10 files changed, 269 insertions, 0 deletions

diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/10-acl.conf b/ansible/roles/dovecot/files/dovecot/conf.d/10-acl.conf
new file mode 100644
index 0000000..f9fa335
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/10-acl.conf
@@ -0,0 +1,15 @@
+mail_plugins = $mail_plugins acl
+
+protocol imap {
+  mail_plugins = $mail_plugins imap_acl
+}
+
+plugin {
+    acl_defaults_from_inbox = yes
+}
+
+# Should saving a mail to a nonexistent mailbox automatically create it?
+lda_mailbox_autocreate = yes
+
+# Should automatically created mailboxes be also automatically subscribed?
+lda_mailbox_autosubscribe = yes
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/10-auth.conf b/ansible/roles/dovecot/files/dovecot/conf.d/10-auth.conf
new file mode 100644
index 0000000..4e23fa8
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/10-auth.conf
@@ -0,0 +1,46 @@
+# cache all authentication results for one hour
+#auth_cache_size = 10M
+#auth_cache_ttl = 1 hour
+#auth_cache_negative_ttl = 1 hour
+
+# Don't cache password details, otherwise password changes require a server HUP
+# before the server will re-query the password data source.
+auth_cache_size = 0
+
+# only use plain username/password auth - OK since everything is over TLS
+auth_mechanisms = plain
+
+# passdb specifies how users are authenticated - sql here, and
+# our sql config specifies the sqlite filename with queries to use
+passdb {
+  driver = sql
+  args = /etc/dovecot/dovecot-sql.conf.ext
+}
+
+# userdb specifies the location of users' "home" directories - where their
+# mail is stored. e.g. /var/mail/vhosts/exmaple.com/user
+# %d = domain, %n = user
+# We can't use "prefetch" because postfix can't read users from "prefetch" db,
+# and we can't use 'static' because the doveadm tool needs to iterate users
+# for purging zero refcount deleted mails, so we give a userdb of sql here
+# and specify a "get all users" SQL query in the configuration file.
+userdb {
+  driver = sql
+  args = /etc/dovecot/dovecot-sql.conf.ext
+}
+
+# UNIX socket path to master authentication server to find users.
+# This is used by imap (for shared users) and lda.
+auth_socket_path = /var/run/dovecot/auth-userdb
+
+# Respect /etc/hosts.deny (populated by fail2ban)
+# You can use /etc/hosts.allow to countermand fail2ban decisions.
+login_access_sockets = tcpwrap
+
+service tcpwrap {
+  unix_listener login/tcpwrap {
+    group = $default_login_user
+    mode = 0600
+    user = $default_login_user
+  }
+}
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/10-mail.conf b/ansible/roles/dovecot/files/dovecot/conf.d/10-mail.conf
new file mode 100644
index 0000000..6c03965
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/10-mail.conf
@@ -0,0 +1,28 @@
+# default home directory location for all users
+mail_home = /var/mail/vhosts/%d/%n
+
+# directory to store mail. The tilda makes it relative to the *dovecot*
+# virtual home directory.
+#
+# I use mdbox - this is Dovecot's own high-performance mail store format.
+# There are other slower, more "traditional" formats you can choose from.
+# Read about them here: https://wiki2.dovecot.org/MailboxFormat
+mail_location = mdbox:~/mdbox
+
+# nothing fancy - just a standard default namespace with '/' as the
+# hierarchy separator
+namespace inbox {
+  separator = /
+  inbox = yes
+}
+
+# set this to the group that owns your vmail directory.
+mail_privileged_group = vmail
+
+# these lines enable attachment deduplication. Attachments must be somewhat
+# large (64k) to store them separately from the mail store.
+mail_attachment_dir = /var/mail/attachments
+mail_attachment_min_size = 64k
+
+# we'll uncomment this after we set up Solr in the following section:
+# mail_plugins = $mail_plugins fts fts_solr
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/10-master.conf b/ansible/roles/dovecot/files/dovecot/conf.d/10-master.conf
new file mode 100644
index 0000000..f99d0f4
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/10-master.conf
@@ -0,0 +1,82 @@
+# to improve performance, disable fsync globally - we will enable it for
+# some specific services later on
+mail_fsync = never
+
+service imap-login {
+  # plain-text IMAP should only be accessible from localhost
+  inet_listener imap {
+    address = 127.0.0.1, ::1
+  }
+
+  # enable high-performance mode, described here:
+  # https://wiki.dovecot.org/LoginProcess
+  service_count = 0
+
+  # set to the number of CPU cores on your server
+  process_min_avail = 3
+  vsz_limit = 1G
+}
+
+# disable POP3 altogether
+service pop3-login {
+  inet_listener pop3 {
+    port = 0
+  }
+
+  inet_listener pop3s {
+    port = 0
+  }
+}
+
+# enable semi-long-lived IMAP processes to improve performance
+service imap {
+  service_count = 256
+  # set to the number of CPU cores on your server
+  process_min_avail = 3
+}
+
+# expose an LMTP socket for postfix to deliver mail
+service lmtp {
+ unix_listener /var/spool/postfix/private/dovecot-lmtp {
+   group = postfix
+   mode = 0600
+   user = postfix
+  }
+}
+
+service auth {
+  # auth_socket_path points to this userdb socket by default. It's typically
+  # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
+  # full permissions to this socket are able to get a list of all usernames and
+  # get the results of everyone's userdb lookups.
+  #
+  # The default 0666 mode allows anyone to connect to the socket, but the
+  # userdb lookups will succeed only if the userdb returns an "uid" field that
+  # matches the caller process's UID. Also if caller's uid or gid matches the
+  # socket's uid or gid the lookup succeeds. Anything else causes a failure.
+  #
+  # To give the caller full permissions to lookup all users, set the mode to
+  # something else than 0666 and Dovecot lets the kernel enforce the
+  # permissions (e.g. 0777 allows everyone full permissions).
+
+  # auth for postfix
+  unix_listener /var/spool/postfix/private/auth {
+    mode = 0666
+    user = postfix
+    group = postfix
+  }
+
+  # auth for doveadm tools
+  unix_listener auth-userdb {
+    mode = 0666
+    user = vmail
+    group = vmail
+  }
+
+  client_limit = 840
+}
+
+# no need to run this as root
+service auth-worker {
+  user = vmail
+}
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/15-lda.conf b/ansible/roles/dovecot/files/dovecot/conf.d/15-lda.conf
new file mode 100644
index 0000000..32ca50d
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/15-lda.conf
@@ -0,0 +1,7 @@
+# configuration for mail delivered by the `dovecot-lda` command. Shouldn't
+# be needed since we are using LMTP, but kept for backwards compatibility.
+protocol lda {
+  # use fsync for write-safety - this deals with delivering actual mail
+  mail_fsync = optimized
+  mail_plugins = $mail_plugins sieve
+}
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/15-mailboxes.conf b/ansible/roles/dovecot/files/dovecot/conf.d/15-mailboxes.conf
new file mode 100644
index 0000000..8674b0b
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/15-mailboxes.conf
@@ -0,0 +1,24 @@
+# define any special IMAP folders here. You can force them to be created or
+# created+subscribed automatically used the `auto` option.
+namespace inbox {
+  mailbox Drafts {
+    auto = subscribe
+    special_use = \Drafts
+  }
+  mailbox Junk {
+    auto = create
+    special_use = \Junk
+  }
+  mailbox Trash {
+    auto = create
+    special_use = \Trash
+  }
+  mailbox Archive {
+    auto = subscribe
+    special_use = \Archive
+  }
+  mailbox Sent {
+    auto = subscribe
+    special_use = \Sent
+  }
+}
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/20-imap.conf b/ansible/roles/dovecot/files/dovecot/conf.d/20-imap.conf
new file mode 100644
index 0000000..7b32396
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/20-imap.conf
@@ -0,0 +1,10 @@
+# Use a longer IDLE interval to reduce network chatter and save battery
+# life. Max is 30 minutes.
+imap_idle_notify_interval = 29 mins
+
+protocol imap {
+  # max IMAP connections per IP address
+  mail_max_userip_connections = 50
+  # imap_sieve will be used for spam training by rspamd
+  mail_plugins = $mail_plugins imap_sieve
+}
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/20-lmtp.conf b/ansible/roles/dovecot/files/dovecot/conf.d/20-lmtp.conf
new file mode 100644
index 0000000..a51ee42
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/20-lmtp.conf
@@ -0,0 +1,5 @@
+protocol lmtp {
+  # use fsync for write-safety - this deals with delivering actual mail
+  mail_fsync = optimized
+  mail_plugins = $mail_plugins sieve
+}
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/90-imapsieve.conf b/ansible/roles/dovecot/files/dovecot/conf.d/90-imapsieve.conf
new file mode 100644
index 0000000..26987b1
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/90-imapsieve.conf
@@ -0,0 +1,18 @@
+plugin {
+  sieve_plugins = sieve_imapsieve sieve_extprograms
+
+  # From elsewhere to Junk folder
+  imapsieve_mailbox1_name = Junk
+  imapsieve_mailbox1_causes = COPY
+  imapsieve_mailbox1_before = file:/etc/dovecot/sieve/report-spam.sieve
+
+  # From Junk folder to elsewhere
+  imapsieve_mailbox2_name = *
+  imapsieve_mailbox2_from = Junk
+  imapsieve_mailbox2_causes = COPY
+  imapsieve_mailbox2_before = file:/etc/dovecot/sieve/report-ham.sieve
+
+  sieve_pipe_bin_dir = /etc/dovecot/sieve
+
+  sieve_global_extensions = +vnd.dovecot.pipe
+}
diff --git a/ansible/roles/dovecot/files/dovecot/conf.d/90-sieve.conf b/ansible/roles/dovecot/files/dovecot/conf.d/90-sieve.conf
new file mode 100644
index 0000000..9a753bf
--- /dev/null
+++ b/ansible/roles/dovecot/files/dovecot/conf.d/90-sieve.conf
@@ -0,0 +1,34 @@
+plugin {
+  # 'active' is a symlink to one sieve source script inside directory at 'file'
+  sieve = file:~/sieve;active=~/.dovecot.sieve
+
+  # directory of global sieve scripts to run before and after processing ALL
+  # incoming mail
+  sieve_before = /etc/dovecot/sieve-before.d
+  sieve_after  = /etc/dovecot/sieve-after.d
+
+  # make sieve aware of [email protected] aliases
+  recipient_delimiter = +
+
+
+  # no limits on script size or actions
+  sieve_quota_max_storage = 0
+  sieve_max_script_size = 0
+  sieve_max_actions = 0
+
+  sieve_extensions = +spamtest +spamtestplus
+
+  sieve_spamtest_status_header = X-Spam-Score
+  sieve_spamtest_status_type = strlen
+
+  # X-Spamd-Bar: +++++++++
+  sieve_spamtest_max_value = 9
+
+
+  # X-Spamd-Result: default: False [9.19 / 15.00];
+  # (regex not fixed to capture the above)
+  #sieve_spamtest_status_type = score
+  #sieve_spamtest_status_header = \
+  #    X-Spamd-Result: [[:alnum:]]+, score=(-?[[:digit:]]+\.[[:digit:]])
+  #sieve_spamtest_max_value = 5.0
+}