]> git.immae.eu Git - perso/Immae/Config/Nix.git/blame - modules/private/mail/dovecot.nix
Handle immae.fr from eldiron
[perso/Immae/Config/Nix.git] / modules / private / mail / dovecot.nix
CommitLineData
ab8f306d 1{ lib, pkgs, config, ... }:
a929614f
IB
2let
3 sieve_bin = pkgs.runCommand "sieve_bin" {
4 buildInputs = [ pkgs.makeWrapper ];
5 } ''
6 cp -a ${./sieve_bin} $out
7 chmod -R u+w $out
8 patchShebangs $out
9 for i in $out/*; do
10 wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]}
11 done
12 '';
13in
14{
8415083e 15 config = lib.mkIf config.myServices.mail.enable {
d2e703c5 16 services.duplyBackup.profiles.mail.excludeFile = ''
8415083e
IB
17 + /var/lib/dhparams
18 + /var/lib/dovecot
19 '';
20 secrets.keys = [
21 {
22 dest = "dovecot/ldap";
23 user = config.services.dovecot2.user;
24 group = config.services.dovecot2.group;
25 permissions = "0400";
26 text = ''
ab8f306d 27 hosts = ${config.myEnv.mail.dovecot.ldap.host}
8415083e 28 tls = yes
a929614f 29
ab8f306d
IB
30 dn = ${config.myEnv.mail.dovecot.ldap.dn}
31 dnpass = ${config.myEnv.mail.dovecot.ldap.password}
a929614f 32
8415083e 33 auth_bind = yes
a929614f 34
8415083e 35 ldap_version = 3
a929614f 36
ab8f306d 37 base = ${config.myEnv.mail.dovecot.ldap.base}
8415083e 38 scope = subtree
a929614f 39
ab8f306d
IB
40 pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
41 pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
a929614f 42
ab8f306d
IB
43 user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
44 user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
45 iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
46 iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
8415083e
IB
47 '';
48 }
a929614f 49 ];
8415083e
IB
50
51 users.users.vhost = {
52 group = "vhost";
53 uid = config.ids.uids.vhost;
54 };
55 users.groups.vhost.gid = config.ids.gids.vhost;
56
57 # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous.......
58 services.dovecot2 = {
59 enable = true;
60 enablePAM = false;
61 enablePop3 = true;
62 enableImap = true;
63 enableLmtp = true;
64 protocols = [ "sieve" ];
65 modules = [
66 pkgs.dovecot_pigeonhole
67 pkgs.dovecot_fts-xapian
68 ];
69 mailUser = "vhost";
70 mailGroup = "vhost";
71 createMailUser = false;
72 mailboxes = [
73 { name = "Trash"; auto = "subscribe"; specialUse = "Trash"; }
74 { name = "Junk"; auto = "subscribe"; specialUse = "Junk"; }
75 { name = "Sent"; auto = "subscribe"; specialUse = "Sent"; }
76 { name = "Drafts"; auto = "subscribe"; specialUse = "Drafts"; }
77 ];
78 mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap";
79 sslServerCert = "/var/lib/acme/mail/fullchain.pem";
80 sslServerKey = "/var/lib/acme/mail/key.pem";
81 sslCACert = "/var/lib/acme/mail/fullchain.pem";
82 extraConfig = builtins.concatStringsSep "\n" [
83 ''
84 postmaster_address = postmaster@immae.eu
85 mail_attribute_dict = file:%h/dovecot-attributes
86 imap_idle_notify_interval = 20 mins
87 namespace inbox {
88 type = private
89 separator = /
90 inbox = yes
91 list = yes
92 }
93 ''
94
089f5093
IB
95 # ACL
96 ''
97 mail_plugins = $mail_plugins acl
98 plugin {
99 acl = vfile:${pkgs.writeText "dovecot-acl" ''
100 Backup/* owner lrp
101 ''}
102 acl_globals_only = yes
103 }
104 ''
105
8415083e
IB
106 # Full text search
107 ''
108 # needs to be bigger than any mailbox size
109 default_vsz_limit = 2GB
110 mail_plugins = $mail_plugins fts fts_xapian
111 plugin {
112 plugin = fts fts_xapian
113 fts = xapian
114 fts_xapian = partial=2 full=20
115 fts_autoindex = yes
116 fts_autoindex_exclude = \Junk
117 fts_autoindex_exclude2 = \Trash
118 fts_autoindex_exclude3 = Virtual/*
119 }
120 ''
121
122 # Antispam
123 # https://docs.iredmail.org/dovecot.imapsieve.html
124 ''
125 # imap_sieve plugin added below
126
a929614f 127 plugin {
8415083e
IB
128 sieve_plugins = sieve_imapsieve sieve_extprograms
129 imapsieve_url = sieve://127.0.0.1:4190
130
304a7dac 131 sieve_before = file:${./sieve_scripts}/backup.sieve;bindir=/var/lib/vhost/.sieve_bin
089f5093 132
8415083e
IB
133 # From elsewhere to Junk folder
134 imapsieve_mailbox1_name = Junk
135 imapsieve_mailbox1_causes = COPY APPEND
136 imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin
137
138 # From Junk folder to elsewhere
139 imapsieve_mailbox2_name = *
140 imapsieve_mailbox2_from = Junk
141 imapsieve_mailbox2_causes = COPY
142 imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
143
144 sieve_pipe_bin_dir = ${sieve_bin}
145
146 sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
a929614f 147 }
8415083e
IB
148 ''
149 # Services to listen
150 ''
151 service imap-login {
152 inet_listener imap {
153 }
154 inet_listener imaps {
155 }
a929614f 156 }
8415083e
IB
157 service pop3-login {
158 inet_listener pop3 {
159 }
160 inet_listener pop3s {
161 }
a929614f 162 }
8415083e 163 service imap {
a929614f 164 }
8415083e 165 service pop3 {
a929614f 166 }
8415083e
IB
167 service auth {
168 unix_listener auth-userdb {
169 }
170 unix_listener ${config.services.postfix.config.queue_directory}/private/auth {
171 mode = 0666
172 }
a929614f 173 }
8415083e 174 service auth-worker {
a929614f 175 }
8415083e
IB
176 service dict {
177 unix_listener dict {
178 }
a929614f 179 }
8415083e
IB
180 service stats {
181 unix_listener stats-reader {
182 user = vhost
183 group = vhost
184 mode = 0660
185 }
186 unix_listener stats-writer {
187 user = vhost
188 group = vhost
189 mode = 0660
190 }
a929614f 191 }
8415083e
IB
192 ''
193
194 # Authentification
195 ''
196 first_valid_uid = ${toString config.ids.uids.vhost}
197 disable_plaintext_auth = yes
198 passdb {
199 driver = ldap
200 args = ${config.secrets.fullPaths."dovecot/ldap"}
201 }
202 userdb {
98f8f4de
IB
203 driver = ldap
204 args = ${config.secrets.fullPaths."dovecot/ldap"}
8415083e
IB
205 }
206 ''
a929614f 207
8415083e
IB
208 # Zlib
209 ''
210 mail_plugins = $mail_plugins zlib
211 plugin {
212 zlib_save_level = 6
213 zlib_save = gz
214 }
215 ''
a929614f 216
8415083e
IB
217 # Sieve
218 ''
219 plugin {
220 sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve
221 }
222 service managesieve-login {
223 }
224 service managesieve {
225 }
226 ''
227
228 # Virtual mailboxes
229 ''
230 mail_plugins = $mail_plugins virtual
231 namespace Virtual {
232 prefix = Virtual/
233 location = virtual:~/Virtual
234 }
235 ''
a929614f 236
8415083e
IB
237 # Protocol specific configuration
238 # Needs to come last if there are mail_plugins entries
239 ''
240 protocol imap {
089f5093 241 mail_plugins = $mail_plugins imap_sieve imap_acl
8415083e
IB
242 }
243 protocol lda {
244 mail_plugins = $mail_plugins sieve
245 }
246 ''
247 ];
248 };
249 networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ];
250 system.activationScripts.dovecot = {
251 deps = [ "users" ];
252 text =''
253 install -m 0755 -o vhost -g vhost -d /var/lib/vhost
254 '';
255 };
256
98f8f4de
IB
257 services.cron.systemCronJobs = let
258 cron_script = pkgs.writeScriptBin "cleanup-imap-folders" ''
cecfa2f6
IB
259 ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX "Backup/*" NOT UID 1:256 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
260 ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Junk SEEN NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
261 ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Trash NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
98f8f4de
IB
262 '';
263 in
264 [
265 "0 2 * * * root ${cron_script}/bin/cleanup-imap-folders"
266 ];
8415083e
IB
267 security.acme.certs."mail" = {
268 postRun = ''
269 systemctl restart dovecot2.service
270 '';
271 extraDomains = {
272 "imap.immae.eu" = null;
273 "pop3.immae.eu" = null;
274 };
a929614f
IB
275 };
276 };
277}
278