]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/dovecot.nix
nix: fix security.pass services
[sourcephile-nix.git] / servers / mermet / dovecot.nix
1 { pkgs, lib, config, system, ... }:
2 let
3 inherit (builtins) toString toFile readFile;
4 inherit (lib) types;
5 inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
6 inherit (config) networking;
7 inherit (config.services) dovecot2 postfix openldap;
8
9 # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
10 stateDir = "/var/lib/dovecot";
11
12 sieve_pipe_bin_dir = pkgs.buildEnv {
13 name = "sieve_pipe_bin_dir";
14 pathsToLink = [ "/bin" ];
15 paths = [
16 learn-spam
17 learn-ham
18 ];
19 };
20 learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
21 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
22 '';
23 learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
24 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
25 '';
26
27 dovecot-virtual = pkgs.buildEnv {
28 name = "dovecot-virtual";
29 pathsToLink = [ "/" ];
30 paths = [
31 dovecot-virtual-all
32 dovecot-virtual-recents
33 ];
34 };
35 dovecot-virtual-all = pkgs.writeTextFile {
36 name = "dovecot-virtual-all";
37 destination = "/All/dovecot-virtual";
38 text = ''
39 *
40 all
41 '';
42 };
43 dovecot-virtual-recents = pkgs.writeTextFile {
44 name = "dovecot-virtual-recents";
45 destination = "/Recents/dovecot-virtual";
46 text = ''
47 *
48 all younger 172800
49 '';
50 };
51 dovecot-virtual-pop3 = pkgs.writeTextFile {
52 name = "dovecot-virtual-pop3";
53 destination = "/pop3/INBOX/dovecot-virtual";
54 text = ''
55 All
56 All+*
57 all
58 '';
59 };
60 in
61 {
62 imports = [
63 dovecot/sourcephile.fr.nix
64 dovecot/autogeree.net.nix
65 ];
66 users.groups.acme.members = [ dovecot2.user ];
67 systemd.services.dovecot2 = {
68 after = [
69 "postfix.service"
70 "openldap.service"
71 ];
72 /*
73 preStart = ''
74 # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
75 install -D -d -m 0771 \
76 -o "${dovecot2.user}" \
77 -g "${dovecot2.group}" \
78 ${stateDir}/mail
79 '';
80 */
81 };
82 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
83 services.dovecot2 = {
84 enable = true;
85 modules = [
86 pkgs.dovecot_pigeonhole
87 pkgs.dovecot_fts_xapian
88 ];
89 enablePAM = false;
90 enableImap = true;
91 enableLmtp = true;
92 enablePop3 = false;
93 protocols = [ "sieve" ];
94 # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
95 # Here INDEX and CONTROL are separated,
96 # it's not useful since there is no quota at the filesystem level
97 # it's just to let this possibility later on.
98 mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
99 createMailUser = false;
100 mailUser = "";
101 mailGroup = "";
102 sslServerCert = null;
103 sieveScripts = {
104 global = dovecot/sieve/global;
105 };
106 extraConfig = ''
107 auth_verbose = no
108 auth_debug = no
109 mail_debug = no
110 verbose_ssl = no
111 log_timestamp = "%Y-%m-%d %H:%M:%S "
112
113 ssl = required
114 ssl_dh = <${../../../sec/openssl/dh.pem}
115 ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
116 ssl_prefer_server_ciphers = yes
117 ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
118 ssl_key = </var/lib/acme/${networking.domain}/key.pem
119 #ssl_ca = <''${caPath}
120 #ssl_verify_client_cert = yes
121
122 listen = *
123 mail_home = ${stateDir}/home/%d/%n
124 # Read multiple mails in parallel, improves performance
125 mail_prefetch_count = 20
126 # Default VSZ (virtual memory size) limit for service processes. This is mainly
127 # intended to catch and kill processes that leak memory before they eat up everything.
128 # Increased for fts_xapian.
129 default_vsz_limit = 1G
130
131 # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
132 # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
133 # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
134 # when in fact, storing the password in the directory server using a Salted SHA-2 hash
135 # and transmitting the clear text password over a secure connection
136 # is more secure than having the directory server store the password in clear text
137 # or in a reversible encryption scheme.
138 # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
139 # Use doveadm pw -s SSHA
140 # or doveadm pw -s PBKDF2 -r 10000
141 # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
142 auth_mechanisms = plain login
143 auth_username_format = %Ln
144 service auth {
145 user = ${dovecot2.user}
146 # auth_socket_path points to this userdb socket by default. It's typically
147 # used by dovecot-lda, doveadm, possibly imap process, etc.
148 # Users that have access to this socket are able to get a list
149 # of all usernames and get results of everyone's userdb lookups.
150 unix_listener auth-userdb {
151 user = ${dovecot2.user}
152 group = ${dovecot2.group}
153 mode = 0660
154 }
155 unix_listener /var/lib/postfix/queue/private/auth {
156 user = ${postfix.user}
157 group = ${postfix.group}
158 mode = 0660
159 }
160 }
161 service auth-worker {
162 user = ${dovecot2.user}
163 }
164 auth_cache_verify_password_with_worker = yes
165 # SEE: http://wiki2.dovecot.org/Quota/FS
166 # NOTE: postfix does not supply a client cert.
167 auth_ssl_require_client_cert = no
168 #auth_ssl_username_from_cert = yes
169 # NOTE: lowercase the username, help with LDAP?
170 auth_username_format = %Lu
171 # NOTE: sync with LDAP's data.
172 first_valid_uid = 1000
173 disable_plaintext_auth = yes
174
175 userdb {
176 driver = ldap
177 # A different path than passdb's args enables non-blocking LDAP requests
178 args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
179 default_fields =
180 override_fields =
181 }
182
183 # No dirty syncs for maildir: locations which may be used directly by neomutt
184 maildir_very_dirty_syncs = no
185 namespace Inbox {
186 type = private
187 inbox = yes
188 hidden = no
189 list = yes
190 prefix =
191 separator = +
192 }
193 namespace Shared {
194 type = shared
195 #list = children
196 # NOTE: always listed in the LIST command.
197 list = yes
198 # NOTE: how to access the other users' mailboxes.
199 # NOTE: %var expands to the logged in user's variable, while
200 # %%var expands to the other users' variables.
201 # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
202 location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
203 prefix = Partages+%%n+
204 separator = +
205 subscriptions = yes
206 }
207 mail_plugins = $mail_plugins virtual
208 namespace Virtual {
209 prefix = Virtual+
210 separator = +
211 hidden = no
212 list = yes
213 subscriptions = no
214 location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
215 }
216
217 mail_plugins = $mail_plugins acl
218 plugin {
219 acl = vfile:/etc/dovecot/acl/global
220 acl_anyone = allow
221 # NOTE: to let users LIST mailboxes shared by other users,
222 # Dovecot needs a shared mailbox dictionary.
223 # FIXME: %d not working with userdb ldap
224 acl_shared_dict = file:${stateDir}/acl/%d/acl.db
225 }
226
227 mail_plugins = $mail_plugins fts fts_xapian
228 plugin {
229 # WARNING: doveadm fts rescan is buggy, it will delete the index:
230 # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
231 # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
232 plugin = fts fts_xapian
233 fts = xapian
234 fts_autoindex = yes
235 fts_autoindex_exclude = \Junk
236 fts_autoindex_exclude2 = \Trash
237 fts_enforced = yes
238 # 2 and 20 are the NGram values for header fields, which means the
239 # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
240 # Full words are also added by default.
241 fts_xapian = partial=2 full=20 attachments=1 verbose=0
242 fts_languages = en fr
243 #fts_dovecot_fs = posix:prefix=%h/fts/
244 }
245
246 mail_plugins = $mail_plugins quota
247 plugin {
248 quota = maildir:User quota
249 quota_rule = *:storage=256M
250 quota_rule2 = Trash:storage=+64M
251 quota_max_mail_size = 20M
252 #quota_exceeded_message = </path/to/quota_exceeded_message.txt
253 quota_warning = storage=95%% quota-warning 95 %u
254 quota_warning2 = storage=80%% quota-warning 80 %u
255 quota_warning3 = -storage=100%% quota-warning below %u
256 }
257
258 protocol lda {
259 hostname = ${networking.domain}
260 mail_plugins = $mail_plugins sieve
261 postmaster_address = postmaster+dovecot+lda@${networking.domain}
262 syslog_facility = mail
263 }
264 lda_mailbox_autocreate = yes
265 lda_mailbox_autosubscribe = yes
266
267 protocol lmtp {
268 mail_plugins = $mail_plugins sieve
269 postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
270 }
271 service lmtp {
272 process_min_avail = ${toString config.nix.maxJobs}
273 unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
274 user = ${postfix.user}
275 group = ${postfix.group}
276 mode = 0600
277 }
278 }
279 plugin {
280 # Let extension.sieve do the handling of the detail
281 #lmtp_save_to_detail_mailbox = yes
282 recipient_delimiter = ${postfix.recipientDelimiter}
283 }
284
285 service imap {
286 # Most of the memory goes to mmap()ing files.
287 # You may need to increase this limit if you have huge mailboxes.
288 #vsz_limit =
289 process_limit = 1024
290 }
291 service imap-login {
292 #inet_listener imap {
293 # address = 127.0.0.1
294 # port = 143
295 # ssl = no
296 #}
297 inet_listener imaps {
298 port = 993
299 ssl = yes
300 }
301 }
302 # Store METADATA information within user's HOME directory
303 mail_attribute_dict = file:%h/dovecot-attributes
304 # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
305 imapc_features = $imapc_features fetch-headers
306 protocol imap {
307 #mail_max_userip_connections = 10
308 mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
309 imap_metadata = yes
310
311 # DOC: https://wiki.dovecot.org/MailboxSettings
312 # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
313 # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
314 imap_capability = +SPECIAL-USE
315
316 namespace Inbox {
317 mailbox "Archives" {
318 auto = subscribe
319 special_use = \Archive
320 }
321 mailbox "Drafts" {
322 auto = no
323 special_use = \Drafts
324 }
325 mailbox "Brouillons" {
326 auto = subscribe
327 special_use = \Drafts
328 }
329 mailbox "Junk" {
330 auto = no
331 #autoexpunge = 30d
332 special_use = \Junk
333 }
334 mailbox "Spams" {
335 auto = no
336 special_use = \Junk
337 }
338 mailbox "Spam" {
339 auto = no
340 special_use = \Junk
341 }
342 mailbox "Pourriels" {
343 auto = no
344 special_use = \Junk
345 }
346 mailbox "Pourriel" {
347 auto = no
348 special_use = \Junk
349 }
350 mailbox "Sent" {
351 auto = no
352 special_use = \Sent
353 }
354 mailbox "Sent Items" {
355 auto = no
356 special_use = \Sent
357 }
358 mailbox "Sent Messages" {
359 auto = no
360 special_use = \Sent
361 }
362 mailbox "Envoyés" {
363 auto = no
364 special_use = \Sent
365 }
366 mailbox "Trash" {
367 auto = no
368 special_use = \Trash
369 #autoexpunge = 30d
370 }
371 mailbox "Corbeille" {
372 auto = no
373 special_use = \Trash
374 }
375 }
376 namespace Virtual {
377 mailbox All {
378 auto = no
379 comment = All messages from all mailboxes
380 # This flag is confused with \Archives by K9-Mail
381 special_use = \All
382 }
383 mailbox Recents {
384 auto = no
385 comment = All messages from all mailboxes, arrived in the past 48h
386 }
387 }
388 }
389 plugin {
390 sieve_plugins = sieve_imapsieve sieve_extprograms
391 sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
392 #sieve_extensions = +editheader
393 sieve = file:~/sieve;active=~/active.sieve
394 sieve_default = file:${stateDir}/sieve/global/default.sieve
395 sieve_default_name = main
396 sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
397 sieve_max_script_size = 1M
398 sieve_quota_max_scripts = 0
399 sieve_quota_max_storage = 10M
400 #sieve_spamtest_max_value = 10
401 #sieve_spamtest_status_header = X-Spam-Score
402 #sieve_spamtest_status_type = strlen
403 #sieve_user_log = ~/sieve.log
404 # Enables support for user Sieve scripts in IMAP
405 #imapsieve_url = sieve://mail.${networking.domain}:4190
406
407 # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
408 imapsieve_mailbox1_name = *
409 imapsieve_mailbox1_causes = FLAG
410 imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
411
412 # From elsewhere to Junk folder
413 imapsieve_mailbox2_name = Pourriel
414 imapsieve_mailbox2_causes = COPY APPEND
415 imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
416
417 # From Junk folder to elsewhere
418 imapsieve_mailbox3_name = *
419 imapsieve_mailbox3_from = Pourriel
420 imapsieve_mailbox3_causes = COPY
421 imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
422 }
423 protocol sieve {
424 # Maximum number of ManageSieve connections allowed for a user from each IP address.
425 # NOTE: The username is compared case-sensitively.
426 mail_max_userip_connections = 10
427
428 # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
429 # the IMPLEMENTATION capability that the dovecot reports to clients.
430 # For example: 'Cyrus timesieved v2.2.13'
431 managesieve_implementation_string = Dovecot Pigeonhole
432
433 # The maximum number of compile errors that are returned to the client upon script
434 # upload or script verification.
435 managesieve_max_compile_errors = 5
436
437 #mail_max_userip_connections = 10
438 #managesieve_implementation_string = Dovecot Pigeonhole
439 managesieve_max_compile_errors = 5
440 #managesieve_max_line_length = 65536
441 #managesieve_notify_capability = mailto
442 #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
443 }
444 service managesieve-login {
445 inet_listener sieve {
446 port = 4190
447 #ssl = yes
448 }
449
450 # Number of connections to handle before starting a new process. Typically
451 # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
452 # is faster. <doc/wiki/LoginProcess.txt>
453 service_count = 1
454
455 # Number of processes to always keep waiting for more connections.
456 process_min_avail = 0
457
458 # If you set service_count=0, you probably need to grow this.
459 #vsz_limit = 64M
460 }
461
462 service quota-warning {
463 executable = script ${
464 pkgs.writeShellScript "quota-warning" ''
465 set -eu
466 PERCENT=$1
467 USER=$2
468 cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
469 "plugin/quota=maildir:User quota:noenforcing"
470 From: postmaster@${networking.domain}
471 Subject: [WARNING] your mailbox is now $PERCENT% full.
472
473 Please remove some mails to make room for new ones.
474 EOF
475 ''
476 }
477 # use some unprivileged user for executing the quota warnings
478 user = ${dovecot2.user}
479 unix_listener quota-warning {
480 }
481 }
482
483 protocol pop3 {
484 mail_plugins = $mail_plugins virtual
485 #mail_max_userip_connections = 10
486 # Virtual namespace for the virtual INBOX.
487 # Use a global directory for dovecot-virtual files.
488 #namespace Inbox {
489 # hidden = yes
490 # list = no
491 # location = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
492 # prefix = pop3+
493 #}
494 pop3_client_workarounds =
495 pop3_fast_size_lookups = yes
496 pop3_lock_session = yes
497 pop3_no_flag_updates = yes
498 # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
499 pop3_uidl_format = %g
500 }
501 service pop3 {
502 process_limit = 1024
503 }
504 service pop3-login {
505 inet_listener pop3s {
506 port = 995
507 ssl = yes
508 }
509 }
510 '';
511 };
512 }