{ inputs, pkgs, lib, config, system, host, ... }:
let
  inherit (builtins) toString toFile readFile;
  inherit (lib) types;
  inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
  inherit (config) networking;
  inherit (config.services) dovecot2 postfix openldap;

  # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
  stateDir = "/var/lib/dovecot";

  sieve_pipe_bin_dir = pkgs.buildEnv {
    name = "sieve_pipe_bin_dir";
    pathsToLink = [ "/bin" ];
    paths = [
      learn-spam
      learn-ham
    ];
  };
  learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
    exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
  '';
  learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
    exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
  '';

  dovecot-virtual = pkgs.buildEnv {
    name = "dovecot-virtual";
    pathsToLink = [ "/" ];
    paths = [
      dovecot-virtual-all
      dovecot-virtual-recents
    ];
  };
  dovecot-virtual-all = pkgs.writeTextFile {
    name = "dovecot-virtual-all";
    destination = "/All/dovecot-virtual";
    text = ''
      *
        all
    '';
  };
  dovecot-virtual-recents = pkgs.writeTextFile {
    name = "dovecot-virtual-recents";
    destination = "/Recents/dovecot-virtual";
    text = ''
      *
        all younger 172800
    '';
  };
  dovecot-virtual-pop3 = pkgs.writeTextFile {
    name = "dovecot-virtual-pop3";
    destination = "/pop3/INBOX/dovecot-virtual";
    text = ''
      All
      All+*
        all
    '';
  };
in
{
imports = [
  dovecot/sourcephile.fr.nix
  dovecot/autogeree.net.nix
];
users.groups.acme.members = [ dovecot2.user ];
systemd.services.dovecot2 = {
  after = [
    "postfix.service"
    "openldap.service"
  ];
  /*
  preStart = ''
    # SEE: http://wiki2.dovecot.org/SharedMailboxes/Permissions
    install -D -d -m 0771 \
     -o "${dovecot2.user}" \
     -g "${dovecot2.group}" \
     ${stateDir}/mail
  '';
  */
  serviceConfig = {
    #ExecStart = lib.mkForce "${pkgs.utillinux}/bin/setarch x86_64 --addr-no-randomize /bin/sh -c 'LD_PRELOAD=${pkgs.gcc-unwrapped.lib}/lib/libasan.so ${pkgs.dovecot}/sbin/dovecot -F'";
    # Dovecot2 does not work with environment.memoryAllocator.provider="scudo"
    # https://wiki.dovecot.org/Design/Memory
    # Scudo ERROR: CHECK failed at /build/compiler-rt-7.1.0.src/lib/scudo/../sanitizer_common/sanitizer_allocator_primary64.h:
    # 644 ((beg)) == ((address_range.MapOrDie(beg, size))) (4398046511092, 4398046507008)
    BindReadOnlyPaths = [ "/dev/null:/etc/ld-nix.so.preload" ];
  };
};
#users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
networking.nftables.ruleset = ''
  add rule inet filter net2fw tcp dport 993 counter accept comment "IMAPS"
  #add rule inet filter net2fw tcp dport 995 counter accept comment "POP3S"
  add rule inet filter net2fw tcp dport 4190 counter accept comment "Sieve"
'';
services.dovecot2 = {
  enable = true;
  modules = [
    pkgs.dovecot_pigeonhole
    pkgs.dovecot_fts_xapian
  ];
  enablePAM = false;
  enableImap = true;
  enableLmtp = true;
  enablePop3 = false;
  protocols = [ "sieve" ];
  # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
  # Here INDEX and CONTROL are separated,
  # it's not useful since there is no quota at the filesystem level
  # it's just to let this possibility later on.
  mailLocation = "sdbox:${stateDir}/home/%d/%n/mail:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
  createMailUser = false;
  mailUser = "";
  mailGroup = "";
  sslServerCert = null;
  sieveScripts = {
    global = dovecot/sieve/global;
  };
  extraConfig = ''
    auth_verbose = no
    auth_debug = no
    mail_debug = no
    verbose_ssl = no
    log_timestamp = "%Y-%m-%d %H:%M:%S "

    ssl = required
    ssl_dh = <${inputs.secrets + "/openssl/dh.pem"}
    ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
    ssl_prefer_server_ciphers = yes
    ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
    ssl_key = </var/lib/acme/${networking.domain}/key.pem
    #ssl_ca = <''${caPath}
    #ssl_verify_client_cert = yes
    # FIXME: change to TLSv1.3 when supported by K-9 Mail
    ssl_min_protocol = TLSv1.2

    listen = *
    mail_home = ${stateDir}/home/%d/%n
    # Read multiple mails in parallel, improves performance
    mail_prefetch_count = 20
    # Default VSZ (virtual memory size) limit for service processes. This is mainly
    # intended to catch and kill processes that leak memory before they eat up everything.
    # Increased for fts_xapian.
    default_vsz_limit = 1G

    # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
    # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
    # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
    # when in fact, storing the password in the directory server using a Salted SHA-2 hash
    # and transmitting the clear text password over a secure connection
    # is more secure than having the directory server store the password in clear text
    # or in a reversible encryption scheme.
    # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
    # Use doveadm pw -s SSHA
    # or doveadm pw -s PBKDF2 -r 10000
    # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
    auth_mechanisms = plain login
    auth_username_format = %Ln
    service auth {
      user = ${dovecot2.user}
      # auth_socket_path points to this userdb socket by default. It's typically
      # used by dovecot-lda, doveadm, possibly imap process, etc.
      # Users that have access to this socket are able to get a list
      # of all usernames and get results of everyone's userdb lookups.
      unix_listener auth-userdb {
        user  = ${dovecot2.user}
        group = ${dovecot2.group}
        mode  = 0660
      }
      unix_listener /var/lib/postfix/queue/private/auth {
        user  = ${postfix.user}
        group = ${postfix.group}
        mode  = 0660
      }
    }
    service auth-worker {
      user = ${dovecot2.user}
    }
    auth_cache_verify_password_with_worker = yes
    # SEE: http://wiki2.dovecot.org/Quota/FS
    # NOTE: postfix does not supply a client cert.
    auth_ssl_require_client_cert = no
    #auth_ssl_username_from_cert = yes
    # NOTE: lowercase the username, help with LDAP?
    auth_username_format = %Lu
    # NOTE: sync with LDAP's data.
    first_valid_uid = 1000
    disable_plaintext_auth = yes

    userdb {
      driver = ldap
      # A different path than passdb's args enables non-blocking LDAP requests
      args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
      default_fields =
      override_fields =
    }

    # No dirty syncs for maildir: locations which may be used directly by neomutt
    maildir_very_dirty_syncs = no
    namespace Inbox {
      type      = private
      inbox     = yes
      hidden    = no
      list      = yes
      prefix    =
      separator = +
    }
    namespace Shared {
      type = shared
      #list = children
      # NOTE: always listed in the LIST command.
      list = yes
      # NOTE: how to access the other users' mailboxes.
      # NOTE: %var expands to the logged in user's variable, while
      #       %%var expands to the other users' variables.
      # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
      location = sdbox:${stateDir}/home/%%d/%%n/${stateDir}/mail:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/shared:INDEX=${stateDir}/index/%%d/%%n/shared:INDEXPVT=${stateDir}/index/%d/%n/shared/%%n
      prefix = Partages+%%n+
      separator = +
      subscriptions = yes
    }
    mail_plugins = $mail_plugins virtual
    namespace Virtual {
      prefix = Virtual+
      separator = +
      hidden = no
      list = yes
      subscriptions = no
      location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
    }

    mail_plugins = $mail_plugins acl
    plugin {
      acl = vfile:/etc/dovecot/acl/global
      acl_anyone = allow
      # NOTE: to let users LIST mailboxes shared by other users,
      #       Dovecot needs a shared mailbox dictionary.
      # FIXME: %d not working with userdb ldap
      acl_shared_dict = file:${stateDir}/acl/%d/acl.db
    }

    mail_plugins = $mail_plugins fts fts_xapian
    plugin {
      # WARNING: doveadm fts rescan is buggy, it will delete the index:
      # https://dovecot.org/pipermail/dovecot/2019-February/114709.html
      # If need be, use rather: doveadm index -u "*@sourcephile.fr" -q '*'
      plugin = fts fts_xapian
      fts = xapian
      fts_autoindex = yes
      fts_autoindex_exclude = \Junk
      fts_autoindex_exclude2 = \Trash
      fts_enforced = yes
      # 2 and 20 are the NGram values for header fields, which means the
      # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
      # Full words are also added by default.
      fts_xapian = partial=2 full=20 attachments=1 verbose=0
      fts_languages = en fr
      #fts_dovecot_fs = posix:prefix=%h/fts/
    }

    mail_plugins = $mail_plugins quota
    plugin {
      quota = maildir:User quota
      quota_rule = *:storage=256M
      quota_rule2 = Trash:storage=+64M
      quota_max_mail_size = 20M
      #quota_exceeded_message = </path/to/quota_exceeded_message.txt
      quota_warning  = storage=95%% quota-warning 95 %u
      quota_warning2 = storage=80%% quota-warning 80 %u
      quota_warning3 = -storage=100%% quota-warning below %u
    }

    protocol lda {
      hostname = ${networking.domain}
      mail_plugins = $mail_plugins sieve
      postmaster_address = postmaster+dovecot+lda@${networking.domain}
      syslog_facility = mail
    }
    lda_mailbox_autocreate = yes
    lda_mailbox_autosubscribe = yes

    protocol lmtp {
      mail_plugins = $mail_plugins sieve
      postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
    }
    service lmtp {
      process_min_avail = ${toString host.CPUs}
      unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
        user  = ${postfix.user}
        group = ${postfix.group}
        mode  = 0600
      }
    }
    plugin {
      # Let extension.sieve do the handling of the detail
      #lmtp_save_to_detail_mailbox = yes
      recipient_delimiter = ${postfix.recipientDelimiter}
    }

    service imap {
      # Most of the memory goes to mmap()ing files.
      # You may need to increase this limit if you have huge mailboxes.
      #vsz_limit =
      process_limit = 1024
    }
    service imap-login {
      #inet_listener imap {
      #  address = 127.0.0.1
      #  port    = 143
      #  ssl     = no
      #}
      inet_listener imaps {
        port = 993
        ssl  = yes
      }
    }
    # Store METADATA information within user's HOME directory
    mail_attribute_dict = file:%h/dovecot-attributes
    # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
    imapc_features = $imapc_features fetch-headers
    protocol imap {
      #mail_max_userip_connections = 10
      mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
      imap_metadata = yes

      # DOC: https://wiki.dovecot.org/MailboxSettings
      # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
      # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
      imap_capability = +SPECIAL-USE

      namespace Inbox {
        mailbox "Archives" {
          auto = subscribe
          special_use = \Archive
        }
        mailbox "Drafts" {
          auto = no
          special_use = \Drafts
        }
        mailbox "Brouillons" {
          auto = subscribe
          special_use = \Drafts
        }
        mailbox "Junk" {
          auto = no
          #autoexpunge = 30d
          special_use = \Junk
        }
        mailbox "Spams" {
          auto = no
          special_use = \Junk
        }
        mailbox "Spam" {
          auto = no
          special_use = \Junk
        }
        mailbox "Pourriels" {
          auto = no
          special_use = \Junk
        }
        mailbox "Pourriel" {
          auto = no
          special_use = \Junk
        }
        mailbox "Sent" {
          auto = no
          special_use = \Sent
        }
        mailbox "Sent Items" {
          auto = no
          special_use = \Sent
        }
        mailbox "Sent Messages" {
          auto = no
          special_use = \Sent
        }
        mailbox "Envoyés" {
          auto = no
          special_use = \Sent
        }
        mailbox "Trash" {
          auto = no
          special_use = \Trash
          #autoexpunge = 30d
        }
        mailbox "Corbeille" {
          auto = no
          special_use = \Trash
        }
      }
      namespace Virtual {
        mailbox All {
          auto = no
          comment = All messages from all mailboxes
          # This flag is confused with \Archives by K9-Mail
          special_use = \All
        }
        mailbox Recents {
          auto = no
          comment = All messages from all mailboxes, arrived in the past 48h
        }
      }
    }
    plugin {
      sieve_plugins = sieve_imapsieve sieve_extprograms
      sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.pipe
      #sieve_extensions = +editheader
      sieve = file:~/sieve;active=~/active.sieve
      sieve_default = file:${stateDir}/sieve/global/default.sieve
      sieve_default_name = main
      sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
      sieve_max_script_size = 1M
      sieve_quota_max_scripts = 0
      sieve_quota_max_storage = 10M
      #sieve_spamtest_max_value = 10
      #sieve_spamtest_status_header = X-Spam-Score
      #sieve_spamtest_status_type = strlen
      #sieve_user_log = ~/sieve.log
      # Enables support for user Sieve scripts in IMAP
      #imapsieve_url = sieve://mail.${networking.domain}:4190

      # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
      imapsieve_mailbox1_name = *
      imapsieve_mailbox1_causes = FLAG
      imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve

      # From elsewhere to Junk folder
      imapsieve_mailbox2_name = Pourriel
      imapsieve_mailbox2_causes = COPY APPEND
      imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve

      # From Junk folder to elsewhere
      imapsieve_mailbox3_name = *
      imapsieve_mailbox3_from = Pourriel
      imapsieve_mailbox3_causes = COPY
      imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
    }
    protocol sieve {
      # Maximum number of ManageSieve connections allowed for a user from each IP address.
      # NOTE: The username is compared case-sensitively.
      mail_max_userip_connections = 10

      # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
      # the IMPLEMENTATION capability that the dovecot reports to clients.
      # For example: 'Cyrus timesieved v2.2.13'
      managesieve_implementation_string = Dovecot Pigeonhole

      # The maximum number of compile errors that are returned to the client upon script
      # upload or script verification.
      managesieve_max_compile_errors = 5

      #mail_max_userip_connections = 10
      #managesieve_implementation_string = Dovecot Pigeonhole
      managesieve_max_compile_errors = 5
      #managesieve_max_line_length = 65536
      #managesieve_notify_capability = mailto
      #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
    }
    service managesieve-login {
      inet_listener sieve {
        port = 4190
        #ssl  = yes
      }

      # Number of connections to handle before starting a new process. Typically
      # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
      # is faster. <doc/wiki/LoginProcess.txt>
      service_count = 1

      # Number of processes to always keep waiting for more connections.
      process_min_avail = 0

      # If you set service_count=0, you probably need to grow this.
      #vsz_limit = 64M
    }

    service quota-warning {
      executable = script ${
        pkgs.writeShellScript "quota-warning" ''
          set -eu
          PERCENT=$1
          USER=$2
          cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
          "plugin/quota=maildir:User quota:noenforcing"
          From: postmaster@${networking.domain}
          Subject: [WARNING] your mailbox is now $PERCENT% full.

          Please remove some mails to make room for new ones.
          EOF
        ''
      }
      # use some unprivileged user for executing the quota warnings
      user = ${dovecot2.user}
      unix_listener quota-warning {
      }
    }

    protocol pop3 {
      mail_plugins = $mail_plugins virtual
      #mail_max_userip_connections = 10
      # Virtual namespace for the virtual INBOX.
      # Use a global directory for dovecot-virtual files.
      #namespace Inbox {
      #  hidden    = yes
      #  list      = no
      #  location  = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
      #  prefix    = pop3+
      #}
      pop3_client_workarounds =
      pop3_fast_size_lookups = yes
      pop3_lock_session = yes
      pop3_no_flag_updates = yes
      # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
      pop3_uidl_format = %g
    }
    service pop3 {
      process_limit = 1024
    }
    service pop3-login {
      inet_listener pop3s {
        port = 995
        ssl  = yes
      }
    }
  '';
};
}