use confd for most settings
This commit is contained in:
Mauro Torrez
parent
77fb4caf93
commit
1ef3a28a71
@ -25,9 +25,6 @@ dovecot_auth_mechanisms: plain
|
||||
# como transformar el nombre de usuario antes de autenticar
|
||||
dovecot_auth_username_format: "%Lu"
|
||||
|
||||
# habilitar userdb/passdb de usuarios del sistema?
|
||||
dovecot_auth_system_enable: no
|
||||
|
||||
# habilitar usuarios master?
|
||||
dovecot_auth_master_enable: no
|
||||
|
||||
@ -36,10 +33,16 @@ dovecot_auth_master_enable: no
|
||||
# habilitar userdb/passdb ldap?
|
||||
dovecot_ldap_enable: yes
|
||||
|
||||
# servidores ldap
|
||||
dovecot_ldap_hosts: []
|
||||
|
||||
# servidores ldap
|
||||
dovecot_ldap_uris:
|
||||
- "{{ ldap_uri | default('ldap://localhost') }}"
|
||||
|
||||
# autenticar con clave provista por usuario
|
||||
dovecot_ldap_bind: yes
|
||||
|
||||
# version del protocolo LDAP
|
||||
dovecot_ldap_version: 3
|
||||
|
||||
|
||||
32
files/10-auth.conf.tmpl
Normal file
32
files/10-auth.conf.tmpl
Normal file
@ -0,0 +1,32 @@
|
||||
auth_realms = {{ getv "/mail/domains" }}
|
||||
auth_default_realm = {{ first 1 (split (getv "/mail/domains") " ") }}
|
||||
auth_username_format = {{ getv "/auth/username/format" }}
|
||||
auth_mechanisms = {{ getv "/auth/mechanisms" }}
|
||||
|
||||
|
||||
{{ if eq (getv "/auth/master/enable") "yes"}}
|
||||
passdb {
|
||||
driver = passwd-file
|
||||
master = yes
|
||||
args = /etc/dovecot/master-users
|
||||
|
||||
# Unless you're using PAM, you probably still want the destination user to
|
||||
# be looked up from passdb that it really exists. pass=yes does that.
|
||||
pass = yes
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
|
||||
{{ if eq (getv "/auth/ldap/enable") "yes"}}
|
||||
passdb {
|
||||
driver = ldap
|
||||
args = /etc/dovecot/local.d/ldap.conf.ext
|
||||
}
|
||||
userdb {
|
||||
driver = prefetch
|
||||
}
|
||||
userdb {
|
||||
driver = ldap
|
||||
args = /etc/dovecot/local.d/ldap2.conf.ext
|
||||
}
|
||||
{{ end }}
|
||||
@ -7,7 +7,7 @@ namespace inbox {
|
||||
# Namespace type: private, shared or public
|
||||
#type = private
|
||||
separator = /
|
||||
#prefix =
|
||||
#prefix =
|
||||
#location =
|
||||
|
||||
# There can be only one INBOX, and this setting defines which namespace
|
||||
@ -51,7 +51,7 @@ mail_gid = vmail
|
||||
|
||||
# A comment or note that is associated with the server. This value is
|
||||
# accessible for authenticated users through the IMAP METADATA server
|
||||
# entry "/shared/comment".
|
||||
# entry "/shared/comment".
|
||||
#mail_server_comment = ""
|
||||
|
||||
# Indicates a method for contacting the server administrator. According to
|
||||
@ -59,7 +59,7 @@ mail_gid = vmail
|
||||
# is currently not enforced. Use for example mailto:admin@example.com. This
|
||||
# value is accessible for authenticated users through the IMAP METADATA server
|
||||
# entry "/shared/admin".
|
||||
#mail_server_admin =
|
||||
#mail_server_admin =
|
||||
|
||||
##
|
||||
## Mail processes
|
||||
@ -112,7 +112,7 @@ mail_gid = vmail
|
||||
# WARNING: Never add directories here which local users can modify, that
|
||||
# may lead to root exploit. Usually this should be done only if you don't
|
||||
# allow shell access for users. <doc/wiki/Chrooting.txt>
|
||||
#valid_chroot_dirs =
|
||||
#valid_chroot_dirs =
|
||||
|
||||
# Default chroot directory for mail processes. This can be overridden for
|
||||
# specific users in user database by giving /./ in user's home directory
|
||||
@ -120,7 +120,7 @@ mail_gid = vmail
|
||||
# need to do chrooting, Dovecot doesn't allow users to access files outside
|
||||
# their mail directory anyway. If your home directories are prefixed with
|
||||
# the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt>
|
||||
#mail_chroot =
|
||||
#mail_chroot =
|
||||
|
||||
# UNIX socket path to master authentication server to find users.
|
||||
# This is used by imap (for shared users) and lda.
|
||||
@ -237,7 +237,7 @@ mailbox_list_index = yes
|
||||
# fallbacks to re-reading the whole mbox file whenever something in mbox isn't
|
||||
# how it's expected to be. The only real downside to this setting is that if
|
||||
# some other MUA changes message flags, Dovecot doesn't notice it immediately.
|
||||
# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
|
||||
# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
|
||||
# commands.
|
||||
#mbox_dirty_syncs = yes
|
||||
|
||||
|
||||
@ -88,8 +88,8 @@ service auth {
|
||||
# permissions (e.g. 0777 allows everyone full permissions).
|
||||
unix_listener auth-userdb {
|
||||
#mode = 0666
|
||||
#user =
|
||||
#group =
|
||||
#user =
|
||||
#group =
|
||||
}
|
||||
|
||||
inet_listener {
|
||||
@ -112,7 +112,7 @@ service dict {
|
||||
# For example: mode=0660, group=vmail and global mail_access_groups=vmail
|
||||
unix_listener dict {
|
||||
#mode = 0600
|
||||
#user =
|
||||
#group =
|
||||
#user =
|
||||
#group =
|
||||
}
|
||||
}
|
||||
|
||||
@ -21,7 +21,7 @@ ssl_key = </ssl/key.pem
|
||||
# PEM encoded trusted certificate authority. Set this only if you intend to use
|
||||
# ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
|
||||
# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
|
||||
#ssl_ca =
|
||||
#ssl_ca =
|
||||
|
||||
# Require that CRL check succeeds for client certificates.
|
||||
#ssl_require_crl = yes
|
||||
|
||||
@ -1,2 +0,0 @@
|
||||
# Enable quota plugin
|
||||
mail_plugins = $mail_plugins quota
|
||||
@ -11,11 +11,11 @@
|
||||
# implicitly when it is first accessed. The user can also be automatically
|
||||
# subscribed to the mailbox after creation. The following values are
|
||||
# defined for this setting:
|
||||
#
|
||||
#
|
||||
# no - Never created automatically.
|
||||
# create - Automatically created, but no automatic subscription.
|
||||
# subscribe - Automatically created and subscribed.
|
||||
#
|
||||
#
|
||||
# special_use:
|
||||
# A space-separated list of SPECIAL-USE flags (RFC 6154) to use for the
|
||||
# mailbox. There are no validity checks, so you could specify anything
|
||||
@ -23,7 +23,7 @@
|
||||
# standard ones specified in the RFC:
|
||||
#
|
||||
# \All - This (virtual) mailbox presents all messages in the
|
||||
# user's message store.
|
||||
# user's message store.
|
||||
# \Archive - This mailbox is used to archive messages.
|
||||
# \Drafts - This mailbox is used to hold draft messages.
|
||||
# \Flagged - This (virtual) mailbox presents all messages in the
|
||||
|
||||
@ -37,7 +37,7 @@ imap_capability = +SPECIAL_USE
|
||||
# ID field names and values to send to clients. Using * as the value makes
|
||||
# Dovecot use the default value. The following fields have default values
|
||||
# currently: name, version, os, os-version, support-url, support-email.
|
||||
#imap_id_send =
|
||||
#imap_id_send =
|
||||
|
||||
# ID fields sent by client to log. * means everything.
|
||||
#imap_id_log =
|
||||
@ -60,7 +60,7 @@ imap_capability = +SPECIAL_USE
|
||||
# greyed out, instead of only later giving "not selectable" popup error.
|
||||
#
|
||||
# The list is space-separated.
|
||||
#imap_client_workarounds =
|
||||
#imap_client_workarounds =
|
||||
|
||||
# Host allowed in URLAUTH URLs sent by client. "*" allows all.
|
||||
#imap_urlauth_host =
|
||||
|
||||
5
files/20-lmtp.conf.tmpl
Normal file
5
files/20-lmtp.conf.tmpl
Normal file
@ -0,0 +1,5 @@
|
||||
protocol lmtp {
|
||||
# postmaster_address aparentemente es obligatorio
|
||||
postmaster_address = postmaster@{{ first 1 (split (getv "/mail/domains") " ") }}
|
||||
mail_plugins = $mail_plugins sieve
|
||||
}
|
||||
27
files/90-quota.conf.tmpl
Normal file
27
files/90-quota.conf.tmpl
Normal file
@ -0,0 +1,27 @@
|
||||
plugin {
|
||||
#quota_rule = *:storage=1G
|
||||
#quota_rule2 = Trash:storage=+100M
|
||||
quota_rule = *:storage={{ dovecot_quota_limit }}
|
||||
{% for key, value in dovecot_quota_additional_limit.items() %}
|
||||
quota_rule{{ loop.index + 1 }} = {{ key }}:storage=+{{ value }}
|
||||
{% endfor %}
|
||||
|
||||
# LDA/LMTP allows saving the last mail to bring user from under quota to
|
||||
# over quota, if the quota doesn't grow too high. Default is to allow as
|
||||
# long as quota will stay under 10% above the limit. Also allowed e.g. 10M.
|
||||
#quota_grace = 10%%
|
||||
quota_grace = {{ dovecot_quota_grace | regex_replace("%.*$","%%") }}
|
||||
|
||||
{% if dovecot_quota_driver == "count" %}
|
||||
quota_vsizes = yes
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
|
||||
plugin {
|
||||
quota = {{ dovecot_quota_driver }}:User quota
|
||||
#quota = dirsize:User quota
|
||||
#quota = maildir:User quota
|
||||
#quota = dict:User quota::proxy::quota
|
||||
#quota = fs:User quota
|
||||
}
|
||||
@ -16,7 +16,7 @@
|
||||
#
|
||||
# location = [<type>:]path[;<option>[=<value>][;...]]
|
||||
#
|
||||
# If the type prefix is omitted, the script location type is 'file' and the
|
||||
# If the type prefix is omitted, the script location type is 'file' and the
|
||||
# location is interpreted as a local filesystem path pointing to a Sieve script
|
||||
# file or directory. Refer to Pigeonhole wiki or INSTALL file for more
|
||||
# information.
|
||||
@ -27,7 +27,7 @@ plugin {
|
||||
# delivery. The "include" extension uses this location for retrieving
|
||||
# :personal" scripts. This is also where the ManageSieve service will store
|
||||
# the user's scripts, if supported.
|
||||
#
|
||||
#
|
||||
# Currently only the 'file:' location type supports ManageSieve operation.
|
||||
# Other location types like 'dict:' and 'ldap:' can currently only
|
||||
# be used as a read-only script source ().
|
||||
@ -46,9 +46,9 @@ plugin {
|
||||
# script.
|
||||
#sieve_default = /var/lib/dovecot/sieve/default.sieve
|
||||
|
||||
# The name by which the default Sieve script (as configured by the
|
||||
# sieve_default setting) is visible to the user through ManageSieve.
|
||||
#sieve_default_name =
|
||||
# The name by which the default Sieve script (as configured by the
|
||||
# sieve_default setting) is visible to the user through ManageSieve.
|
||||
#sieve_default_name =
|
||||
|
||||
# Location for ":global" include scripts as used by the "include" extension.
|
||||
#sieve_global =
|
||||
@ -63,7 +63,7 @@ plugin {
|
||||
#sieve_discard =
|
||||
|
||||
# Location Sieve of scripts that need to be executed before the user's
|
||||
# personal script. If a 'file' location path points to a directory, all the
|
||||
# personal script. If a 'file' location path points to a directory, all the
|
||||
# Sieve scripts contained therein (with the proper `.sieve' extension) are
|
||||
# executed. The order of execution within that directory is determined by the
|
||||
# file names, using a normal 8bit per-character comparison.
|
||||
@ -181,18 +181,18 @@ plugin {
|
||||
## TRACE DEBUGGING
|
||||
# Trace debugging provides detailed insight in the operations performed by
|
||||
# the Sieve script. These settings apply to both the LDA Sieve plugin and the
|
||||
# IMAPSIEVE plugin.
|
||||
# IMAPSIEVE plugin.
|
||||
#
|
||||
# WARNING: On a busy server, this functionality can quickly fill up the trace
|
||||
# directory with a lot of trace files. Enable this only temporarily and as
|
||||
# selective as possible.
|
||||
|
||||
|
||||
# The directory where trace files are written. Trace debugging is disabled if
|
||||
# this setting is not configured or if the directory does not exist. If the
|
||||
# this setting is not configured or if the directory does not exist. If the
|
||||
# path is relative or it starts with "~/" it is interpreted relative to the
|
||||
# current user's home directory.
|
||||
#sieve_trace_dir =
|
||||
|
||||
|
||||
# The verbosity level of the trace messages. Trace debugging is disabled if
|
||||
# this setting is not configured. Possible values are:
|
||||
#
|
||||
@ -203,12 +203,12 @@ plugin {
|
||||
# "matching" - Print all executed commands, performed tests and the
|
||||
# values matched in those tests.
|
||||
#sieve_trace_level =
|
||||
|
||||
|
||||
# Enables highly verbose debugging messages that are usually only useful for
|
||||
# developers.
|
||||
#sieve_trace_debug = no
|
||||
|
||||
|
||||
# Enables showing byte code addresses in the trace output, rather than only
|
||||
# the source line numbers.
|
||||
#sieve_trace_addresses = no
|
||||
#sieve_trace_addresses = no
|
||||
}
|
||||
|
||||
@ -38,18 +38,20 @@ ADD 10-mail.conf \
|
||||
20-imap.conf \
|
||||
90-antispam.conf \
|
||||
90-sieve.conf \
|
||||
auth-ldap.conf.ext \
|
||||
auth-master.conf.ext \
|
||||
/etc/dovecot/conf.d/
|
||||
|
||||
ADD local.conf /etc/dovecot/
|
||||
ADD junk-filter.sieve /etc/dovecot/sieve/before/
|
||||
|
||||
ADD submission.conf.tmpl \
|
||||
ADD \
|
||||
10-auth.conf.tmpl \
|
||||
20-lmtp.conf.tmpl \
|
||||
ldap.conf.ext.tmpl \
|
||||
submission.conf.tmpl \
|
||||
/etc/confd/templates/
|
||||
ADD confd.toml /etc/confd/conf.d/
|
||||
|
||||
ADD junk-filter.sieve /etc/dovecot/sieve/before/
|
||||
# RUN sievec /etc/dovecot/sieve/before && sievec /etc/dovecot/sieve/after
|
||||
RUN sievec /etc/dovecot/sieve/before/junk-filter.sieve
|
||||
|
||||
VOLUME /etc/dovecot /ssl /vmail
|
||||
|
||||
|
||||
@ -1,37 +0,0 @@
|
||||
# Authentication for LDAP users. Included from 10-auth.conf.
|
||||
#
|
||||
# <doc/wiki/AuthDatabase.LDAP.txt>
|
||||
|
||||
# Usar LDAP para validar claves
|
||||
passdb {
|
||||
driver = ldap
|
||||
|
||||
# Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext
|
||||
args = /etc/dovecot/dovecot-ldap.conf.ext
|
||||
}
|
||||
|
||||
# "prefetch" user database means that the passdb already provided the
|
||||
# needed information and there's no need to do a separate userdb lookup.
|
||||
# <doc/wiki/UserDatabase.Prefetch.txt>
|
||||
userdb {
|
||||
driver = prefetch
|
||||
}
|
||||
|
||||
# Usar LDAP para obtener info de usuario
|
||||
# Notar que se usa un enlace al archivo dovecot-ldap.conf.ext,
|
||||
# esto es para poder hacer conexiones asíncronas y optimizar performance
|
||||
userdb {
|
||||
driver = ldap
|
||||
args = /etc/dovecot/dovecot-ldap2.conf.ext
|
||||
|
||||
# Default fields can be used to specify defaults that LDAP may override
|
||||
#default_fields = home=/home/virtual/%u
|
||||
}
|
||||
|
||||
# If you don't have any user-specific settings, you can avoid the userdb LDAP
|
||||
# lookup by using userdb static instead of userdb ldap, for example:
|
||||
# <doc/wiki/UserDatabase.Static.txt>
|
||||
#userdb {
|
||||
# driver = static
|
||||
# args = uid=vmail gid=vmail home=/srv/vmail/%d/%n
|
||||
#}
|
||||
@ -1,16 +0,0 @@
|
||||
# Authentication for master users. Included from 10-auth.conf.
|
||||
|
||||
# By adding master=yes setting inside a passdb you make the passdb a list
|
||||
# of "master users", who can log in as anyone else.
|
||||
# <doc/wiki/Authentication.MasterUsers.txt>
|
||||
|
||||
# Example master user passdb using passwd-file. You can use any passdb though.
|
||||
passdb {
|
||||
driver = passwd-file
|
||||
master = yes
|
||||
args = /etc/dovecot/master-users
|
||||
|
||||
# Unless you're using PAM, you probably still want the destination user to
|
||||
# be looked up from passdb that it really exists. pass=yes does that.
|
||||
pass = yes
|
||||
}
|
||||
@ -2,14 +2,70 @@
|
||||
src = "submission.conf.tmpl"
|
||||
dest = "/etc/dovecot/local.d/submission.conf"
|
||||
keys = [
|
||||
"submission/enable",
|
||||
"submission/relay/host",
|
||||
"submission/relay/port",
|
||||
"submission/relay/trusted",
|
||||
"submission/relay/user",
|
||||
"submission/relay/master/user",
|
||||
"submission/relay/password",
|
||||
"submission/relay/ssl",
|
||||
"submission/relay/ssl/verify",
|
||||
"submission/relay/rawlog/dir"
|
||||
"/submission/enable",
|
||||
"/submission/relay/host",
|
||||
"/submission/relay/port",
|
||||
"/submission/relay/trusted",
|
||||
"/submission/relay/user",
|
||||
"/submission/relay/master/user",
|
||||
"/submission/relay/password",
|
||||
"/submission/relay/ssl",
|
||||
"/submission/relay/ssl/verify",
|
||||
"/submission/relay/rawlog/dir"
|
||||
]
|
||||
|
||||
[template]
|
||||
src = "10-auth.conf.tmpl"
|
||||
dest = "/etc/dovecot/local.d/10-auth.conf"
|
||||
keys = [
|
||||
"/mail/domains",
|
||||
"/auth/username/format",
|
||||
"/auth/mechanisms",
|
||||
"/auth/master/enable",
|
||||
"/auth/ldap/enable"
|
||||
]
|
||||
|
||||
[template]
|
||||
src = "20-lmtp.conf.tmpl"
|
||||
dest = "/etc/dovecot/local.d/20-lmtp.conf"
|
||||
keys = [
|
||||
"/mail/domains"
|
||||
]
|
||||
|
||||
[template]
|
||||
src = "ldap.conf.ext.tmpl"
|
||||
dest = "/etc/dovecot/local.d/ldap.conf.ext"
|
||||
keys = [
|
||||
"/ldap/hosts",
|
||||
"/ldap/uris",
|
||||
"/ldap/bind",
|
||||
"/ldap/version",
|
||||
"/ldap/base",
|
||||
"/ldap/scope",
|
||||
"/ldap/user/attrs",
|
||||
"/ldap/user/filter",
|
||||
"/ldap/pass/attrs",
|
||||
"/ldap/pass/filter",
|
||||
"/ldap/iterate/attrs",
|
||||
"/ldap/iterate/filter",
|
||||
"/ldap/default/pass/scheme",
|
||||
]
|
||||
|
||||
[template]
|
||||
src = "ldap.conf.ext.tmpl"
|
||||
dest = "/etc/dovecot/local.d/ldap2.conf.ext"
|
||||
keys = [
|
||||
"/ldap/hosts",
|
||||
"/ldap/uris",
|
||||
"/ldap/bind",
|
||||
"/ldap/version",
|
||||
"/ldap/base",
|
||||
"/ldap/scope",
|
||||
"/ldap/user/attrs",
|
||||
"/ldap/user/filter",
|
||||
"/ldap/pass/attrs",
|
||||
"/ldap/pass/filter",
|
||||
"/ldap/iterate/attrs",
|
||||
"/ldap/iterate/filter",
|
||||
"/ldap/default/pass/scheme",
|
||||
]
|
||||
|
||||
16
files/ldap.conf.ext.tmpl
Normal file
16
files/ldap.conf.ext.tmpl
Normal file
@ -0,0 +1,16 @@
|
||||
{{ if (getv "/ldap/hosts") }}
|
||||
hosts = {{ getv "/ldap/hosts" }}
|
||||
{{ else }}
|
||||
uris = {{ getv "/ldap/uris" }}
|
||||
{{ end }}
|
||||
auth_bind = {{ getv "/ldap/bind" }}
|
||||
ldap_version = {{ getv "/ldap/version" }}
|
||||
base = {{ getv "/ldap/base" }}
|
||||
scope = {{ getv "/ldap/scope" }}
|
||||
user_attrs = {{ getv "/ldap/user/attrs" }}
|
||||
user_filter = {{ getv "/ldap/user/filter" }}
|
||||
pass_attrs = {{ getv "/ldap/pass/attrs" }}
|
||||
pass_filter = {{ getv "/ldap/pass/filter" }}
|
||||
iterate_attrs = {{ getv "/ldap/iterate/attrs" }}
|
||||
iterate_filter = {{ getv "/ldap/iterate/filter" }}
|
||||
default_pass_scheme = {{ getv "/ldap/default/pass/scheme" }}
|
||||
@ -11,16 +11,17 @@
|
||||
dest: /root/.dovecot-docker-image
|
||||
loop:
|
||||
- Dockerfile
|
||||
- 10-auth.conf.tmpl
|
||||
- 10-mail.conf
|
||||
- 10-master.conf
|
||||
- 10-ssl.conf
|
||||
- 11-quota.conf
|
||||
- 15-mailboxes.conf
|
||||
- 20-imap.conf
|
||||
- 20-lmtp.conf.tmpl
|
||||
- 90-antispam.conf
|
||||
- 90-sieve.conf
|
||||
- auth-ldap.conf.ext
|
||||
- auth-master.conf.ext
|
||||
- ldap.conf.ext
|
||||
- junk-filter.sieve
|
||||
- local.conf
|
||||
- submission.conf.tmpl
|
||||
@ -50,6 +51,11 @@
|
||||
- 143:143
|
||||
- 2000:2000
|
||||
env:
|
||||
MAIL_DOMAINS: "{{ mail_domains.keys() | list | join(' ') }}"
|
||||
AUTH_MECHANISMS: "{{ dovecot_auth_mechanisms }}"
|
||||
AUTH_USERNAME_FORMAT: "{{ dovecot_auth_username_format }}"
|
||||
AUTH_LDAP_ENABLE: "{{ 'yes' if dovecot_ldap_enable else '' }}"
|
||||
AUTH_MASTER_ENABLE: "{{ 'yes' if dovecot_auth_master_enable else '' }}"
|
||||
SUBMISSION_ENABLE: "yes"
|
||||
SUBMISSION_RELAY_HOST: postfix
|
||||
SUBMISSION_RELAY_PORT: "25"
|
||||
@ -60,7 +66,20 @@
|
||||
# SUBMISSION_RELAY_SSL: starttls
|
||||
# SUBMISSION_RELAY_SSL_VERIFY: "no"
|
||||
# SUBMISSION_RELAY_RAWLOG_DIR:
|
||||
register: container
|
||||
LDAP_HOSTS: "{{ dovecot_ldap_hosts | join(' ') }}"
|
||||
LDAP_URIS: "{{ dovecot_ldap_uris | join(' ') }}"
|
||||
LDAP_BIND: "{{ 'yes' if dovecot_ldap_bind else 'no' }}"
|
||||
LDAP_VERSION: "{{ dovecot_ldap_version }}"
|
||||
LDAP_BASE: "{{ dovecot_ldap_base }}"
|
||||
LDAP_SCOPE: "{{ dovecot_ldap_scope }}"
|
||||
LDAP_USER_ATTRS: "{{ dovecot_ldap_user_attrs }}"
|
||||
LDAP_USER_FILTER: "{{ dovecot_ldap_user_filter }}"
|
||||
LDAP_PASS_ATTRS: "{{ dovecot_ldap_pass_attrs }}"
|
||||
LDAP_PASS_FILTER: "{{ dovecot_ldap_pass_filter }}"
|
||||
LDAP_ITERATE_ATTRS: "{{ dovecot_ldap_iterate_attrs }}"
|
||||
LDAP_ITERATE_FILTER: "{{ dovecot_ldap_iterate_filter }}"
|
||||
LDAP_DEFAULT_PASS_SCHEME: "{{ dovecot_ldap_default_pass_scheme }}"
|
||||
REGISTER: container
|
||||
|
||||
- name: Leer info de volumen {{ dovecot_volume_config }}
|
||||
docker_volume_info:
|
||||
@ -87,24 +106,12 @@
|
||||
dovecot_volume_ssl: "{{ lookup('vars','dovecot_volume_ssl') }}"
|
||||
dovecot_mountpoint_ssl: "{{ res_ssl.volume.Mountpoint }}"
|
||||
|
||||
- name: Configuración de Dovecot (1)
|
||||
template:
|
||||
dest: "{{ dovecot_mountpoint_config }}/conf.d/{{ item }}"
|
||||
src: "{{item}}.j2"
|
||||
loop:
|
||||
- 10-auth.conf
|
||||
- 20-lmtp.conf
|
||||
- 90-quota.conf
|
||||
notify: restart dovecot
|
||||
|
||||
- name: Configuración de Dovecot (2-LDAP)
|
||||
template:
|
||||
dest: "{{ dovecot_mountpoint_config }}/dovecot-ldap.conf.ext"
|
||||
src: "dovecot-ldap.conf.ext.j2"
|
||||
notify: restart dovecot
|
||||
|
||||
- name: Configuración de Dovecot (3-LDAP)
|
||||
template:
|
||||
dest: "{{ dovecot_mountpoint_config }}/dovecot-ldap2.conf.ext"
|
||||
src: "dovecot-ldap.conf.ext.j2"
|
||||
notify: restart dovecot
|
||||
# FIXME: configurar quota mediante confd
|
||||
#
|
||||
# - name: Configuración de Dovecot (1)
|
||||
# template:
|
||||
# dest: "{{ dovecot_mountpoint_config }}/conf.d/{{ item }}"
|
||||
# src: "{{item}}.j2"
|
||||
# loop:
|
||||
# - 90-quota.conf
|
||||
# notify: restart dovecot
|
||||
|
||||
@ -1,135 +0,0 @@
|
||||
##
|
||||
## Authentication processes
|
||||
##
|
||||
|
||||
# Disable LOGIN command and all other plaintext authentications unless
|
||||
# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
|
||||
# matches the local IP (ie. you're connecting from the same computer), the
|
||||
# connection is considered secure and plaintext authentication is allowed.
|
||||
# See also ssl=required setting.
|
||||
#disable_plaintext_auth = yes
|
||||
|
||||
# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
|
||||
# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used.
|
||||
#auth_cache_size = 0
|
||||
# Time to live for cached data. After TTL expires the cached record is no
|
||||
# longer used, *except* if the main database lookup returns internal failure.
|
||||
# We also try to handle password changes automatically: If user's previous
|
||||
# authentication was successful, but this one wasn't, the cache isn't used.
|
||||
# For now this works only with plaintext authentication.
|
||||
#auth_cache_ttl = 1 hour
|
||||
# TTL for negative hits (user not found, password mismatch).
|
||||
# 0 disables caching them completely.
|
||||
#auth_cache_negative_ttl = 1 hour
|
||||
|
||||
# Space separated list of realms for SASL authentication mechanisms that need
|
||||
# them. You can leave it empty if you don't want to support multiple realms.
|
||||
# Many clients simply use the first one listed here, so keep the default realm
|
||||
# first.
|
||||
auth_realms = {{ mail_domains | join(" ") }}
|
||||
|
||||
# Default realm/domain to use if none was specified. This is used for both
|
||||
# SASL realms and appending @domain to username in plaintext logins.
|
||||
auth_default_realm = {{ mail_domains | first }}
|
||||
|
||||
# List of allowed characters in username. If the user-given username contains
|
||||
# a character not listed in here, the login automatically fails. This is just
|
||||
# an extra check to make sure user can't exploit any potential quote escaping
|
||||
# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
|
||||
# set this value to empty.
|
||||
#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
|
||||
|
||||
# Username character translations before it's looked up from databases. The
|
||||
# value contains series of from -> to characters. For example "#@/@" means
|
||||
# that '#' and '/' characters are translated to '@'.
|
||||
#auth_username_translation =
|
||||
|
||||
# Username formatting before it's looked up from databases. You can use
|
||||
# the standard variables here, eg. %Lu would lowercase the username, %n would
|
||||
# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
|
||||
# "-AT-". This translation is done after auth_username_translation changes.
|
||||
auth_username_format = {{ dovecot_auth_username_format }}
|
||||
|
||||
# If you want to allow master users to log in by specifying the master
|
||||
# username within the normal username string (ie. not using SASL mechanism's
|
||||
# support for it), you can specify the separator character here. The format
|
||||
# is then <username><separator><master username>. UW-IMAP uses "*" as the
|
||||
# separator, so that could be a good choice.
|
||||
#auth_master_user_separator =
|
||||
|
||||
# Username to use for users logging in with ANONYMOUS SASL mechanism
|
||||
#auth_anonymous_username = anonymous
|
||||
|
||||
# Maximum number of dovecot-auth worker processes. They're used to execute
|
||||
# blocking passdb and userdb queries (eg. MySQL and PAM). They're
|
||||
# automatically created and destroyed as needed.
|
||||
#auth_worker_max_count = 30
|
||||
|
||||
# Host name to use in GSSAPI principal names. The default is to use the
|
||||
# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab
|
||||
# entries.
|
||||
#auth_gssapi_hostname =
|
||||
|
||||
# Kerberos keytab to use for the GSSAPI mechanism. Will use the system
|
||||
# default (usually /etc/krb5.keytab) if not specified. You may need to change
|
||||
# the auth service to run as root to be able to read this file.
|
||||
#auth_krb5_keytab =
|
||||
|
||||
# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
|
||||
# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>
|
||||
#auth_use_winbind = no
|
||||
|
||||
# Path for Samba's ntlm_auth helper binary.
|
||||
#auth_winbind_helper_path = /usr/bin/ntlm_auth
|
||||
|
||||
# Time to delay before replying to failed authentications.
|
||||
#auth_failure_delay = 2 secs
|
||||
|
||||
# Require a valid SSL client certificate or the authentication fails.
|
||||
#auth_ssl_require_client_cert = no
|
||||
|
||||
# Take the username from client's SSL certificate, using
|
||||
# X509_NAME_get_text_by_NID() which returns the subject's DN's
|
||||
# CommonName.
|
||||
#auth_ssl_username_from_cert = no
|
||||
|
||||
# Space separated list of wanted authentication mechanisms:
|
||||
# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey
|
||||
# gss-spnego
|
||||
# NOTE: See also disable_plaintext_auth setting.
|
||||
# el mecanismo "login" es para compatibilidad para Outlooks viejos
|
||||
auth_mechanisms = {{ dovecot_auth_mechanisms }}
|
||||
|
||||
##
|
||||
## Password and user databases
|
||||
##
|
||||
|
||||
#
|
||||
# Password database is used to verify user's password (and nothing more).
|
||||
# You can have multiple passdbs and userdbs. This is useful if you want to
|
||||
# allow both system users (/etc/passwd) and virtual users to login without
|
||||
# duplicating the system users into virtual database.
|
||||
#
|
||||
# <doc/wiki/PasswordDatabase.txt>
|
||||
#
|
||||
# User database specifies where mails are located and what user/group IDs
|
||||
# own them. For single-UID configuration use "static" userdb.
|
||||
#
|
||||
# <doc/wiki/UserDatabase.txt>
|
||||
|
||||
#!include auth-deny.conf.ext
|
||||
{% if dovecot_auth_master_enable %}
|
||||
!include auth-master.conf.ext
|
||||
{% endif %}
|
||||
#!include auth-passwdfile.conf.ext
|
||||
{% if dovecot_auth_system_enable %}
|
||||
!include auth-system.conf.ext
|
||||
{% endif %}
|
||||
#!include auth-sql.conf.ext
|
||||
{% if dovecot_ldap_enable %}
|
||||
!include auth-ldap.conf.ext
|
||||
{% endif %}
|
||||
#!include auth-passwdfile.conf.ext
|
||||
#!include auth-checkpassword.conf.ext
|
||||
#!include auth-vpopmail.conf.ext
|
||||
#!include auth-static.conf.ext
|
||||
@ -1,28 +0,0 @@
|
||||
##
|
||||
## LMTP specific settings
|
||||
##
|
||||
|
||||
# Support proxying to other LMTP/SMTP servers by performing passdb lookups.
|
||||
#lmtp_proxy = no
|
||||
|
||||
# When recipient address includes the detail (e.g. user+detail), try to save
|
||||
# the mail to the detail mailbox. See also recipient_delimiter and
|
||||
# lda_mailbox_autocreate settings.
|
||||
#lmtp_save_to_detail_mailbox = no
|
||||
|
||||
# Verify quota before replying to RCPT TO. This adds a small overhead.
|
||||
#lmtp_rcpt_check_quota = no
|
||||
|
||||
# Which recipient address to use for Delivered-To: header and Received:
|
||||
# header. The default is "final", which is the same as the one given to
|
||||
# RCPT TO command. "original" uses the address given in RCPT TO's ORCPT
|
||||
# parameter, "none" uses nothing. Note that "none" is currently always used
|
||||
# when a mail has multiple recipients.
|
||||
#lmtp_hdr_delivery_address = final
|
||||
|
||||
protocol lmtp {
|
||||
# postmaster_address aparentemente es obligatorio
|
||||
postmaster_address = postmaster@{{ mail_domains | first }}
|
||||
# Space separated list of plugins to load (default is global mail_plugins).
|
||||
mail_plugins = $mail_plugins sieve
|
||||
}
|
||||
@ -1,91 +0,0 @@
|
||||
#jinja2: lstrip_blocks: True
|
||||
##
|
||||
## Quota configuration.
|
||||
##
|
||||
|
||||
# Note that you also have to enable quota plugin in mail_plugins setting.
|
||||
# <doc/wiki/Quota.txt>
|
||||
|
||||
##
|
||||
## Quota limits
|
||||
##
|
||||
|
||||
# Quota limits are set using "quota_rule" parameters. To get per-user quota
|
||||
# limits, you can set/override them by returning "quota_rule" extra field
|
||||
# from userdb. It's also possible to give mailbox-specific limits, for example
|
||||
# to give additional 100 MB when saving to Trash:
|
||||
|
||||
plugin {
|
||||
#quota_rule = *:storage=1G
|
||||
#quota_rule2 = Trash:storage=+100M
|
||||
quota_rule = *:storage={{ dovecot_quota_limit }}
|
||||
{% for key, value in dovecot_quota_additional_limit.items() %}
|
||||
quota_rule{{ loop.index + 1 }} = {{ key }}:storage=+{{ value }}
|
||||
{% endfor %}
|
||||
|
||||
# LDA/LMTP allows saving the last mail to bring user from under quota to
|
||||
# over quota, if the quota doesn't grow too high. Default is to allow as
|
||||
# long as quota will stay under 10% above the limit. Also allowed e.g. 10M.
|
||||
#quota_grace = 10%%
|
||||
quota_grace = {{ dovecot_quota_grace | regex_replace("%.*$","%%") }}
|
||||
|
||||
{% if dovecot_quota_driver == "count" %}
|
||||
quota_vsizes = yes
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
##
|
||||
## Quota warnings
|
||||
##
|
||||
|
||||
# You can execute a given command when user exceeds a specified quota limit.
|
||||
# Each quota root has separate limits. Only the command for the first
|
||||
# exceeded limit is excecuted, so put the highest limit first.
|
||||
# The commands are executed via script service by connecting to the named
|
||||
# UNIX socket (quota-warning below).
|
||||
# Note that % needs to be escaped as %%, otherwise "% " expands to empty.
|
||||
|
||||
plugin {
|
||||
#quota_warning = storage=95%% quota-warning 95 %u
|
||||
#quota_warning2 = storage=80%% quota-warning 80 %u
|
||||
}
|
||||
|
||||
# Example quota-warning service. The unix listener's permissions should be
|
||||
# set in a way that mail processes can connect to it. Below example assumes
|
||||
# that mail processes run as vmail user. If you use mode=0666, all system users
|
||||
# can generate quota warnings to anyone.
|
||||
#service quota-warning {
|
||||
# executable = script /usr/local/bin/quota-warning.sh
|
||||
# user = dovecot
|
||||
# unix_listener quota-warning {
|
||||
# user = vmail
|
||||
# }
|
||||
#}
|
||||
|
||||
##
|
||||
## Quota backends
|
||||
##
|
||||
|
||||
# Multiple backends are supported:
|
||||
# dirsize: Find and sum all the files found from mail directory.
|
||||
# Extremely SLOW with Maildir. It'll eat your CPU and disk I/O.
|
||||
# dict: Keep quota stored in dictionary (eg. SQL)
|
||||
# maildir: Maildir++ quota
|
||||
# fs: Read-only support for filesystem quota
|
||||
|
||||
plugin {
|
||||
quota = {{ dovecot_quota_driver }}:User quota
|
||||
#quota = dirsize:User quota
|
||||
#quota = maildir:User quota
|
||||
#quota = dict:User quota::proxy::quota
|
||||
#quota = fs:User quota
|
||||
}
|
||||
|
||||
# Multiple quota roots are also possible, for example this gives each user
|
||||
# their own 100MB quota and one shared 1GB quota within the domain:
|
||||
plugin {
|
||||
#quota = dict:user::proxy::quota
|
||||
#quota2 = dict:domain:%d:proxy::quota_domain
|
||||
#quota_rule = *:storage=102400
|
||||
#quota2_rule = *:storage=1048576
|
||||
}
|
||||
@ -1,75 +0,0 @@
|
||||
# This file is commonly accessed via passdb {} or userdb {} section in
|
||||
# conf.d/auth-ldap.conf.ext
|
||||
|
||||
# This file is opened as root, so it should be owned by root and mode 0600.
|
||||
# http://wiki2.dovecot.org/AuthDatabase/LDAP
|
||||
|
||||
# Space separated list of LDAP hosts to use. host:port is allowed too.
|
||||
uris = {{ dovecot_ldap_uris | join(" ") }}
|
||||
|
||||
# Use authentication binding for verifying password's validity. This works by
|
||||
# logging into LDAP server using the username and password given by client.
|
||||
# The pass_filter is used to find the DN for the user. Note that the pass_attrs
|
||||
# is still used, only the password field is ignored in it. Before doing any
|
||||
# search, the binding is switched back to the default DN.
|
||||
auth_bind = yes
|
||||
|
||||
# If authentication binding is used, you can save one LDAP request per login
|
||||
# if users' DN can be specified with a common template. The template can use
|
||||
# the standard %variables (see user_filter). Note that you can't
|
||||
# use any pass_attrs if you use this setting.
|
||||
# auth_bind_userdn =
|
||||
|
||||
# LDAP protocol version to use. Likely 2 or 3.
|
||||
ldap_version = {{ dovecot_ldap_version }}
|
||||
|
||||
# LDAP base. %variables can be used here.
|
||||
# For example: dc=mail, dc=example, dc=org
|
||||
base = {{ dovecot_ldap_base }}
|
||||
|
||||
# Search scope: base, onelevel, subtree
|
||||
scope = {{ dovecot_ldap_scope }}
|
||||
|
||||
# User attributes are given in LDAP-name=dovecot-internal-name list. The
|
||||
# internal names are:
|
||||
# uid - System UID
|
||||
# gid - System GID
|
||||
# home - Home directory
|
||||
# mail - Mail location
|
||||
#
|
||||
# There are also other special fields which can be returned, see
|
||||
# http://wiki2.dovecot.org/UserDatabase/ExtraFields
|
||||
#user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid
|
||||
user_attrs = {{ dovecot_ldap_user_attrs }}
|
||||
|
||||
# Filter for user lookup. Some variables can be used (see
|
||||
# http://wiki2.dovecot.org/Variables for full list):
|
||||
# %u - username
|
||||
# %n - user part in user@domain, same as %u if there's no domain
|
||||
# %d - domain part in user@domain, empty if user there's no domain
|
||||
user_filter = {{ dovecot_ldap_user_filter }}
|
||||
|
||||
# Password checking attributes:
|
||||
# user: Virtual user name (user@domain), if you wish to change the
|
||||
# user-given username to something else
|
||||
# password: Password, may optionally start with {type}, eg. {crypt}
|
||||
# There are also other special fields which can be returned, see
|
||||
# http://wiki2.dovecot.org/PasswordDatabase/ExtraFields
|
||||
# pass_attrs = uid=user,userPassword=password
|
||||
|
||||
# If you wish to avoid two LDAP lookups (passdb + userdb), you can use
|
||||
# userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll
|
||||
# also have to include user_attrs in pass_attrs field prefixed with "userdb_"
|
||||
# string. For example:
|
||||
pass_attrs = {{ dovecot_ldap_pass_attrs }}
|
||||
|
||||
# Filter for password lookups
|
||||
pass_filter = {{ dovecot_ldap_pass_filter }}
|
||||
|
||||
# Attributes and filter to get a list of all users
|
||||
iterate_attrs = {{ dovecot_ldap_iterate_attrs }}
|
||||
iterate_filter = {{ dovecot_ldap_iterate_filter }}
|
||||
|
||||
# Default password scheme. "{scheme}" before password overrides this.
|
||||
# List of supported schemes is in: http://wiki2.dovecot.org/Authentication
|
||||
default_pass_scheme = {{ dovecot_ldap_default_pass_scheme }}
|
||||
Loading…
x
Reference in New Issue
Block a user