513     #    (dom: ''
 514     #      local_name mail.${dom} {
 515     #        #ssl_ca   = <''${caPath}
 516     #        ssl_cert = <${x509.cert dom}
 517     #        ssl_key  = <${x509.key dom}
 518     #        }
 519     #    '')
 520     #    dovecot2.domains
 521     #}
 522   };
 523   #services.postfix.mapFiles."transport-dovecot" =
 524   #  toFile "transport-dovecot"
 525   #   (unlines
 526   #     (lib.mapAttrsToList
 527   #       (dom: {...}: "${transportSubDomain}.${dom} lmtp:unix:private/dovecot-lmtp")
 528   #       dovecot2.domains));
 529 }