servers/mermet/dovecot.nix

   1 { pkgs, lib, config, system, ... }:
   2 let
   3   inherit (builtins) toString toFile readFile;
   4   inherit (builtins.extraBuiltins) pass;
   5   inherit (lib) types;
   6   inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
   7   inherit (config) networking;
   8   inherit (config.services) dovecot2 postfix openldap;
   9
  10   # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
  11   stateDir    = "/var/lib/dovecot";
  12
  13   sieve_pipe_bin_dir = pkgs.buildEnv {
  14     name = "sieve_pipe_bin_dir";
  15     pathsToLink = [ "/bin" ];
  16     paths = [
  17       learn-spam
  18       learn-ham
  19     ];
  20   };
  21   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  22     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  23   '';
  24   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  25     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  26   '';
  27
  28   dovecot-virtual = pkgs.buildEnv {
  29     name = "dovecot-virtual";
  30     pathsToLink = [ "/" ];
  31     paths = [
  32       dovecot-virtual-all
  33       dovecot-virtual-recents
  34     ];
  35   };
  36   dovecot-virtual-all = pkgs.writeTextFile {
  37     name = "dovecot-virtual-all";
  38     destination = "/All/dovecot-virtual";
  39     text = ''
  40       *
  41         all
  42     '';
  43   };
  44   dovecot-virtual-recents = pkgs.writeTextFile {
  45     name = "dovecot-virtual-recents";
  46     destination = "/Recents/dovecot-virtual";
  47     text = ''
  48       *
  49         all younger 172800
  50     '';
  51   };
  52   dovecot-virtual-pop3 = pkgs.writeTextFile {
  53     name = "dovecot-virtual-pop3";
  54     destination = "/pop3/INBOX/dovecot-virtual";
  55     text = ''
  56       All
  57       All+*
  58         all
  59     '';
  60   };
  61 in
  62 {
  63 imports = [
  64   dovecot/autoconfig.nix
  65 ];
  66 systemd.services.dovecot2 = {
  67   after = [
  68     "postfix.service"
  69     "openldap.service"
  70     "${networking.domain}.key.pem-key.service"
  71   ];
  72 };
  73 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  74 services.dovecot2 = {
  75   enable    = true;
  76   modules   = [
  77     pkgs.dovecot_pigeonhole
  78     pkgs.dovecot_fts_xapian
  79   ];
  80   enablePAM = false;
  81   enableImap = true;
  82   enableLmtp = true;
  83   enablePop3 = true;
  84   protocols = [ "sieve" ];
  85   # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
  86   # Here INDEX and CONTROL are separated,
  87   # it's not useful since there is not quota at the filesystem level
  88   # it's just to let this possibility later on.
  89   mailLocation = "sdbox:${stateDir}/mail/%d/%n/mail.d:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
  90   createMailUser = false;
  91   mailUser = "";
  92   mailGroup = "";
  93   sslServerCert = null;
  94   sieveScripts = {
  95     global = dovecot/sieve/global;
  96   };
  97   extraConfig = ''
  98     auth_verbose = yes
  99     auth_debug = yes
 100     mail_debug = yes
 101     verbose_ssl = no
 102     log_timestamp = "%Y-%m-%d %H:%M:%S "
 103
 104     ssl = required
 105     ssl_dh = <${../../../sec/openssl/dh.pem}
 106     ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 107     ssl_cert = <${loadFile (../../../sec + "/openssl/${networking.domain}/cert.self-signed.pem")}
 108     ssl_key = </run/keys/${networking.domain}.key.pem
 109     #ssl_ca = <''${caPath}
 110     #ssl_verify_client_cert = yes
 111
 112     listen = *
 113     # If needed, may be overrided by userdb_mail
 114     mail_home = ${stateDir}/mail/%d/%n
 115     # Read multiple mails in parallel, improves performance
 116     mail_prefetch_count = 20
 117     # Default VSZ (virtual memory size) limit for service processes. This is mainly
 118     # intended to catch and kill processes that leak memory before they eat up everything.
 119     # Increased for fts_xapian.
 120     default_vsz_limit = 1G
 121
 122     # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
 123     # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
 124     # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
 125     # when in fact, storing the password in the directory server using a Salted SHA-2 hash
 126     # and transmitting the clear text password over a secure connection
 127     # is more secure than having the directory server store the password in clear text
 128     # or in a reversible encryption scheme.
 129     # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
 130     # Use doveadm pw -s SSHA256 -u $user
 131     auth_mechanisms = plain login
 132     auth_username_format = %Ln
 133     passdb {
 134       driver = ldap
 135       # Because auth_bind=yes and auth_bind_userdn are used,
 136       # this cannot prefetch any userdb_*.
 137       args = ${dovecot/ldap/sourcephile.fr.conf}
 138       default_fields =
 139       override_fields =
 140     }
 141     userdb {
 142       driver = ldap
 143       # A different path than passdb's args enables non-blocking LDAP requests
 144       args = ${pkgs.symlinkJoin {name="ldap"; paths=[dovecot/ldap];}}/sourcephile.fr.conf
 145       default_fields =
 146       override_fields =
 147     }
 148     service auth {
 149       user = ${dovecot2.user}
 150       # auth_socket_path points to this userdb socket by default. It's typically
 151       # used by dovecot-lda, doveadm, possibly imap process, etc.
 152       # Users that have access to this socket are able to get a list
 153       # of all usernames and get results of everyone's userdb lookups.
 154       unix_listener auth-userdb {
 155         user  = ${dovecot2.user}
 156         group = ${dovecot2.group}
 157         mode  = 0660
 158       }
 159       unix_listener /var/lib/postfix/queue/private/auth {
 160         user  = ${postfix.user}
 161         group = ${postfix.group}
 162         mode  = 0660
 163       }
 164     }
 165     service auth-worker {
 166       user = ${dovecot2.user}
 167     }
 168     auth_cache_verify_password_with_worker = yes
 169     # SEE: http://wiki2.dovecot.org/Quota/FS
 170     # NOTE: postfix does not supply a client cert.
 171     auth_ssl_require_client_cert = no
 172     #auth_ssl_username_from_cert = yes
 173     # NOTE: lowercase the username, help with LDAP?
 174     auth_username_format = %Lu
 175     # NOTE: sync with LDAP's data.
 176     first_valid_uid = 1000
 177     disable_plaintext_auth = yes
 178
 179     # No dirty syncs for maildir: locations which may be used directly by neomutt
 180     maildir_very_dirty_syncs = no
 181     namespace Inbox {
 182       type      = private
 183       inbox     = yes
 184       hidden    = no
 185       list      = yes
 186       prefix    =
 187       separator = +
 188     }
 189     namespace Shared {
 190       type = shared
 191       #list = children
 192       # NOTE: always listed in the LIST command.
 193       list = yes
 194       # NOTE: how to access the other users' mailboxes.
 195       # NOTE: %var expands to the logged in user's variable, while
 196       #       %%var expands to the other users' variables.
 197       # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 198       location = sdbox:${stateDir}/mail/%%d/%%n/${stateDir}/mail.d:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/Shared:INDEX=${stateDir}/index/%%d/%%n/Shared:INDEXPVT=${stateDir}/index/%d/%n/Shared/%%n
 199       prefix = Partages+%%n+
 200       separator = +
 201       subscriptions = yes
 202     }
 203     mail_plugins = $mail_plugins virtual
 204     namespace Virtual {
 205       prefix = Virtual+
 206       separator = +
 207       hidden = no
 208       list = yes
 209       subscriptions = no
 210       location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 211     }
 212
 213     mail_plugins = $mail_plugins acl
 214     plugin {
 215       acl = vfile:/etc/dovecot/acl/global.d
 216       acl_anyone = allow
 217       # NOTE: to let users LIST mailboxes shared by other users,
 218       #       Dovecot needs a shared mailbox dictionary.
 219       # FIXME: %d not working with userdb ldap
 220       acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 221     }
 222
 223     mail_plugins = $mail_plugins fts fts_xapian
 224     plugin {
 225       plugin = fts fts_xapian
 226       fts = xapian
 227       fts_autoindex = yes
 228       fts_autoindex_exclude = \Junk
 229       fts_autoindex_exclude2 = \Trash
 230       fts_enforced = yes
 231       # 2 and 20 are the NGram values for header fields, which means the
 232       # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 233       # Full words are also added by default.
 234       fts_xapian = partial=2 full=20 verbose=0
 235     }
 236
 237     mail_plugins = $mail_plugins quota
 238     plugin {
 239       quota = maildir:User quota
 240       quota_rule = *:storage=256M
 241       quota_rule2 = Trash:storage=+64M
 242       quota_max_mail_size = 20M
 243       #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 244       quota_warning  = storage=95%% quota-warning 95 %u
 245       quota_warning2 = storage=80%% quota-warning 80 %u
 246       quota_warning3 = -storage=100%% quota-warning below %u
 247     }
 248
 249     protocol lda {
 250       hostname = ${networking.domain}
 251       mail_plugins = $mail_plugins sieve
 252       postmaster_address = postmaster+dovecot+lda@${networking.domain}
 253       syslog_facility = mail
 254     }
 255     lda_mailbox_autocreate = yes
 256     lda_mailbox_autosubscribe = yes
 257
 258     protocol lmtp {
 259       mail_plugins = $mail_plugins sieve
 260       postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
 261     }
 262     service lmtp {
 263       process_min_avail = ${toString config.nix.maxJobs}
 264       unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 265         user  = ${postfix.user}
 266         group = ${postfix.group}
 267         mode  = 0600
 268       }
 269     }
 270     plugin {
 271       # Let extension.sieve do the handling of the detail
 272       #lmtp_save_to_detail_mailbox = yes
 273       recipient_delimiter = ${postfix.recipientDelimiter}
 274     }
 275
 276     service imap {
 277       # Most of the memory goes to mmap()ing files.
 278       # You may need to increase this limit if you have huge mailboxes.
 279       #vsz_limit =
 280       process_limit = 1024
 281     }
 282     service imap-login {
 283       #inet_listener imap {
 284       #  address = 127.0.0.1
 285       #  port    = 143
 286       #  ssl     = no
 287       #}
 288       inet_listener imaps {
 289         port = 993
 290         ssl  = yes
 291       }
 292     }
 293     # Store METADATA information within user's HOME directory
 294     mail_attribute_dict = file:%h/dovecot-attributes
 295     # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 296     imapc_features = $imapc_features fetch-headers
 297     protocol imap {
 298       #mail_max_userip_connections = 10
 299       mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
 300       imap_metadata = yes
 301
 302       # DOC: https://wiki.dovecot.org/MailboxSettings
 303       # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 304       # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 305       imap_capability = +SPECIAL-USE
 306
 307       namespace Inbox {
 308         mailbox "Archives" {
 309           auto = subscribe
 310           special_use = \Archive
 311         }
 312         mailbox "Drafts" {
 313           auto = no
 314           special_use = \Drafts
 315         }
 316         mailbox "Brouillons" {
 317           auto = subscribe
 318           special_use = \Drafts
 319         }
 320         mailbox "Junk" {
 321           auto = no
 322           #autoexpunge = 30d
 323           special_use = \Junk
 324         }
 325         mailbox "Spams" {
 326           auto = no
 327           special_use = \Junk
 328         }
 329         mailbox "Spam" {
 330           auto = no
 331           special_use = \Junk
 332         }
 333         mailbox "Pourriels" {
 334           auto = no
 335           special_use = \Junk
 336         }
 337         mailbox "Pourriel" {
 338           auto = no
 339           special_use = \Junk
 340         }
 341         mailbox "Sent" {
 342           auto = no
 343           special_use = \Sent
 344         }
 345         mailbox "Sent Items" {
 346           auto = no
 347           special_use = \Sent
 348         }
 349         mailbox "Sent Messages" {
 350           auto = no
 351           special_use = \Sent
 352         }
 353         mailbox "Envoyés" {
 354           auto = no
 355           special_use = \Sent
 356         }
 357         mailbox "Trash" {
 358           auto = no
 359           special_use = \Trash
 360           #autoexpunge = 30d
 361         }
 362         mailbox "Corbeille" {
 363           auto = no
 364           special_use = \Trash
 365         }
 366       }
 367       namespace Virtual {
 368         mailbox All {
 369           auto = no
 370           comment = All messages from all mailboxes
 371           special_use = \All
 372         }
 373         mailbox Recents {
 374           auto = no
 375           comment = All messages from all mailboxes arrived in the past 48h
 376         }
 377       }
 378     }
 379     plugin {
 380       #sieve_default = file:${stateDir}/mail/%u/default.sieve
 381       #sieve_default_name = default
 382       sieve_plugins = sieve_imapsieve sieve_extprograms
 383       sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
 384       #sieve_extensions = +editheader
 385       sieve = file:~/sieve.d;active=~/sieve
 386       sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
 387       sieve_max_script_size = 1M
 388       sieve_quota_max_scripts = 0
 389       sieve_quota_max_storage = 10M
 390       #sieve_spamtest_max_value = 10
 391       #sieve_spamtest_status_header = X-Spam-Score
 392       #sieve_spamtest_status_type = strlen
 393       sieve_user_log = /var/log/dovecot/%d/sieve.%n.log
 394       # Enables support for user Sieve scripts in IMAP
 395       #imapsieve_url = sieve://mail.${networking.domain}:4190
 396
 397       # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 398       imapsieve_mailbox1_name = *
 399       imapsieve_mailbox1_causes = FLAG
 400       imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 401
 402       # From elsewhere to Junk folder
 403       imapsieve_mailbox2_name = Pourriel
 404       imapsieve_mailbox2_causes = COPY APPEND
 405       imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 406
 407       # From Junk folder to elsewhere
 408       imapsieve_mailbox3_name = *
 409       imapsieve_mailbox3_from = Pourriel
 410       imapsieve_mailbox3_causes = COPY
 411       imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 412     }
 413     protocol sieve {
 414       # Maximum number of ManageSieve connections allowed for a user from each IP address.
 415       # NOTE: The username is compared case-sensitively.
 416       mail_max_userip_connections = 10
 417
 418       # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 419       # the IMPLEMENTATION capability that the dovecot reports to clients.
 420       # For example: 'Cyrus timsieved v2.2.13'
 421       managesieve_implementation_string = Dovecot Pigeonhole
 422
 423       # The maximum number of compile errors that are returned to the client upon script
 424       # upload or script verification.
 425       managesieve_max_compile_errors = 5
 426
 427       #mail_max_userip_connections = 10
 428       #managesieve_implementation_string = Dovecot Pigeonhole
 429       managesieve_max_compile_errors = 5
 430       #managesieve_max_line_length = 65536
 431       #managesieve_notify_capability = mailto
 432       #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 433     }
 434     service managesieve-login {
 435       inet_listener sieve {
 436         port = 4190
 437         #ssl  = yes
 438       }
 439
 440       # Number of connections to handle before starting a new process. Typically
 441       # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 442       # is faster. <doc/wiki/LoginProcess.txt>
 443       service_count = 1
 444
 445       # Number of processes to always keep waiting for more connections.
 446       process_min_avail = 0
 447
 448       # If you set service_count=0, you probably need to grow this.
 449       #vsz_limit = 64M
 450     }
 451
 452     service quota-warning {
 453       executable = script ${
 454         pkgs.writeScript "quota-warning" ''
 455           #!/bin/sh -eu
 456           PERCENT=$1
 457           USER=$2
 458           cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 459           "plugin/quota=maildir:User quota:noenforcing"
 460           From: postmaster@${networking.domain}
 461           Subject: [WARNING] your mailbox is now $PERCENT% full.
 462
 463           Please remove some mails to make room for new ones.
 464           EOF
 465         ''
 466       }
 467       # use some unprivileged user for executing the quota warnings
 468       user = ${dovecot2.user}
 469       unix_listener quota-warning {
 470       }
 471     }
 472
 473     protocol pop3 {
 474       mail_plugins = $mail_plugins virtual
 475       #mail_max_userip_connections = 10
 476       # Virtual namespace for the virtual INBOX.
 477       # Use a global directory for dovecot-virtual files.
 478       #namespace Inbox {
 479       #  hidden    = yes
 480       #  list      = no
 481       #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 482       #  prefix    = pop3+
 483       #}
 484       pop3_client_workarounds =
 485       pop3_fast_size_lookups = yes
 486       pop3_lock_session = yes
 487       pop3_no_flag_updates = yes
 488       # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 489       pop3_uidl_format = %g
 490     }
 491     service pop3 {
 492       process_limit = 1024
 493     }
 494     service pop3-login {
 495       inet_listener pop3s {
 496         port = 995
 497         ssl  = yes
 498       }
 499     }
 500   '';
 501   #${lib.concatMapStringsSep "\n"
 502   #    (dom: ''
 503   #      local_name mail.${dom} {
 504   #        #ssl_ca   = <''${caPath}
 505   #        ssl_cert = <${x509.cert dom}
 506   #        ssl_key  = <${x509.key dom}
 507   #        }
 508   #    '')
 509   #    dovecot2.domains
 510   #}
 511 };
 512 #services.postfix.mapFiles."transport-dovecot" =
 513 #  toFile "transport-dovecot"
 514 #   (unlines
 515 #     (lib.mapAttrsToList
 516 #       (dom: {...}: "${transportSubDomain}.${dom} lmtp:unix:private/dovecot-lmtp")
 517 #       dovecot2.domains));
 518 }