modules/private/mail/dovecot.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   sieve_bin = pkgs.runCommand "sieve_bin" {
   4     buildInputs = [ pkgs.makeWrapper ];
   5   } ''
   6     cp -a ${./sieve_bin} $out
   7     chmod -R u+w $out
   8     patchShebangs $out
   9     for i in $out/*; do
  10       wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]}
  11     done
  12     '';
  13 in
  14 {
  15   config = lib.mkIf config.myServices.mail.enable {
  16     services.duplyBackup.profiles.mail.excludeFile = ''
  17       + /var/lib/dhparams
  18       + /var/lib/dovecot
  19       '';
  20     secrets.keys = [
  21       {
  22         dest = "dovecot/ldap";
  23         user = config.services.dovecot2.user;
  24         group = config.services.dovecot2.group;
  25         permissions = "0400";
  26         text = ''
  27           hosts = ${config.myEnv.mail.dovecot.ldap.host}
  28           tls = yes
  29
  30           dn = ${config.myEnv.mail.dovecot.ldap.dn}
  31           dnpass = ${config.myEnv.mail.dovecot.ldap.password}
  32
  33           auth_bind = yes
  34
  35           ldap_version = 3
  36
  37           base = ${config.myEnv.mail.dovecot.ldap.base}
  38           scope = subtree
  39
  40           pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
  41           pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
  42
  43           user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
  44           user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
  45           iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
  46           iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
  47           '';
  48       }
  49     ];
  50
  51     users.users.vhost = {
  52       group = "vhost";
  53       uid = config.ids.uids.vhost;
  54     };
  55     users.groups.vhost.gid = config.ids.gids.vhost;
  56
  57     # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous.......
  58     services.dovecot2 = {
  59       enable = true;
  60       enablePAM = false;
  61       enablePop3 = true;
  62       enableImap = true;
  63       enableLmtp = true;
  64       protocols = [ "sieve" ];
  65       modules = [
  66         pkgs.dovecot_pigeonhole
  67         pkgs.dovecot_fts-xapian
  68       ];
  69       mailUser = "vhost";
  70       mailGroup = "vhost";
  71       createMailUser = false;
  72       mailboxes = [
  73         { name = "Trash";  auto = "subscribe"; specialUse = "Trash"; }
  74         { name = "Junk";   auto = "subscribe"; specialUse = "Junk"; }
  75         { name = "Sent";   auto = "subscribe"; specialUse = "Sent"; }
  76         { name = "Drafts"; auto = "subscribe"; specialUse = "Drafts"; }
  77       ];
  78       mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap";
  79       sslServerCert = "/var/lib/acme/mail/fullchain.pem";
  80       sslServerKey = "/var/lib/acme/mail/key.pem";
  81       sslCACert = "/var/lib/acme/mail/fullchain.pem";
  82       extraConfig = builtins.concatStringsSep "\n" [
  83         # For printer which doesn’t support elliptic curve
  84         ''
  85           ssl_alt_cert = </var/lib/acme/mail-rsa/fullchain.pem
  86           ssl_alt_key = </var/lib/acme/mail-rsa/key.pem
  87         ''
  88
  89         ''
  90           postmaster_address = postmaster@immae.eu
  91           mail_attribute_dict = file:%h/dovecot-attributes
  92           imap_idle_notify_interval = 20 mins
  93           namespace inbox {
  94             type = private
  95             separator = /
  96             inbox = yes
  97             list = yes
  98           }
  99         ''
 100
 101         # ACL
 102         ''
 103           mail_plugins = $mail_plugins acl
 104           plugin {
 105             acl = vfile:${pkgs.writeText "dovecot-acl" ''
 106               Backup/* owner lrp
 107               ''}
 108             acl_globals_only = yes
 109           }
 110         ''
 111
 112         # Full text search
 113         ''
 114           # needs to be bigger than any mailbox size
 115           default_vsz_limit = 2GB
 116           mail_plugins = $mail_plugins fts fts_xapian
 117           plugin {
 118             plugin = fts fts_xapian
 119             fts = xapian
 120             fts_xapian = partial=2 full=20
 121             fts_autoindex = yes
 122             fts_autoindex_exclude = \Junk
 123             fts_autoindex_exclude2 = \Trash
 124             fts_autoindex_exclude3 = Virtual/*
 125           }
 126         ''
 127
 128         # Antispam
 129         # https://docs.iredmail.org/dovecot.imapsieve.html
 130         ''
 131         # imap_sieve plugin added below
 132
 133         plugin {
 134             sieve_plugins = sieve_imapsieve sieve_extprograms
 135             imapsieve_url = sieve://127.0.0.1:4190
 136
 137             sieve_before = file:${./sieve_scripts}/backup.sieve;bindir=/var/lib/vhost/.sieve_bin
 138
 139             # From elsewhere to Junk folder
 140             imapsieve_mailbox1_name = Junk
 141             imapsieve_mailbox1_causes = COPY APPEND
 142             imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 143
 144             # From Junk folder to elsewhere
 145             imapsieve_mailbox2_name = *
 146             imapsieve_mailbox2_from = Junk
 147             imapsieve_mailbox2_causes = COPY
 148             imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 149
 150             # From anywhere to NoJunk folder
 151             imapsieve_mailbox3_name = NoJunk
 152             imapsieve_mailbox3_causes = COPY APPEND
 153             imapsieve_mailbox3_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 154
 155             sieve_pipe_bin_dir = ${sieve_bin}
 156
 157             sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
 158         }
 159         ''
 160         # Services to listen
 161         ''
 162         service imap-login {
 163           inet_listener imap {
 164           }
 165           inet_listener imaps {
 166           }
 167         }
 168         service pop3-login {
 169           inet_listener pop3 {
 170           }
 171           inet_listener pop3s {
 172           }
 173         }
 174         service imap {
 175         }
 176         service pop3 {
 177         }
 178         service auth {
 179           unix_listener auth-userdb {
 180           }
 181           unix_listener ${config.services.postfix.config.queue_directory}/private/auth {
 182             mode = 0666
 183           }
 184         }
 185         service auth-worker {
 186         }
 187         service dict {
 188           unix_listener dict {
 189           }
 190         }
 191         service stats {
 192           unix_listener stats-reader {
 193             user = vhost
 194             group = vhost
 195             mode = 0660
 196           }
 197           unix_listener stats-writer {
 198             user = vhost
 199             group = vhost
 200             mode = 0660
 201           }
 202         }
 203         ''
 204
 205         # Authentification
 206         ''
 207         first_valid_uid = ${toString config.ids.uids.vhost}
 208         disable_plaintext_auth = yes
 209         passdb {
 210           driver = ldap
 211           args = ${config.secrets.fullPaths."dovecot/ldap"}
 212         }
 213         userdb {
 214           driver = ldap
 215           args = ${config.secrets.fullPaths."dovecot/ldap"}
 216         }
 217         ''
 218
 219         # Zlib
 220         ''
 221         mail_plugins = $mail_plugins zlib
 222         plugin {
 223           zlib_save_level = 6
 224           zlib_save = gz
 225         }
 226         ''
 227
 228         # Sieve
 229         ''
 230         plugin {
 231           sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve
 232         }
 233         service managesieve-login {
 234         }
 235         service managesieve {
 236         }
 237         ''
 238
 239         # Virtual mailboxes
 240         ''
 241         mail_plugins = $mail_plugins virtual
 242         namespace Virtual {
 243           prefix = Virtual/
 244           location = virtual:~/Virtual
 245         }
 246         ''
 247
 248         # Protocol specific configuration
 249         # Needs to come last if there are mail_plugins entries
 250         ''
 251         protocol imap {
 252           mail_plugins = $mail_plugins imap_sieve imap_acl
 253         }
 254         protocol lda {
 255           mail_plugins = $mail_plugins sieve
 256         }
 257         ''
 258       ];
 259     };
 260     networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ];
 261     system.activationScripts.dovecot = {
 262       deps = [ "users" ];
 263       text  =''
 264         install -m 0755 -o vhost -g vhost -d /var/lib/vhost
 265         '';
 266     };
 267
 268     services.cron.systemCronJobs = let
 269       cron_script = pkgs.writeScriptBin "cleanup-imap-folders" ''
 270         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX "Backup/*" NOT FLAGGED BEFORE 8w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 271         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Junk SEEN NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 272         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Trash NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 273         '';
 274       in
 275       [
 276         "0 2 * * * root ${cron_script}/bin/cleanup-imap-folders"
 277       ];
 278     security.acme.certs."mail-rsa" = {
 279       postRun = ''
 280         systemctl restart dovecot2.service
 281       '';
 282       extraDomains = {
 283         "imap.immae.eu" = null;
 284         "pop3.immae.eu" = null;
 285       };
 286     };
 287     security.acme.certs."mail" = {
 288       postRun = ''
 289         systemctl restart dovecot2.service
 290       '';
 291       extraDomains = {
 292         "imap.immae.eu" = null;
 293         "pop3.immae.eu" = null;
 294       };
 295     };
 296   };
 297 }
 298