modules/private/mail/dovecot.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   sieve_bin = pkgs.runCommand "sieve_bin" {
   4     buildInputs = [ pkgs.makeWrapper ];
   5   } ''
   6     cp -a ${./sieve_bin} $out
   7     chmod -R u+w $out
   8     patchShebangs $out
   9     for i in $out/*; do
  10       wrapProgram "$i" --prefix PATH : ${lib.makeBinPath [ pkgs.coreutils ]}
  11     done
  12     '';
  13 in
  14 {
  15   config = lib.mkIf config.myServices.mail.enable {
  16     systemd.services.dovecot2.serviceConfig.Slice = "mail.slice";
  17     services.duplyBackup.profiles.mail.excludeFile = ''
  18       + /var/lib/dhparams
  19       + /var/lib/dovecot
  20       '';
  21     secrets.keys = [
  22       {
  23         dest = "dovecot/ldap";
  24         user = config.services.dovecot2.user;
  25         group = config.services.dovecot2.group;
  26         permissions = "0400";
  27         text = ''
  28           hosts = ${config.myEnv.mail.dovecot.ldap.host}
  29           tls = yes
  30
  31           dn = ${config.myEnv.mail.dovecot.ldap.dn}
  32           dnpass = ${config.myEnv.mail.dovecot.ldap.password}
  33
  34           auth_bind = yes
  35
  36           ldap_version = 3
  37
  38           base = ${config.myEnv.mail.dovecot.ldap.base}
  39           scope = subtree
  40
  41           pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
  42           pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
  43
  44           user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
  45           user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
  46           iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
  47           iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
  48           '';
  49       }
  50     ];
  51
  52     users.users.vhost = {
  53       group = "vhost";
  54       uid = config.ids.uids.vhost;
  55     };
  56     users.groups.vhost.gid = config.ids.gids.vhost;
  57
  58     # https://blog.zeninc.net/index.php?post/2018/04/01/Un-annuaire-pour-les-gouverner-tous.......
  59     services.dovecot2 = {
  60       enable = true;
  61       enablePAM = false;
  62       enablePop3 = true;
  63       enableImap = true;
  64       enableLmtp = true;
  65       protocols = [ "sieve" ];
  66       modules = [
  67         pkgs.dovecot_pigeonhole
  68         pkgs.dovecot_fts-xapian
  69       ];
  70       mailUser = "vhost";
  71       mailGroup = "vhost";
  72       createMailUser = false;
  73       mailboxes = {
  74         Trash  = { auto = "subscribe"; specialUse = "Trash"; };
  75         Junk   = { auto = "subscribe"; specialUse = "Junk"; };
  76         Sent   = { auto = "subscribe"; specialUse = "Sent"; };
  77         Drafts = { auto = "subscribe"; specialUse = "Drafts"; };
  78       };
  79       mailLocation = "mbox:~/Mail:INBOX=~/Mail/Inbox:INDEX=~/.imap";
  80       sslServerCert = "/var/lib/acme/mail/fullchain.pem";
  81       sslServerKey = "/var/lib/acme/mail/key.pem";
  82       sslCACert = "/var/lib/acme/mail/fullchain.pem";
  83       extraConfig = builtins.concatStringsSep "\n" [
  84         # For printer which doesn’t support elliptic curve
  85         ''
  86           ssl_alt_cert = </var/lib/acme/mail-rsa/fullchain.pem
  87           ssl_alt_key = </var/lib/acme/mail-rsa/key.pem
  88         ''
  89
  90         ''
  91           postmaster_address = postmaster@immae.eu
  92           mail_attribute_dict = file:%h/dovecot-attributes
  93           imap_idle_notify_interval = 20 mins
  94           namespace inbox {
  95             type = private
  96             separator = /
  97             inbox = yes
  98             list = yes
  99           }
 100         ''
 101
 102         # ACL
 103         ''
 104           mail_plugins = $mail_plugins acl
 105           plugin {
 106             acl = vfile:${pkgs.writeText "dovecot-acl" ''
 107               Backup/* owner lrp
 108               ''}
 109             acl_globals_only = yes
 110           }
 111         ''
 112
 113         # Full text search
 114         ''
 115           # needs to be bigger than any mailbox size
 116           default_vsz_limit = 2GB
 117           mail_plugins = $mail_plugins fts fts_xapian
 118           plugin {
 119             plugin = fts fts_xapian
 120             fts = xapian
 121             fts_xapian = partial=2 full=20
 122             fts_autoindex = yes
 123             fts_autoindex_exclude = \Junk
 124             fts_autoindex_exclude2 = \Trash
 125             fts_autoindex_exclude3 = Virtual/*
 126           }
 127         ''
 128
 129         # Antispam
 130         # https://docs.iredmail.org/dovecot.imapsieve.html
 131         ''
 132         # imap_sieve plugin added below
 133
 134         plugin {
 135             sieve_plugins = sieve_imapsieve sieve_extprograms
 136             imapsieve_url = sieve://127.0.0.1:4190
 137
 138             sieve_before = file:${./sieve_scripts}/backup.sieve;bindir=/var/lib/vhost/.sieve_bin
 139
 140             # From elsewhere to Junk folder
 141             imapsieve_mailbox1_name = Junk
 142             imapsieve_mailbox1_causes = COPY APPEND
 143             imapsieve_mailbox1_before = file:${./sieve_scripts}/report_spam.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 144
 145             # From Junk folder to elsewhere
 146             imapsieve_mailbox2_name = *
 147             imapsieve_mailbox2_from = Junk
 148             imapsieve_mailbox2_causes = COPY
 149             imapsieve_mailbox2_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 150
 151             # From anywhere to NoJunk folder
 152             imapsieve_mailbox3_name = NoJunk
 153             imapsieve_mailbox3_causes = COPY APPEND
 154             imapsieve_mailbox3_before = file:${./sieve_scripts}/report_ham.sieve;bindir=/var/lib/vhost/.imapsieve_bin
 155
 156             sieve_pipe_bin_dir = ${sieve_bin}
 157
 158             sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
 159         }
 160         ''
 161         # Services to listen
 162         ''
 163         service imap-login {
 164           inet_listener imap {
 165           }
 166           inet_listener imaps {
 167           }
 168         }
 169         service pop3-login {
 170           inet_listener pop3 {
 171           }
 172           inet_listener pop3s {
 173           }
 174         }
 175         service imap {
 176         }
 177         service pop3 {
 178         }
 179         service auth {
 180           unix_listener auth-userdb {
 181           }
 182           unix_listener ${config.services.postfix.config.queue_directory}/private/auth {
 183             mode = 0666
 184           }
 185         }
 186         service auth-worker {
 187         }
 188         service dict {
 189           unix_listener dict {
 190           }
 191         }
 192         service stats {
 193           unix_listener stats-reader {
 194             user = vhost
 195             group = vhost
 196             mode = 0660
 197           }
 198           unix_listener stats-writer {
 199             user = vhost
 200             group = vhost
 201             mode = 0660
 202           }
 203         }
 204         ''
 205
 206         # Authentification
 207         ''
 208         first_valid_uid = ${toString config.ids.uids.vhost}
 209         disable_plaintext_auth = yes
 210         passdb {
 211           driver = ldap
 212           args = ${config.secrets.fullPaths."dovecot/ldap"}
 213         }
 214         userdb {
 215           driver = ldap
 216           args = ${config.secrets.fullPaths."dovecot/ldap"}
 217         }
 218         ''
 219
 220         # Zlib
 221         ''
 222         mail_plugins = $mail_plugins zlib
 223         plugin {
 224           zlib_save_level = 6
 225           zlib_save = gz
 226         }
 227         ''
 228
 229         # Sieve
 230         ''
 231         plugin {
 232           sieve = file:~/sieve;bindir=~/.sieve-bin;active=~/.dovecot.sieve
 233         }
 234         service managesieve-login {
 235         }
 236         service managesieve {
 237         }
 238         ''
 239
 240         # Virtual mailboxes
 241         ''
 242         mail_plugins = $mail_plugins virtual
 243         namespace Virtual {
 244           prefix = Virtual/
 245           location = virtual:~/Virtual
 246         }
 247         ''
 248
 249         # Protocol specific configuration
 250         # Needs to come last if there are mail_plugins entries
 251         ''
 252         protocol imap {
 253           mail_plugins = $mail_plugins imap_sieve imap_acl
 254         }
 255         protocol lda {
 256           mail_plugins = $mail_plugins sieve
 257         }
 258         ''
 259       ];
 260     };
 261     networking.firewall.allowedTCPPorts = [ 110 143 993 995 4190 ];
 262     system.activationScripts.dovecot = {
 263       deps = [ "users" ];
 264       text  =''
 265         install -m 0755 -o vhost -g vhost -d /var/lib/vhost
 266         '';
 267     };
 268
 269     services.cron.systemCronJobs = let
 270       cron_script = pkgs.writeScriptBin "cleanup-imap-folders" ''
 271         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX "Backup/*" NOT FLAGGED BEFORE 8w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 272         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Junk SEEN NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 273         ${pkgs.dovecot}/bin/doveadm expunge -A MAILBOX Trash NOT FLAGGED BEFORE 4w 2>&1 > /dev/null | grep -v "Mailbox doesn't exist:" | grep -v "Info: Opening DB"
 274         '';
 275       in
 276       [
 277         "0 2 * * * root ${cron_script}/bin/cleanup-imap-folders"
 278       ];
 279     security.acme.certs."mail-rsa" = {
 280       postRun = ''
 281         systemctl restart dovecot2.service
 282       '';
 283       extraDomains = {
 284         "imap.immae.eu" = null;
 285         "pop3.immae.eu" = null;
 286       };
 287     };
 288     security.acme.certs."mail" = {
 289       postRun = ''
 290         systemctl restart dovecot2.service
 291       '';
 292       extraDomains = {
 293         "imap.immae.eu" = null;
 294         "pop3.immae.eu" = null;
 295       };
 296     };
 297   };
 298 }
 299