servers/mermet/dovecot.nix

   1 { pkgs, lib, config, system, ... }:
   2 let
   3   inherit (builtins) toString toFile readFile;
   4   inherit (builtins.extraBuiltins) pass;
   5   inherit (lib) types;
   6   inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
   7   inherit (config) networking;
   8   inherit (config.services) dovecot2 postfix openldap;
   9
  10   # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
  11   stateDir = "/var/lib/dovecot";
  12
  13   sieve_pipe_bin_dir = pkgs.buildEnv {
  14     name = "sieve_pipe_bin_dir";
  15     pathsToLink = [ "/bin" ];
  16     paths = [
  17       learn-spam
  18       learn-ham
  19     ];
  20   };
  21   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  22     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  23   '';
  24   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  25     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  26   '';
  27
  28   dovecot-virtual = pkgs.buildEnv {
  29     name = "dovecot-virtual";
  30     pathsToLink = [ "/" ];
  31     paths = [
  32       dovecot-virtual-all
  33       dovecot-virtual-recents
  34     ];
  35   };
  36   dovecot-virtual-all = pkgs.writeTextFile {
  37     name = "dovecot-virtual-all";
  38     destination = "/All/dovecot-virtual";
  39     text = ''
  40       *
  41         all
  42     '';
  43   };
  44   dovecot-virtual-recents = pkgs.writeTextFile {
  45     name = "dovecot-virtual-recents";
  46     destination = "/Recents/dovecot-virtual";
  47     text = ''
  48       *
  49         all younger 172800
  50     '';
  51   };
  52   dovecot-virtual-pop3 = pkgs.writeTextFile {
  53     name = "dovecot-virtual-pop3";
  54     destination = "/pop3/INBOX/dovecot-virtual";
  55     text = ''
  56       All
  57       All+*
  58         all
  59     '';
  60   };
  61 in
  62 {
  63 imports = [
  64   dovecot/sourcephile.fr.nix
  65   dovecot/autogeree.net.nix
  66 ];
  67 users.groups.acme.members = [ dovecot2.user ];
  68 systemd.services.dovecot2 = {
  69   after = [
  70     "postfix.service"
  71     "openldap.service"
  72   ];
  73   /*
  74   preStart = ''
  75     # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
  76     install -D -d -m 0771 \
  77      -o "${dovecot2.user}" \
  78      -g "${dovecot2.group}" \
  79      ${stateDir}/mail
  80   '';
  81   */
  82 };
  83 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  84 services.dovecot2 = {
  85   enable = true;
  86   modules = [
  87     pkgs.dovecot_pigeonhole
  88     pkgs.dovecot_fts_xapian
  89   ];
  90   enablePAM = false;
  91   enableImap = true;
  92   enableLmtp = true;
  93   enablePop3 = false;
  94   protocols = [ "sieve" ];
  95   # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
  96   # Here INDEX and CONTROL are separated,
  97   # it's not useful since there is no quota at the filesystem level
  98   # it's just to let this possibility later on.
  99   mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
 100   createMailUser = false;
 101   mailUser = "";
 102   mailGroup = "";
 103   sslServerCert = null;
 104   sieveScripts = {
 105     global = dovecot/sieve/global;
 106   };
 107   extraConfig = ''
 108     auth_verbose = no
 109     auth_debug = no
 110     mail_debug = no
 111     verbose_ssl = no
 112     log_timestamp = "%Y-%m-%d %H:%M:%S "
 113
 114     ssl = required
 115     ssl_dh = <${../../../sec/openssl/dh.pem}
 116     ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 117     ssl_prefer_server_ciphers = yes
 118     ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
 119     ssl_key = </var/lib/acme/${networking.domain}/key.pem
 120     #ssl_ca = <''${caPath}
 121     #ssl_verify_client_cert = yes
 122
 123     listen = *
 124     # If needed, may be overrided by userdb_mail
 125     mail_home = ${stateDir}/home/%d/%n
 126     # Read multiple mails in parallel, improves performance
 127     mail_prefetch_count = 20
 128     # Default VSZ (virtual memory size) limit for service processes. This is mainly
 129     # intended to catch and kill processes that leak memory before they eat up everything.
 130     # Increased for fts_xapian.
 131     default_vsz_limit = 1G
 132
 133     # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
 134     # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
 135     # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
 136     # when in fact, storing the password in the directory server using a Salted SHA-2 hash
 137     # and transmitting the clear text password over a secure connection
 138     # is more secure than having the directory server store the password in clear text
 139     # or in a reversible encryption scheme.
 140     # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
 141     # Use doveadm pw -s SSHA
 142     # or doveadm pw -s PBKDF2 -r 10000
 143     # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
 144     auth_mechanisms = plain login
 145     auth_username_format = %Ln
 146     service auth {
 147       user = ${dovecot2.user}
 148       # auth_socket_path points to this userdb socket by default. It's typically
 149       # used by dovecot-lda, doveadm, possibly imap process, etc.
 150       # Users that have access to this socket are able to get a list
 151       # of all usernames and get results of everyone's userdb lookups.
 152       unix_listener auth-userdb {
 153         user  = ${dovecot2.user}
 154         group = ${dovecot2.group}
 155         mode  = 0660
 156       }
 157       unix_listener /var/lib/postfix/queue/private/auth {
 158         user  = ${postfix.user}
 159         group = ${postfix.group}
 160         mode  = 0660
 161       }
 162     }
 163     service auth-worker {
 164       user = ${dovecot2.user}
 165     }
 166     auth_cache_verify_password_with_worker = yes
 167     # SEE: http://wiki2.dovecot.org/Quota/FS
 168     # NOTE: postfix does not supply a client cert.
 169     auth_ssl_require_client_cert = no
 170     #auth_ssl_username_from_cert = yes
 171     # NOTE: lowercase the username, help with LDAP?
 172     auth_username_format = %Lu
 173     # NOTE: sync with LDAP's data.
 174     first_valid_uid = 1000
 175     disable_plaintext_auth = yes
 176
 177     userdb {
 178       driver = ldap
 179       # A different path than passdb's args enables non-blocking LDAP requests
 180       args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
 181       default_fields =
 182       override_fields =
 183     }
 184
 185     # No dirty syncs for maildir: locations which may be used directly by neomutt
 186     maildir_very_dirty_syncs = no
 187     namespace Inbox {
 188       type      = private
 189       inbox     = yes
 190       hidden    = no
 191       list      = yes
 192       prefix    =
 193       separator = +
 194     }
 195     namespace Shared {
 196       type = shared
 197       #list = children
 198       # NOTE: always listed in the LIST command.
 199       list = yes
 200       # NOTE: how to access the other users' mailboxes.
 201       # NOTE: %var expands to the logged in user's variable, while
 202       #       %%var expands to the other users' variables.
 203       # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 204       location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
 205       prefix = Partages+%%n+
 206       separator = +
 207       subscriptions = yes
 208     }
 209     mail_plugins = $mail_plugins virtual
 210     namespace Virtual {
 211       prefix = Virtual+
 212       separator = +
 213       hidden = no
 214       list = yes
 215       subscriptions = no
 216       location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 217     }
 218
 219     mail_plugins = $mail_plugins acl
 220     plugin {
 221       acl = vfile:/etc/dovecot/acl/global
 222       acl_anyone = allow
 223       # NOTE: to let users LIST mailboxes shared by other users,
 224       #       Dovecot needs a shared mailbox dictionary.
 225       # FIXME: %d not working with userdb ldap
 226       acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 227     }
 228
 229     mail_plugins = $mail_plugins fts fts_xapian
 230     plugin {
 231       # WARNING: doveadm fts rescan is buggy, it will delete the index:
 232       # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
 233       # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
 234       plugin = fts fts_xapian
 235       fts = xapian
 236       fts_autoindex = yes
 237       fts_autoindex_exclude = \Junk
 238       fts_autoindex_exclude2 = \Trash
 239       fts_enforced = yes
 240       # 2 and 20 are the NGram values for header fields, which means the
 241       # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 242       # Full words are also added by default.
 243       fts_xapian = partial=2 full=20 attachments=1 verbose=0
 244       fts_languages = en fr
 245       #fts_dovecot_fs = posix:prefix=%h/fts/
 246     }
 247
 248     mail_plugins = $mail_plugins quota
 249     plugin {
 250       quota = maildir:User quota
 251       quota_rule = *:storage=256M
 252       quota_rule2 = Trash:storage=+64M
 253       quota_max_mail_size = 20M
 254       #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 255       quota_warning  = storage=95%% quota-warning 95 %u
 256       quota_warning2 = storage=80%% quota-warning 80 %u
 257       quota_warning3 = -storage=100%% quota-warning below %u
 258     }
 259
 260     protocol lda {
 261       hostname = ${networking.domain}
 262       mail_plugins = $mail_plugins sieve
 263       postmaster_address = postmaster+dovecot+lda@${networking.domain}
 264       syslog_facility = mail
 265     }
 266     lda_mailbox_autocreate = yes
 267     lda_mailbox_autosubscribe = yes
 268
 269     protocol lmtp {
 270       mail_plugins = $mail_plugins sieve
 271       postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
 272     }
 273     service lmtp {
 274       process_min_avail = ${toString config.nix.maxJobs}
 275       unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 276         user  = ${postfix.user}
 277         group = ${postfix.group}
 278         mode  = 0600
 279       }
 280     }
 281     plugin {
 282       # Let extension.sieve do the handling of the detail
 283       #lmtp_save_to_detail_mailbox = yes
 284       recipient_delimiter = ${postfix.recipientDelimiter}
 285     }
 286
 287     service imap {
 288       # Most of the memory goes to mmap()ing files.
 289       # You may need to increase this limit if you have huge mailboxes.
 290       #vsz_limit =
 291       process_limit = 1024
 292     }
 293     service imap-login {
 294       #inet_listener imap {
 295       #  address = 127.0.0.1
 296       #  port    = 143
 297       #  ssl     = no
 298       #}
 299       inet_listener imaps {
 300         port = 993
 301         ssl  = yes
 302       }
 303     }
 304     # Store METADATA information within user's HOME directory
 305     mail_attribute_dict = file:%h/dovecot-attributes
 306     # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 307     imapc_features = $imapc_features fetch-headers
 308     protocol imap {
 309       #mail_max_userip_connections = 10
 310       mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
 311       imap_metadata = yes
 312
 313       # DOC: https://wiki.dovecot.org/MailboxSettings
 314       # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 315       # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 316       imap_capability = +SPECIAL-USE
 317
 318       namespace Inbox {
 319         mailbox "Archives" {
 320           auto = subscribe
 321           special_use = \Archive
 322         }
 323         mailbox "Drafts" {
 324           auto = no
 325           special_use = \Drafts
 326         }
 327         mailbox "Brouillons" {
 328           auto = subscribe
 329           special_use = \Drafts
 330         }
 331         mailbox "Junk" {
 332           auto = no
 333           #autoexpunge = 30d
 334           special_use = \Junk
 335         }
 336         mailbox "Spams" {
 337           auto = no
 338           special_use = \Junk
 339         }
 340         mailbox "Spam" {
 341           auto = no
 342           special_use = \Junk
 343         }
 344         mailbox "Pourriels" {
 345           auto = no
 346           special_use = \Junk
 347         }
 348         mailbox "Pourriel" {
 349           auto = no
 350           special_use = \Junk
 351         }
 352         mailbox "Sent" {
 353           auto = no
 354           special_use = \Sent
 355         }
 356         mailbox "Sent Items" {
 357           auto = no
 358           special_use = \Sent
 359         }
 360         mailbox "Sent Messages" {
 361           auto = no
 362           special_use = \Sent
 363         }
 364         mailbox "Envoyés" {
 365           auto = no
 366           special_use = \Sent
 367         }
 368         mailbox "Trash" {
 369           auto = no
 370           special_use = \Trash
 371           #autoexpunge = 30d
 372         }
 373         mailbox "Corbeille" {
 374           auto = no
 375           special_use = \Trash
 376         }
 377       }
 378       namespace Virtual {
 379         mailbox All {
 380           auto = no
 381           comment = All messages from all mailboxes
 382           # This flag is confused with \Archives by K9-Mail
 383           special_use = \All
 384         }
 385         mailbox Recents {
 386           auto = no
 387           comment = All messages from all mailboxes, arrived in the past 48h
 388         }
 389       }
 390     }
 391     plugin {
 392       sieve_plugins = sieve_imapsieve sieve_extprograms
 393       sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
 394       #sieve_extensions = +editheader
 395       sieve = file:~/sieve;active=~/active.sieve
 396       sieve_default = file:${stateDir}/sieve/global/default.sieve
 397       sieve_default_name = main
 398       sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
 399       sieve_max_script_size = 1M
 400       sieve_quota_max_scripts = 0
 401       sieve_quota_max_storage = 10M
 402       #sieve_spamtest_max_value = 10
 403       #sieve_spamtest_status_header = X-Spam-Score
 404       #sieve_spamtest_status_type = strlen
 405       #sieve_user_log = ~/sieve.log
 406       # Enables support for user Sieve scripts in IMAP
 407       #imapsieve_url = sieve://mail.${networking.domain}:4190
 408
 409       # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 410       imapsieve_mailbox1_name = *
 411       imapsieve_mailbox1_causes = FLAG
 412       imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 413
 414       # From elsewhere to Junk folder
 415       imapsieve_mailbox2_name = Pourriel
 416       imapsieve_mailbox2_causes = COPY APPEND
 417       imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 418
 419       # From Junk folder to elsewhere
 420       imapsieve_mailbox3_name = *
 421       imapsieve_mailbox3_from = Pourriel
 422       imapsieve_mailbox3_causes = COPY
 423       imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 424     }
 425     protocol sieve {
 426       # Maximum number of ManageSieve connections allowed for a user from each IP address.
 427       # NOTE: The username is compared case-sensitively.
 428       mail_max_userip_connections = 10
 429
 430       # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 431       # the IMPLEMENTATION capability that the dovecot reports to clients.
 432       # For example: 'Cyrus timesieved v2.2.13'
 433       managesieve_implementation_string = Dovecot Pigeonhole
 434
 435       # The maximum number of compile errors that are returned to the client upon script
 436       # upload or script verification.
 437       managesieve_max_compile_errors = 5
 438
 439       #mail_max_userip_connections = 10
 440       #managesieve_implementation_string = Dovecot Pigeonhole
 441       managesieve_max_compile_errors = 5
 442       #managesieve_max_line_length = 65536
 443       #managesieve_notify_capability = mailto
 444       #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 445     }
 446     service managesieve-login {
 447       inet_listener sieve {
 448         port = 4190
 449         #ssl  = yes
 450       }
 451
 452       # Number of connections to handle before starting a new process. Typically
 453       # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 454       # is faster. <doc/wiki/LoginProcess.txt>
 455       service_count = 1
 456
 457       # Number of processes to always keep waiting for more connections.
 458       process_min_avail = 0
 459
 460       # If you set service_count=0, you probably need to grow this.
 461       #vsz_limit = 64M
 462     }
 463
 464     service quota-warning {
 465       executable = script ${
 466         pkgs.writeShellScript "quota-warning" ''
 467           set -eu
 468           PERCENT=$1
 469           USER=$2
 470           cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 471           "plugin/quota=maildir:User quota:noenforcing"
 472           From: postmaster@${networking.domain}
 473           Subject: [WARNING] your mailbox is now $PERCENT% full.
 474
 475           Please remove some mails to make room for new ones.
 476           EOF
 477         ''
 478       }
 479       # use some unprivileged user for executing the quota warnings
 480       user = ${dovecot2.user}
 481       unix_listener quota-warning {
 482       }
 483     }
 484
 485     protocol pop3 {
 486       mail_plugins = $mail_plugins virtual
 487       #mail_max_userip_connections = 10
 488       # Virtual namespace for the virtual INBOX.
 489       # Use a global directory for dovecot-virtual files.
 490       #namespace Inbox {
 491       #  hidden    = yes
 492       #  list      = no
 493       #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 494       #  prefix    = pop3+
 495       #}
 496       pop3_client_workarounds =
 497       pop3_fast_size_lookups = yes
 498       pop3_lock_session = yes
 499       pop3_no_flag_updates = yes
 500       # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 501       pop3_uidl_format = %g
 502     }
 503     service pop3 {
 504       process_limit = 1024
 505     }
 506     service pop3-login {
 507       inet_listener pop3s {
 508         port = 995
 509         ssl  = yes
 510       }
 511     }
 512   '';
 513 };
 514 }