simple-nixos-mailserver/mail-server/dovecot.nix

#  nixos-mailserver: a simple mail server
#  Copyright (C) 2016-2018  Robin Raymond
#
#  This program is free software: you can redistribute it and/or modify
#  it under the terms of the GNU General Public License as published by
#  the Free Software Foundation, either version 3 of the License, or
#  (at your option) any later version.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program. If not, see <http://www.gnu.org/licenses/>

{
  config,
  options,
  pkgs,
  lib,
  ...
}:

with (import ./common.nix {
  inherit
    config
    options
    pkgs
    lib
    ;
});

let
  cfg = config.mailserver;

  passwdDir = "/run/dovecot2";
  passwdFile = "${passwdDir}/passwd";
  userdbFile = "${passwdDir}/userdb";
  # This file contains the ldap bind password
  ldapConfFile = "${passwdDir}/dovecot-ldap.conf.ext";
  boolToYesNo = x: if x then "yes" else "no";
  listToLine = lib.concatStringsSep " ";
  listToMultiAttrs =
    keyPrefix: attrs:
    lib.listToAttrs (
      lib.imap1 (n: x: {
        name = "${keyPrefix}${if n == 1 then "" else toString n}";
        value = x;
      }) attrs
    );

  maildirLayoutAppendix = lib.optionalString cfg.useFsLayout ":LAYOUT=fs";
  maildirUTF8FolderNames = lib.optionalString cfg.useUTF8FolderNames ":UTF-8";

  # https://doc.dovecot.org/2.3/configuration_manual/home_directories_for_virtual_users/#ways-to-set-up-home-directory
  # Mail directory below the home directory
  dovecotMaildir =
    "maildir:~/mail${maildirLayoutAppendix}${maildirUTF8FolderNames}"
    + (lib.optionalString (cfg.indexDir != null) ":INDEX=${cfg.indexDir}/%{domain}/%{username}");

  postfixCfg = config.services.postfix;

  ldapUuidAttribute = cfg.ldap.attributes.uuid;
  ldapConfig = pkgs.writeTextFile {
    name = "dovecot-ldap.conf.ext.template";
    text = ''
      ldap_version = 3
      uris = ${lib.concatStringsSep " " cfg.ldap.uris}
      ${lib.optionalString cfg.ldap.startTls ''
        tls = yes
      ''}
      tls_require_cert = hard
      tls_ca_cert_file = ${cfg.ldap.tlsCAFile}
      dn = ${cfg.ldap.bind.dn}
      sasl_bind = no
      auth_bind = yes
      base = ${cfg.ldap.searchBase}
      scope = ${mkLdapSearchScope cfg.ldap.searchScope}
      user_attrs = \
        ${ldapUuidAttribute}=${ldapUuidAttribute}, \
        =home=/var/vmail/ldap/%{ldap:${ldapUuidAttribute}}, \
        =mail=maildir:~/mail${maildirLayoutAppendix}${maildirUTF8FolderNames}${
          lib.optionalString (cfg.indexDir != null) ":INDEX=${cfg.indexDir}/ldap/%{ldap:${ldapUuidAttribute}}"
        }
      user_filter = ${cfg.ldap.dovecot.userFilter}
      ${lib.optionalString (cfg.ldap.dovecot.passAttrs != "") ''
        pass_attrs = ${cfg.ldap.dovecot.passAttrs}
      ''}
      pass_filter = ${cfg.ldap.dovecot.passFilter}
    '';
  };

  setPwdInLdapConfFile = appendLdapBindPwd {
    name = "ldap-conf-file";
    file = ldapConfig;
    prefix = ''dnpass = "'';
    suffix = ''"'';
    passwordFile = cfg.ldap.bind.passwordFile;
    destination = ldapConfFile;
  };

  genPasswdScript =
    pkgs.writeScript "generate-password-file"
      # bash
      ''
        #!${pkgs.stdenv.shell}

        set -euo pipefail

        if (! test -d "${passwdDir}"); then
          mkdir "${passwdDir}"
          chmod 755 "${passwdDir}"
        fi

        # Prevent world-readable password files, even temporarily.
        umask 077

        for f in ${
          builtins.toString (lib.mapAttrsToList (name: _: passwordFiles."${name}") cfg.loginAccounts)
        }; do
          if [ ! -f "$f" ]; then
            echo "Expected password hash file $f does not exist!"
            exit 1
          fi
        done

        cat <<EOF > ${passwdFile}
        ${lib.concatStringsSep "\n" (
          lib.mapAttrsToList (
            name: _:
            if lib.elem name accountsWithPlaintextPasswordFiles then
              "${name}:${"$(sed -n '1{p;p;q}' ${passwordFiles."${name}"} | ${lib.getExe' pkgs.dovecot "doveadm"} pw)"}::::::"
            else
              "${name}:${"$(head -n 1 ${passwordFiles."${name}"})"}::::::"
          ) cfg.loginAccounts
        )}
        EOF

        cat <<EOF > ${userdbFile}
        ${lib.concatStringsSep "\n" (
          lib.mapAttrsToList (
            name: value:
            "${name}:::::::"
            + lib.optionalString (value.quota != null) "userdb_quota_rule=*:storage=${value.quota}"
          ) cfg.loginAccounts
        )}
        EOF
      '';

  junkMailboxes = builtins.attrNames (
    lib.filterAttrs (_: v: v ? "specialUse" && v.specialUse == "Junk") cfg.mailboxes
  );
  junkMailboxNumber = builtins.length junkMailboxes;
  # The assertion guarantees there is exactly one Junk mailbox.
  junkMailboxName = if junkMailboxNumber == 1 then builtins.elemAt junkMailboxes 0 else "";

  mkLdapSearchScope =
    scope:
    (
      if scope == "sub" then
        "subtree"
      else if scope == "one" then
        "onelevel"
      else
        scope
    );

  ftsPluginSettings = {
    fts = "flatcurve";
    fts_languages = listToLine cfg.fullTextSearch.languages;
    fts_tokenizers = listToLine [
      "generic"
      "email-address"
    ];
    fts_tokenizer_email_address = "maxlen=100"; # default 254 too large for Xapian
    fts_flatcurve_substring_search = boolToYesNo cfg.fullTextSearch.substringSearch;
    fts_filters = listToLine cfg.fullTextSearch.filters;
    fts_header_excludes = listToLine cfg.fullTextSearch.headerExcludes;
    fts_autoindex = boolToYesNo cfg.fullTextSearch.autoIndex;
    fts_enforced = cfg.fullTextSearch.enforced;
  }
  // (listToMultiAttrs "fts_autoindex_exclude" cfg.fullTextSearch.autoIndexExclude);

in
{
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = junkMailboxNumber == 1;
        message = "nixos-mailserver requires exactly one dovecot mailbox with the 'special use' flag set to 'Junk' (${builtins.toString junkMailboxNumber} have been found)";
      }
    ];

    warnings =
      lib.optional
        (
          (builtins.length cfg.fullTextSearch.languages > 1)
          && (builtins.elem "stopwords" cfg.fullTextSearch.filters)
        )
        ''
          Using stopwords in `mailserver.fullTextSearch.filters` with multiple
          languages in `mailserver.fullTextSearch.languages` configured WILL
          cause some searches to fail.

          The recommended solution is to NOT use the stopword filter when
          multiple languages are present in the configuration.
        '';

    security.acme.certs = lib.mkIf withACME {
      ${cfg.x509.useACMEHost} = {
        reloadServices = [ "dovecot.service" ];
      };
    };

    # for sieve-test. Shelling it in on demand usually doesn't work, as it reads
    # the global config and tries to open shared libraries configured in there,
    # which are usually not compatible.
    environment.systemPackages = [
      pkgs.dovecot_pigeonhole
    ]
    ++ lib.optional cfg.fullTextSearch.enable pkgs.dovecot-fts-flatcurve;

    # For compatibility with python imaplib
    environment.etc."dovecot/modules".source = "/run/current-system/sw/lib/dovecot/modules";

    services.dovecot2 = {
      enable = true;
      enableImap = cfg.enableImap || cfg.enableImapSsl;
      enablePop3 = cfg.enablePop3 || cfg.enablePop3Ssl;
      enablePAM = false;
      enableQuota = true;
      mailGroup = cfg.vmailGroupName;
      mailUser = cfg.vmailUserName;
      mailLocation = dovecotMaildir;
      sslServerCert = x509CertificateFile;
      sslServerKey = x509PrivateKeyFile;
      enableDHE = lib.mkDefault false;
      enableLmtp = true;
      mailPlugins.globally.enable = lib.optionals cfg.fullTextSearch.enable [
        "fts"
        "fts_flatcurve"
      ];
      protocols = lib.optional cfg.enableManageSieve "sieve";

      pluginSettings = {
        sieve = "file:${cfg.sieveDirectory}/%{user}/scripts;active=${cfg.sieveDirectory}/%{user}/active.sieve";
        sieve_default = "file:${cfg.sieveDirectory}/%{user}/default.sieve";
        sieve_default_name = "default";
      }
      // (lib.optionalAttrs cfg.fullTextSearch.enable ftsPluginSettings);

      sieve = {
        extensions = [
          "fileinto"
        ];

        scripts.after = builtins.toFile "spam.sieve" ''
          require "fileinto";

          if header :is "X-Spam" "Yes" {
              fileinto "${junkMailboxName}";
              stop;
          }
        '';

        pipeBins = map lib.getExe [
          (pkgs.writeShellScriptBin "rspamd-learn-ham.sh" "exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/worker-controller.sock learn_ham")
          (pkgs.writeShellScriptBin "rspamd-learn-spam.sh" "exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/worker-controller.sock learn_spam")
        ];
      };

      imapsieve.mailbox = [
        {
          name = junkMailboxName;
          causes = [
            "COPY"
            "APPEND"
          ];
          before = ./dovecot/imap_sieve/report-spam.sieve;
        }
        {
          name = "*";
          from = junkMailboxName;
          causes = [ "COPY" ];
          before = ./dovecot/imap_sieve/report-ham.sieve;
        }
      ];

      mailboxes = cfg.mailboxes;

      extraConfig = ''
        #Extra Config
        ${lib.optionalString cfg.debug.dovecot ''
          mail_debug = yes
          auth_debug = yes
          verbose_ssl = yes
        ''}

        ${lib.optionalString (cfg.enableImap || cfg.enableImapSsl) ''
          service imap-login {
            inet_listener imap {
              ${
                if cfg.enableImap then
                  ''
                    port = 143
                  ''
                else
                  ''
                    # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html
                    port = 0
                  ''
              }
            }
            inet_listener imaps {
              ${
                if cfg.enableImapSsl then
                  ''
                    port = 993
                    ssl = yes
                  ''
                else
                  ''
                    # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html
                    port = 0
                  ''
              }
            }
          }
        ''}
        ${lib.optionalString (cfg.enablePop3 || cfg.enablePop3Ssl) ''
          service pop3-login {
            inet_listener pop3 {
              ${
                if cfg.enablePop3 then
                  ''
                    port = 110
                  ''
                else
                  ''
                    # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html
                    port = 0
                  ''
              }
            }
            inet_listener pop3s {
              ${
                if cfg.enablePop3Ssl then
                  ''
                    port = 995
                    ssl = yes
                  ''
                else
                  ''
                    # see https://dovecot.org/pipermail/dovecot/2010-March/047479.html
                    port = 0
                  ''
              }
            }
          }
        ''}

        protocol imap {
          mail_max_userip_connections = ${toString cfg.maxConnectionsPerUser}
          mail_plugins = $mail_plugins imap_sieve
        }

        service imap {
          vsz_limit = ${builtins.toString cfg.imapMemoryLimit} MB
        }

        protocol pop3 {
          mail_max_userip_connections = ${toString cfg.maxConnectionsPerUser}
        }

        mail_access_groups = ${cfg.vmailGroupName}

        # https://ssl-config.mozilla.org/#server=dovecot&version=2.3.21&config=intermediate&openssl=3.4.1&guideline=5.7
        ssl = required
        ssl_min_protocol = TLSv1.2
        ssl_prefer_server_ciphers = no
        ssl_cipher_list = ${
          lib.concatStringsSep ":" [
            # TLS1.3
            "TLS_AES_128_GCM_SHA256"
            "TLS_CHACHA20_POLY1305_SHA256"
            "TLS_AES_256_GCM_SHA384"
            # TLS1.2
            # EC key material
            "ECDHE-ECDSA-AES128-GCM-SHA256"
            "ECDHE-ECDSA-CHACHA20-POLY1305"
            "ECDHE-ECDSA-AES256-GCM-SHA384"
            # RSA key material
            "ECDHE-RSA-AES128-GCM-SHA256"
            "ECDHE-RSA-CHACHA20-POLY1305"
            "ECDHE-RSA-AES256-GCM-SHA384"
          ]
        }
        ssl_curve_list = X25519MLKEM768:X25519:prime256v1:secp384r1

        service lmtp {
          unix_listener dovecot-lmtp {
            group = ${postfixCfg.group}
            mode = 0600
            user = ${postfixCfg.user}
          }
          vsz_limit = ${builtins.toString cfg.lmtpMemoryLimit} MB
        }

        service quota-status {
          inet_listener {
            port = 0
          }
          unix_listener quota-status {
            user = postfix
          }
          vsz_limit = ${builtins.toString cfg.quotaStatusMemoryLimit} MB
        }

        recipient_delimiter = ${cfg.recipientDelimiter}
        lmtp_save_to_detail_mailbox = ${cfg.lmtpSaveToDetailMailbox}

        protocol lmtp {
          mail_plugins = $mail_plugins sieve
        }

        passdb {
          driver = passwd-file
          args = ${passwdFile}
        }

        userdb {
          driver = passwd-file
          args = ${userdbFile}
          default_fields = \
            home=${cfg.mailDirectory}/%{domain}/%{username} \
            uid=${builtins.toString cfg.vmailUID} \
            gid=${builtins.toString cfg.vmailUID}
        }

        ${lib.optionalString cfg.ldap.enable ''
          passdb {
            driver = ldap
            args = ${ldapConfFile}
          }

          userdb {
            driver = ldap
            args = ${ldapConfFile}
            default_fields = \
              uid=${toString cfg.vmailUID} \
              gid=${toString cfg.vmailUID}
          }
        ''}

        service auth {
          unix_listener auth {
            mode = 0660
            user = ${postfixCfg.user}
            group = ${postfixCfg.group}
          }
        }

        auth_mechanisms = plain login

        namespace inbox {
          separator = ${cfg.hierarchySeparator}
          inbox = yes
        }

        service indexer-worker {
        ${lib.optionalString (cfg.fullTextSearch.memoryLimit != null) ''
          vsz_limit = ${toString (cfg.fullTextSearch.memoryLimit * 1024 * 1024)}
        ''}
        }

        lda_mailbox_autosubscribe = yes
        lda_mailbox_autocreate = yes
      '';
    };

    systemd.services.dovecot = {
      preStart = ''
        ${genPasswdScript}
      ''
      + (lib.optionalString cfg.ldap.enable setPwdInLdapConfFile);
      reloadTriggers = lib.mkIf (!withACME) [
        x509CertificateFile
        x509PrivateKeyFile
      ];
    };

    systemd.services.postfix.restartTriggers = [
      genPasswdScript
    ]
    ++ (lib.optional cfg.ldap.enable [ setPwdInLdapConfFile ]);
  };
}