Official NixOS Wiki

Dovecot: Difference between revisions

← Older edit
MyOtherCarIsACdr (talk | contribs)
1 edit
VisualWikitext
Tie-ling (talk | contribs)
92 edits
add standard mailboxes
Upgrade settings to Dovecot 2.4 and new `dovecot2.settings` option
 
Line 66: Line 66:
     enablePAM = false;
     enablePAM = false;


     # https://doc.dovecot.org/2.3/configuration_manual/howto/postfix_dovecot_lmtp/
     # https://doc.dovecot.org/2.4.4/howto/lmtp/postfix.html
     # https://doc.dovecot.org/2.3/configuration_manual/howto/postfix_and_dovecot_sasl/
     # https://doc.dovecot.org/2.4.4/howto/sasl/postfix.html
     extraConfig = ''
     settings = {
       # force to use full user name plus domain name
      # dovecot_config_version and dovecot_storage_version must be explicitly set
       # for disambiguation
       # to retain compatibility with future updates.
       auth_username_format = %Lu
       dovecot_config_version = "2.4.2";
       dovecot_storage_version = "2.4.0";


       # Authentication configuration:
       auth_username_format = "%{user | lower}";
       auth_mechanisms = plain
       auth_mechanisms = [ "plain" ];
       passdb {
       "passdb passwd-file" = {
         driver = passwd-file
         driver = "passwd-file";
         args = ${config.age.secrets.dovecot.path}
         passwd_file_path = config.age.secrets.dovecot.path;
       }
       };
     ''
     };
   };
   };
</syntaxhighlight>
</syntaxhighlight>


= Setup virtual users =
= Setup virtual users =
<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix"># /var/spool/mail/vmail needs to be created and owned by vmail
  # /var/spool/mail/vmail needs to be created and owned by vmail
   systemd.tmpfiles.rules = [
   users.users."vmail" = {
     "d /var/spool/mail/vmail 0700 vmail vmail -"
     createHome = true;
   ];
    home = "/var/spool/mail/vmail";
   };


   services.dovecot2 = {
   services.dovecot2 = {
     # configure virtual mail user and group
     settings = {
    createMailUser = true;
      # dovecot_config_version and dovecot_storage_version must be explicitly set
    mailUser = "vmail";
      # to retain compatibility with future updates.
    mailGroup = "vmail";
      dovecot_config_version = "2.4.2";
      dovecot_config_version = "2.4.0";
 
      # If config.services.dovecot2.createMailUser is true (which is the default),
      # the user defined in mail_uid and mail_gid will be automatically created.
      mail_uid = "vmail";
      mail_gid = "vmail";
 
      # implement virtual users
      # https://doc.dovecot.org/2.4.4/howto/virtual/simple_install.html
      # store virtual mail under /var/spool/mail/vmail/<DOMAIN>/<USER>/Maildir
      mail_driver = "maildir";
      mail_path = "~/Maildir";


    # implement virtual users
      "namespace inbox" = {
    # https://doc.dovecot.org/2.3/configuration_manual/howto/simple_virtual_install/
        "mailbox All" = { auto = "create"; special_use = "\\All"; };
    # store virtual mail under
        "mailbox Archive" = { auto = "create"; special_use = "\\Archive"; };
    # /var/spool/mail/vmail/<DOMAIN>/<USER>/Maildir/
        "mailbox Drafts" = { auto = "create"; special_use = "\\Drafts"; };
    mailLocation = "maildir:~/Maildir";
        "mailbox Flagged" = { auto = "create"; special_use = "\\Flagged"; };
        "mailbox Junk" = { auto = "create"; special_use = "\\Junk"; autoexpunge = "60d"; };
        "mailbox Sent" = { auto = "create"; special_use = "\\Sent"; };
        "mailbox Trash" = { auto = "create"; special_use = "\\Trash"; autoexpunge = "60d"; };
      };


    mailboxes = {
       "userdb static" = {
       # use rfc standard https://apple.stackexchange.com/a/201346
        fields = {
      All = { auto = "create"; autoexpunge = null; specialUse = "All"; };
          uid = "vmail";
      Archive = { auto = "create"; autoexpunge = null; specialUse = "Archive"; };
          gid = "vmail";
      Drafts = { auto = "create"; autoexpunge = null; specialUse = "Drafts"; };
          username_format = "%u";
      Flagged = { auto = "create"; autoexpunge = null; specialUse = "Flagged"; };
          home = "/var/spool/mail/vmail/%d/%n";
      Junk = { auto = "create"; autoexpunge = "60d"; specialUse = "Junk"; };
        };
      Sent = { auto = "create"; autoexpunge = null; specialUse = "Sent"; };
       };
       Trash = { auto = "create"; autoexpunge = "60d"; specialUse = "Trash"; };
     };
     };
 
   };</syntaxhighlight>
    extraConfig = ''
      userdb {
        driver = static
        # the full e-mail address inside passwd-file is the username (%u)
        # user@example.com
        # %d for domain_name %n for user_name
        args = uid=vmail gid=vmail username_format=%u home=/var/spool/mail/vmail/%d/%n
      }
    '';
   };
</syntaxhighlight>


= Connect to postfix via lmtp =
= Connect to postfix via lmtp =
See [[Postfix]] for further setup on postfix side.
See [[Postfix]] for further setup on postfix side.


<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix"> # create path for dovecot socket
  systemd.tmpfiles.rules = [
    "d /var/spool/postfix 0700 postfix postfix -";
  ];
 
   services.dovecot2 = {
   services.dovecot2 = {
     # connection to postfix
     settings = {
    enableLmtp = true;
      # dovecot_config_version and dovecot_storage_version must be explicitly set
      # to retain compatibility with future updates.
      dovecot_config_version = "2.4.2";
      dovecot_config_version = "2.4.0";


    # https://doc.dovecot.org/2.3/configuration_manual/howto/postfix_dovecot_lmtp/
      protocols = [ "imap" "lmtp" ];
    # https://doc.dovecot.org/2.3/configuration_manual/howto/postfix_and_dovecot_sasl/
 
    extraConfig = ''
      # https://doc.dovecot.org/2.4.4/howto/lmtp/postfix.html
      # connection to postfix via lmtp
       "service lmtp" = {
       service lmtp {
        # Note that the socket needs to be placed here because Postfix access is limited to this directory
      unix_listener /var/spool/postfix/dovecot-lmtp {
        "unix_listener /var/spool/postfix/dovecot-lmtp" = {
        mode = 0600
          user = "postfix";
        user = postfix
          group = "postfix";
        group = postfix
          mode = "0600";
         }
         };
       }
       };
       service auth {
 
         unix_listener /var/spool/postfix/auth {
      # https://doc.dovecot.org/2.4.4/howto/sasl/postfix.html
           mode = 0600
       "service auth" = {
           user = postfix
         "unix_listener /var/spool/postfix/auth" = {
           group = postfix
           user = "postfix";
         }
           group = "postfix";
       }
           mode = "0600";
     '';
         };
  };
       };
     };


   # postfix connection to dovecot
   # postfix connection to dovecot
   services.postfix.config = {
   services.postfix.config = {
     # https://doc.dovecot.org/2.3/configuration_manual/howto/postfix_dovecot_lmtp/
     # https://doc.dovecot.org/2.4.4/howto/lmtp/postfix.html
     mailbox_transport = "lmtp:unix:/var/spool/postfix/dovecot-lmtp";
     mailbox_transport = "lmtp:unix:/var/spool/postfix/dovecot-lmtp";
     virtual_transport = "lmtp:unix:/var/spool/postfix/dovecot-lmtp";
     virtual_transport = "lmtp:unix:/var/spool/postfix/dovecot-lmtp";


     # https://doc.dovecot.org/2.3/configuration_manual/howto/postfix_and_dovecot_sasl/
     # https://doc.dovecot.org/2.4.4/howto/sasl/postfix.html
     smtpd_sasl_type = "dovecot";
     smtpd_sasl_type = "dovecot";
     smtpd_sasl_path = "/var/spool/postfix/auth";
     smtpd_sasl_path = "/var/spool/postfix/auth";
Line 167: Line 178:
     smtpd_recipient_restrictions = "permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination";
     smtpd_recipient_restrictions = "permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination";
   };
   };
  # create path for dovecot socket
  users.users."postfix" = {
    createHome = true;
    home = "/var/spool/postfix";
  };
</syntaxhighlight>
</syntaxhighlight>


Line 179: Line 183:
<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix">
   services.dovecot2 = {
   services.dovecot2 = {
     sslServerCert = "${sslCertDir}/fullchain.pem";
     settings = {
    sslServerKey = "${sslCertDir}/key.pem";
      # dovecot_config_version and dovecot_storage_version must be explicitly set
    sslCACert = "${sslCertDir}/chain.pem";
      # to retain compatibility with future updates.
      dovecot_config_version = "2.4.2";
      dovecot_config_version = "2.4.0";
 
      # https://doc.dovecot.org/2.4.4/core/config/ssl.html
      ssl = true; # see also "required"
      ssl_server_cert_file = "${sslCertDir}/fullchain.pem";
      ssl_server_key_file = "${sslCertDir}/key.pem";
      ssl_server_ca_file = "${sslCertDir}/chain.pem";
    };  
   };
   };
</syntaxhighlight>
</syntaxhighlight>
Line 199: Line 212:


= mail_crypt plugin (encryption at rest) =
= mail_crypt plugin (encryption at rest) =
 
{{Outdated}}
The following seems to make mail_crypt work in its per-user/per-folder mode (note that this mode is still described as 'not production quality' in the dovecot docs):
The following seems to make mail_crypt work in its per-user/per-folder mode (note that this mode is still described as 'not production quality' in the dovecot docs):


Retrieved from "https://wiki.nixos.org/wiki/Dovecot"