hosts/mermet/dovecot.nix

   1 { pkgs, lib, config, host, ... }:
   2 let
   3   inherit (builtins) toString;
   4   inherit (config) networking;
   5   inherit (config.services) dovecot2 postfix;
   6
   7   stateDir = "/var/lib/dovecot";
   8
   9   sieve_pipe_bin_dir = pkgs.buildEnv {
  10     name = "sieve_pipe_bin_dir";
  11     pathsToLink = [ "/bin" ];
  12     paths = [
  13       learn-spam
  14       learn-ham
  15     ];
  16   };
  17   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  18     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  19   '';
  20   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  21     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  22   '';
  23
  24   dovecot-virtual = pkgs.buildEnv {
  25     name = "dovecot-virtual";
  26     pathsToLink = [ "/" ];
  27     paths = [
  28       dovecot-virtual-all
  29       dovecot-virtual-recents
  30     ];
  31   };
  32   dovecot-virtual-all = pkgs.writeTextFile {
  33     name = "dovecot-virtual-all";
  34     destination = "/All/dovecot-virtual";
  35     text = ''
  36       *
  37         all
  38     '';
  39   };
  40   dovecot-virtual-recents = pkgs.writeTextFile {
  41     name = "dovecot-virtual-recents";
  42     destination = "/Recents/dovecot-virtual";
  43     text = ''
  44       *
  45         all younger 172800
  46     '';
  47   };
  48 in
  49 {
  50   imports = [
  51     dovecot/sourcephile.fr.nix
  52     dovecot/autogeree.net.nix
  53   ];
  54   environment.systemPackages = [
  55     pkgs.dovecot_pigeonhole
  56   ];
  57   users.groups.acme.members = [ dovecot2.user ];
  58   systemd.services.dovecot2 = {
  59     after = [
  60       "postfix.service"
  61       "openldap.service"
  62     ];
  63     /*
  64       preStart = ''
  65       # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
  66       install -D -d -m 0771 \
  67        -o "${dovecot2.user}" \
  68        -g "${dovecot2.group}" \
  69        ${stateDir}/mail
  70       '';
  71     */
  72     preStart = ''
  73       ln -fns -t ${stateDir}/virtual/ \
  74         ${dovecot-virtual-all}/All \
  75         ${dovecot-virtual-recents}/Recents
  76     '';
  77     serviceConfig = {
  78       #ExecStart = lib.mkForce "${pkgs.utillinux}/bin/setarch x86_64 --addr-no-randomize /bin/sh -c 'LD_PRELOAD=${pkgs.gcc-unwrapped.lib}/lib/libasan.so ${pkgs.dovecot}/sbin/dovecot -F'";
  79       # Dovecot2 does not work with environment.memoryAllocator.provider="scudo"
  80       # https://wiki.dovecot.org/Design/Memory
  81       # Scudo ERROR: CHECK failed at /build/compiler-rt-7.1.0.src/lib/scudo/../sanitizer_common/sanitizer_allocator_primary64.h:
  82       # 644 ((beg)) == ((address_range.MapOrDie(beg, size))) (4398046511092, 4398046507008)
  83       BindReadOnlyPaths = [ "/dev/null:/etc/ld-nix.so.preload" ];
  84       StateDirectory = [ "dovecot/virtual" ];
  85     };
  86   };
  87   #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  88   networking.nftables.ruleset = ''
  89     table inet filter {
  90       chain input-net {
  91         tcp dport imaps counter accept comment "dovecot: IMAPS"
  92         #tcp dport 995 counter accept comment "dovecot: POP3S"
  93         tcp dport sieve counter accept comment "dovecot: Sieve"
  94       }
  95     }
  96   '';
  97   fileSystems."/var/lib/dovecot" = {
  98     device = "rpool/var/mail";
  99     fsType = "zfs";
 100   };
 101   services.sanoid.datasets."rpool/var/mail" = {
 102     use_template = [ "snap" ];
 103     daily = 7;
 104   };
 105   services.dovecot2 = {
 106     enable = true;
 107     modules = [
 108       pkgs.dovecot_pigeonhole
 109       # Commented out because it uses too much disk space
 110       #pkgs.dovecot_fts_xapian
 111     ];
 112     enablePAM = false;
 113     enableImap = true;
 114     enableLmtp = true;
 115     enablePop3 = false;
 116     protocols = [ "sieve" ];
 117     # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
 118     # Here INDEX and CONTROL are separated,
 119     # it's not useful since there is no quota at the filesystem level
 120     # it's just to let this possibility later on.
 121     mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
 122     createMailUser = false;
 123     mailUser = "";
 124     mailGroup = "";
 125     sslServerCert = null;
 126     sieveScripts = {
 127       global = dovecot/sieve/global;
 128     };
 129     extraConfig = ''
 130       #auth_verbose = yes
 131       #auth_debug = yes
 132       #mail_debug = yes
 133       #verbose_ssl = yes
 134       log_timestamp = "%Y-%m-%d %H:%M:%S "
 135
 136       ssl = required
 137       ssl_dh = <${dovecot/dh4096.pem}
 138       ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 139       ssl_prefer_server_ciphers = yes
 140       ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
 141       ssl_key = </var/lib/acme/${networking.domain}/key.pem
 142       #ssl_ca = <''${caPath}
 143       #ssl_verify_client_cert = yes
 144       # FIXME: change to TLSv1.3 when supported by K-9 Mail
 145       ssl_min_protocol = TLSv1.2
 146
 147       listen = *
 148       mail_home = ${stateDir}/home/%d/%n
 149       # Read multiple mails in parallel, improves performance
 150       mail_prefetch_count = 20
 151
 152       # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
 153       # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
 154       # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
 155       # when in fact, storing the password in the directory server using a Salted SHA-2 hash
 156       # and transmitting the clear text password over a secure connection
 157       # is more secure than having the directory server store the password in clear text
 158       # or in a reversible encryption scheme.
 159       # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
 160       # Use doveadm pw -s SSHA
 161       # or doveadm pw -s PBKDF2 -r 10000
 162       # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
 163       auth_mechanisms = plain login
 164       auth_username_format = %Ln
 165       service auth {
 166         user = ${dovecot2.user}
 167         # auth_socket_path points to this userdb socket by default. It's typically
 168         # used by dovecot-lda, doveadm, possibly imap process, etc.
 169         # Users that have access to this socket are able to get a list
 170         # of all usernames and get results of everyone's userdb lookups.
 171         unix_listener auth-userdb {
 172           user  = ${dovecot2.user}
 173           group = ${dovecot2.group}
 174           mode  = 0660
 175         }
 176         unix_listener /var/lib/postfix/queue/private/auth {
 177           user  = ${postfix.user}
 178           group = ${postfix.group}
 179           mode  = 0660
 180         }
 181       }
 182       service auth-worker {
 183         user = ${dovecot2.user}
 184       }
 185       auth_cache_verify_password_with_worker = yes
 186       # SEE: http://wiki2.dovecot.org/Quota/FS
 187       # NOTE: postfix does not supply a client cert.
 188       auth_ssl_require_client_cert = no
 189       #auth_ssl_username_from_cert = yes
 190       # NOTE: lowercase the username, help with LDAP?
 191       auth_username_format = %Lu
 192       # NOTE: sync with LDAP's data.
 193       first_valid_uid = 1000
 194       disable_plaintext_auth = yes
 195
 196       userdb {
 197         driver = ldap
 198         # A different path than passdb's args enables non-blocking LDAP requests
 199         args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
 200         default_fields =
 201         override_fields =
 202       }
 203
 204       # No dirty syncs for maildir: locations which may be used directly by neomutt
 205       maildir_very_dirty_syncs = no
 206       namespace Inbox {
 207         type      = private
 208         inbox     = yes
 209         hidden    = no
 210         list      = yes
 211         prefix    =
 212         separator = +
 213       }
 214       namespace Shared {
 215         type = shared
 216         #list = children
 217         # NOTE: always listed in the LIST command.
 218         list = yes
 219         # NOTE: how to access the other users' mailboxes.
 220         # NOTE: %var expands to the logged in user's variable, while
 221         #       %%var expands to the other users' variables.
 222         # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 223         location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
 224         prefix = Partages+%%n+
 225         separator = +
 226         subscriptions = yes
 227       }
 228       mail_plugins = $mail_plugins virtual
 229       namespace Virtual {
 230         prefix = Virtual+
 231         separator = +
 232         hidden = no
 233         list = yes
 234         subscriptions = no
 235         location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 236       }
 237
 238       mail_plugins = $mail_plugins acl
 239       plugin {
 240         acl = vfile:/etc/dovecot/acl/global
 241         acl_anyone = allow
 242         # NOTE: to let users LIST mailboxes shared by other users,
 243         #       Dovecot needs a shared mailbox dictionary.
 244         # FIXME: %d not working with userdb ldap
 245         acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 246       }
 247
 248       #mail_plugins = $mail_plugins fts fts_xapian
 249       # Default VSZ (virtual memory size) limit for service processes. This is mainly
 250       # intended to catch and kill processes that leak memory before they eat up everything.
 251       # Increased for fts_xapian.
 252       #default_vsz_limit = 1G
 253       #plugin {
 254       #  # WARNING: doveadm fts rescan is buggy, it will delete the index:
 255       #  # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
 256       #  # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
 257       #  plugin = fts fts_xapian
 258       #  fts = xapian
 259       #  fts_autoindex = yes
 260       #  fts_autoindex_exclude = \Junk
 261       #  fts_autoindex_exclude2 = \Trash
 262       #  fts_enforced = yes
 263       #  # 2 and 20 are the NGram values for header fields, which means the
 264       #  # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 265       #  # Full words are also added by default.
 266       #  fts_xapian = partial=2 full=20 attachments=1 verbose=0
 267       #  fts_languages = en fr
 268       #  #fts_dovecot_fs = posix:prefix=%h/fts/
 269       #}
 270
 271       mail_plugins = $mail_plugins quota
 272       plugin {
 273         quota = maildir:User quota
 274         quota_rule = *:storage=256M
 275         quota_rule2 = Trash:storage=+64M
 276         quota_max_mail_size = 20M
 277         #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 278         quota_warning  = storage=95%% quota-warning 95 %u
 279         quota_warning2 = storage=80%% quota-warning 80 %u
 280         quota_warning3 = -storage=100%% quota-warning below %u
 281       }
 282
 283       protocol lda {
 284         hostname = ${networking.domain}
 285         mail_plugins = $mail_plugins sieve
 286         postmaster_address = root+dovecot+lda@${networking.domain}
 287         syslog_facility = mail
 288       }
 289       lda_mailbox_autocreate = yes
 290       lda_mailbox_autosubscribe = yes
 291
 292       protocol lmtp {
 293         mail_plugins = $mail_plugins sieve
 294         postmaster_address = root+dovecot+lmtp@${networking.domain}
 295       }
 296       service lmtp {
 297         process_min_avail = ${toString host.CPUs}
 298         unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 299           user  = ${postfix.user}
 300           group = ${postfix.group}
 301           mode  = 0600
 302         }
 303       }
 304       plugin {
 305         # Let extension.sieve do the handling of the detail
 306         #lmtp_save_to_detail_mailbox = yes
 307         recipient_delimiter = ${postfix.recipientDelimiter}
 308       }
 309
 310       service imap {
 311         # Most of the memory goes to mmap()ing files.
 312         # You may need to increase this limit if you have huge mailboxes.
 313         #vsz_limit =
 314         process_limit = 1024
 315       }
 316       service imap-login {
 317         #inet_listener imap {
 318         #  address = 127.0.0.1
 319         #  port    = 143
 320         #  ssl     = no
 321         #}
 322         inet_listener imaps {
 323           port = 993
 324           ssl  = yes
 325         }
 326       }
 327       # Store METADATA information within user's HOME directory
 328       mail_attribute_dict = file:%h/dovecot-attributes
 329       # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 330       imapc_features = $imapc_features fetch-headers
 331       protocol imap {
 332         #mail_max_userip_connections = 10
 333         mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
 334         imap_metadata = yes
 335
 336         # DOC: https://wiki.dovecot.org/MailboxSettings
 337         # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 338         # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 339         imap_capability = +SPECIAL-USE
 340
 341         namespace Inbox {
 342           mailbox "Archives" {
 343             auto = subscribe
 344             special_use = \Archive
 345           }
 346           mailbox "Drafts" {
 347             auto = no
 348             special_use = \Drafts
 349           }
 350           mailbox "Brouillons" {
 351             auto = subscribe
 352             special_use = \Drafts
 353           }
 354           mailbox "Junk" {
 355             auto = no
 356             #autoexpunge = 30d
 357             special_use = \Junk
 358           }
 359           mailbox "Spams" {
 360             auto = no
 361             special_use = \Junk
 362           }
 363           mailbox "Spam" {
 364             auto = no
 365             special_use = \Junk
 366           }
 367           mailbox "Pourriels" {
 368             auto = no
 369             special_use = \Junk
 370           }
 371           mailbox "Pourriel" {
 372             auto = no
 373             special_use = \Junk
 374           }
 375           mailbox "Sent" {
 376             auto = no
 377             special_use = \Sent
 378           }
 379           mailbox "Sent Items" {
 380             auto = no
 381             special_use = \Sent
 382           }
 383           mailbox "Sent Messages" {
 384             auto = no
 385             special_use = \Sent
 386           }
 387           mailbox "Envoyés" {
 388             auto = no
 389             special_use = \Sent
 390           }
 391           mailbox "Trash" {
 392             auto = no
 393             special_use = \Trash
 394             #autoexpunge = 30d
 395           }
 396           mailbox "Corbeille" {
 397             auto = no
 398             special_use = \Trash
 399           }
 400         }
 401         namespace Virtual {
 402           mailbox All {
 403             auto = no
 404             comment = All messages from all mailboxes
 405             # This flag is confused with \Archives by K9-Mail
 406             special_use = \All
 407           }
 408           mailbox Recents {
 409             auto = no
 410             comment = All messages from all mailboxes, arrived in the past 48h
 411           }
 412         }
 413       }
 414       plugin {
 415         sieve_plugins = sieve_imapsieve sieve_extprograms
 416         sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
 417         #sieve_extensions = +editheader
 418         sieve = file:~/sieve;active=~/active.sieve
 419         sieve_default = file:${stateDir}/sieve/global/default.sieve
 420         sieve_default_name = main
 421         sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
 422         sieve_max_script_size = 1M
 423         sieve_quota_max_scripts = 0
 424         sieve_quota_max_storage = 10M
 425         #sieve_spamtest_max_value = 10
 426         #sieve_spamtest_status_header = X-Spam-Score
 427         #sieve_spamtest_status_type = strlen
 428         #sieve_user_log = ~/active.sieve.log
 429         #sieve_trace_dir = ~/sieve-log
 430         #sieve_trace_level = matching
 431         # Enables support for user Sieve scripts in IMAP
 432         #imapsieve_url = sieve://mail.${networking.domain}:4190
 433
 434         # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 435         imapsieve_mailbox1_name = *
 436         imapsieve_mailbox1_causes = FLAG
 437         imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 438
 439         # From elsewhere to Junk folder
 440         imapsieve_mailbox2_name = Pourriel
 441         imapsieve_mailbox2_causes = COPY APPEND
 442         imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 443
 444         # From Junk folder to elsewhere
 445         imapsieve_mailbox3_name = *
 446         imapsieve_mailbox3_from = Pourriel
 447         imapsieve_mailbox3_causes = COPY
 448         imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 449       }
 450       protocol sieve {
 451         # Maximum number of ManageSieve connections allowed for a user from each IP address.
 452         # NOTE: The username is compared case-sensitively.
 453         mail_max_userip_connections = 10
 454
 455         # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 456         # the IMPLEMENTATION capability that the dovecot reports to clients.
 457         # For example: 'Cyrus timesieved v2.2.13'
 458         managesieve_implementation_string = Dovecot Pigeonhole
 459
 460         # The maximum number of compile errors that are returned to the client upon script
 461         # upload or script verification.
 462         managesieve_max_compile_errors = 5
 463
 464         #mail_max_userip_connections = 10
 465         #managesieve_implementation_string = Dovecot Pigeonhole
 466         managesieve_max_compile_errors = 5
 467         #managesieve_max_line_length = 65536
 468         #managesieve_notify_capability = mailto
 469         #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 470       }
 471       service managesieve-login {
 472         inet_listener sieve {
 473           port = 4190
 474           #ssl  = yes
 475         }
 476
 477         # Number of connections to handle before starting a new process. Typically
 478         # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 479         # is faster. <doc/wiki/LoginProcess.txt>
 480         service_count = 1
 481
 482         # Number of processes to always keep waiting for more connections.
 483         process_min_avail = 0
 484
 485         # If you set service_count=0, you probably need to grow this.
 486         #vsz_limit = 64M
 487       }
 488
 489       service quota-warning {
 490         executable = script ${
 491           pkgs.writeShellScript "quota-warning" ''
 492             set -eu
 493             PERCENT=$1
 494             USER=$2
 495             cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 496             "plugin/quota=maildir:User quota:noenforcing"
 497             From: root+docevot@${networking.domain}
 498             Subject: [WARNING] your mailbox is now $PERCENT% full.
 499
 500             Please remove some mails to make room for new ones.
 501             EOF
 502           ''
 503         }
 504         # use some unprivileged user for executing the quota warnings
 505         user = ${dovecot2.user}
 506         unix_listener quota-warning {
 507         }
 508       }
 509
 510       protocol pop3 {
 511         mail_plugins = $mail_plugins virtual
 512         #mail_max_userip_connections = 10
 513         # Virtual namespace for the virtual INBOX.
 514         # Use a global directory for dovecot-virtual files.
 515         #namespace Inbox {
 516         #  hidden    = yes
 517         #  list      = no
 518         #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 519         #  prefix    = pop3+
 520         #}
 521         pop3_client_workarounds =
 522         pop3_fast_size_lookups = yes
 523         pop3_lock_session = yes
 524         pop3_no_flag_updates = yes
 525         # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 526         pop3_uidl_format = %g
 527       }
 528       service pop3 {
 529         process_limit = 1024
 530       }
 531       service pop3-login {
 532         inet_listener pop3s {
 533           port = 995
 534           ssl  = yes
 535         }
 536       }
 537     '';
 538   };
 539 }