1 { pkgs, lib, config, system, ... }:
3 inherit (builtins) toString toFile readFile;
5 inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
6 inherit (config) networking;
7 inherit (config.services) dovecot2 postfix openldap;
9 # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
10 stateDir = "/var/lib/dovecot";
12 sieve_pipe_bin_dir = pkgs.buildEnv {
13 name = "sieve_pipe_bin_dir";
14 pathsToLink = [ "/bin" ];
20 learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
21 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
23 learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
24 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
27 dovecot-virtual = pkgs.buildEnv {
28 name = "dovecot-virtual";
29 pathsToLink = [ "/" ];
32 dovecot-virtual-recents
35 dovecot-virtual-all = pkgs.writeTextFile {
36 name = "dovecot-virtual-all";
37 destination = "/All/dovecot-virtual";
43 dovecot-virtual-recents = pkgs.writeTextFile {
44 name = "dovecot-virtual-recents";
45 destination = "/Recents/dovecot-virtual";
51 dovecot-virtual-pop3 = pkgs.writeTextFile {
52 name = "dovecot-virtual-pop3";
53 destination = "/pop3/INBOX/dovecot-virtual";
63 dovecot/sourcephile.fr.nix
64 dovecot/autogeree.net.nix
66 users.groups.acme.members = [ dovecot2.user ];
67 systemd.services.dovecot2 = {
74 # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
75 install -D -d -m 0771 \
76 -o "${dovecot2.user}" \
77 -g "${dovecot2.group}" \
82 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
83 networking.nftables.ruleset = ''
84 add rule inet filter net2fw tcp dport 993 counter accept comment "IMAPS"
85 #add rule inet filter net2fw tcp dport 995 counter accept comment "POP3S"
86 add rule inet filter net2fw tcp dport 4190 counter accept comment "Sieve"
91 pkgs.dovecot_pigeonhole
92 pkgs.dovecot_fts_xapian
98 protocols = [ "sieve" ];
99 # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
100 # Here INDEX and CONTROL are separated,
101 # it's not useful since there is no quota at the filesystem level
102 # it's just to let this possibility later on.
103 mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
104 createMailUser = false;
107 sslServerCert = null;
109 global = dovecot/sieve/global;
116 log_timestamp = "%Y-%m-%d %H:%M:%S "
119 ssl_dh = <${../../../sec/openssl/dh.pem}
120 ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
121 ssl_prefer_server_ciphers = yes
122 ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
123 ssl_key = </var/lib/acme/${networking.domain}/key.pem
124 #ssl_ca = <''${caPath}
125 #ssl_verify_client_cert = yes
128 mail_home = ${stateDir}/home/%d/%n
129 # Read multiple mails in parallel, improves performance
130 mail_prefetch_count = 20
131 # Default VSZ (virtual memory size) limit for service processes. This is mainly
132 # intended to catch and kill processes that leak memory before they eat up everything.
133 # Increased for fts_xapian.
134 default_vsz_limit = 1G
136 # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
137 # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
138 # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
139 # when in fact, storing the password in the directory server using a Salted SHA-2 hash
140 # and transmitting the clear text password over a secure connection
141 # is more secure than having the directory server store the password in clear text
142 # or in a reversible encryption scheme.
143 # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
144 # Use doveadm pw -s SSHA
145 # or doveadm pw -s PBKDF2 -r 10000
146 # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
147 auth_mechanisms = plain login
148 auth_username_format = %Ln
150 user = ${dovecot2.user}
151 # auth_socket_path points to this userdb socket by default. It's typically
152 # used by dovecot-lda, doveadm, possibly imap process, etc.
153 # Users that have access to this socket are able to get a list
154 # of all usernames and get results of everyone's userdb lookups.
155 unix_listener auth-userdb {
156 user = ${dovecot2.user}
157 group = ${dovecot2.group}
160 unix_listener /var/lib/postfix/queue/private/auth {
161 user = ${postfix.user}
162 group = ${postfix.group}
166 service auth-worker {
167 user = ${dovecot2.user}
169 auth_cache_verify_password_with_worker = yes
170 # SEE: http://wiki2.dovecot.org/Quota/FS
171 # NOTE: postfix does not supply a client cert.
172 auth_ssl_require_client_cert = no
173 #auth_ssl_username_from_cert = yes
174 # NOTE: lowercase the username, help with LDAP?
175 auth_username_format = %Lu
176 # NOTE: sync with LDAP's data.
177 first_valid_uid = 1000
178 disable_plaintext_auth = yes
182 # A different path than passdb's args enables non-blocking LDAP requests
183 args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
188 # No dirty syncs for maildir: locations which may be used directly by neomutt
189 maildir_very_dirty_syncs = no
201 # NOTE: always listed in the LIST command.
203 # NOTE: how to access the other users' mailboxes.
204 # NOTE: %var expands to the logged in user's variable, while
205 # %%var expands to the other users' variables.
206 # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
207 location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
208 prefix = Partages+%%n+
212 mail_plugins = $mail_plugins virtual
219 location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
222 mail_plugins = $mail_plugins acl
224 acl = vfile:/etc/dovecot/acl/global
226 # NOTE: to let users LIST mailboxes shared by other users,
227 # Dovecot needs a shared mailbox dictionary.
228 # FIXME: %d not working with userdb ldap
229 acl_shared_dict = file:${stateDir}/acl/%d/acl.db
232 mail_plugins = $mail_plugins fts fts_xapian
234 # WARNING: doveadm fts rescan is buggy, it will delete the index:
235 # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
236 # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
237 plugin = fts fts_xapian
240 fts_autoindex_exclude = \Junk
241 fts_autoindex_exclude2 = \Trash
243 # 2 and 20 are the NGram values for header fields, which means the
244 # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
245 # Full words are also added by default.
246 fts_xapian = partial=2 full=20 attachments=1 verbose=0
247 fts_languages = en fr
248 #fts_dovecot_fs = posix:prefix=%h/fts/
251 mail_plugins = $mail_plugins quota
253 quota = maildir:User quota
254 quota_rule = *:storage=256M
255 quota_rule2 = Trash:storage=+64M
256 quota_max_mail_size = 20M
257 #quota_exceeded_message = </path/to/quota_exceeded_message.txt
258 quota_warning = storage=95%% quota-warning 95 %u
259 quota_warning2 = storage=80%% quota-warning 80 %u
260 quota_warning3 = -storage=100%% quota-warning below %u
264 hostname = ${networking.domain}
265 mail_plugins = $mail_plugins sieve
266 postmaster_address = postmaster+dovecot+lda@${networking.domain}
267 syslog_facility = mail
269 lda_mailbox_autocreate = yes
270 lda_mailbox_autosubscribe = yes
273 mail_plugins = $mail_plugins sieve
274 postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
277 process_min_avail = ${toString config.nix.maxJobs}
278 unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
279 user = ${postfix.user}
280 group = ${postfix.group}
285 # Let extension.sieve do the handling of the detail
286 #lmtp_save_to_detail_mailbox = yes
287 recipient_delimiter = ${postfix.recipientDelimiter}
291 # Most of the memory goes to mmap()ing files.
292 # You may need to increase this limit if you have huge mailboxes.
297 #inet_listener imap {
298 # address = 127.0.0.1
302 inet_listener imaps {
307 # Store METADATA information within user's HOME directory
308 mail_attribute_dict = file:%h/dovecot-attributes
309 # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
310 imapc_features = $imapc_features fetch-headers
312 #mail_max_userip_connections = 10
313 mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
316 # DOC: https://wiki.dovecot.org/MailboxSettings
317 # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
318 # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
319 imap_capability = +SPECIAL-USE
324 special_use = \Archive
328 special_use = \Drafts
330 mailbox "Brouillons" {
332 special_use = \Drafts
347 mailbox "Pourriels" {
359 mailbox "Sent Items" {
363 mailbox "Sent Messages" {
376 mailbox "Corbeille" {
384 comment = All messages from all mailboxes
385 # This flag is confused with \Archives by K9-Mail
390 comment = All messages from all mailboxes, arrived in the past 48h
395 sieve_plugins = sieve_imapsieve sieve_extprograms
396 sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
397 #sieve_extensions = +editheader
398 sieve = file:~/sieve;active=~/active.sieve
399 sieve_default = file:${stateDir}/sieve/global/default.sieve
400 sieve_default_name = main
401 sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
402 sieve_max_script_size = 1M
403 sieve_quota_max_scripts = 0
404 sieve_quota_max_storage = 10M
405 #sieve_spamtest_max_value = 10
406 #sieve_spamtest_status_header = X-Spam-Score
407 #sieve_spamtest_status_type = strlen
408 #sieve_user_log = ~/sieve.log
409 # Enables support for user Sieve scripts in IMAP
410 #imapsieve_url = sieve://mail.${networking.domain}:4190
412 # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
413 imapsieve_mailbox1_name = *
414 imapsieve_mailbox1_causes = FLAG
415 imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
417 # From elsewhere to Junk folder
418 imapsieve_mailbox2_name = Pourriel
419 imapsieve_mailbox2_causes = COPY APPEND
420 imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
422 # From Junk folder to elsewhere
423 imapsieve_mailbox3_name = *
424 imapsieve_mailbox3_from = Pourriel
425 imapsieve_mailbox3_causes = COPY
426 imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
429 # Maximum number of ManageSieve connections allowed for a user from each IP address.
430 # NOTE: The username is compared case-sensitively.
431 mail_max_userip_connections = 10
433 # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
434 # the IMPLEMENTATION capability that the dovecot reports to clients.
435 # For example: 'Cyrus timesieved v2.2.13'
436 managesieve_implementation_string = Dovecot Pigeonhole
438 # The maximum number of compile errors that are returned to the client upon script
439 # upload or script verification.
440 managesieve_max_compile_errors = 5
442 #mail_max_userip_connections = 10
443 #managesieve_implementation_string = Dovecot Pigeonhole
444 managesieve_max_compile_errors = 5
445 #managesieve_max_line_length = 65536
446 #managesieve_notify_capability = mailto
447 #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
449 service managesieve-login {
450 inet_listener sieve {
455 # Number of connections to handle before starting a new process. Typically
456 # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
457 # is faster. <doc/wiki/LoginProcess.txt>
460 # Number of processes to always keep waiting for more connections.
461 process_min_avail = 0
463 # If you set service_count=0, you probably need to grow this.
467 service quota-warning {
468 executable = script ${
469 pkgs.writeShellScript "quota-warning" ''
473 cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
474 "plugin/quota=maildir:User quota:noenforcing"
475 From: postmaster@${networking.domain}
476 Subject: [WARNING] your mailbox is now $PERCENT% full.
478 Please remove some mails to make room for new ones.
482 # use some unprivileged user for executing the quota warnings
483 user = ${dovecot2.user}
484 unix_listener quota-warning {
489 mail_plugins = $mail_plugins virtual
490 #mail_max_userip_connections = 10
491 # Virtual namespace for the virtual INBOX.
492 # Use a global directory for dovecot-virtual files.
496 # location = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
499 pop3_client_workarounds =
500 pop3_fast_size_lookups = yes
501 pop3_lock_session = yes
502 pop3_no_flag_updates = yes
503 # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
504 pop3_uidl_format = %g
510 inet_listener pop3s {