modules/private/mail/dovecot.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   sieve_bin = pkgs.runCommand "sieve_bin" {
   4     buildInputs = [ pkgs.makeWrapper ];
   5   } ''
   6     cp -a ${./sieve_bin} $out
   7     chmod -R u+w $out
   8     patchShebangs $out
   9     for i in $out/*; do
  10       wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]}
  11     done
  12     '';
  13 in
  14 {
  15   config = lib.mkIf config.myServices.mail.enable {
  16     myServices.chatonsProperties.services.email = {
  17       file.datetime = "2022-08-22T01:00:00";
  18       service = {
  19         name = "E-mail account";
  20         description = "Compte e-mail avec configuration imap et smtp/pop3";
  21         logo = "https://www.dovecot.org/wp-content/uploads/2021/09/favicon.ico";
  22         website = "https://mail.immae.eu/";
  23         status.level = "OK";
  24         status.description = "OK";
  25         registration."" = ["MEMBER" "CLIENT"];
  26         registration.load = "OPEN";
  27         install.type = "PACKAGE";
  28       };
  29       software = {
  30         name = "Dovecot";
  31         website = "https://www.dovecot.org/";
  32         license.url = "https://github.com/dovecot/core/blob/main/COPYING";
  33         license.name = "MIT and LGPLv2.1 Licenses";
  34         version = pkgs.dovecot.version;
  35         source.url = "https://github.com/dovecot/core";
  36         modules = ["roundcube" "rainloop"] ++ map (a: a.pname) config.services.dovecot2.modules;
  37       };
  38     };
  39     systemd.services.dovecot2.serviceConfig.Slice = "mail.slice";
  40     secrets.keys."dovecot/ldap" = {
  41       user = config.services.dovecot2.user;
  42       group = config.services.dovecot2.group;
  43       permissions = "0400";
  44       text = ''
  45         hosts = ${config.myEnv.mail.dovecot.ldap.host}
  46         tls = yes
  47
  48         dn = ${config.myEnv.mail.dovecot.ldap.dn}
  49         dnpass = ${config.myEnv.mail.dovecot.ldap.password}
  50
  51         auth_bind = yes
  52
  53         ldap_version = 3
  54
  55         base = ${config.myEnv.mail.dovecot.ldap.base}
  56         scope = subtree
  57
  58         pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
  59         pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
  60
  61         user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
  62         user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
  63         iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
  64         iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
  65         '';
  66     };
  67
  68     users.users.vhost = {
  69       group = "vhost";
  70       uid = config.ids.uids.vhost;
  71     };
  72     users.groups.vhost.gid = config.ids.gids.vhost;
  73     users.users."${config.services.dovecot2.user}".extraGroups = [ "acme" ];
  74
  75     # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous.......
  76     services.dovecot2 = {
  77       enable = true;
  78       enablePAM = false;
  79       enablePop3 = true;
  80       enableImap = true;
  81       enableLmtp = true;
  82       protocols = [ "sieve" ];
  83       modules = [
  84         pkgs.dovecot_pigeonhole
  85         pkgs.dovecot_fts_xapian
  86       ];
  87       mailUser = "vhost";
  88       mailGroup = "vhost";
  89       createMailUser = false;
  90       mailboxes = {
  91         Trash  = { auto = "subscribe"; specialUse = "Trash"; };
  92         Junk   = { auto = "subscribe"; specialUse = "Junk"; };
  93         Sent   = { auto = "subscribe"; specialUse = "Sent"; };
  94         Drafts = { auto = "subscribe"; specialUse = "Drafts"; };
  95       };
  96       mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap";
  97       sslServerCert = "/etc/dovecot/fullchain.pem";
  98       sslServerKey = "/var/lib/acme/mail/key.pem";
  99       sslCACert = "/etc/dovecot/fullchain.pem";
 100       extraConfig = builtins.concatStringsSep "\n" [
 101         # For printer which doesn’t support elliptic curve
 102         ''
 103           ssl_alt_cert = </etc/dovecot/fullchain-rsa.pem
 104           ssl_alt_key = </var/lib/acme/mail-rsa/key.pem
 105         ''
 106
 107         ''
 108           postmaster_address = postmaster@immae.eu
 109           mail_attribute_dict = file:%h/dovecot-attributes
 110           imap_idle_notify_interval = 20 mins
 111           namespace inbox {
 112             type = private
 113             separator = /
 114             inbox = yes
 115             list = yes
 116           }
 117         ''
 118
 119         # ACL
 120         ''
 121           mail_plugins = $mail_plugins acl
 122           plugin {
 123             acl = vfile:${pkgs.writeText "dovecot-acl" ''
 124               Backup/* owner lrp
 125               ''}
 126             acl_globals_only = yes
 127           }
 128         ''
 129
 130         # Full text search
 131         ''
 132           # needs to be bigger than any mailbox size
 133           default_vsz_limit = 2GB
 134           mail_plugins = $mail_plugins fts fts_xapian
 135           plugin {
 136             plugin = fts fts_xapian
 137             fts = xapian
 138             fts_xapian = partial=2 full=20
 139             fts_autoindex = yes
 140             fts_autoindex_exclude = \Junk
 141             fts_autoindex_exclude2 = \Trash
 142             fts_autoindex_exclude3 = Virtual/*
 143           }
 144         ''
 145
 146         # Antispam
 147         # https://docs.iredmail.org/dovecot.imapsieve.html
 148         ''
 149         # imap_sieve plugin added below
 150
 151         plugin {
 152             sieve_plugins = sieve_imapsieve sieve_extprograms
 153             imapsieve_url = sieve://127.0.0.1:4190
 154
 155             sieve_before = file:${./sieve_scripts}/backup.sieve;bindir=/var/lib/vhost/.sieve_bin
 156
 157             # From elsewhere to Junk folder
 158             imapsieve_mailbox1_name = Junk
 159             imapsieve_mailbox1_causes = COPY APPEND
 160             imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 161
 162             # From Junk folder to elsewhere
 163             imapsieve_mailbox2_name = *
 164             imapsieve_mailbox2_from = Junk
 165             imapsieve_mailbox2_causes = COPY
 166             imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 167
 168             # From anywhere to NoJunk folder
 169             imapsieve_mailbox3_name = NoJunk
 170             imapsieve_mailbox3_causes = COPY APPEND
 171             imapsieve_mailbox3_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 172
 173             sieve_pipe_bin_dir = ${sieve_bin}
 174
 175             sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
 176         }
 177         ''
 178         # Services to listen
 179         ''
 180         service imap-login {
 181           inet_listener imap {
 182           }
 183           inet_listener imaps {
 184           }
 185         }
 186         service pop3-login {
 187           inet_listener pop3 {
 188           }
 189           inet_listener pop3s {
 190           }
 191         }
 192         service imap {
 193         }
 194         service pop3 {
 195         }
 196         service auth {
 197           unix_listener auth-userdb {
 198           }
 199           unix_listener ${config.services.postfix.config.queue_directory}/private/auth {
 200             mode = 0666
 201           }
 202         }
 203         service auth-worker {
 204         }
 205         service dict {
 206           unix_listener dict {
 207           }
 208         }
 209         service stats {
 210           unix_listener stats-reader {
 211             user = vhost
 212             group = vhost
 213             mode = 0660
 214           }
 215           unix_listener stats-writer {
 216             user = vhost
 217             group = vhost
 218             mode = 0660
 219           }
 220         }
 221         ''
 222
 223         # Authentification
 224         ''
 225         first_valid_uid = ${toString config.ids.uids.vhost}
 226         disable_plaintext_auth = yes
 227         passdb {
 228           driver = ldap
 229           args = ${config.secrets.fullPaths."dovecot/ldap"}
 230         }
 231         userdb {
 232           driver = ldap
 233           args = ${config.secrets.fullPaths."dovecot/ldap"}
 234         }
 235         ''
 236
 237         # Zlib
 238         ''
 239         mail_plugins = $mail_plugins zlib
 240         plugin {
 241           zlib_save_level = 6
 242           zlib_save = gz
 243         }
 244         ''
 245
 246         # Sieve
 247         ''
 248         plugin {
 249           sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve
 250         }
 251         service managesieve-login {
 252         }
 253         service managesieve {
 254         }
 255         ''
 256
 257         # Virtual mailboxes
 258         ''
 259         mail_plugins = $mail_plugins virtual
 260         namespace Virtual {
 261           prefix = Virtual/
 262           location = virtual:~/Virtual
 263         }
 264         ''
 265
 266         # Protocol specific configuration
 267         # Needs to come last if there are mail_plugins entries
 268         ''
 269         protocol imap {
 270           mail_plugins = $mail_plugins imap_sieve imap_acl
 271         }
 272         protocol lda {
 273           mail_plugins = $mail_plugins sieve
 274         }
 275         ''
 276       ];
 277     };
 278     networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ];
 279     system.activationScripts.dovecot = {
 280       deps = [ "users" ];
 281       text  =''
 282         install -m 0755 -o vhost -g vhost -d /var/lib/vhost
 283         '';
 284     };
 285
 286     services.cron.systemCronJobs = let
 287       cron_script = pkgs.writeScriptBin "cleanup-imap-folders" ''
 288         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX "Backup/*" NOT FLAGGED BEFORE 8w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 289         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Junk SEEN NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 290         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Trash NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 291         '';
 292       in
 293       [
 294         "0 2 * * * root ${cron_script}/bin/cleanup-imap-folders"
 295       ];
 296     security.acme.certs."mail-rsa" = {
 297       postRun = ''
 298         systemctl restart dovecot2.service
 299       '';
 300       extraDomainNames = [ "imap.immae.eu" "pop3.immae.eu" ];
 301     };
 302     security.acme.certs."mail" = {
 303       postRun = ''
 304         systemctl restart dovecot2.service
 305       '';
 306       extraDomainNames = [ "imap.immae.eu" "pop3.immae.eu" ];
 307     };
 308   };
 309 }
 310