]>
Commit | Line | Data |
---|---|---|
ab8f306d | 1 | { lib, pkgs, config, ... }: |
a929614f IB |
2 | let |
3 | sieve_bin = pkgs.runCommand "sieve_bin" { | |
4 | buildInputs = [ pkgs.makeWrapper ]; | |
5 | } '' | |
6 | cp -a ${./sieve_bin} $out | |
7 | chmod -R u+w $out | |
8 | patchShebangs $out | |
9 | for i in $out/*; do | |
10 | wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]} | |
11 | done | |
12 | ''; | |
13 | in | |
14 | { | |
8415083e | 15 | config = lib.mkIf config.myServices.mail.enable { |
d2e703c5 | 16 | services.duplyBackup.profiles.mail.excludeFile = '' |
8415083e IB |
17 | + /var/lib/dhparams |
18 | + /var/lib/dovecot | |
19 | ''; | |
20 | secrets.keys = [ | |
21 | { | |
22 | dest = "dovecot/ldap"; | |
23 | user = config.services.dovecot2.user; | |
24 | group = config.services.dovecot2.group; | |
25 | permissions = "0400"; | |
26 | text = '' | |
ab8f306d | 27 | hosts = ${config.myEnv.mail.dovecot.ldap.host} |
8415083e | 28 | tls = yes |
a929614f | 29 | |
ab8f306d IB |
30 | dn = ${config.myEnv.mail.dovecot.ldap.dn} |
31 | dnpass = ${config.myEnv.mail.dovecot.ldap.password} | |
a929614f | 32 | |
8415083e | 33 | auth_bind = yes |
a929614f | 34 | |
8415083e | 35 | ldap_version = 3 |
a929614f | 36 | |
ab8f306d | 37 | base = ${config.myEnv.mail.dovecot.ldap.base} |
8415083e | 38 | scope = subtree |
a929614f | 39 | |
ab8f306d IB |
40 | pass_filter = ${config.myEnv.mail.dovecot.ldap.filter} |
41 | pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs} | |
a929614f | 42 | |
ab8f306d IB |
43 | user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs} |
44 | user_filter = ${config.myEnv.mail.dovecot.ldap.filter} | |
45 | iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs} | |
46 | iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter} | |
8415083e IB |
47 | ''; |
48 | } | |
a929614f | 49 | ]; |
8415083e IB |
50 | |
51 | users.users.vhost = { | |
52 | group = "vhost"; | |
53 | uid = config.ids.uids.vhost; | |
54 | }; | |
55 | users.groups.vhost.gid = config.ids.gids.vhost; | |
56 | ||
57 | # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous....... | |
58 | services.dovecot2 = { | |
59 | enable = true; | |
60 | enablePAM = false; | |
61 | enablePop3 = true; | |
62 | enableImap = true; | |
63 | enableLmtp = true; | |
64 | protocols = [ "sieve" ]; | |
65 | modules = [ | |
66 | pkgs.dovecot_pigeonhole | |
67 | pkgs.dovecot_fts-xapian | |
68 | ]; | |
69 | mailUser = "vhost"; | |
70 | mailGroup = "vhost"; | |
71 | createMailUser = false; | |
72 | mailboxes = [ | |
73 | { name = "Trash"; auto = "subscribe"; specialUse = "Trash"; } | |
74 | { name = "Junk"; auto = "subscribe"; specialUse = "Junk"; } | |
75 | { name = "Sent"; auto = "subscribe"; specialUse = "Sent"; } | |
76 | { name = "Drafts"; auto = "subscribe"; specialUse = "Drafts"; } | |
77 | ]; | |
78 | mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap"; | |
79 | sslServerCert = "/var/lib/acme/mail/fullchain.pem"; | |
80 | sslServerKey = "/var/lib/acme/mail/key.pem"; | |
81 | sslCACert = "/var/lib/acme/mail/fullchain.pem"; | |
82 | extraConfig = builtins.concatStringsSep "\n" [ | |
5153eb54 IB |
83 | # For printer which doesn’t support elliptic curve |
84 | '' | |
85 | ssl_alt_cert = </var/lib/acme/mail-rsa/fullchain.pem | |
86 | ssl_alt_key = </var/lib/acme/mail-rsa/key.pem | |
87 | '' | |
88 | ||
8415083e IB |
89 | '' |
90 | postmaster_address = postmaster@immae.eu | |
91 | mail_attribute_dict = file:%h/dovecot-attributes | |
92 | imap_idle_notify_interval = 20 mins | |
93 | namespace inbox { | |
94 | type = private | |
95 | separator = / | |
96 | inbox = yes | |
97 | list = yes | |
98 | } | |
99 | '' | |
100 | ||
089f5093 IB |
101 | # ACL |
102 | '' | |
103 | mail_plugins = $mail_plugins acl | |
104 | plugin { | |
105 | acl = vfile:${pkgs.writeText "dovecot-acl" '' | |
106 | Backup/* owner lrp | |
107 | ''} | |
108 | acl_globals_only = yes | |
109 | } | |
110 | '' | |
111 | ||
8415083e IB |
112 | # Full text search |
113 | '' | |
114 | # needs to be bigger than any mailbox size | |
115 | default_vsz_limit = 2GB | |
116 | mail_plugins = $mail_plugins fts fts_xapian | |
117 | plugin { | |
118 | plugin = fts fts_xapian | |
119 | fts = xapian | |
120 | fts_xapian = partial=2 full=20 | |
121 | fts_autoindex = yes | |
122 | fts_autoindex_exclude = \Junk | |
123 | fts_autoindex_exclude2 = \Trash | |
124 | fts_autoindex_exclude3 = Virtual/* | |
125 | } | |
126 | '' | |
127 | ||
128 | # Antispam | |
129 | # https://docs.iredmail.org/dovecot.imapsieve.html | |
130 | '' | |
131 | # imap_sieve plugin added below | |
132 | ||
a929614f | 133 | plugin { |
8415083e IB |
134 | sieve_plugins = sieve_imapsieve sieve_extprograms |
135 | imapsieve_url = sieve://127.0.0.1:4190 | |
136 | ||
304a7dac | 137 | sieve_before = file:${./sieve_scripts}/backup.sieve;bindir=/var/lib/vhost/.sieve_bin |
089f5093 | 138 | |
8415083e IB |
139 | # From elsewhere to Junk folder |
140 | imapsieve_mailbox1_name = Junk | |
141 | imapsieve_mailbox1_causes = COPY APPEND | |
142 | imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin | |
143 | ||
144 | # From Junk folder to elsewhere | |
145 | imapsieve_mailbox2_name = * | |
146 | imapsieve_mailbox2_from = Junk | |
147 | imapsieve_mailbox2_causes = COPY | |
148 | imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin | |
149 | ||
95ca3110 IB |
150 | # From anywhere to NoJunk folder |
151 | imapsieve_mailbox3_name = NoJunk | |
152 | imapsieve_mailbox3_causes = COPY APPEND | |
153 | imapsieve_mailbox3_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin | |
154 | ||
8415083e IB |
155 | sieve_pipe_bin_dir = ${sieve_bin} |
156 | ||
157 | sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment | |
a929614f | 158 | } |
8415083e IB |
159 | '' |
160 | # Services to listen | |
161 | '' | |
162 | service imap-login { | |
163 | inet_listener imap { | |
164 | } | |
165 | inet_listener imaps { | |
166 | } | |
a929614f | 167 | } |
8415083e IB |
168 | service pop3-login { |
169 | inet_listener pop3 { | |
170 | } | |
171 | inet_listener pop3s { | |
172 | } | |
a929614f | 173 | } |
8415083e | 174 | service imap { |
a929614f | 175 | } |
8415083e | 176 | service pop3 { |
a929614f | 177 | } |
8415083e IB |
178 | service auth { |
179 | unix_listener auth-userdb { | |
180 | } | |
181 | unix_listener ${config.services.postfix.config.queue_directory}/private/auth { | |
182 | mode = 0666 | |
183 | } | |
a929614f | 184 | } |
8415083e | 185 | service auth-worker { |
a929614f | 186 | } |
8415083e IB |
187 | service dict { |
188 | unix_listener dict { | |
189 | } | |
a929614f | 190 | } |
8415083e IB |
191 | service stats { |
192 | unix_listener stats-reader { | |
193 | user = vhost | |
194 | group = vhost | |
195 | mode = 0660 | |
196 | } | |
197 | unix_listener stats-writer { | |
198 | user = vhost | |
199 | group = vhost | |
200 | mode = 0660 | |
201 | } | |
a929614f | 202 | } |
8415083e IB |
203 | '' |
204 | ||
205 | # Authentification | |
206 | '' | |
207 | first_valid_uid = ${toString config.ids.uids.vhost} | |
208 | disable_plaintext_auth = yes | |
209 | passdb { | |
210 | driver = ldap | |
211 | args = ${config.secrets.fullPaths."dovecot/ldap"} | |
212 | } | |
213 | userdb { | |
98f8f4de IB |
214 | driver = ldap |
215 | args = ${config.secrets.fullPaths."dovecot/ldap"} | |
8415083e IB |
216 | } |
217 | '' | |
a929614f | 218 | |
8415083e IB |
219 | # Zlib |
220 | '' | |
221 | mail_plugins = $mail_plugins zlib | |
222 | plugin { | |
223 | zlib_save_level = 6 | |
224 | zlib_save = gz | |
225 | } | |
226 | '' | |
a929614f | 227 | |
8415083e IB |
228 | # Sieve |
229 | '' | |
230 | plugin { | |
231 | sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve | |
232 | } | |
233 | service managesieve-login { | |
234 | } | |
235 | service managesieve { | |
236 | } | |
237 | '' | |
238 | ||
239 | # Virtual mailboxes | |
240 | '' | |
241 | mail_plugins = $mail_plugins virtual | |
242 | namespace Virtual { | |
243 | prefix = Virtual/ | |
244 | location = virtual:~/Virtual | |
245 | } | |
246 | '' | |
a929614f | 247 | |
8415083e IB |
248 | # Protocol specific configuration |
249 | # Needs to come last if there are mail_plugins entries | |
250 | '' | |
251 | protocol imap { | |
089f5093 | 252 | mail_plugins = $mail_plugins imap_sieve imap_acl |
8415083e IB |
253 | } |
254 | protocol lda { | |
255 | mail_plugins = $mail_plugins sieve | |
256 | } | |
257 | '' | |
258 | ]; | |
259 | }; | |
260 | networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ]; | |
261 | system.activationScripts.dovecot = { | |
262 | deps = [ "users" ]; | |
263 | text ='' | |
264 | install -m 0755 -o vhost -g vhost -d /var/lib/vhost | |
265 | ''; | |
266 | }; | |
267 | ||
98f8f4de IB |
268 | services.cron.systemCronJobs = let |
269 | cron_script = pkgs.writeScriptBin "cleanup-imap-folders" '' | |
5dc338f0 | 270 | ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX "Backup/*" NOT FLAGGED BEFORE 8w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB" |
cecfa2f6 IB |
271 | ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Junk SEEN NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB" |
272 | ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Trash NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB" | |
98f8f4de IB |
273 | ''; |
274 | in | |
275 | [ | |
276 | "0 2 * * * root ${cron_script}/bin/cleanup-imap-folders" | |
277 | ]; | |
5153eb54 IB |
278 | security.acme.certs."mail-rsa" = { |
279 | postRun = '' | |
280 | systemctl restart dovecot2.service | |
281 | ''; | |
282 | extraDomains = { | |
283 | "imap.immae.eu" = null; | |
284 | "pop3.immae.eu" = null; | |
285 | }; | |
286 | }; | |
5400b9b6 | 287 | security.acme.certs."mail" = { |
8415083e IB |
288 | postRun = '' |
289 | systemctl restart dovecot2.service | |
290 | ''; | |
291 | extraDomains = { | |
292 | "imap.immae.eu" = null; | |
293 | "pop3.immae.eu" = null; | |
294 | }; | |
a929614f IB |
295 | }; |
296 | }; | |
297 | } | |
298 |