From 216fb11972b8e3505802aac0a1b5e5a52443a83a Mon Sep 17 00:00:00 2001 From: Mauro Torrez Date: Tue, 28 May 2019 00:20:51 -0300 Subject: [PATCH] rol inicial (queda por arreglar) --- defaults/main.yml | 206 +++++++++++++++++++ handlers/main.yml | 9 + tasks/main.yml | 57 ++++++ templates/10-auth.conf.j2 | 135 ++++++++++++ templates/10-mail.conf.j2 | 317 +++++++++++++++++++++++++++++ templates/10-master.conf.j2 | 126 ++++++++++++ templates/10-ssl.conf.j2 | 70 +++++++ templates/15-mailboxes.conf.j2 | 81 ++++++++ templates/20-imap.conf.j2 | 77 +++++++ templates/20-lmtp.conf.j2 | 31 +++ templates/90-antispam.conf.j2 | 185 +++++++++++++++++ templates/90-quota.conf.j2 | 87 ++++++++ templates/90-sieve.conf.j2 | 214 +++++++++++++++++++ templates/auth-ldap.conf.ext.j2 | 37 ++++ templates/auth-master.conf.ext.j2 | 16 ++ templates/dovecot-ldap.conf.ext.j2 | 75 +++++++ templates/junk-filter.sieve.j2 | 9 + 17 files changed, 1732 insertions(+) create mode 100644 defaults/main.yml create mode 100644 handlers/main.yml create mode 100644 tasks/main.yml create mode 100644 templates/10-auth.conf.j2 create mode 100644 templates/10-mail.conf.j2 create mode 100644 templates/10-master.conf.j2 create mode 100644 templates/10-ssl.conf.j2 create mode 100644 templates/15-mailboxes.conf.j2 create mode 100644 templates/20-imap.conf.j2 create mode 100644 templates/20-lmtp.conf.j2 create mode 100644 templates/90-antispam.conf.j2 create mode 100644 templates/90-quota.conf.j2 create mode 100644 templates/90-sieve.conf.j2 create mode 100644 templates/auth-ldap.conf.ext.j2 create mode 100644 templates/auth-master.conf.ext.j2 create mode 100644 templates/dovecot-ldap.conf.ext.j2 create mode 100644 templates/junk-filter.sieve.j2 diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..da737d2 --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,206 @@ +--- + +# junk mailbox name +dovecot_mailbox_junk: "Junk" + +# activar single-instance storage? +dovecot_sis_enable: yes + +# lugar donde se guardan los adjuntos +dovecot_sis_directory: "{{ vmail_home }}/attachments" + +# tamaño minimo de adjuntos a guardar aparte +dovecot_sis_min_size: "128k" + +# hash a usar para desduplicar +dovecot_sis_hash: "%{sha1}" + +# habilitar desduplicacion postergada? +dovecot_sis_queue_enable: no + +# carpeta de "encolados para desduplicar +dovecot_sis_queue_directory: "{{ vmail_home }}/attachments-queue" + +# carpeta alternativa de correo +dovecot_altstorage_enable: no + +# carpeta alternativa de correo +dovecot_altstorage_directory: "{{ vmail_home }}/alt-storage" + +# formato del mailbox: dbox, mdbox, sdbox, maildir +dovecot_mailbox_format: "dbox" + +# ubicacion de mails de dovecot +dovecot_mail_location: > + {%- if "dbox" in dovecot_mailbox_format -%} + {{dovecot_mailbox_format}}:~/dbox + {%- else -%} + {{dovecot_mailbox_format}}:~/Maildir + {%- endif %} + +# carpeta "home" de los usuarios de dovecot +dovecot_user_home: "{{ vmail_home }}/mail/%d/%n" + +# como transformar el nombre de usuario antes de autenticar +dovecot_auth_username_format: "%Lu" + +# mecanismos de autenticacion: agregar login para compat. outlook +dovecot_auth_mechanisms: "plain" + +# habilitar userdb/passdb de usuarios del sistema? +dovecot_auth_system_enable: no + +# habilitar userdb/passdb ldap? +dovecot_auth_ldap_enable: yes + +# servidores ldap +dovecot_auth_ldap_servers: [ "localhost" ] + +# version del protocolo LDAP +dovecot_auth_ldap_version: 3 + +# base para la busqueda en LDAP +dovecot_auth_ldap_base: "ou=People,dc=%Dd" + +# scope para la busqueda en ldap: base, onelevel, subtree +dovecot_auth_ldap_scope: "subtree" + +# filtro para obtener la entrada del usuario LDAP +dovecot_auth_ldap_user_filter: "(&(objectClass=inetOrgPerson)(uid=%n))" + +# filtro para obtener la clave del usuario LDAP +dovecot_auth_ldap_pass_filter: "(&(objectClass=inetOrgPerson)(uid=%n))" + +# atributos del usuario leidos de LDAP +# por defecto, usar valores pre-calculados +dovecot_auth_ldap_user_attrs: > + =home={{ dovecot_user_home }}, + =uid={{ vmail_user }}, + =gid={{ vmail_group }} + +# clave + atributos del usuario leidos de LDAP +# por defecto, usar valores pre-calculados +dovecot_auth_ldap_pass_attrs: > + userPassword=password, + =userdb_home={{ dovecot_user_home }}, + =userdb_uid={{ vmail_user }}, + =userdb_gid={{ vmail_group }} + +# iteracion con doveadm +# CAVEAT: al usar %Dd en ldap_base, no se puede utilizar doveadm -A, +# sino que siempre se debe especificar un dominio usando -u "*@dominio" +dovecot_auth_ldap_iterate_attrs: "=user=%{ldap:uid}@%d" + +# cuando ldap_base es fija (sin %Dd): +# dovecot_auth_ldap_iterate_attrs: "uid=user" + +# filtro para iteracion: este filtro debe devolver todas las personas +# de tipo "usuario" +dovecot_auth_ldap_iterate_filter: "(objectClass=inetOrgPerson)" + +# ??? +dovecot_auth_ldap_default_pass_scheme: "CRYPT" + +# habilitar usuarios master? +dovecot_auth_master_enable: no + +# habilitar ssl +dovecot_ssl_enable: yes + +# requerir ssl +dovecot_ssl_require: no + +# path absoluto al certificado SSL +dovecot_ssl_cert: "{{ tls_certificate }}" + +# path absoluto a la clave privada SSL +dovecot_ssl_key: "{{ tls_certificate_key }}" + +# activar IMAP? +dovecot_proto_imap_enable: yes + +# activar IMAPS? +dovecot_proto_imaps_enable: no + +# activar POP3? +dovecot_proto_pop3_enable: no + +# activar POP3S? +dovecot_proto_pop3s_enable: no + +# activar managesieve? +dovecot_proto_managesieve_enable: yes + +# Activar el plugin antispam? +dovecot_antispam_enable: yes + +# Backend del plugin antispam. Valores posibles: +# crm114, dspam, pipe, spool2dir +dovecot_antispam_backend: "pipe" + +# Header que indica que el mail ha sido escaneado para spam +dovecot_antispam_signature: "X-Bogosity" + +# Pipe: programa que entrena leyendo el mail en STDIN +dovecot_antispam_pipe_program: "/usr/bin/bogofilter" + +# antispam_pipe_program_args = --for;%u +dovecot_antispam_pipe_program_args: "-l" + +# Pipe: argumento que indica que el mail NO ES spam +dovecot_antispam_pipe_program_notspam_arg: "-n" + +# Pipe: argumento que indica que el mail ES spam +dovecot_antispam_pipe_program_spam_arg: "-s" + +# Pipe: directorio temporal (creo que el mail se copia ahi primero) +dovecot_antispam_pipe_tmpdir: "/tmp" + +# accion cuando se mueve un mail que no tiene signature de/hacia spam +# valores posibles: +# error: fallar en la operacion +# move: mover el mensaje de todos modos +dovecot_antispam_signature_missing: "error" + +# nombres de las carpetas de spam +dovecot_antispam_spam: "Junk;junk;Junk Mail;Spam;spam;SPAM" + +# nombres de las carpetas de papelera +dovecot_antispam_trash: "Trash;trash;mail/trash;Deleted Messages" + +# debug del plugin antispam +dovecot_antispam_debug_enable: no +dovecot_antispam_debug_target: "syslog" +dovecot_antispam_debug_verbosity: 0 + +# activar plugin quota? +dovecot_plugin_quota_enable: yes + +# opciones de quota +dovecot_plugin_quota: + + # driver: count, maildir + driver: "count" + + # limite global de la cuota de usuario (en M) + limit: "4096M" + + # limites adicionales para casillas especificas + mailbox_additional_limit: + Trash: "100M" + + # gracia (en porcentaje o M) + grace: "10%" + +# activar plugin sieve? +dovecot_plugin_sieve_enable: yes + +# opciones de sieve +dovecot_plugin_sieve: + + # dir con scripts ejecutados antes que los del usuario + before: "/etc/dovecot/sieve/before" + + # dir con scripts ejecutados luego de los del usuario + after: "/etc/dovecot/sieve/after" + diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..9157638 --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,9 @@ +--- +- name: restart dovecot + service: name=dovecot state=restarted + +- name: recompile sieve scripts + command: sievec "{{ item }}" + with_fileglob: + - "{{ dovecot_plugin_sieve.before }}/*.sieve" + - "{{ dovecot_plugin_sieve.after }}/*.sieve" diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..0e562f8 --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,57 @@ +--- +- apt: name=dovecot-ldap + when: dovecot_auth_ldap_enable + +- apt: name=dovecot-pop3d + when: dovecot_proto_pop3_enable or dovecot_proto_pop3s_enable + +- apt: name=dovecot-imapd + when: dovecot_proto_imap_enable or dovecot_proto_imapd_enable + +- apt: name=dovecot-lmtpd + +- apt: name=dovecot-managesieved + when: dovecot_proto_managesieve_enable + +- apt: name=dovecot-antispam + when: dovecot_plugin_antispam_enable + +- name: Configuración de Dovecot + template: dest="/etc/dovecot/conf.d/{{item}}" src="{{item}}.j2" + with_items: + - 10-mail.conf + - 10-auth.conf + - 10-ssl.conf + - 20-lmtp.conf + - 20-imap.conf + - 10-master.conf + - auth-ldap.conf.ext + - 15-mailboxes.conf + - 90-sieve.conf + - 90-quota.conf + - 90-antispam.conf + notify: restart dovecot + +- name: configuracion dovecot-ldap + template: + dest: "/etc/dovecot/dovecot-ldap.conf.ext" + src: "dovecot-ldap.conf.ext.j2" + notify: restart dovecot + +- name: enlace simbólico a dovecot-ldap.conf.ext + file: + src: dovecot-ldap.conf.ext + dest: /etc/dovecot/dovecot-ldap2.conf.ext + state: link + notify: restart dovecot + +- file: path={{ dovecot_plugin_sieve.after }} state=directory + when: dovecot_plugin_sieve_enable + +- file: path={{ dovecot_plugin_sieve.before }} state=directory + when: dovecot_plugin_sieve_enable + +- name: filtro spam global en sieve-after + template: src=junk-filter.sieve.j2 dest={{dovecot_plugin_sieve.after}}/junk-filter.sieve + when: dovecot_plugin_sieve_enable + notify: recompile sieve scripts diff --git a/templates/10-auth.conf.j2 b/templates/10-auth.conf.j2 new file mode 100644 index 0000000..b0f8874 --- /dev/null +++ b/templates/10-auth.conf.j2 @@ -0,0 +1,135 @@ +## +## Authentication processes +## + +# Disable LOGIN command and all other plaintext authentications unless +# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP +# matches the local IP (ie. you're connecting from the same computer), the +# connection is considered secure and plaintext authentication is allowed. +# See also ssl=required setting. +#disable_plaintext_auth = yes + +# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that +# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used. +#auth_cache_size = 0 +# Time to live for cached data. After TTL expires the cached record is no +# longer used, *except* if the main database lookup returns internal failure. +# We also try to handle password changes automatically: If user's previous +# authentication was successful, but this one wasn't, the cache isn't used. +# For now this works only with plaintext authentication. +#auth_cache_ttl = 1 hour +# TTL for negative hits (user not found, password mismatch). +# 0 disables caching them completely. +#auth_cache_negative_ttl = 1 hour + +# Space separated list of realms for SASL authentication mechanisms that need +# them. You can leave it empty if you don't want to support multiple realms. +# Many clients simply use the first one listed here, so keep the default realm +# first. +auth_realms = {{ mail_domains | join(" ") }} + +# Default realm/domain to use if none was specified. This is used for both +# SASL realms and appending @domain to username in plaintext logins. +auth_default_realm = {{ mail_domains | first }} + +# List of allowed characters in username. If the user-given username contains +# a character not listed in here, the login automatically fails. This is just +# an extra check to make sure user can't exploit any potential quote escaping +# vulnerabilities with SQL/LDAP databases. If you want to allow all characters, +# set this value to empty. +#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ + +# Username character translations before it's looked up from databases. The +# value contains series of from -> to characters. For example "#@/@" means +# that '#' and '/' characters are translated to '@'. +#auth_username_translation = + +# Username formatting before it's looked up from databases. You can use +# the standard variables here, eg. %Lu would lowercase the username, %n would +# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into +# "-AT-". This translation is done after auth_username_translation changes. +auth_username_format = {{ dovecot_auth_username_format }} + +# If you want to allow master users to log in by specifying the master +# username within the normal username string (ie. not using SASL mechanism's +# support for it), you can specify the separator character here. The format +# is then . UW-IMAP uses "*" as the +# separator, so that could be a good choice. +#auth_master_user_separator = + +# Username to use for users logging in with ANONYMOUS SASL mechanism +#auth_anonymous_username = anonymous + +# Maximum number of dovecot-auth worker processes. They're used to execute +# blocking passdb and userdb queries (eg. MySQL and PAM). They're +# automatically created and destroyed as needed. +#auth_worker_max_count = 30 + +# Host name to use in GSSAPI principal names. The default is to use the +# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab +# entries. +#auth_gssapi_hostname = + +# Kerberos keytab to use for the GSSAPI mechanism. Will use the system +# default (usually /etc/krb5.keytab) if not specified. You may need to change +# the auth service to run as root to be able to read this file. +#auth_krb5_keytab = + +# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and +# ntlm_auth helper. +#auth_use_winbind = no + +# Path for Samba's ntlm_auth helper binary. +#auth_winbind_helper_path = /usr/bin/ntlm_auth + +# Time to delay before replying to failed authentications. +#auth_failure_delay = 2 secs + +# Require a valid SSL client certificate or the authentication fails. +#auth_ssl_require_client_cert = no + +# Take the username from client's SSL certificate, using +# X509_NAME_get_text_by_NID() which returns the subject's DN's +# CommonName. +#auth_ssl_username_from_cert = no + +# Space separated list of wanted authentication mechanisms: +# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey +# gss-spnego +# NOTE: See also disable_plaintext_auth setting. +# el mecanismo "login" es para compatibilidad para Outlooks viejos +auth_mechanisms = {{ dovecot_auth_mechanisms }} + +## +## Password and user databases +## + +# +# Password database is used to verify user's password (and nothing more). +# You can have multiple passdbs and userdbs. This is useful if you want to +# allow both system users (/etc/passwd) and virtual users to login without +# duplicating the system users into virtual database. +# +# +# +# User database specifies where mails are located and what user/group IDs +# own them. For single-UID configuration use "static" userdb. +# +# + +#!include auth-deny.conf.ext +{% if dovecot_auth_master_enable %} +!include auth-master.conf.ext +{% endif %} +#!include auth-passwdfile.conf.ext +{% if dovecot_auth_system_enable %} +!include auth-system.conf.ext +{% endif %} +#!include auth-sql.conf.ext +{% if dovecot_auth_ldap_enable %} +!include auth-ldap.conf.ext +{% endif %} +#!include auth-passwdfile.conf.ext +#!include auth-checkpassword.conf.ext +#!include auth-vpopmail.conf.ext +#!include auth-static.conf.ext diff --git a/templates/10-mail.conf.j2 b/templates/10-mail.conf.j2 new file mode 100644 index 0000000..e4c7b9e --- /dev/null +++ b/templates/10-mail.conf.j2 @@ -0,0 +1,317 @@ +## +## Mailbox locations and namespaces +## +mail_location = {{ dovecot_mail_location }} +{%- if "dbox" in dovecot_mailbox_format and dovecot_altstorage_enable -%} +:ALT={{ dovecot_altstorage_directory }}/%d/%n/dbox +{% endif %} + +namespace inbox { + # Namespace type: private, shared or public + #type = private + separator = / + #prefix = + #location = + + # There can be only one INBOX, and this setting defines which namespace + # has it. + inbox = yes + + #hidden = no + #list = yes + #subscriptions = yes + + # See 15-mailboxes.conf for definitions of special mailboxes. +} + +# System user and group used to access mails. If you use multiple, userdb +# can override these by returning uid or gid fields. You can use either numbers +# or names. +mail_uid = {{ vmail_user }} +mail_gid = {{ vmail_group }} + +# Group to enable temporarily for privileged operations. Currently this is +# used only with INBOX when either its initial creation or dotlocking fails. +# Typically this is set to "mail" to give access to /var/mail. +#mail_privileged_group = + +# Grant access to these supplementary groups for mail processes. Typically +# these are used to set up access to shared mailboxes. Note that it may be +# dangerous to set these if users can create symlinks (e.g. if "mail" group is +# set here, ln -s /var/mail ~/mail/var could allow a user to delete others' +# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it). +#mail_access_groups = + +# Allow full filesystem access to clients. There's no access checks other than +# what the operating system does for the active UID/GID. It works with both +# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/ +# or ~user/. +#mail_full_filesystem_access = no + +# Dictionary for key=value mailbox attributes. This is used for example by +# URLAUTH and METADATA extensions. +#mail_attribute_dict = + +# A comment or note that is associated with the server. This value is +# accessible for authenticated users through the IMAP METADATA server +# entry "/shared/comment". +#mail_server_comment = "" + +# Indicates a method for contacting the server administrator. According to +# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that +# is currently not enforced. Use for example mailto:admin@example.com. This +# value is accessible for authenticated users through the IMAP METADATA server +# entry "/shared/admin". +#mail_server_admin = + +## +## Mail processes +## + +# Don't use mmap() at all. This is required if you store indexes to shared +# filesystems (NFS or clustered filesystem). +#mmap_disable = no + +# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL +# since version 3, so this should be safe to use nowadays by default. +#dotlock_use_excl = yes + +# When to use fsync() or fdatasync() calls: +# optimized (default): Whenever necessary to avoid losing important data +# always: Useful with e.g. NFS when write()s are delayed +# never: Never use it (best performance, but crashes can lose data) +#mail_fsync = optimized + +# Locking method for index files. Alternatives are fcntl, flock and dotlock. +# Dotlocking uses some tricks which may create more disk I/O than other locking +# methods. NFS users: flock doesn't work, remember to change mmap_disable. +#lock_method = fcntl + +# Directory in which LDA/LMTP temporarily stores incoming mails >128 kB. +#mail_temp_dir = /tmp + +# Valid UID range for users, defaults to 500 and above. This is mostly +# to make sure that users can't log in as daemons or other system users. +# Note that denying root logins is hardcoded to dovecot binary and can't +# be done even if first_valid_uid is set to 0. +#first_valid_uid = 500 +#last_valid_uid = 0 + +# Valid GID range for users, defaults to non-root/wheel. Users having +# non-valid GID as primary group ID aren't allowed to log in. If user +# belongs to supplementary groups with non-valid GIDs, those groups are +# not set. +#first_valid_gid = 1 +#last_valid_gid = 0 + +# Maximum allowed length for mail keyword name. It's only forced when trying +# to create new keywords. +#mail_max_keyword_length = 50 + +# ':' separated list of directories under which chrooting is allowed for mail +# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too). +# This setting doesn't affect login_chroot, mail_chroot or auth chroot +# settings. If this setting is empty, "/./" in home dirs are ignored. +# WARNING: Never add directories here which local users can modify, that +# may lead to root exploit. Usually this should be done only if you don't +# allow shell access for users. +#valid_chroot_dirs = + +# Default chroot directory for mail processes. This can be overridden for +# specific users in user database by giving /./ in user's home directory +# (eg. /home/./user chroots into /home). Note that usually there is no real +# need to do chrooting, Dovecot doesn't allow users to access files outside +# their mail directory anyway. If your home directories are prefixed with +# the chroot directory, append "/." to mail_chroot. +#mail_chroot = + +# UNIX socket path to master authentication server to find users. +# This is used by imap (for shared users) and lda. +#auth_socket_path = /var/run/dovecot/auth-userdb + +# Directory where to look up mail plugins. +#mail_plugin_dir = /usr/lib/dovecot/modules + +# Space separated list of plugins to load for all services. Plugins specific to +# IMAP, LDA, etc. are added to this list in their own .conf files. +mail_plugins = $mail_plugins {% if dovecot_plugin_quota_enable -%} +quota +{% endif %} + +## +## Mailbox handling optimizations +## + +# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are +# also required for IMAP NOTIFY extension to be enabled. +{% if dovecot_plugin_quota_enable and dovecot_plugin_quota.driver == "count" -%} +mailbox_list_index = yes +{% endif %} + +# The minimum number of mails in a mailbox before updates are done to cache +# file. This allows optimizing Dovecot's behavior to do less disk writes at +# the cost of more disk reads. +#mail_cache_min_mail_count = 0 + +# When IDLE command is running, mailbox is checked once in a while to see if +# there are any new mails or other changes. This setting defines the minimum +# time to wait between those checks. Dovecot can also use inotify and +# kqueue to find out immediately when changes occur. +#mailbox_idle_check_interval = 30 secs + +# Save mails with CR+LF instead of plain LF. This makes sending those mails +# take less CPU, especially with sendfile() syscall with Linux and FreeBSD. +# But it also creates a bit more disk I/O which may just make it slower. +# Also note that if other software reads the mboxes/maildirs, they may handle +# the extra CRs wrong and cause problems. +#mail_save_crlf = no + +# Max number of mails to keep open and prefetch to memory. This only works with +# some mailbox formats and/or operating systems. +#mail_prefetch_count = 0 + +# How often to scan for stale temporary files and delete them (0 = never). +# These should exist only after Dovecot dies in the middle of saving mails. +#mail_temp_scan_interval = 1w + +## +## Maildir-specific settings +## + +# By default LIST command returns all entries in maildir beginning with a dot. +# Enabling this option makes Dovecot return only entries which are directories. +# This is done by stat()ing each entry, so it causes more disk I/O. +# (For systems setting struct dirent->d_type, this check is free and it's +# done always regardless of this setting) +#maildir_stat_dirs = no + +# When copying a message, do it with hard links whenever possible. This makes +# the performance much better, and it's unlikely to have any side effects. +#maildir_copy_with_hardlinks = yes + +# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only +# when its mtime changes unexpectedly or when we can't find the mail otherwise. +#maildir_very_dirty_syncs = no + +# If enabled, Dovecot doesn't use the S= in the Maildir filenames for +# getting the mail's physical size, except when recalculating Maildir++ quota. +# This can be useful in systems where a lot of the Maildir filenames have a +# broken size. The performance hit for enabling this is very small. +#maildir_broken_filename_sizes = no + +# Always move mails from new/ directory to cur/, even when the \Recent flags +# aren't being reset. +#maildir_empty_new = no + +## +## mbox-specific settings +## + +# Which locking methods to use for locking mbox. There are four available: +# dotlock: Create .lock file. This is the oldest and most NFS-safe +# solution. If you want to use /var/mail/ like directory, the users +# will need write access to that directory. +# dotlock_try: Same as dotlock, but if it fails because of permissions or +# because there isn't enough disk space, just skip it. +# fcntl : Use this if possible. Works with NFS too if lockd is used. +# flock : May not exist in all systems. Doesn't work with NFS. +# lockf : May not exist in all systems. Doesn't work with NFS. +# +# You can use multiple locking methods; if you do the order they're declared +# in is important to avoid deadlocks if other MTAs/MUAs are using multiple +# locking methods as well. Some operating systems don't allow using some of +# them simultaneously. +# +# The Debian value for mbox_write_locks differs from upstream Dovecot. It is +# changed to be compliant with Debian Policy (section 11.6) for NFS safety. +# Dovecot: mbox_write_locks = dotlock fcntl +# Debian: mbox_write_locks = fcntl dotlock +# +#mbox_read_locks = fcntl +#mbox_write_locks = fcntl dotlock + +# Maximum time to wait for lock (all of them) before aborting. +#mbox_lock_timeout = 5 mins + +# If dotlock exists but the mailbox isn't modified in any way, override the +# lock file after this much time. +#mbox_dotlock_change_timeout = 2 mins + +# When mbox changes unexpectedly we have to fully read it to find out what +# changed. If the mbox is large this can take a long time. Since the change +# is usually just a newly appended mail, it'd be faster to simply read the +# new mails. If this setting is enabled, Dovecot does this but still safely +# fallbacks to re-reading the whole mbox file whenever something in mbox isn't +# how it's expected to be. The only real downside to this setting is that if +# some other MUA changes message flags, Dovecot doesn't notice it immediately. +# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK +# commands. +#mbox_dirty_syncs = yes + +# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE, +# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored. +#mbox_very_dirty_syncs = no + +# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK +# commands and when closing the mailbox). This is especially useful for POP3 +# where clients often delete all mails. The downside is that our changes +# aren't immediately visible to other MUAs. +#mbox_lazy_writes = yes + +# If mbox size is smaller than this (e.g. 100k), don't write index files. +# If an index file already exists it's still read, just not updated. +#mbox_min_index_size = 0 + +# Mail header selection algorithm to use for MD5 POP3 UIDLs when +# pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired +# algorithm, but it fails if the first Received: header isn't unique in all +# mails. An alternative algorithm is "all" that selects all headers. +#mbox_md5 = apop3d + +## +## mdbox-specific settings +## + +# Maximum dbox file size until it's rotated. +#mdbox_rotate_size = 2M + +# Maximum dbox file age until it's rotated. Typically in days. Day begins +# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. +#mdbox_rotate_interval = 0 + +# When creating new mdbox files, immediately preallocate their size to +# mdbox_rotate_size. This setting currently works only in Linux with some +# filesystems (ext4, xfs). +#mdbox_preallocate_space = no + +## +## Mail attachments +## + +# sdbox and mdbox support saving mail attachments to external files, which +# also allows single instance storage for them. Other backends don't support +# this for now. + +# Directory root where to store mail attachments. Disabled, if empty. +mail_attachment_dir = {% if dovecot_sis_enable -%} +{{ dovecot_sis_directory }} +{% endif %} + +# Attachments smaller than this aren't saved externally. It's also possible to +# write a plugin to disable saving specific attachments externally. +mail_attachment_min_size = {{ dovecot_sis_min_size }} + +# Filesystem backend to use for saving attachments: +# posix : No SiS done by Dovecot (but this might help FS's own deduplication) +# sis posix : SiS with immediate byte-by-byte comparison during saving +# sis-queue posix : SiS with delayed comparison and deduplication +mail_attachment_fs = {% if dovecot_sis_queue_enable -%} +sis-queue {{ dovecot_sis_queue_directory }}:posix +{%- else -%} +sis posix +{% endif %} + +# Hash format to use in attachment filenames. You can add any text and +# variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. +# Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits +mail_attachment_hash = {{ dovecot_sis_hash }} diff --git a/templates/10-master.conf.j2 b/templates/10-master.conf.j2 new file mode 100644 index 0000000..dbe1cbf --- /dev/null +++ b/templates/10-master.conf.j2 @@ -0,0 +1,126 @@ +#default_process_limit = 100 +#default_client_limit = 1000 + +# Default VSZ (virtual memory size) limit for service processes. This is mainly +# intended to catch and kill processes that leak memory before they eat up +# everything. +#default_vsz_limit = 256M + +# Login user is internally used by login processes. This is the most untrusted +# user in Dovecot system. It shouldn't have access to anything at all. +#default_login_user = dovenull + +# Internal user is used by unprivileged processes. It should be separate from +# login user, so that login processes can't disturb other processes. +#default_internal_user = dovecot + +service imap-login { + inet_listener imap { + {% if not dovecot_proto_imap_enable -%} + port = 0 + {% endif -%} + #port = 143 + } + inet_listener imaps { + {% if not dovecot_proto_imaps_enable -%} + port = 0 + {% endif -%} + #port = 993 + #ssl = yes + } + + # Number of connections to handle before starting a new process. Typically + # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0 + # is faster. + service_count = 0 + + # Number of processes to always keep waiting for more connections. + process_min_avail = 1 + + # If you set service_count=0, you probably need to grow this. + #vsz_limit = $default_vsz_limit +} + +service pop3-login { + inet_listener pop3 { + {% if not dovecot_proto_pop3_enable -%} + port = 0 + {% endif -%} + #port = 110 + } + inet_listener pop3s { + {% if not dovecot_proto_pop3s_enable -%} + port = 0 + {% endif -%} + #port = 995 + #ssl = yes + } +} + +service lmtp { + unix_listener lmtp { + #mode = 0666 + } + + # Create inet listener only if you can't use the above UNIX socket + #inet_listener lmtp { + # Avoid making LMTP visible for the entire internet + #address = + #port = + #} +} + +service imap { + # Most of the memory goes to mmap()ing files. You may need to increase this + # limit if you have huge mailboxes. + #vsz_limit = $default_vsz_limit + + # Max. number of IMAP processes (connections) + #process_limit = 1024 +} + +service pop3 { + # Max. number of POP3 processes (connections) + #process_limit = 1024 +} + +service auth { + # auth_socket_path points to this userdb socket by default. It's typically + # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have + # full permissions to this socket are able to get a list of all usernames and + # get the results of everyone's userdb lookups. + # + # The default 0666 mode allows anyone to connect to the socket, but the + # userdb lookups will succeed only if the userdb returns an "uid" field that + # matches the caller process's UID. Also if caller's uid or gid matches the + # socket's uid or gid the lookup succeeds. Anything else causes a failure. + # + # To give the caller full permissions to lookup all users, set the mode to + # something else than 0666 and Dovecot lets the kernel enforce the + # permissions (e.g. 0777 allows everyone full permissions). + unix_listener auth-userdb { + #mode = 0666 + #user = + #group = + } + + # Auth process is run as this user. + #user = $default_internal_user +} + +service auth-worker { + # Auth worker process is run as root by default, so that it can access + # /etc/shadow. If this isn't necessary, the user should be changed to + # $default_internal_user. + #user = root +} + +service dict { + # If dict proxy is used, mail processes should have access to its socket. + # For example: mode=0660, group=vmail and global mail_access_groups=vmail + unix_listener dict { + #mode = 0600 + #user = + #group = + } +} diff --git a/templates/10-ssl.conf.j2 b/templates/10-ssl.conf.j2 new file mode 100644 index 0000000..f7ab77b --- /dev/null +++ b/templates/10-ssl.conf.j2 @@ -0,0 +1,70 @@ +## +## SSL settings +## + +# SSL/TLS support: yes, no, required. +ssl = {% if dovecot_ssl_enable -%} +{% if dovecot_ssl_require -%} +required +{%- else -%} +yes +{% endif %} +{%- else -%} +no +{% endif %} + +# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before +# dropping root privileges, so keep the key file unreadable by anyone but +# root. Included doc/mkcert.sh can be used to easily generate self-signed +# certificate, just make sure to update the domains in dovecot-openssl.cnf +ssl_cert = <{{ dovecot_ssl_cert }} +ssl_key = <{{ dovecot_ssl_key }} + +# If key file is password protected, give the password here. Alternatively +# give it when starting dovecot with -p parameter. Since this file is often +# world-readable, you may want to place this setting instead to a different +# root owned 0600 file by using ssl_key_password = + +## +## Quota limits +## + +# Quota limits are set using "quota_rule" parameters. To get per-user quota +# limits, you can set/override them by returning "quota_rule" extra field +# from userdb. It's also possible to give mailbox-specific limits, for example +# to give additional 100 MB when saving to Trash: + +plugin { + quota_rule = *:storage={{dovecot_plugin_quota.limit}} + {% for key, value in dovecot_plugin_quota.mailbox_additional_limit.iteritems() -%} + quota_rule{{ loop.index + 1 }} = {{ key }}:storage=+{{value}} + {% endfor %} + + # LDA/LMTP allows saving the last mail to bring user from under quota to + # over quota, if the quota doesn't grow too high. Default is to allow as + # long as quota will stay under 10% above the limit. Also allowed e.g. 10M. + quota_grace = {{ dovecot_plugin_quota.grace | regex_replace("%.*$","%%") }} + + {% if dovecot_plugin_quota.driver == "count" -%} + quota_vsizes = yes + {% endif %} +} + +## +## Quota warnings +## + +# You can execute a given command when user exceeds a specified quota limit. +# Each quota root has separate limits. Only the command for the first +# exceeded limit is excecuted, so put the highest limit first. +# The commands are executed via script service by connecting to the named +# UNIX socket (quota-warning below). +# Note that % needs to be escaped as %%, otherwise "% " expands to empty. + +plugin { + #quota_warning = storage=95%% quota-warning 95 %u + #quota_warning2 = storage=80%% quota-warning 80 %u +} + +# Example quota-warning service. The unix listener's permissions should be +# set in a way that mail processes can connect to it. Below example assumes +# that mail processes run as vmail user. If you use mode=0666, all system users +# can generate quota warnings to anyone. +#service quota-warning { +# executable = script /usr/local/bin/quota-warning.sh +# user = dovecot +# unix_listener quota-warning { +# user = vmail +# } +#} + +## +## Quota backends +## + +# Multiple backends are supported: +# dirsize: Find and sum all the files found from mail directory. +# Extremely SLOW with Maildir. It'll eat your CPU and disk I/O. +# dict: Keep quota stored in dictionary (eg. SQL) +# maildir: Maildir++ quota +# fs: Read-only support for filesystem quota + +plugin { + quota = {{ dovecot_plugin_quota.driver }}:User quota + #quota = dirsize:User quota + #quota = maildir:User quota + #quota = dict:User quota::proxy::quota + #quota = fs:User quota +} + +# Multiple quota roots are also possible, for example this gives each user +# their own 100MB quota and one shared 1GB quota within the domain: +plugin { + #quota = dict:user::proxy::quota + #quota2 = dict:domain:%d:proxy::quota_domain + #quota_rule = *:storage=102400 + #quota2_rule = *:storage=1048576 +} diff --git a/templates/90-sieve.conf.j2 b/templates/90-sieve.conf.j2 new file mode 100644 index 0000000..e220820 --- /dev/null +++ b/templates/90-sieve.conf.j2 @@ -0,0 +1,214 @@ +## +## Settings for the Sieve interpreter +## + +# Do not forget to enable the Sieve plugin in 15-lda.conf and 20-lmtp.conf +# by adding it to the respective mail_plugins= settings. + +# The Sieve interpreter can retrieve Sieve scripts from several types of +# locations. The default `file' location type is a local filesystem path +# pointing to a Sieve script file or a directory containing multiple Sieve +# script files. More complex setups can use other location types such as +# `ldap' or `dict' to fetch Sieve scripts from remote databases. +# +# All settings that specify the location of one ore more Sieve scripts accept +# the following syntax: +# +# location = [:]path[;