hosts/mermet/dovecot.nix

   1 { pkgs, lib, config, host, ... }:
   2 let
   3   inherit (builtins) toString;
   4   inherit (config) networking;
   5   inherit (config.services) dovecot2 postfix;
   6
   7   stateDir = "/var/lib/dovecot";
   8
   9   sieve_pipe_bin_dir = pkgs.buildEnv {
  10     name = "sieve_pipe_bin_dir";
  11     pathsToLink = [ "/bin" ];
  12     paths = [
  13       learn-spam
  14       learn-ham
  15     ];
  16   };
  17   learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
  18     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  19   '';
  20   learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
  21     exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  22   '';
  23
  24   dovecot-virtual = pkgs.buildEnv {
  25     name = "dovecot-virtual";
  26     pathsToLink = [ "/" ];
  27     paths = [
  28       dovecot-virtual-all
  29       dovecot-virtual-recents
  30     ];
  31   };
  32   dovecot-virtual-all = pkgs.writeTextFile {
  33     name = "dovecot-virtual-all";
  34     destination = "/All/dovecot-virtual";
  35     text = ''
  36       *
  37         all
  38     '';
  39   };
  40   dovecot-virtual-recents = pkgs.writeTextFile {
  41     name = "dovecot-virtual-recents";
  42     destination = "/Recents/dovecot-virtual";
  43     text = ''
  44       *
  45         all younger 172800
  46     '';
  47   };
  48 in
  49 {
  50   imports = [
  51     dovecot/sourcephile.fr.nix
  52     dovecot/autogeree.net.nix
  53   ];
  54   environment.systemPackages = [
  55     pkgs.dovecot_pigeonhole
  56   ];
  57   users.groups.acme.members = [ dovecot2.user ];
  58   systemd.services.dovecot2 = {
  59     after = [
  60       "postfix.service"
  61       "openldap.service"
  62     ];
  63     /*
  64       preStart = ''
  65       # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
  66       install -D -d -m 0771 \
  67        -o "${dovecot2.user}" \
  68        -g "${dovecot2.group}" \
  69        ${stateDir}/mail
  70       '';
  71     */
  72     preStart = ''
  73       ln -fns -t ${stateDir}/virtual/ \
  74         ${dovecot-virtual-all}/All \
  75         ${dovecot-virtual-recents}/Recents
  76     '';
  77     serviceConfig = {
  78       #ExecStart = lib.mkForce "${pkgs.utillinux}/bin/setarch x86_64 --addr-no-randomize /bin/sh -c 'LD_PRELOAD=${pkgs.gcc-unwrapped.lib}/lib/libasan.so ${pkgs.dovecot}/sbin/dovecot -F'";
  79       # Dovecot2 does not work with environment.memoryAllocator.provider="scudo"
  80       # https://wiki.dovecot.org/Design/Memory
  81       # Scudo ERROR: CHECK failed at /build/compiler-rt-7.1.0.src/lib/scudo/../sanitizer_common/sanitizer_allocator_primary64.h:
  82       # 644 ((beg)) == ((address_range.MapOrDie(beg, size))) (4398046511092, 4398046507008)
  83       BindReadOnlyPaths = [ "/dev/null:/etc/ld-nix.so.preload" ];
  84       StateDirectory = [ "dovecot/virtual" ];
  85     };
  86   };
  87   #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
  88   networking.nftables.ruleset = ''
  89     table inet filter {
  90       chain input-net {
  91         tcp dport imaps counter accept comment "dovecot: IMAPS"
  92         #tcp dport 995 counter accept comment "dovecot: POP3S"
  93         tcp dport sieve counter accept comment "dovecot: Sieve"
  94       }
  95     }
  96   '';
  97   fileSystems."/var/lib/dovecot" = {
  98     device = "rpool/var/mail";
  99     fsType = "zfs";
 100   };
 101   services.sanoid.datasets."rpool/var/mail" = {
 102     use_template = [ "snap" ];
 103     daily = 7;
 104   };
 105   services.dovecot2 = {
 106     enable = true;
 107     modules = [
 108       pkgs.dovecot_pigeonhole
 109       pkgs.dovecot_fts_xapian
 110     ];
 111     enablePAM = false;
 112     enableImap = true;
 113     enableLmtp = true;
 114     enablePop3 = false;
 115     protocols = [ "sieve" ];
 116     # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
 117     # Here INDEX and CONTROL are separated,
 118     # it's not useful since there is no quota at the filesystem level
 119     # it's just to let this possibility later on.
 120     mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
 121     createMailUser = false;
 122     mailUser = "";
 123     mailGroup = "";
 124     sslServerCert = null;
 125     sieveScripts = {
 126       global = dovecot/sieve/global;
 127     };
 128     extraConfig = ''
 129       auth_verbose = no
 130       auth_debug = no
 131       mail_debug = no
 132       verbose_ssl = no
 133       log_timestamp = "%Y-%m-%d %H:%M:%S "
 134
 135       ssl = required
 136       ssl_dh = <${dovecot/dh4096.pem}
 137       ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
 138       ssl_prefer_server_ciphers = yes
 139       ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
 140       ssl_key = </var/lib/acme/${networking.domain}/key.pem
 141       #ssl_ca = <''${caPath}
 142       #ssl_verify_client_cert = yes
 143       # FIXME: change to TLSv1.3 when supported by K-9 Mail
 144       ssl_min_protocol = TLSv1.2
 145
 146       listen = *
 147       mail_home = ${stateDir}/home/%d/%n
 148       # Read multiple mails in parallel, improves performance
 149       mail_prefetch_count = 20
 150       # Default VSZ (virtual memory size) limit for service processes. This is mainly
 151       # intended to catch and kill processes that leak memory before they eat up everything.
 152       # Increased for fts_xapian.
 153       default_vsz_limit = 1G
 154
 155       # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
 156       # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
 157       # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
 158       # when in fact, storing the password in the directory server using a Salted SHA-2 hash
 159       # and transmitting the clear text password over a secure connection
 160       # is more secure than having the directory server store the password in clear text
 161       # or in a reversible encryption scheme.
 162       # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
 163       # Use doveadm pw -s SSHA
 164       # or doveadm pw -s PBKDF2 -r 10000
 165       # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
 166       auth_mechanisms = plain login
 167       auth_username_format = %Ln
 168       service auth {
 169         user = ${dovecot2.user}
 170         # auth_socket_path points to this userdb socket by default. It's typically
 171         # used by dovecot-lda, doveadm, possibly imap process, etc.
 172         # Users that have access to this socket are able to get a list
 173         # of all usernames and get results of everyone's userdb lookups.
 174         unix_listener auth-userdb {
 175           user  = ${dovecot2.user}
 176           group = ${dovecot2.group}
 177           mode  = 0660
 178         }
 179         unix_listener /var/lib/postfix/queue/private/auth {
 180           user  = ${postfix.user}
 181           group = ${postfix.group}
 182           mode  = 0660
 183         }
 184       }
 185       service auth-worker {
 186         user = ${dovecot2.user}
 187       }
 188       auth_cache_verify_password_with_worker = yes
 189       # SEE: http://wiki2.dovecot.org/Quota/FS
 190       # NOTE: postfix does not supply a client cert.
 191       auth_ssl_require_client_cert = no
 192       #auth_ssl_username_from_cert = yes
 193       # NOTE: lowercase the username, help with LDAP?
 194       auth_username_format = %Lu
 195       # NOTE: sync with LDAP's data.
 196       first_valid_uid = 1000
 197       disable_plaintext_auth = yes
 198
 199       userdb {
 200         driver = ldap
 201         # A different path than passdb's args enables non-blocking LDAP requests
 202         args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
 203         default_fields =
 204         override_fields =
 205       }
 206
 207       # No dirty syncs for maildir: locations which may be used directly by neomutt
 208       maildir_very_dirty_syncs = no
 209       namespace Inbox {
 210         type      = private
 211         inbox     = yes
 212         hidden    = no
 213         list      = yes
 214         prefix    =
 215         separator = +
 216       }
 217       namespace Shared {
 218         type = shared
 219         #list = children
 220         # NOTE: always listed in the LIST command.
 221         list = yes
 222         # NOTE: how to access the other users' mailboxes.
 223         # NOTE: %var expands to the logged in user's variable, while
 224         #       %%var expands to the other users' variables.
 225         # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
 226         location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
 227         prefix = Partages+%%n+
 228         separator = +
 229         subscriptions = yes
 230       }
 231       mail_plugins = $mail_plugins virtual
 232       namespace Virtual {
 233         prefix = Virtual+
 234         separator = +
 235         hidden = no
 236         list = yes
 237         subscriptions = no
 238         location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
 239       }
 240
 241       mail_plugins = $mail_plugins acl
 242       plugin {
 243         acl = vfile:/etc/dovecot/acl/global
 244         acl_anyone = allow
 245         # NOTE: to let users LIST mailboxes shared by other users,
 246         #       Dovecot needs a shared mailbox dictionary.
 247         # FIXME: %d not working with userdb ldap
 248         acl_shared_dict = file:${stateDir}/acl/%d/acl.db
 249       }
 250
 251       mail_plugins = $mail_plugins fts fts_xapian
 252       plugin {
 253         # WARNING: doveadm fts rescan is buggy, it will delete the index:
 254         # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
 255         # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
 256         plugin = fts fts_xapian
 257         fts = xapian
 258         fts_autoindex = yes
 259         fts_autoindex_exclude = \Junk
 260         fts_autoindex_exclude2 = \Trash
 261         fts_enforced = yes
 262         # 2 and 20 are the NGram values for header fields, which means the
 263         # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
 264         # Full words are also added by default.
 265         fts_xapian = partial=2 full=20 attachments=1 verbose=0
 266         fts_languages = en fr
 267         #fts_dovecot_fs = posix:prefix=%h/fts/
 268       }
 269
 270       mail_plugins = $mail_plugins quota
 271       plugin {
 272         quota = maildir:User quota
 273         quota_rule = *:storage=256M
 274         quota_rule2 = Trash:storage=+64M
 275         quota_max_mail_size = 20M
 276         #quota_exceeded_message = </path/to/quota_exceeded_message.txt
 277         quota_warning  = storage=95%% quota-warning 95 %u
 278         quota_warning2 = storage=80%% quota-warning 80 %u
 279         quota_warning3 = -storage=100%% quota-warning below %u
 280       }
 281
 282       protocol lda {
 283         hostname = ${networking.domain}
 284         mail_plugins = $mail_plugins sieve
 285         postmaster_address = root+dovecot+lda@${networking.domain}
 286         syslog_facility = mail
 287       }
 288       lda_mailbox_autocreate = yes
 289       lda_mailbox_autosubscribe = yes
 290
 291       protocol lmtp {
 292         mail_plugins = $mail_plugins sieve
 293         postmaster_address = root+dovecot+lmtp@${networking.domain}
 294       }
 295       service lmtp {
 296         process_min_avail = ${toString host.CPUs}
 297         unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
 298           user  = ${postfix.user}
 299           group = ${postfix.group}
 300           mode  = 0600
 301         }
 302       }
 303       plugin {
 304         # Let extension.sieve do the handling of the detail
 305         #lmtp_save_to_detail_mailbox = yes
 306         recipient_delimiter = ${postfix.recipientDelimiter}
 307       }
 308
 309       service imap {
 310         # Most of the memory goes to mmap()ing files.
 311         # You may need to increase this limit if you have huge mailboxes.
 312         #vsz_limit =
 313         process_limit = 1024
 314       }
 315       service imap-login {
 316         #inet_listener imap {
 317         #  address = 127.0.0.1
 318         #  port    = 143
 319         #  ssl     = no
 320         #}
 321         inet_listener imaps {
 322           port = 993
 323           ssl  = yes
 324         }
 325       }
 326       # Store METADATA information within user's HOME directory
 327       mail_attribute_dict = file:%h/dovecot-attributes
 328       # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
 329       imapc_features = $imapc_features fetch-headers
 330       protocol imap {
 331         #mail_max_userip_connections = 10
 332         mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
 333         imap_metadata = yes
 334
 335         # DOC: https://wiki.dovecot.org/MailboxSettings
 336         # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
 337         # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
 338         imap_capability = +SPECIAL-USE
 339
 340         namespace Inbox {
 341           mailbox "Archives" {
 342             auto = subscribe
 343             special_use = \Archive
 344           }
 345           mailbox "Drafts" {
 346             auto = no
 347             special_use = \Drafts
 348           }
 349           mailbox "Brouillons" {
 350             auto = subscribe
 351             special_use = \Drafts
 352           }
 353           mailbox "Junk" {
 354             auto = no
 355             #autoexpunge = 30d
 356             special_use = \Junk
 357           }
 358           mailbox "Spams" {
 359             auto = no
 360             special_use = \Junk
 361           }
 362           mailbox "Spam" {
 363             auto = no
 364             special_use = \Junk
 365           }
 366           mailbox "Pourriels" {
 367             auto = no
 368             special_use = \Junk
 369           }
 370           mailbox "Pourriel" {
 371             auto = no
 372             special_use = \Junk
 373           }
 374           mailbox "Sent" {
 375             auto = no
 376             special_use = \Sent
 377           }
 378           mailbox "Sent Items" {
 379             auto = no
 380             special_use = \Sent
 381           }
 382           mailbox "Sent Messages" {
 383             auto = no
 384             special_use = \Sent
 385           }
 386           mailbox "Envoyés" {
 387             auto = no
 388             special_use = \Sent
 389           }
 390           mailbox "Trash" {
 391             auto = no
 392             special_use = \Trash
 393             #autoexpunge = 30d
 394           }
 395           mailbox "Corbeille" {
 396             auto = no
 397             special_use = \Trash
 398           }
 399         }
 400         namespace Virtual {
 401           mailbox All {
 402             auto = no
 403             comment = All messages from all mailboxes
 404             # This flag is confused with \Archives by K9-Mail
 405             special_use = \All
 406           }
 407           mailbox Recents {
 408             auto = no
 409             comment = All messages from all mailboxes, arrived in the past 48h
 410           }
 411         }
 412       }
 413       plugin {
 414         sieve_plugins = sieve_imapsieve sieve_extprograms
 415         sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
 416         #sieve_extensions = +editheader
 417         sieve = file:~/sieve;active=~/active.sieve
 418         sieve_default = file:${stateDir}/sieve/global/default.sieve
 419         sieve_default_name = main
 420         sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
 421         sieve_max_script_size = 1M
 422         sieve_quota_max_scripts = 0
 423         sieve_quota_max_storage = 10M
 424         #sieve_spamtest_max_value = 10
 425         #sieve_spamtest_status_header = X-Spam-Score
 426         #sieve_spamtest_status_type = strlen
 427         #sieve_user_log = ~/sieve.log
 428         # Enables support for user Sieve scripts in IMAP
 429         #imapsieve_url = sieve://mail.${networking.domain}:4190
 430
 431         # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
 432         imapsieve_mailbox1_name = *
 433         imapsieve_mailbox1_causes = FLAG
 434         imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
 435
 436         # From elsewhere to Junk folder
 437         imapsieve_mailbox2_name = Pourriel
 438         imapsieve_mailbox2_causes = COPY APPEND
 439         imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
 440
 441         # From Junk folder to elsewhere
 442         imapsieve_mailbox3_name = *
 443         imapsieve_mailbox3_from = Pourriel
 444         imapsieve_mailbox3_causes = COPY
 445         imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
 446       }
 447       protocol sieve {
 448         # Maximum number of ManageSieve connections allowed for a user from each IP address.
 449         # NOTE: The username is compared case-sensitively.
 450         mail_max_userip_connections = 10
 451
 452         # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
 453         # the IMPLEMENTATION capability that the dovecot reports to clients.
 454         # For example: 'Cyrus timesieved v2.2.13'
 455         managesieve_implementation_string = Dovecot Pigeonhole
 456
 457         # The maximum number of compile errors that are returned to the client upon script
 458         # upload or script verification.
 459         managesieve_max_compile_errors = 5
 460
 461         #mail_max_userip_connections = 10
 462         #managesieve_implementation_string = Dovecot Pigeonhole
 463         managesieve_max_compile_errors = 5
 464         #managesieve_max_line_length = 65536
 465         #managesieve_notify_capability = mailto
 466         #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
 467       }
 468       service managesieve-login {
 469         inet_listener sieve {
 470           port = 4190
 471           #ssl  = yes
 472         }
 473
 474         # Number of connections to handle before starting a new process. Typically
 475         # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
 476         # is faster. <doc/wiki/LoginProcess.txt>
 477         service_count = 1
 478
 479         # Number of processes to always keep waiting for more connections.
 480         process_min_avail = 0
 481
 482         # If you set service_count=0, you probably need to grow this.
 483         #vsz_limit = 64M
 484       }
 485
 486       service quota-warning {
 487         executable = script ${
 488           pkgs.writeShellScript "quota-warning" ''
 489             set -eu
 490             PERCENT=$1
 491             USER=$2
 492             cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
 493             "plugin/quota=maildir:User quota:noenforcing"
 494             From: root+docevot@${networking.domain}
 495             Subject: [WARNING] your mailbox is now $PERCENT% full.
 496
 497             Please remove some mails to make room for new ones.
 498             EOF
 499           ''
 500         }
 501         # use some unprivileged user for executing the quota warnings
 502         user = ${dovecot2.user}
 503         unix_listener quota-warning {
 504         }
 505       }
 506
 507       protocol pop3 {
 508         mail_plugins = $mail_plugins virtual
 509         #mail_max_userip_connections = 10
 510         # Virtual namespace for the virtual INBOX.
 511         # Use a global directory for dovecot-virtual files.
 512         #namespace Inbox {
 513         #  hidden    = yes
 514         #  list      = no
 515         #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
 516         #  prefix    = pop3+
 517         #}
 518         pop3_client_workarounds =
 519         pop3_fast_size_lookups = yes
 520         pop3_lock_session = yes
 521         pop3_no_flag_updates = yes
 522         # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
 523         pop3_uidl_format = %g
 524       }
 525       service pop3 {
 526         process_limit = 1024
 527       }
 528       service pop3-login {
 529         inet_listener pop3s {
 530           port = 995
 531           ssl  = yes
 532         }
 533       }
 534     '';
 535   };
 536 }