modules/private/mail/dovecot.nix

   1 { lib, pkgs, config, myconfig,  ... }:
   2 let
   3   sieve_bin = pkgs.runCommand "sieve_bin" {
   4     buildInputs = [ pkgs.makeWrapper ];
   5   } ''
   6     cp -a ${./sieve_bin} $out
   7     chmod -R u+w $out
   8     patchShebangs $out
   9     for i in $out/*; do
  10       wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]}
  11     done
  12     '';
  13 in
  14 {
  15   config.services.backup.profiles.mail.excludeFile = ''
  16     + /var/lib/dhparams
  17     + /var/lib/dovecot
  18     '';
  19   config.secrets.keys = [
  20     {
  21       dest = "dovecot/ldap";
  22       user = config.services.dovecot2.user;
  23       group = config.services.dovecot2.group;
  24       permissions = "0400";
  25       text = ''
  26         hosts = ${myconfig.env.mail.dovecot.ldap.host}
  27         tls = yes
  28
  29         dn = ${myconfig.env.mail.dovecot.ldap.dn}
  30         dnpass = ${myconfig.env.mail.dovecot.ldap.password}
  31
  32         auth_bind = yes
  33
  34         ldap_version = 3
  35
  36         base = ${myconfig.env.mail.dovecot.ldap.base}
  37         scope = subtree
  38
  39         user_filter = ${myconfig.env.mail.dovecot.ldap.filter}
  40         pass_filter = ${myconfig.env.mail.dovecot.ldap.filter}
  41
  42         user_attrs = ${myconfig.env.mail.dovecot.ldap.user_attrs}
  43         pass_attrs = ${myconfig.env.mail.dovecot.ldap.pass_attrs}
  44         '';
  45     }
  46   ];
  47
  48   config.users.users.vhost = {
  49     group = "vhost";
  50     uid = config.ids.uids.vhost;
  51   };
  52   config.users.groups.vhost.gid = config.ids.gids.vhost;
  53
  54   # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous.......
  55   config.services.dovecot2 = {
  56     enable = true;
  57     enablePAM = false;
  58     enablePop3 = true;
  59     enableImap = true;
  60     enableLmtp = true;
  61     protocols = [ "sieve" ];
  62     modules = [
  63       pkgs.dovecot_pigeonhole
  64       pkgs.dovecot_fts-xapian
  65     ];
  66     mailUser = "vhost";
  67     mailGroup = "vhost";
  68     createMailUser = false;
  69     mailboxes = [
  70       { name = "Trash";  auto = "subscribe"; specialUse = "Trash"; }
  71       { name = "Junk";   auto = "subscribe"; specialUse = "Junk"; }
  72       { name = "Sent";   auto = "subscribe"; specialUse = "Sent"; }
  73       { name = "Drafts"; auto = "subscribe"; specialUse = "Drafts"; }
  74     ];
  75     mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap";
  76     sslServerCert = "/var/lib/acme/mail/fullchain.pem";
  77     sslServerKey = "/var/lib/acme/mail/key.pem";
  78     sslCACert = "/var/lib/acme/mail/fullchain.pem";
  79     extraConfig = builtins.concatStringsSep "\n" [
  80       ''
  81         postmaster_address = postmaster@immae.eu
  82         mail_attribute_dict = file:%h/dovecot-attributes
  83         imap_idle_notify_interval = 20 mins
  84         namespace inbox {
  85           type = private
  86           separator = /
  87           inbox = yes
  88           list = yes
  89         }
  90       ''
  91
  92       # Full text search
  93       ''
  94         # needs to be bigger than any mailbox size
  95         default_vsz_limit = 2GB
  96         mail_plugins = $mail_plugins fts fts_xapian
  97         plugin {
  98           plugin = fts fts_xapian
  99           fts = xapian
 100           fts_xapian = partial=2 full=20
 101           fts_autoindex = yes
 102           fts_autoindex_exclude = \Junk
 103           fts_autoindex_exclude2 = \Trash
 104           fts_autoindex_exclude3 = Virtual/*
 105         }
 106       ''
 107
 108       # Antispam
 109       # https://docs.iredmail.org/dovecot.imapsieve.html
 110       ''
 111       # imap_sieve plugin added below
 112
 113       plugin {
 114           sieve_plugins = sieve_imapsieve sieve_extprograms
 115           imapsieve_url = sieve://127.0.0.1:4190
 116
 117           # From elsewhere to Junk folder
 118           imapsieve_mailbox1_name = Junk
 119           imapsieve_mailbox1_causes = COPY APPEND
 120           imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 121
 122           # From Junk folder to elsewhere
 123           imapsieve_mailbox2_name = *
 124           imapsieve_mailbox2_from = Junk
 125           imapsieve_mailbox2_causes = COPY
 126           imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 127
 128           sieve_pipe_bin_dir = ${sieve_bin}
 129
 130           sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
 131       }
 132       ''
 133       # Services to listen
 134       ''
 135       service imap-login {
 136         inet_listener imap {
 137         }
 138         inet_listener imaps {
 139         }
 140       }
 141       service pop3-login {
 142         inet_listener pop3 {
 143         }
 144         inet_listener pop3s {
 145         }
 146       }
 147       service imap {
 148       }
 149       service pop3 {
 150       }
 151       service auth {
 152         unix_listener auth-userdb {
 153         }
 154         unix_listener ${config.services.postfix.config.queue_directory}/private/auth {
 155           mode = 0666
 156         }
 157       }
 158       service auth-worker {
 159       }
 160       service dict {
 161         unix_listener dict {
 162         }
 163       }
 164       service stats {
 165         unix_listener stats-reader {
 166           user = vhost
 167           group = vhost
 168           mode = 0660
 169         }
 170         unix_listener stats-writer {
 171           user = vhost
 172           group = vhost
 173           mode = 0660
 174         }
 175       }
 176       ''
 177
 178       # Authentification
 179       ''
 180       first_valid_uid = ${toString config.ids.uids.vhost}
 181       disable_plaintext_auth = yes
 182       passdb {
 183         driver = ldap
 184         args = ${config.secrets.fullPaths."dovecot/ldap"}
 185       }
 186       userdb {
 187         driver = static
 188         args = user=%u uid=vhost gid=vhost home=/var/lib/vhost/%d/%n/ mail=mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap
 189       }
 190       ''
 191
 192       # Zlib
 193       ''
 194       mail_plugins = $mail_plugins zlib
 195       plugin {
 196         zlib_save_level = 6
 197         zlib_save = gz
 198       }
 199       ''
 200
 201       # Sieve
 202       ''
 203       plugin {
 204         sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve
 205       }
 206       service managesieve-login {
 207       }
 208       service managesieve {
 209       }
 210       ''
 211
 212       # Virtual mailboxes
 213       ''
 214       mail_plugins = $mail_plugins virtual
 215       namespace Virtual {
 216         prefix = Virtual/
 217         location = virtual:~/Virtual
 218       }
 219       ''
 220
 221       # Protocol specific configuration
 222       # Needs to come last if there are mail_plugins entries
 223       ''
 224       protocol imap {
 225         mail_plugins = $mail_plugins imap_sieve
 226       }
 227       protocol lda {
 228         mail_plugins = $mail_plugins sieve
 229       }
 230       ''
 231     ];
 232   };
 233   config.networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ];
 234   config.system.activationScripts.dovecot = {
 235     deps = [ "users" ];
 236     text  =''
 237       install -m 0755 -o vhost -g vhost -d /var/lib/vhost
 238       '';
 239   };
 240
 241   config.security.acme.certs."mail" = {
 242     postRun = ''
 243       systemctl restart dovecot2.service
 244     '';
 245     extraDomains = {
 246       "imap.immae.eu" = null;
 247       "pop3.immae.eu" = null;
 248     };
 249   };
 250 }
 251