]>
Commit | Line | Data |
---|---|---|
ab8f306d | 1 | { lib, pkgs, config, ... }: |
a929614f IB |
2 | let |
3 | sieve_bin = pkgs.runCommand "sieve_bin" { | |
4 | buildInputs = [ pkgs.makeWrapper ]; | |
5 | } '' | |
6 | cp -a ${./sieve_bin} $out | |
7 | chmod -R u+w $out | |
8 | patchShebangs $out | |
9 | for i in $out/*; do | |
10 | wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]} | |
11 | done | |
12 | ''; | |
13 | in | |
14 | { | |
8415083e | 15 | config = lib.mkIf config.myServices.mail.enable { |
1a64deeb IB |
16 | myServices.dns.zones."immae.eu".subdomains = |
17 | with config.myServices.dns.helpers; | |
18 | { | |
19 | imap = ips servers.eldiron.ips.main; | |
20 | pop3 = ips servers.eldiron.ips.main; | |
21 | }; | |
22 | ||
23 | myServices.chatonsProperties.services.email = { | |
24 | file.datetime = "2022-08-22T01:00:00"; | |
25 | service = { | |
26 | name = "E-mail account"; | |
27 | description = "Compte e-mail avec configuration imap et smtp/pop3"; | |
28 | logo = "https://www.dovecot.org/wp-content/uploads/2021/09/favicon.ico"; | |
29 | website = "https://mail.immae.eu/"; | |
30 | status.level = "OK"; | |
31 | status.description = "OK"; | |
32 | registration."" = ["MEMBER" "CLIENT"]; | |
33 | registration.load = "OPEN"; | |
34 | install.type = "PACKAGE"; | |
35 | }; | |
36 | software = { | |
37 | name = "Dovecot"; | |
38 | website = "https://www.dovecot.org/"; | |
39 | license.url = "https://github.com/dovecot/core/blob/main/COPYING"; | |
40 | license.name = "MIT and LGPLv2.1 Licenses"; | |
41 | version = pkgs.dovecot.version; | |
42 | source.url = "https://github.com/dovecot/core"; | |
43 | modules = ["roundcube" "rainloop"] ++ map (a: a.pname) config.services.dovecot2.modules; | |
44 | }; | |
45 | }; | |
850adcf4 | 46 | systemd.services.dovecot2.serviceConfig.Slice = "mail.slice"; |
1cf1f916 IB |
47 | secrets.keys."dovecot/sql" = { |
48 | user = config.services.dovecot2.user; | |
49 | group = config.services.dovecot2.group; | |
50 | permissions = "0400"; | |
51 | text = '' | |
52 | driver = mysql | |
53 | connect = host=${config.myEnv.mail.dovecot.mysql.socket} dbname=${config.myEnv.mail.dovecot.mysql.database} user=${config.myEnv.mail.dovecot.mysql.user} password=${config.myEnv.mail.dovecot.mysql.password} | |
54 | password_query = SELECT NULL AS password, 'Y' as noauthenticate, destination AS user \ | |
55 | FROM forwardings WHERE \ | |
56 | ((regex = 1 AND '%u' REGEXP CONCAT('^',source,'$')) OR (regex = 0 AND source = '%u')) \ | |
57 | AND active = 1 | |
58 | ''; | |
59 | }; | |
4c4652aa IB |
60 | secrets.keys."dovecot/ldap" = { |
61 | user = config.services.dovecot2.user; | |
62 | group = config.services.dovecot2.group; | |
63 | permissions = "0400"; | |
64 | text = '' | |
65 | hosts = ${config.myEnv.mail.dovecot.ldap.host} | |
66 | tls = yes | |
67 | ||
68 | dn = ${config.myEnv.mail.dovecot.ldap.dn} | |
69 | dnpass = ${config.myEnv.mail.dovecot.ldap.password} | |
70 | ||
71 | auth_bind = yes | |
72 | ||
73 | ldap_version = 3 | |
74 | ||
75 | base = ${config.myEnv.mail.dovecot.ldap.base} | |
76 | scope = subtree | |
77 | ||
78 | pass_filter = ${config.myEnv.mail.dovecot.ldap.filter} | |
79 | pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs} | |
80 | ||
81 | user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs} | |
82 | user_filter = ${config.myEnv.mail.dovecot.ldap.filter} | |
83 | iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs} | |
84 | iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter} | |
85 | ''; | |
86 | }; | |
8415083e IB |
87 | |
88 | users.users.vhost = { | |
89 | group = "vhost"; | |
90 | uid = config.ids.uids.vhost; | |
91 | }; | |
92 | users.groups.vhost.gid = config.ids.gids.vhost; | |
1a64deeb IB |
93 | users.users."${config.services.dovecot2.user}".extraGroups = [ "acme" ]; |
94 | ||
95 | nixpkgs.overlays = [ | |
96 | (self: super: { | |
1cf1f916 | 97 | dovecot = super.dovecot.override { withMySQL = true; openldap = self.openldap_libressl_cyrus; }; |
1a64deeb IB |
98 | }) |
99 | ]; | |
8415083e IB |
100 | |
101 | # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous....... | |
102 | services.dovecot2 = { | |
103 | enable = true; | |
104 | enablePAM = false; | |
105 | enablePop3 = true; | |
106 | enableImap = true; | |
107 | enableLmtp = true; | |
108 | protocols = [ "sieve" ]; | |
109 | modules = [ | |
110 | pkgs.dovecot_pigeonhole | |
1a64deeb | 111 | pkgs.dovecot_fts_xapian |
8415083e IB |
112 | ]; |
113 | mailUser = "vhost"; | |
114 | mailGroup = "vhost"; | |
115 | createMailUser = false; | |
2053ddac IB |
116 | mailboxes = { |
117 | Trash = { auto = "subscribe"; specialUse = "Trash"; }; | |
118 | Junk = { auto = "subscribe"; specialUse = "Junk"; }; | |
119 | Sent = { auto = "subscribe"; specialUse = "Sent"; }; | |
120 | Drafts = { auto = "subscribe"; specialUse = "Drafts"; }; | |
121 | }; | |
8415083e | 122 | mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap"; |
1a64deeb | 123 | sslServerCert = "/etc/dovecot/fullchain.pem"; |
8415083e | 124 | sslServerKey = "/var/lib/acme/mail/key.pem"; |
1a64deeb | 125 | sslCACert = "/etc/dovecot/fullchain.pem"; |
8415083e | 126 | extraConfig = builtins.concatStringsSep "\n" [ |
5153eb54 IB |
127 | # For printer which doesn’t support elliptic curve |
128 | '' | |
1a64deeb | 129 | ssl_alt_cert = </etc/dovecot/fullchain-rsa.pem |
5153eb54 IB |
130 | ssl_alt_key = </var/lib/acme/mail-rsa/key.pem |
131 | '' | |
132 | ||
8415083e IB |
133 | '' |
134 | postmaster_address = postmaster@immae.eu | |
135 | mail_attribute_dict = file:%h/dovecot-attributes | |
136 | imap_idle_notify_interval = 20 mins | |
137 | namespace inbox { | |
138 | type = private | |
139 | separator = / | |
140 | inbox = yes | |
141 | list = yes | |
142 | } | |
143 | '' | |
144 | ||
089f5093 IB |
145 | # ACL |
146 | '' | |
147 | mail_plugins = $mail_plugins acl | |
148 | plugin { | |
149 | acl = vfile:${pkgs.writeText "dovecot-acl" '' | |
150 | Backup/* owner lrp | |
151 | ''} | |
152 | acl_globals_only = yes | |
153 | } | |
154 | '' | |
155 | ||
8415083e IB |
156 | # Full text search |
157 | '' | |
158 | # needs to be bigger than any mailbox size | |
159 | default_vsz_limit = 2GB | |
160 | mail_plugins = $mail_plugins fts fts_xapian | |
161 | plugin { | |
162 | plugin = fts fts_xapian | |
163 | fts = xapian | |
164 | fts_xapian = partial=2 full=20 | |
165 | fts_autoindex = yes | |
166 | fts_autoindex_exclude = \Junk | |
167 | fts_autoindex_exclude2 = \Trash | |
168 | fts_autoindex_exclude3 = Virtual/* | |
169 | } | |
170 | '' | |
171 | ||
172 | # Antispam | |
173 | # https://docs.iredmail.org/dovecot.imapsieve.html | |
174 | '' | |
175 | # imap_sieve plugin added below | |
176 | ||
a929614f | 177 | plugin { |
8415083e IB |
178 | sieve_plugins = sieve_imapsieve sieve_extprograms |
179 | imapsieve_url = sieve://127.0.0.1:4190 | |
180 | ||
304a7dac | 181 | sieve_before = file:${./sieve_scripts}/backup.sieve;bindir=/var/lib/vhost/.sieve_bin |
089f5093 | 182 | |
8415083e IB |
183 | # From elsewhere to Junk folder |
184 | imapsieve_mailbox1_name = Junk | |
185 | imapsieve_mailbox1_causes = COPY APPEND | |
186 | imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin | |
187 | ||
188 | # From Junk folder to elsewhere | |
189 | imapsieve_mailbox2_name = * | |
190 | imapsieve_mailbox2_from = Junk | |
191 | imapsieve_mailbox2_causes = COPY | |
192 | imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin | |
193 | ||
95ca3110 IB |
194 | # From anywhere to NoJunk folder |
195 | imapsieve_mailbox3_name = NoJunk | |
196 | imapsieve_mailbox3_causes = COPY APPEND | |
197 | imapsieve_mailbox3_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin | |
198 | ||
8415083e IB |
199 | sieve_pipe_bin_dir = ${sieve_bin} |
200 | ||
201 | sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment | |
a929614f | 202 | } |
8415083e IB |
203 | '' |
204 | # Services to listen | |
205 | '' | |
206 | service imap-login { | |
207 | inet_listener imap { | |
208 | } | |
209 | inet_listener imaps { | |
210 | } | |
a929614f | 211 | } |
8415083e IB |
212 | service pop3-login { |
213 | inet_listener pop3 { | |
214 | } | |
215 | inet_listener pop3s { | |
216 | } | |
a929614f | 217 | } |
8415083e | 218 | service imap { |
a929614f | 219 | } |
8415083e | 220 | service pop3 { |
a929614f | 221 | } |
8415083e IB |
222 | service auth { |
223 | unix_listener auth-userdb { | |
224 | } | |
225 | unix_listener ${config.services.postfix.config.queue_directory}/private/auth { | |
226 | mode = 0666 | |
227 | } | |
a929614f | 228 | } |
8415083e | 229 | service auth-worker { |
a929614f | 230 | } |
8415083e IB |
231 | service dict { |
232 | unix_listener dict { | |
233 | } | |
a929614f | 234 | } |
8415083e IB |
235 | service stats { |
236 | unix_listener stats-reader { | |
237 | user = vhost | |
238 | group = vhost | |
239 | mode = 0660 | |
240 | } | |
241 | unix_listener stats-writer { | |
242 | user = vhost | |
243 | group = vhost | |
244 | mode = 0660 | |
245 | } | |
a929614f | 246 | } |
8415083e IB |
247 | '' |
248 | ||
249 | # Authentification | |
250 | '' | |
251 | first_valid_uid = ${toString config.ids.uids.vhost} | |
252 | disable_plaintext_auth = yes | |
1cf1f916 IB |
253 | passdb { |
254 | driver = sql | |
255 | args = ${config.secrets.fullPaths."dovecot/sql"} | |
256 | } | |
8415083e IB |
257 | passdb { |
258 | driver = ldap | |
259 | args = ${config.secrets.fullPaths."dovecot/ldap"} | |
260 | } | |
261 | userdb { | |
98f8f4de IB |
262 | driver = ldap |
263 | args = ${config.secrets.fullPaths."dovecot/ldap"} | |
8415083e IB |
264 | } |
265 | '' | |
a929614f | 266 | |
8415083e IB |
267 | # Zlib |
268 | '' | |
269 | mail_plugins = $mail_plugins zlib | |
270 | plugin { | |
271 | zlib_save_level = 6 | |
272 | zlib_save = gz | |
273 | } | |
274 | '' | |
a929614f | 275 | |
8415083e IB |
276 | # Sieve |
277 | '' | |
278 | plugin { | |
279 | sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve | |
280 | } | |
281 | service managesieve-login { | |
282 | } | |
283 | service managesieve { | |
284 | } | |
285 | '' | |
286 | ||
287 | # Virtual mailboxes | |
288 | '' | |
289 | mail_plugins = $mail_plugins virtual | |
290 | namespace Virtual { | |
291 | prefix = Virtual/ | |
292 | location = virtual:~/Virtual | |
293 | } | |
294 | '' | |
a929614f | 295 | |
8415083e IB |
296 | # Protocol specific configuration |
297 | # Needs to come last if there are mail_plugins entries | |
298 | '' | |
299 | protocol imap { | |
089f5093 | 300 | mail_plugins = $mail_plugins imap_sieve imap_acl |
8415083e IB |
301 | } |
302 | protocol lda { | |
303 | mail_plugins = $mail_plugins sieve | |
304 | } | |
305 | '' | |
306 | ]; | |
307 | }; | |
308 | networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ]; | |
309 | system.activationScripts.dovecot = { | |
310 | deps = [ "users" ]; | |
311 | text ='' | |
312 | install -m 0755 -o vhost -g vhost -d /var/lib/vhost | |
313 | ''; | |
314 | }; | |
315 | ||
98f8f4de IB |
316 | services.cron.systemCronJobs = let |
317 | cron_script = pkgs.writeScriptBin "cleanup-imap-folders" '' | |
5dc338f0 | 318 | ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX "Backup/*" NOT FLAGGED BEFORE 8w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB" |
cecfa2f6 IB |
319 | ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Junk SEEN NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB" |
320 | ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Trash NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB" | |
98f8f4de IB |
321 | ''; |
322 | in | |
323 | [ | |
324 | "0 2 * * * root ${cron_script}/bin/cleanup-imap-folders" | |
325 | ]; | |
5153eb54 IB |
326 | security.acme.certs."mail-rsa" = { |
327 | postRun = '' | |
328 | systemctl restart dovecot2.service | |
329 | ''; | |
1a64deeb | 330 | extraDomainNames = [ "imap.immae.eu" "pop3.immae.eu" ]; |
5153eb54 | 331 | }; |
5400b9b6 | 332 | security.acme.certs."mail" = { |
8415083e IB |
333 | postRun = '' |
334 | systemctl restart dovecot2.service | |
335 | ''; | |
1a64deeb | 336 | extraDomainNames = [ "imap.immae.eu" "pop3.immae.eu" ]; |
a929614f | 337 | }; |
1a64deeb IB |
338 | myServices.monitoring.fromMasterActivatedPlugins = [ "imap" "tcp" ]; |
339 | myServices.monitoring.fromMasterObjects.service = [ | |
340 | { | |
341 | service_description = "imap connection works"; | |
342 | host_name = config.hostEnv.fqdn; | |
343 | use = "external-service"; | |
344 | check_command = "check_imap_connection"; | |
345 | ||
346 | servicegroups = "webstatus-remote-services,webstatus-email"; | |
347 | _webstatus_name = "IMAP"; | |
348 | _webstatus_url = "imap.immae.eu"; | |
349 | } | |
350 | ||
351 | { | |
352 | service_description = "imap SSL is up to date"; | |
353 | host_name = config.hostEnv.fqdn; | |
354 | use = "external-service"; | |
355 | check_command = ["check_tcp_ssl" "993"]; | |
356 | ||
357 | servicegroups = "webstatus-ssl"; | |
358 | _webstatus_name = "IMAP"; | |
359 | _webstatus_url = "imap.immae.eu"; | |
360 | } | |
361 | ||
362 | ]; | |
a929614f IB |
363 | }; |
364 | } | |
365 |