]>
Commit | Line | Data |
---|---|---|
1 | { lib, pkgs, config, myconfig, ... }: | |
2 | let | |
3 | sieve_bin = pkgs.runCommand "sieve_bin" { | |
4 | buildInputs = [ pkgs.makeWrapper ]; | |
5 | } '' | |
6 | cp -a ${./sieve_bin} $out | |
7 | chmod -R u+w $out | |
8 | patchShebangs $out | |
9 | for i in $out/*; do | |
10 | wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]} | |
11 | done | |
12 | ''; | |
13 | in | |
14 | { | |
15 | config.services.backup.profiles.mail.excludeFile = '' | |
16 | + /var/lib/dhparams | |
17 | + /var/lib/dovecot | |
18 | ''; | |
19 | config.secrets.keys = [ | |
20 | { | |
21 | dest = "dovecot/ldap"; | |
22 | user = config.services.dovecot2.user; | |
23 | group = config.services.dovecot2.group; | |
24 | permissions = "0400"; | |
25 | text = '' | |
26 | hosts = ${myconfig.env.mail.dovecot.ldap.host} | |
27 | tls = yes | |
28 | ||
29 | dn = ${myconfig.env.mail.dovecot.ldap.dn} | |
30 | dnpass = ${myconfig.env.mail.dovecot.ldap.password} | |
31 | ||
32 | auth_bind = yes | |
33 | ||
34 | ldap_version = 3 | |
35 | ||
36 | base = ${myconfig.env.mail.dovecot.ldap.base} | |
37 | scope = subtree | |
38 | ||
39 | user_filter = ${myconfig.env.mail.dovecot.ldap.filter} | |
40 | pass_filter = ${myconfig.env.mail.dovecot.ldap.filter} | |
41 | ||
42 | user_attrs = ${myconfig.env.mail.dovecot.ldap.user_attrs} | |
43 | pass_attrs = ${myconfig.env.mail.dovecot.ldap.pass_attrs} | |
44 | ''; | |
45 | } | |
46 | ]; | |
47 | ||
48 | config.users.users.vhost = { | |
49 | group = "vhost"; | |
50 | uid = config.ids.uids.vhost; | |
51 | }; | |
52 | config.users.groups.vhost.gid = config.ids.gids.vhost; | |
53 | ||
54 | # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous....... | |
55 | config.services.dovecot2 = { | |
56 | enable = true; | |
57 | enablePAM = false; | |
58 | enablePop3 = true; | |
59 | enableImap = true; | |
60 | enableLmtp = true; | |
61 | protocols = [ "sieve" ]; | |
62 | modules = [ | |
63 | pkgs.dovecot_pigeonhole | |
64 | pkgs.dovecot_fts-xapian | |
65 | ]; | |
66 | mailUser = "vhost"; | |
67 | mailGroup = "vhost"; | |
68 | createMailUser = false; | |
69 | mailboxes = [ | |
70 | { name = "Trash"; auto = "subscribe"; specialUse = "Trash"; } | |
71 | { name = "Junk"; auto = "subscribe"; specialUse = "Junk"; } | |
72 | { name = "Sent"; auto = "subscribe"; specialUse = "Sent"; } | |
73 | { name = "Drafts"; auto = "subscribe"; specialUse = "Drafts"; } | |
74 | ]; | |
75 | mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap"; | |
76 | sslServerCert = "/var/lib/acme/mail/fullchain.pem"; | |
77 | sslServerKey = "/var/lib/acme/mail/key.pem"; | |
78 | sslCACert = "/var/lib/acme/mail/fullchain.pem"; | |
79 | extraConfig = builtins.concatStringsSep "\n" [ | |
80 | '' | |
81 | postmaster_address = postmaster@immae.eu | |
82 | mail_attribute_dict = file:%h/dovecot-attributes | |
83 | imap_idle_notify_interval = 20 mins | |
84 | namespace inbox { | |
85 | type = private | |
86 | separator = / | |
87 | inbox = yes | |
88 | list = yes | |
89 | } | |
90 | '' | |
91 | ||
92 | # Full text search | |
93 | '' | |
94 | # needs to be bigger than any mailbox size | |
95 | default_vsz_limit = 2GB | |
96 | mail_plugins = $mail_plugins fts fts_xapian | |
97 | plugin { | |
98 | plugin = fts fts_xapian | |
99 | fts = xapian | |
100 | fts_xapian = partial=2 full=20 | |
101 | fts_autoindex = yes | |
102 | fts_autoindex_exclude = \Junk | |
103 | fts_autoindex_exclude2 = \Trash | |
104 | fts_autoindex_exclude3 = Virtual/* | |
105 | } | |
106 | '' | |
107 | ||
108 | # Antispam | |
109 | # https://docs.iredmail.org/dovecot.imapsieve.html | |
110 | '' | |
111 | # imap_sieve plugin added below | |
112 | ||
113 | plugin { | |
114 | sieve_plugins = sieve_imapsieve sieve_extprograms | |
115 | imapsieve_url = sieve://127.0.0.1:4190 | |
116 | ||
117 | # From elsewhere to Junk folder | |
118 | imapsieve_mailbox1_name = Junk | |
119 | imapsieve_mailbox1_causes = COPY APPEND | |
120 | imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin | |
121 | ||
122 | # From Junk folder to elsewhere | |
123 | imapsieve_mailbox2_name = * | |
124 | imapsieve_mailbox2_from = Junk | |
125 | imapsieve_mailbox2_causes = COPY | |
126 | imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin | |
127 | ||
128 | sieve_pipe_bin_dir = ${sieve_bin} | |
129 | ||
130 | sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment | |
131 | } | |
132 | '' | |
133 | # Services to listen | |
134 | '' | |
135 | service imap-login { | |
136 | inet_listener imap { | |
137 | } | |
138 | inet_listener imaps { | |
139 | } | |
140 | } | |
141 | service pop3-login { | |
142 | inet_listener pop3 { | |
143 | } | |
144 | inet_listener pop3s { | |
145 | } | |
146 | } | |
147 | service imap { | |
148 | } | |
149 | service pop3 { | |
150 | } | |
151 | service auth { | |
152 | unix_listener auth-userdb { | |
153 | } | |
154 | unix_listener ${config.services.postfix.config.queue_directory}/private/auth { | |
155 | mode = 0666 | |
156 | } | |
157 | } | |
158 | service auth-worker { | |
159 | } | |
160 | service dict { | |
161 | unix_listener dict { | |
162 | } | |
163 | } | |
164 | service stats { | |
165 | unix_listener stats-reader { | |
166 | user = vhost | |
167 | group = vhost | |
168 | mode = 0660 | |
169 | } | |
170 | unix_listener stats-writer { | |
171 | user = vhost | |
172 | group = vhost | |
173 | mode = 0660 | |
174 | } | |
175 | } | |
176 | '' | |
177 | ||
178 | # Authentification | |
179 | '' | |
180 | first_valid_uid = ${toString config.ids.uids.vhost} | |
181 | disable_plaintext_auth = yes | |
182 | passdb { | |
183 | driver = ldap | |
184 | args = ${config.secrets.fullPaths."dovecot/ldap"} | |
185 | } | |
186 | userdb { | |
187 | driver = static | |
188 | args = user=%u uid=vhost gid=vhost home=/var/lib/vhost/%d/%n/ mail=mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap | |
189 | } | |
190 | '' | |
191 | ||
192 | # Zlib | |
193 | '' | |
194 | mail_plugins = $mail_plugins zlib | |
195 | plugin { | |
196 | zlib_save_level = 6 | |
197 | zlib_save = gz | |
198 | } | |
199 | '' | |
200 | ||
201 | # Sieve | |
202 | '' | |
203 | plugin { | |
204 | sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve | |
205 | } | |
206 | service managesieve-login { | |
207 | } | |
208 | service managesieve { | |
209 | } | |
210 | '' | |
211 | ||
212 | # Virtual mailboxes | |
213 | '' | |
214 | mail_plugins = $mail_plugins virtual | |
215 | namespace Virtual { | |
216 | prefix = Virtual/ | |
217 | location = virtual:~/Virtual | |
218 | } | |
219 | '' | |
220 | ||
221 | # Protocol specific configuration | |
222 | # Needs to come last if there are mail_plugins entries | |
223 | '' | |
224 | protocol imap { | |
225 | mail_plugins = $mail_plugins imap_sieve | |
226 | } | |
227 | protocol lda { | |
228 | mail_plugins = $mail_plugins sieve | |
229 | } | |
230 | '' | |
231 | ]; | |
232 | }; | |
233 | config.networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ]; | |
234 | config.system.activationScripts.dovecot = { | |
235 | deps = [ "users" ]; | |
236 | text ='' | |
237 | install -m 0755 -o vhost -g vhost -d /var/lib/vhost | |
238 | ''; | |
239 | }; | |
240 | ||
241 | config.security.acme.certs."mail" = { | |
242 | postRun = '' | |
243 | systemctl restart dovecot2.service | |
244 | ''; | |
245 | extraDomains = { | |
246 | "imap.immae.eu" = null; | |
247 | "pop3.immae.eu" = null; | |
248 | }; | |
249 | }; | |
250 | } | |
251 |