]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/dovecot.nix
carotte: move to carotte.wg
[sourcephile-nix.git] / hosts / mermet / dovecot.nix
1 { inputs, pkgs, lib, config, system, host, ... }:
2 let
3 inherit (builtins) toString toFile readFile;
4 inherit (lib) types;
5 inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
6 inherit (config) networking;
7 inherit (config.services) dovecot2 postfix openldap;
8
9 # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
10 stateDir = "/var/lib/dovecot";
11
12 sieve_pipe_bin_dir = pkgs.buildEnv {
13 name = "sieve_pipe_bin_dir";
14 pathsToLink = [ "/bin" ];
15 paths = [
16 learn-spam
17 learn-ham
18 ];
19 };
20 learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
21 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
22 '';
23 learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
24 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
25 '';
26
27 dovecot-virtual = pkgs.buildEnv {
28 name = "dovecot-virtual";
29 pathsToLink = [ "/" ];
30 paths = [
31 dovecot-virtual-all
32 dovecot-virtual-recents
33 ];
34 };
35 dovecot-virtual-all = pkgs.writeTextFile {
36 name = "dovecot-virtual-all";
37 destination = "/All/dovecot-virtual";
38 text = ''
39 *
40 all
41 '';
42 };
43 dovecot-virtual-recents = pkgs.writeTextFile {
44 name = "dovecot-virtual-recents";
45 destination = "/Recents/dovecot-virtual";
46 text = ''
47 *
48 all younger 172800
49 '';
50 };
51 dovecot-virtual-pop3 = pkgs.writeTextFile {
52 name = "dovecot-virtual-pop3";
53 destination = "/pop3/INBOX/dovecot-virtual";
54 text = ''
55 All
56 All+*
57 all
58 '';
59 };
60 in
61 {
62 imports = [
63 dovecot/sourcephile.fr.nix
64 dovecot/autogeree.net.nix
65 ];
66 users.groups.acme.members = [ dovecot2.user ];
67 systemd.services.dovecot2 = {
68 after = [
69 "postfix.service"
70 "openldap.service"
71 ];
72 /*
73 preStart = ''
74 # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
75 install -D -d -m 0771 \
76 -o "${dovecot2.user}" \
77 -g "${dovecot2.group}" \
78 ${stateDir}/mail
79 '';
80 */
81 preStart = ''
82 ln -fns -t ${stateDir}/virtual/ \
83 ${dovecot-virtual-all}/All \
84 ${dovecot-virtual-recents}/Recents
85 '';
86 serviceConfig = {
87 #ExecStart = lib.mkForce "${pkgs.utillinux}/bin/setarch x86_64 --addr-no-randomize /bin/sh -c 'LD_PRELOAD=${pkgs.gcc-unwrapped.lib}/lib/libasan.so ${pkgs.dovecot}/sbin/dovecot -F'";
88 # Dovecot2 does not work with environment.memoryAllocator.provider="scudo"
89 # https://wiki.dovecot.org/Design/Memory
90 # Scudo ERROR: CHECK failed at /build/compiler-rt-7.1.0.src/lib/scudo/../sanitizer_common/sanitizer_allocator_primary64.h:
91 # 644 ((beg)) == ((address_range.MapOrDie(beg, size))) (4398046511092, 4398046507008)
92 BindReadOnlyPaths = [ "/dev/null:/etc/ld-nix.so.preload" ];
93 StateDirectory = ["dovecot/virtual"];
94 };
95 };
96 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
97 networking.nftables.ruleset = ''
98 add rule inet filter net2fw tcp dport 993 counter accept comment "IMAPS"
99 #add rule inet filter net2fw tcp dport 995 counter accept comment "POP3S"
100 add rule inet filter net2fw tcp dport 4190 counter accept comment "Sieve"
101 '';
102 fileSystems."/var/lib/dovecot" = {
103 device = "rpool/var/mail";
104 fsType = "zfs";
105 };
106 services.sanoid.datasets."rpool/var/mail" = {
107 use_template = [ "snap" ];
108 hourly = 12;
109 daily = 7;
110 };
111 services.dovecot2 = {
112 enable = true;
113 modules = [
114 pkgs.dovecot_pigeonhole
115 pkgs.dovecot_fts_xapian
116 ];
117 enablePAM = false;
118 enableImap = true;
119 enableLmtp = true;
120 enablePop3 = false;
121 protocols = [ "sieve" ];
122 # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
123 # Here INDEX and CONTROL are separated,
124 # it's not useful since there is no quota at the filesystem level
125 # it's just to let this possibility later on.
126 mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
127 createMailUser = false;
128 mailUser = "";
129 mailGroup = "";
130 sslServerCert = null;
131 sieveScripts = {
132 global = dovecot/sieve/global;
133 };
134 extraConfig = ''
135 auth_verbose = no
136 auth_debug = no
137 mail_debug = no
138 verbose_ssl = no
139 log_timestamp = "%Y-%m-%d %H:%M:%S "
140
141 ssl = required
142 ssl_dh = <${inputs.secrets + "/openssl/dh.pem"}
143 ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
144 ssl_prefer_server_ciphers = yes
145 ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
146 ssl_key = </var/lib/acme/${networking.domain}/key.pem
147 #ssl_ca = <''${caPath}
148 #ssl_verify_client_cert = yes
149 # FIXME: change to TLSv1.3 when supported by K-9 Mail
150 ssl_min_protocol = TLSv1.2
151
152 listen = *
153 mail_home = ${stateDir}/home/%d/%n
154 # Read multiple mails in parallel, improves performance
155 mail_prefetch_count = 20
156 # Default VSZ (virtual memory size) limit for service processes. This is mainly
157 # intended to catch and kill processes that leak memory before they eat up everything.
158 # Increased for fts_xapian.
159 default_vsz_limit = 1G
160
161 # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
162 # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
163 # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
164 # when in fact, storing the password in the directory server using a Salted SHA-2 hash
165 # and transmitting the clear text password over a secure connection
166 # is more secure than having the directory server store the password in clear text
167 # or in a reversible encryption scheme.
168 # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
169 # Use doveadm pw -s SSHA
170 # or doveadm pw -s PBKDF2 -r 10000
171 # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
172 auth_mechanisms = plain login
173 auth_username_format = %Ln
174 service auth {
175 user = ${dovecot2.user}
176 # auth_socket_path points to this userdb socket by default. It's typically
177 # used by dovecot-lda, doveadm, possibly imap process, etc.
178 # Users that have access to this socket are able to get a list
179 # of all usernames and get results of everyone's userdb lookups.
180 unix_listener auth-userdb {
181 user = ${dovecot2.user}
182 group = ${dovecot2.group}
183 mode = 0660
184 }
185 unix_listener /var/lib/postfix/queue/private/auth {
186 user = ${postfix.user}
187 group = ${postfix.group}
188 mode = 0660
189 }
190 }
191 service auth-worker {
192 user = ${dovecot2.user}
193 }
194 auth_cache_verify_password_with_worker = yes
195 # SEE: http://wiki2.dovecot.org/Quota/FS
196 # NOTE: postfix does not supply a client cert.
197 auth_ssl_require_client_cert = no
198 #auth_ssl_username_from_cert = yes
199 # NOTE: lowercase the username, help with LDAP?
200 auth_username_format = %Lu
201 # NOTE: sync with LDAP's data.
202 first_valid_uid = 1000
203 disable_plaintext_auth = yes
204
205 userdb {
206 driver = ldap
207 # A different path than passdb's args enables non-blocking LDAP requests
208 args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
209 default_fields =
210 override_fields =
211 }
212
213 # No dirty syncs for maildir: locations which may be used directly by neomutt
214 maildir_very_dirty_syncs = no
215 namespace Inbox {
216 type = private
217 inbox = yes
218 hidden = no
219 list = yes
220 prefix =
221 separator = +
222 }
223 namespace Shared {
224 type = shared
225 #list = children
226 # NOTE: always listed in the LIST command.
227 list = yes
228 # NOTE: how to access the other users' mailboxes.
229 # NOTE: %var expands to the logged in user's variable, while
230 # %%var expands to the other users' variables.
231 # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
232 location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
233 prefix = Partages+%%n+
234 separator = +
235 subscriptions = yes
236 }
237 mail_plugins = $mail_plugins virtual
238 namespace Virtual {
239 prefix = Virtual+
240 separator = +
241 hidden = no
242 list = yes
243 subscriptions = no
244 location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
245 }
246
247 mail_plugins = $mail_plugins acl
248 plugin {
249 acl = vfile:/etc/dovecot/acl/global
250 acl_anyone = allow
251 # NOTE: to let users LIST mailboxes shared by other users,
252 # Dovecot needs a shared mailbox dictionary.
253 # FIXME: %d not working with userdb ldap
254 acl_shared_dict = file:${stateDir}/acl/%d/acl.db
255 }
256
257 mail_plugins = $mail_plugins fts fts_xapian
258 plugin {
259 # WARNING: doveadm fts rescan is buggy, it will delete the index:
260 # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
261 # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
262 plugin = fts fts_xapian
263 fts = xapian
264 fts_autoindex = yes
265 fts_autoindex_exclude = \Junk
266 fts_autoindex_exclude2 = \Trash
267 fts_enforced = yes
268 # 2 and 20 are the NGram values for header fields, which means the
269 # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
270 # Full words are also added by default.
271 fts_xapian = partial=2 full=20 attachments=1 verbose=0
272 fts_languages = en fr
273 #fts_dovecot_fs = posix:prefix=%h/fts/
274 }
275
276 mail_plugins = $mail_plugins quota
277 plugin {
278 quota = maildir:User quota
279 quota_rule = *:storage=256M
280 quota_rule2 = Trash:storage=+64M
281 quota_max_mail_size = 20M
282 #quota_exceeded_message = </path/to/quota_exceeded_message.txt
283 quota_warning = storage=95%% quota-warning 95 %u
284 quota_warning2 = storage=80%% quota-warning 80 %u
285 quota_warning3 = -storage=100%% quota-warning below %u
286 }
287
288 protocol lda {
289 hostname = ${networking.domain}
290 mail_plugins = $mail_plugins sieve
291 postmaster_address = root+dovecot+lda@${networking.domain}
292 syslog_facility = mail
293 }
294 lda_mailbox_autocreate = yes
295 lda_mailbox_autosubscribe = yes
296
297 protocol lmtp {
298 mail_plugins = $mail_plugins sieve
299 postmaster_address = root+dovecot+lmtp@${networking.domain}
300 }
301 service lmtp {
302 process_min_avail = ${toString host.CPUs}
303 unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
304 user = ${postfix.user}
305 group = ${postfix.group}
306 mode = 0600
307 }
308 }
309 plugin {
310 # Let extension.sieve do the handling of the detail
311 #lmtp_save_to_detail_mailbox = yes
312 recipient_delimiter = ${postfix.recipientDelimiter}
313 }
314
315 service imap {
316 # Most of the memory goes to mmap()ing files.
317 # You may need to increase this limit if you have huge mailboxes.
318 #vsz_limit =
319 process_limit = 1024
320 }
321 service imap-login {
322 #inet_listener imap {
323 # address = 127.0.0.1
324 # port = 143
325 # ssl = no
326 #}
327 inet_listener imaps {
328 port = 993
329 ssl = yes
330 }
331 }
332 # Store METADATA information within user's HOME directory
333 mail_attribute_dict = file:%h/dovecot-attributes
334 # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
335 imapc_features = $imapc_features fetch-headers
336 protocol imap {
337 #mail_max_userip_connections = 10
338 mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
339 imap_metadata = yes
340
341 # DOC: https://wiki.dovecot.org/MailboxSettings
342 # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
343 # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
344 imap_capability = +SPECIAL-USE
345
346 namespace Inbox {
347 mailbox "Archives" {
348 auto = subscribe
349 special_use = \Archive
350 }
351 mailbox "Drafts" {
352 auto = no
353 special_use = \Drafts
354 }
355 mailbox "Brouillons" {
356 auto = subscribe
357 special_use = \Drafts
358 }
359 mailbox "Junk" {
360 auto = no
361 #autoexpunge = 30d
362 special_use = \Junk
363 }
364 mailbox "Spams" {
365 auto = no
366 special_use = \Junk
367 }
368 mailbox "Spam" {
369 auto = no
370 special_use = \Junk
371 }
372 mailbox "Pourriels" {
373 auto = no
374 special_use = \Junk
375 }
376 mailbox "Pourriel" {
377 auto = no
378 special_use = \Junk
379 }
380 mailbox "Sent" {
381 auto = no
382 special_use = \Sent
383 }
384 mailbox "Sent Items" {
385 auto = no
386 special_use = \Sent
387 }
388 mailbox "Sent Messages" {
389 auto = no
390 special_use = \Sent
391 }
392 mailbox "Envoyés" {
393 auto = no
394 special_use = \Sent
395 }
396 mailbox "Trash" {
397 auto = no
398 special_use = \Trash
399 #autoexpunge = 30d
400 }
401 mailbox "Corbeille" {
402 auto = no
403 special_use = \Trash
404 }
405 }
406 namespace Virtual {
407 mailbox All {
408 auto = no
409 comment = All messages from all mailboxes
410 # This flag is confused with \Archives by K9-Mail
411 special_use = \All
412 }
413 mailbox Recents {
414 auto = no
415 comment = All messages from all mailboxes, arrived in the past 48h
416 }
417 }
418 }
419 plugin {
420 sieve_plugins = sieve_imapsieve sieve_extprograms
421 sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
422 #sieve_extensions = +editheader
423 sieve = file:~/sieve;active=~/active.sieve
424 sieve_default = file:${stateDir}/sieve/global/default.sieve
425 sieve_default_name = main
426 sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
427 sieve_max_script_size = 1M
428 sieve_quota_max_scripts = 0
429 sieve_quota_max_storage = 10M
430 #sieve_spamtest_max_value = 10
431 #sieve_spamtest_status_header = X-Spam-Score
432 #sieve_spamtest_status_type = strlen
433 #sieve_user_log = ~/sieve.log
434 # Enables support for user Sieve scripts in IMAP
435 #imapsieve_url = sieve://mail.${networking.domain}:4190
436
437 # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
438 imapsieve_mailbox1_name = *
439 imapsieve_mailbox1_causes = FLAG
440 imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
441
442 # From elsewhere to Junk folder
443 imapsieve_mailbox2_name = Pourriel
444 imapsieve_mailbox2_causes = COPY APPEND
445 imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
446
447 # From Junk folder to elsewhere
448 imapsieve_mailbox3_name = *
449 imapsieve_mailbox3_from = Pourriel
450 imapsieve_mailbox3_causes = COPY
451 imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
452 }
453 protocol sieve {
454 # Maximum number of ManageSieve connections allowed for a user from each IP address.
455 # NOTE: The username is compared case-sensitively.
456 mail_max_userip_connections = 10
457
458 # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
459 # the IMPLEMENTATION capability that the dovecot reports to clients.
460 # For example: 'Cyrus timesieved v2.2.13'
461 managesieve_implementation_string = Dovecot Pigeonhole
462
463 # The maximum number of compile errors that are returned to the client upon script
464 # upload or script verification.
465 managesieve_max_compile_errors = 5
466
467 #mail_max_userip_connections = 10
468 #managesieve_implementation_string = Dovecot Pigeonhole
469 managesieve_max_compile_errors = 5
470 #managesieve_max_line_length = 65536
471 #managesieve_notify_capability = mailto
472 #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
473 }
474 service managesieve-login {
475 inet_listener sieve {
476 port = 4190
477 #ssl = yes
478 }
479
480 # Number of connections to handle before starting a new process. Typically
481 # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
482 # is faster. <doc/wiki/LoginProcess.txt>
483 service_count = 1
484
485 # Number of processes to always keep waiting for more connections.
486 process_min_avail = 0
487
488 # If you set service_count=0, you probably need to grow this.
489 #vsz_limit = 64M
490 }
491
492 service quota-warning {
493 executable = script ${
494 pkgs.writeShellScript "quota-warning" ''
495 set -eu
496 PERCENT=$1
497 USER=$2
498 cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
499 "plugin/quota=maildir:User quota:noenforcing"
500 From: root+docevot@${networking.domain}
501 Subject: [WARNING] your mailbox is now $PERCENT% full.
502
503 Please remove some mails to make room for new ones.
504 EOF
505 ''
506 }
507 # use some unprivileged user for executing the quota warnings
508 user = ${dovecot2.user}
509 unix_listener quota-warning {
510 }
511 }
512
513 protocol pop3 {
514 mail_plugins = $mail_plugins virtual
515 #mail_max_userip_connections = 10
516 # Virtual namespace for the virtual INBOX.
517 # Use a global directory for dovecot-virtual files.
518 #namespace Inbox {
519 # hidden = yes
520 # list = no
521 # location = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
522 # prefix = pop3+
523 #}
524 pop3_client_workarounds =
525 pop3_fast_size_lookups = yes
526 pop3_lock_session = yes
527 pop3_no_flag_updates = yes
528 # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
529 pop3_uidl_format = %g
530 }
531 service pop3 {
532 process_limit = 1024
533 }
534 service pop3-login {
535 inet_listener pop3s {
536 port = 995
537 ssl = yes
538 }
539 }
540 '';
541 };
542 }