servers/mermet/dovecot.nix

   1 { pkgs, lib, config, system, ... }:
   2 let
   3   inherit (builtins) toString toFile readFile;
   4   inherit (lib) types;
   5   inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
   6   inherit (config) networking;
   7   inherit (config.services) dovecot2 postfix openldap;
   8
   9   # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
  10   stateDir = "/var/lib/dovecot";
  11
  12   sieve_pipe_bin_dir = pkgs.buildEnv {
  13     name = "sieve_pipe_bin_dir";
  14     pathsToLink = [ "/bin" ];
  15     paths = [
  16       learn-spam
  17       learn-ham
  18     ];
  19   };
  20   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  21     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  22   '';
  23   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  24     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  25   '';
  26
  27   dovecot-virtual = pkgs.buildEnv {
  28     name = "dovecot-virtual";
  29     pathsToLink = [ "/" ];
  30     paths = [
  31       dovecot-virtual-all
  32       dovecot-virtual-recents
  33     ];
  34   };
  35   dovecot-virtual-all = pkgs.writeTextFile {
  36     name = "dovecot-virtual-all";
  37     destination = "/All/dovecot-virtual";
  38     text = ''
  39       *
  40         all
  41     '';
  42   };
  43   dovecot-virtual-recents = pkgs.writeTextFile {
  44     name = "dovecot-virtual-recents";
  45     destination = "/Recents/dovecot-virtual";
  46     text = ''
  47       *
  48         all younger 172800
  49     '';
  50   };
  51   dovecot-virtual-pop3 = pkgs.writeTextFile {
  52     name = "dovecot-virtual-pop3";
  53     destination = "/pop3/INBOX/dovecot-virtual";
  54     text = ''
  55       All
  56       All+*
  57         all
  58     '';
  59   };
  60 in
  61 {
  62 imports = [
  63   dovecot/sourcephile.fr.nix
  64   dovecot/autogeree.net.nix
  65 ];
  66 users.groups.acme.members = [ dovecot2.user ];
  67 systemd.services.dovecot2 = {
  68   after = [
  69     "postfix.service"
  70     "openldap.service"
  71   ];
  72   /*
  73   preStart = ''
  74     # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
  75     install -D -d -m 0771 \
  76      -o "${dovecot2.user}" \
  77      -g "${dovecot2.group}" \
  78      ${stateDir}/mail
  79   '';
  80   */
  81 };
  82 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  83 services.dovecot2 = {
  84   enable = true;
  85   modules = [
  86     pkgs.dovecot_pigeonhole
  87     pkgs.dovecot_fts_xapian
  88   ];
  89   enablePAM = false;
  90   enableImap = true;
  91   enableLmtp = true;
  92   enablePop3 = false;
  93   protocols = [ "sieve" ];
  94   # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
  95   # Here INDEX and CONTROL are separated,
  96   # it's not useful since there is no quota at the filesystem level
  97   # it's just to let this possibility later on.
  98   mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
  99   createMailUser = false;
 100   mailUser = "";
 101   mailGroup = "";
 102   sslServerCert = null;
 103   sieveScripts = {
 104     global = dovecot/sieve/global;
 105   };
 106   extraConfig = ''
 107     auth_verbose = no
 108     auth_debug = no
 109     mail_debug = no
 110     verbose_ssl = no
 111     log_timestamp = "%Y-%m-%d %H:%M:%S "
 112
 113     ssl = required
 114     ssl_dh = <${../../../sec/openssl/dh.pem}
 115     ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 116     ssl_prefer_server_ciphers = yes
 117     ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
 118     ssl_key = </var/lib/acme/${networking.domain}/key.pem
 119     #ssl_ca = <''${caPath}
 120     #ssl_verify_client_cert = yes
 121
 122     listen = *
 123     mail_home = ${stateDir}/home/%d/%n
 124     # Read multiple mails in parallel, improves performance
 125     mail_prefetch_count = 20
 126     # Default VSZ (virtual memory size) limit for service processes. This is mainly
 127     # intended to catch and kill processes that leak memory before they eat up everything.
 128     # Increased for fts_xapian.
 129     default_vsz_limit = 1G
 130
 131     # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
 132     # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
 133     # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
 134     # when in fact, storing the password in the directory server using a Salted SHA-2 hash
 135     # and transmitting the clear text password over a secure connection
 136     # is more secure than having the directory server store the password in clear text
 137     # or in a reversible encryption scheme.
 138     # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
 139     # Use doveadm pw -s SSHA
 140     # or doveadm pw -s PBKDF2 -r 10000
 141     # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
 142     auth_mechanisms = plain login
 143     auth_username_format = %Ln
 144     service auth {
 145       user = ${dovecot2.user}
 146       # auth_socket_path points to this userdb socket by default. It's typically
 147       # used by dovecot-lda, doveadm, possibly imap process, etc.
 148       # Users that have access to this socket are able to get a list
 149       # of all usernames and get results of everyone's userdb lookups.
 150       unix_listener auth-userdb {
 151         user  = ${dovecot2.user}
 152         group = ${dovecot2.group}
 153         mode  = 0660
 154       }
 155       unix_listener /var/lib/postfix/queue/private/auth {
 156         user  = ${postfix.user}
 157         group = ${postfix.group}
 158         mode  = 0660
 159       }
 160     }
 161     service auth-worker {
 162       user = ${dovecot2.user}
 163     }
 164     auth_cache_verify_password_with_worker = yes
 165     # SEE: http://wiki2.dovecot.org/Quota/FS
 166     # NOTE: postfix does not supply a client cert.
 167     auth_ssl_require_client_cert = no
 168     #auth_ssl_username_from_cert = yes
 169     # NOTE: lowercase the username, help with LDAP?
 170     auth_username_format = %Lu
 171     # NOTE: sync with LDAP's data.
 172     first_valid_uid = 1000
 173     disable_plaintext_auth = yes
 174
 175     userdb {
 176       driver = ldap
 177       # A different path than passdb's args enables non-blocking LDAP requests
 178       args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
 179       default_fields =
 180       override_fields =
 181     }
 182
 183     # No dirty syncs for maildir: locations which may be used directly by neomutt
 184     maildir_very_dirty_syncs = no
 185     namespace Inbox {
 186       type      = private
 187       inbox     = yes
 188       hidden    = no
 189       list      = yes
 190       prefix    =
 191       separator = +
 192     }
 193     namespace Shared {
 194       type = shared
 195       #list = children
 196       # NOTE: always listed in the LIST command.
 197       list = yes
 198       # NOTE: how to access the other users' mailboxes.
 199       # NOTE: %var expands to the logged in user's variable, while
 200       #       %%var expands to the other users' variables.
 201       # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 202       location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
 203       prefix = Partages+%%n+
 204       separator = +
 205       subscriptions = yes
 206     }
 207     mail_plugins = $mail_plugins virtual
 208     namespace Virtual {
 209       prefix = Virtual+
 210       separator = +
 211       hidden = no
 212       list = yes
 213       subscriptions = no
 214       location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 215     }
 216
 217     mail_plugins = $mail_plugins acl
 218     plugin {
 219       acl = vfile:/etc/dovecot/acl/global
 220       acl_anyone = allow
 221       # NOTE: to let users LIST mailboxes shared by other users,
 222       #       Dovecot needs a shared mailbox dictionary.
 223       # FIXME: %d not working with userdb ldap
 224       acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 225     }
 226
 227     mail_plugins = $mail_plugins fts fts_xapian
 228     plugin {
 229       # WARNING: doveadm fts rescan is buggy, it will delete the index:
 230       # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
 231       # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
 232       plugin = fts fts_xapian
 233       fts = xapian
 234       fts_autoindex = yes
 235       fts_autoindex_exclude = \Junk
 236       fts_autoindex_exclude2 = \Trash
 237       fts_enforced = yes
 238       # 2 and 20 are the NGram values for header fields, which means the
 239       # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 240       # Full words are also added by default.
 241       fts_xapian = partial=2 full=20 attachments=1 verbose=0
 242       fts_languages = en fr
 243       #fts_dovecot_fs = posix:prefix=%h/fts/
 244     }
 245
 246     mail_plugins = $mail_plugins quota
 247     plugin {
 248       quota = maildir:User quota
 249       quota_rule = *:storage=256M
 250       quota_rule2 = Trash:storage=+64M
 251       quota_max_mail_size = 20M
 252       #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 253       quota_warning  = storage=95%% quota-warning 95 %u
 254       quota_warning2 = storage=80%% quota-warning 80 %u
 255       quota_warning3 = -storage=100%% quota-warning below %u
 256     }
 257
 258     protocol lda {
 259       hostname = ${networking.domain}
 260       mail_plugins = $mail_plugins sieve
 261       postmaster_address = postmaster+dovecot+lda@${networking.domain}
 262       syslog_facility = mail
 263     }
 264     lda_mailbox_autocreate = yes
 265     lda_mailbox_autosubscribe = yes
 266
 267     protocol lmtp {
 268       mail_plugins = $mail_plugins sieve
 269       postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
 270     }
 271     service lmtp {
 272       process_min_avail = ${toString config.nix.maxJobs}
 273       unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 274         user  = ${postfix.user}
 275         group = ${postfix.group}
 276         mode  = 0600
 277       }
 278     }
 279     plugin {
 280       # Let extension.sieve do the handling of the detail
 281       #lmtp_save_to_detail_mailbox = yes
 282       recipient_delimiter = ${postfix.recipientDelimiter}
 283     }
 284
 285     service imap {
 286       # Most of the memory goes to mmap()ing files.
 287       # You may need to increase this limit if you have huge mailboxes.
 288       #vsz_limit =
 289       process_limit = 1024
 290     }
 291     service imap-login {
 292       #inet_listener imap {
 293       #  address = 127.0.0.1
 294       #  port    = 143
 295       #  ssl     = no
 296       #}
 297       inet_listener imaps {
 298         port = 993
 299         ssl  = yes
 300       }
 301     }
 302     # Store METADATA information within user's HOME directory
 303     mail_attribute_dict = file:%h/dovecot-attributes
 304     # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 305     imapc_features = $imapc_features fetch-headers
 306     protocol imap {
 307       #mail_max_userip_connections = 10
 308       mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
 309       imap_metadata = yes
 310
 311       # DOC: https://wiki.dovecot.org/MailboxSettings
 312       # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 313       # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 314       imap_capability = +SPECIAL-USE
 315
 316       namespace Inbox {
 317         mailbox "Archives" {
 318           auto = subscribe
 319           special_use = \Archive
 320         }
 321         mailbox "Drafts" {
 322           auto = no
 323           special_use = \Drafts
 324         }
 325         mailbox "Brouillons" {
 326           auto = subscribe
 327           special_use = \Drafts
 328         }
 329         mailbox "Junk" {
 330           auto = no
 331           #autoexpunge = 30d
 332           special_use = \Junk
 333         }
 334         mailbox "Spams" {
 335           auto = no
 336           special_use = \Junk
 337         }
 338         mailbox "Spam" {
 339           auto = no
 340           special_use = \Junk
 341         }
 342         mailbox "Pourriels" {
 343           auto = no
 344           special_use = \Junk
 345         }
 346         mailbox "Pourriel" {
 347           auto = no
 348           special_use = \Junk
 349         }
 350         mailbox "Sent" {
 351           auto = no
 352           special_use = \Sent
 353         }
 354         mailbox "Sent Items" {
 355           auto = no
 356           special_use = \Sent
 357         }
 358         mailbox "Sent Messages" {
 359           auto = no
 360           special_use = \Sent
 361         }
 362         mailbox "Envoyés" {
 363           auto = no
 364           special_use = \Sent
 365         }
 366         mailbox "Trash" {
 367           auto = no
 368           special_use = \Trash
 369           #autoexpunge = 30d
 370         }
 371         mailbox "Corbeille" {
 372           auto = no
 373           special_use = \Trash
 374         }
 375       }
 376       namespace Virtual {
 377         mailbox All {
 378           auto = no
 379           comment = All messages from all mailboxes
 380           # This flag is confused with \Archives by K9-Mail
 381           special_use = \All
 382         }
 383         mailbox Recents {
 384           auto = no
 385           comment = All messages from all mailboxes, arrived in the past 48h
 386         }
 387       }
 388     }
 389     plugin {
 390       sieve_plugins = sieve_imapsieve sieve_extprograms
 391       sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
 392       #sieve_extensions = +editheader
 393       sieve = file:~/sieve;active=~/active.sieve
 394       sieve_default = file:${stateDir}/sieve/global/default.sieve
 395       sieve_default_name = main
 396       sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
 397       sieve_max_script_size = 1M
 398       sieve_quota_max_scripts = 0
 399       sieve_quota_max_storage = 10M
 400       #sieve_spamtest_max_value = 10
 401       #sieve_spamtest_status_header = X-Spam-Score
 402       #sieve_spamtest_status_type = strlen
 403       #sieve_user_log = ~/sieve.log
 404       # Enables support for user Sieve scripts in IMAP
 405       #imapsieve_url = sieve://mail.${networking.domain}:4190
 406
 407       # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 408       imapsieve_mailbox1_name = *
 409       imapsieve_mailbox1_causes = FLAG
 410       imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 411
 412       # From elsewhere to Junk folder
 413       imapsieve_mailbox2_name = Pourriel
 414       imapsieve_mailbox2_causes = COPY APPEND
 415       imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 416
 417       # From Junk folder to elsewhere
 418       imapsieve_mailbox3_name = *
 419       imapsieve_mailbox3_from = Pourriel
 420       imapsieve_mailbox3_causes = COPY
 421       imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 422     }
 423     protocol sieve {
 424       # Maximum number of ManageSieve connections allowed for a user from each IP address.
 425       # NOTE: The username is compared case-sensitively.
 426       mail_max_userip_connections = 10
 427
 428       # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 429       # the IMPLEMENTATION capability that the dovecot reports to clients.
 430       # For example: 'Cyrus timesieved v2.2.13'
 431       managesieve_implementation_string = Dovecot Pigeonhole
 432
 433       # The maximum number of compile errors that are returned to the client upon script
 434       # upload or script verification.
 435       managesieve_max_compile_errors = 5
 436
 437       #mail_max_userip_connections = 10
 438       #managesieve_implementation_string = Dovecot Pigeonhole
 439       managesieve_max_compile_errors = 5
 440       #managesieve_max_line_length = 65536
 441       #managesieve_notify_capability = mailto
 442       #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 443     }
 444     service managesieve-login {
 445       inet_listener sieve {
 446         port = 4190
 447         #ssl  = yes
 448       }
 449
 450       # Number of connections to handle before starting a new process. Typically
 451       # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 452       # is faster. <doc/wiki/LoginProcess.txt>
 453       service_count = 1
 454
 455       # Number of processes to always keep waiting for more connections.
 456       process_min_avail = 0
 457
 458       # If you set service_count=0, you probably need to grow this.
 459       #vsz_limit = 64M
 460     }
 461
 462     service quota-warning {
 463       executable = script ${
 464         pkgs.writeShellScript "quota-warning" ''
 465           set -eu
 466           PERCENT=$1
 467           USER=$2
 468           cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 469           "plugin/quota=maildir:User quota:noenforcing"
 470           From: postmaster@${networking.domain}
 471           Subject: [WARNING] your mailbox is now $PERCENT% full.
 472
 473           Please remove some mails to make room for new ones.
 474           EOF
 475         ''
 476       }
 477       # use some unprivileged user for executing the quota warnings
 478       user = ${dovecot2.user}
 479       unix_listener quota-warning {
 480       }
 481     }
 482
 483     protocol pop3 {
 484       mail_plugins = $mail_plugins virtual
 485       #mail_max_userip_connections = 10
 486       # Virtual namespace for the virtual INBOX.
 487       # Use a global directory for dovecot-virtual files.
 488       #namespace Inbox {
 489       #  hidden    = yes
 490       #  list      = no
 491       #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 492       #  prefix    = pop3+
 493       #}
 494       pop3_client_workarounds =
 495       pop3_fast_size_lookups = yes
 496       pop3_lock_session = yes
 497       pop3_no_flag_updates = yes
 498       # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 499       pop3_uidl_format = %g
 500     }
 501     service pop3 {
 502       process_limit = 1024
 503     }
 504     service pop3-login {
 505       inet_listener pop3s {
 506         port = 995
 507         ssl  = yes
 508       }
 509     }
 510   '';
 511 };
 512 }