]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/dovecot.nix
losurdo: systemd: enable in stage-1
[sourcephile-nix.git] / hosts / mermet / dovecot.nix
1 { pkgs, lib, config, host, ... }:
2 let
3 inherit (builtins) toString;
4 inherit (config) networking;
5 inherit (config.services) dovecot2 postfix;
6
7 stateDir = "/var/lib/dovecot";
8
9 sieve_pipe_bin_dir = pkgs.buildEnv {
10 name = "sieve_pipe_bin_dir";
11 pathsToLink = [ "/bin" ];
12 paths = [
13 learn-spam
14 learn-ham
15 ];
16 };
17 learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
18 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
19 '';
20 learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
21 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
22 '';
23
24 dovecot-virtual = pkgs.buildEnv {
25 name = "dovecot-virtual";
26 pathsToLink = [ "/" ];
27 paths = [
28 dovecot-virtual-all
29 dovecot-virtual-recents
30 ];
31 };
32 dovecot-virtual-all = pkgs.writeTextFile {
33 name = "dovecot-virtual-all";
34 destination = "/All/dovecot-virtual";
35 text = ''
36 *
37 all
38 '';
39 };
40 dovecot-virtual-recents = pkgs.writeTextFile {
41 name = "dovecot-virtual-recents";
42 destination = "/Recents/dovecot-virtual";
43 text = ''
44 *
45 all younger 172800
46 '';
47 };
48 in
49 {
50 imports = [
51 dovecot/sourcephile.fr.nix
52 dovecot/autogeree.net.nix
53 ];
54 environment.systemPackages = [
55 pkgs.dovecot_pigeonhole
56 ];
57 users.groups.acme.members = [ dovecot2.user ];
58 systemd.services.dovecot2 = {
59 after = [
60 "postfix.service"
61 "openldap.service"
62 ];
63 /*
64 preStart = ''
65 # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
66 install -D -d -m 0771 \
67 -o "${dovecot2.user}" \
68 -g "${dovecot2.group}" \
69 ${stateDir}/mail
70 '';
71 */
72 preStart = ''
73 ln -fns -t ${stateDir}/virtual/ \
74 ${dovecot-virtual-all}/All \
75 ${dovecot-virtual-recents}/Recents
76 '';
77 serviceConfig = {
78 #ExecStart = lib.mkForce "${pkgs.utillinux}/bin/setarch x86_64 --addr-no-randomize /bin/sh -c 'LD_PRELOAD=${pkgs.gcc-unwrapped.lib}/lib/libasan.so ${pkgs.dovecot}/sbin/dovecot -F'";
79 # Dovecot2 does not work with environment.memoryAllocator.provider="scudo"
80 # https://wiki.dovecot.org/Design/Memory
81 # Scudo ERROR: CHECK failed at /build/compiler-rt-7.1.0.src/lib/scudo/../sanitizer_common/sanitizer_allocator_primary64.h:
82 # 644 ((beg)) == ((address_range.MapOrDie(beg, size))) (4398046511092, 4398046507008)
83 BindReadOnlyPaths = [ "/dev/null:/etc/ld-nix.so.preload" ];
84 StateDirectory = [ "dovecot/virtual" ];
85 };
86 };
87 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
88 networking.nftables.ruleset = ''
89 table inet filter {
90 chain input-net {
91 tcp dport imaps counter accept comment "dovecot: IMAPS"
92 #tcp dport 995 counter accept comment "dovecot: POP3S"
93 tcp dport sieve counter accept comment "dovecot: Sieve"
94 }
95 }
96 '';
97 fileSystems."/var/lib/dovecot" = {
98 device = "rpool/var/mail";
99 fsType = "zfs";
100 };
101 services.sanoid.datasets."rpool/var/mail" = {
102 use_template = [ "snap" ];
103 daily = 7;
104 };
105 services.dovecot2 = {
106 enable = true;
107 modules = [
108 pkgs.dovecot_pigeonhole
109 # Commented out because it uses too much disk space
110 #pkgs.dovecot_fts_xapian
111 ];
112 enablePAM = false;
113 enableImap = true;
114 enableLmtp = true;
115 enablePop3 = false;
116 protocols = [ "sieve" ];
117 # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
118 # Here INDEX and CONTROL are separated,
119 # it's not useful since there is no quota at the filesystem level
120 # it's just to let this possibility later on.
121 mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
122 createMailUser = false;
123 mailUser = "";
124 mailGroup = "";
125 sslServerCert = null;
126 sieveScripts = {
127 global = dovecot/sieve/global;
128 };
129 extraConfig = ''
130 #auth_verbose = yes
131 #auth_debug = yes
132 #mail_debug = yes
133 #verbose_ssl = yes
134 log_timestamp = "%Y-%m-%d %H:%M:%S "
135
136 ssl = required
137 ssl_dh = <${dovecot/dh4096.pem}
138 ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
139 ssl_prefer_server_ciphers = yes
140 ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
141 ssl_key = </var/lib/acme/${networking.domain}/key.pem
142 #ssl_ca = <''${caPath}
143 #ssl_verify_client_cert = yes
144 # FIXME: change to TLSv1.3 when supported by K-9 Mail
145 ssl_min_protocol = TLSv1.2
146
147 listen = *
148 mail_home = ${stateDir}/home/%d/%n
149 # Read multiple mails in parallel, improves performance
150 mail_prefetch_count = 20
151
152 # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
153 # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
154 # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
155 # when in fact, storing the password in the directory server using a Salted SHA-2 hash
156 # and transmitting the clear text password over a secure connection
157 # is more secure than having the directory server store the password in clear text
158 # or in a reversible encryption scheme.
159 # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
160 # Use doveadm pw -s SSHA
161 # or doveadm pw -s PBKDF2 -r 10000
162 # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
163 auth_mechanisms = plain login
164 auth_username_format = %Ln
165 service auth {
166 user = ${dovecot2.user}
167 # auth_socket_path points to this userdb socket by default. It's typically
168 # used by dovecot-lda, doveadm, possibly imap process, etc.
169 # Users that have access to this socket are able to get a list
170 # of all usernames and get results of everyone's userdb lookups.
171 unix_listener auth-userdb {
172 user = ${dovecot2.user}
173 group = ${dovecot2.group}
174 mode = 0660
175 }
176 unix_listener /var/lib/postfix/queue/private/auth {
177 user = ${postfix.user}
178 group = ${postfix.group}
179 mode = 0660
180 }
181 }
182 service auth-worker {
183 user = ${dovecot2.user}
184 }
185 auth_cache_verify_password_with_worker = yes
186 # SEE: http://wiki2.dovecot.org/Quota/FS
187 # NOTE: postfix does not supply a client cert.
188 auth_ssl_require_client_cert = no
189 #auth_ssl_username_from_cert = yes
190 # NOTE: lowercase the username, help with LDAP?
191 auth_username_format = %Lu
192 # NOTE: sync with LDAP's data.
193 first_valid_uid = 1000
194 disable_plaintext_auth = yes
195
196 userdb {
197 driver = ldap
198 # A different path than passdb's args enables non-blocking LDAP requests
199 args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
200 default_fields =
201 override_fields =
202 }
203
204 # No dirty syncs for maildir: locations which may be used directly by neomutt
205 maildir_very_dirty_syncs = no
206 namespace Inbox {
207 type = private
208 inbox = yes
209 hidden = no
210 list = yes
211 prefix =
212 separator = +
213 }
214 namespace Shared {
215 type = shared
216 #list = children
217 # NOTE: always listed in the LIST command.
218 list = yes
219 # NOTE: how to access the other users' mailboxes.
220 # NOTE: %var expands to the logged in user's variable, while
221 # %%var expands to the other users' variables.
222 # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
223 location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
224 prefix = Partages+%%n+
225 separator = +
226 subscriptions = yes
227 }
228 mail_plugins = $mail_plugins virtual
229 namespace Virtual {
230 prefix = Virtual+
231 separator = +
232 hidden = no
233 list = yes
234 subscriptions = no
235 location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
236 }
237
238 mail_plugins = $mail_plugins acl
239 plugin {
240 acl = vfile:/etc/dovecot/acl/global
241 acl_anyone = allow
242 # NOTE: to let users LIST mailboxes shared by other users,
243 # Dovecot needs a shared mailbox dictionary.
244 # FIXME: %d not working with userdb ldap
245 acl_shared_dict = file:${stateDir}/acl/%d/acl.db
246 }
247
248 #mail_plugins = $mail_plugins fts fts_xapian
249 # Default VSZ (virtual memory size) limit for service processes. This is mainly
250 # intended to catch and kill processes that leak memory before they eat up everything.
251 # Increased for fts_xapian.
252 #default_vsz_limit = 1G
253 #plugin {
254 # # WARNING: doveadm fts rescan is buggy, it will delete the index:
255 # # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
256 # # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
257 # plugin = fts fts_xapian
258 # fts = xapian
259 # fts_autoindex = yes
260 # fts_autoindex_exclude = \Junk
261 # fts_autoindex_exclude2 = \Trash
262 # fts_enforced = yes
263 # # 2 and 20 are the NGram values for header fields, which means the
264 # # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
265 # # Full words are also added by default.
266 # fts_xapian = partial=2 full=20 attachments=1 verbose=0
267 # fts_languages = en fr
268 # #fts_dovecot_fs = posix:prefix=%h/fts/
269 #}
270
271 mail_plugins = $mail_plugins quota
272 plugin {
273 quota = maildir:User quota
274 quota_rule = *:storage=256M
275 quota_rule2 = Trash:storage=+64M
276 quota_max_mail_size = 20M
277 #quota_exceeded_message = </path/to/quota_exceeded_message.txt
278 quota_warning = storage=95%% quota-warning 95 %u
279 quota_warning2 = storage=80%% quota-warning 80 %u
280 quota_warning3 = -storage=100%% quota-warning below %u
281 }
282
283 protocol lda {
284 hostname = ${networking.domain}
285 mail_plugins = $mail_plugins sieve
286 postmaster_address = root+dovecot+lda@${networking.domain}
287 syslog_facility = mail
288 }
289 lda_mailbox_autocreate = yes
290 lda_mailbox_autosubscribe = yes
291
292 protocol lmtp {
293 mail_plugins = $mail_plugins sieve
294 postmaster_address = root+dovecot+lmtp@${networking.domain}
295 }
296 service lmtp {
297 process_min_avail = ${toString host.CPUs}
298 unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
299 user = ${postfix.user}
300 group = ${postfix.group}
301 mode = 0600
302 }
303 }
304 plugin {
305 # Let extension.sieve do the handling of the detail
306 #lmtp_save_to_detail_mailbox = yes
307 recipient_delimiter = ${postfix.recipientDelimiter}
308 }
309
310 service imap {
311 # Most of the memory goes to mmap()ing files.
312 # You may need to increase this limit if you have huge mailboxes.
313 #vsz_limit =
314 process_limit = 1024
315 }
316 service imap-login {
317 #inet_listener imap {
318 # address = 127.0.0.1
319 # port = 143
320 # ssl = no
321 #}
322 inet_listener imaps {
323 port = 993
324 ssl = yes
325 }
326 }
327 # Store METADATA information within user's HOME directory
328 mail_attribute_dict = file:%h/dovecot-attributes
329 # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
330 imapc_features = $imapc_features fetch-headers
331 protocol imap {
332 #mail_max_userip_connections = 10
333 mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
334 imap_metadata = yes
335
336 # DOC: https://wiki.dovecot.org/MailboxSettings
337 # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
338 # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
339 imap_capability = +SPECIAL-USE
340
341 namespace Inbox {
342 mailbox "Archives" {
343 auto = subscribe
344 special_use = \Archive
345 }
346 mailbox "Drafts" {
347 auto = no
348 special_use = \Drafts
349 }
350 mailbox "Brouillons" {
351 auto = subscribe
352 special_use = \Drafts
353 }
354 mailbox "Junk" {
355 auto = no
356 #autoexpunge = 30d
357 special_use = \Junk
358 }
359 mailbox "Spams" {
360 auto = no
361 special_use = \Junk
362 }
363 mailbox "Spam" {
364 auto = no
365 special_use = \Junk
366 }
367 mailbox "Pourriels" {
368 auto = no
369 special_use = \Junk
370 }
371 mailbox "Pourriel" {
372 auto = no
373 special_use = \Junk
374 }
375 mailbox "Sent" {
376 auto = no
377 special_use = \Sent
378 }
379 mailbox "Sent Items" {
380 auto = no
381 special_use = \Sent
382 }
383 mailbox "Sent Messages" {
384 auto = no
385 special_use = \Sent
386 }
387 mailbox "Envoyés" {
388 auto = no
389 special_use = \Sent
390 }
391 mailbox "Trash" {
392 auto = no
393 special_use = \Trash
394 #autoexpunge = 30d
395 }
396 mailbox "Corbeille" {
397 auto = no
398 special_use = \Trash
399 }
400 }
401 namespace Virtual {
402 mailbox All {
403 auto = no
404 comment = All messages from all mailboxes
405 # This flag is confused with \Archives by K9-Mail
406 special_use = \All
407 }
408 mailbox Recents {
409 auto = no
410 comment = All messages from all mailboxes, arrived in the past 48h
411 }
412 }
413 }
414 plugin {
415 sieve_plugins = sieve_imapsieve sieve_extprograms
416 sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
417 #sieve_extensions = +editheader
418 sieve = file:~/sieve;active=~/active.sieve
419 sieve_default = file:${stateDir}/sieve/global/default.sieve
420 sieve_default_name = main
421 sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
422 sieve_max_script_size = 1M
423 sieve_quota_max_scripts = 0
424 sieve_quota_max_storage = 10M
425 #sieve_spamtest_max_value = 10
426 #sieve_spamtest_status_header = X-Spam-Score
427 #sieve_spamtest_status_type = strlen
428 #sieve_user_log = ~/active.sieve.log
429 #sieve_trace_dir = ~/sieve-log
430 #sieve_trace_level = matching
431 # Enables support for user Sieve scripts in IMAP
432 #imapsieve_url = sieve://mail.${networking.domain}:4190
433
434 # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
435 imapsieve_mailbox1_name = *
436 imapsieve_mailbox1_causes = FLAG
437 imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
438
439 # From elsewhere to Junk folder
440 imapsieve_mailbox2_name = Pourriel
441 imapsieve_mailbox2_causes = COPY APPEND
442 imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
443
444 # From Junk folder to elsewhere
445 imapsieve_mailbox3_name = *
446 imapsieve_mailbox3_from = Pourriel
447 imapsieve_mailbox3_causes = COPY
448 imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
449 }
450 protocol sieve {
451 # Maximum number of ManageSieve connections allowed for a user from each IP address.
452 # NOTE: The username is compared case-sensitively.
453 mail_max_userip_connections = 10
454
455 # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
456 # the IMPLEMENTATION capability that the dovecot reports to clients.
457 # For example: 'Cyrus timesieved v2.2.13'
458 managesieve_implementation_string = Dovecot Pigeonhole
459
460 # The maximum number of compile errors that are returned to the client upon script
461 # upload or script verification.
462 managesieve_max_compile_errors = 5
463
464 #mail_max_userip_connections = 10
465 #managesieve_implementation_string = Dovecot Pigeonhole
466 managesieve_max_compile_errors = 5
467 #managesieve_max_line_length = 65536
468 #managesieve_notify_capability = mailto
469 #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
470 }
471 service managesieve-login {
472 inet_listener sieve {
473 port = 4190
474 #ssl = yes
475 }
476
477 # Number of connections to handle before starting a new process. Typically
478 # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
479 # is faster. <doc/wiki/LoginProcess.txt>
480 service_count = 1
481
482 # Number of processes to always keep waiting for more connections.
483 process_min_avail = 0
484
485 # If you set service_count=0, you probably need to grow this.
486 #vsz_limit = 64M
487 }
488
489 service quota-warning {
490 executable = script ${
491 pkgs.writeShellScript "quota-warning" ''
492 set -eu
493 PERCENT=$1
494 USER=$2
495 cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
496 "plugin/quota=maildir:User quota:noenforcing"
497 From: root+docevot@${networking.domain}
498 Subject: [WARNING] your mailbox is now $PERCENT% full.
499
500 Please remove some mails to make room for new ones.
501 EOF
502 ''
503 }
504 # use some unprivileged user for executing the quota warnings
505 user = ${dovecot2.user}
506 unix_listener quota-warning {
507 }
508 }
509
510 protocol pop3 {
511 mail_plugins = $mail_plugins virtual
512 #mail_max_userip_connections = 10
513 # Virtual namespace for the virtual INBOX.
514 # Use a global directory for dovecot-virtual files.
515 #namespace Inbox {
516 # hidden = yes
517 # list = no
518 # location = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
519 # prefix = pop3+
520 #}
521 pop3_client_workarounds =
522 pop3_fast_size_lookups = yes
523 pop3_lock_session = yes
524 pop3_no_flag_updates = yes
525 # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
526 pop3_uidl_format = %g
527 }
528 service pop3 {
529 process_limit = 1024
530 }
531 service pop3-login {
532 inet_listener pop3s {
533 port = 995
534 ssl = yes
535 }
536 }
537 '';
538 };
539 }