mail: setup dovecot sevice

7 files changed, 595 insertions, 1 deletions

diff --git a/host_vars/vultr b/host_vars/vultr
index 7d83385..15c2209 100644
--- a/host_vars/vultr
+++ b/host_vars/vultr
@@ -56,7 +56,7 @@ nameservers:
 
 mail:
   domains:
-    - liwt.net
+    - liwt.net  # primary
     - aaronly.me
   # Virtual mail user for local delivery (e.g., by Dovecot))
   user:
diff --git a/roles/mail/files/sieve/README b/roles/mail/files/sieve/README
new file mode 100644
index 0000000..b004418
--- /dev/null
+++ b/roles/mail/files/sieve/README
@@ -0,0 +1,24 @@
+This directory contains the global Sieve scripts:
+
+* before.d : scripts executed before the user's personal script;
+* after.d : scripts executed after the user's personal script.
+
+Most scripts are placed to the "after.d" location, thus enable user to
+easily overwrite the system/global defaults.
+
+NOTE:
+* These Sieve scripts should have the proper ".sieve" extension.
+* These Sieve scripts should been manually compiled, due to the lack of
+  write permission for the caller process:
+  $ sievec before.d
+  $ sievec after.d
+
+See:
+* https://wiki.dovecot.org/Pigeonhole/Sieve
+* https://wiki.dovecot.org/Pigeonhole/Sieve/Configuration
+* https://wiki.dovecot.org/Pigeonhole/Sieve/Usage
+* https://wiki.dovecot.org/Pigeonhole/Sieve/Examples
+
+
+Aaron LI
+2017-04-25
diff --git a/roles/mail/files/sieve/after.d/50-spam.sieve b/roles/mail/files/sieve/after.d/50-spam.sieve
new file mode 100644
index 0000000..3d48337
--- /dev/null
+++ b/roles/mail/files/sieve/after.d/50-spam.sieve
@@ -0,0 +1,32 @@
+#
+# /usr/local/etc/dovecot/sieve/after.d/50-spam.sieve
+#
+# Global filters to filter spams.
+#
+# See: https://wiki.dovecot.org/Pigeonhole/Sieve
+#
+# Aaron LI
+# 2017-04-24
+#
+
+
+# fileinto: place messages into an IMAP folder other than INBOX
+require "fileinto";
+# mailbox: create the IMAP folder if not exists
+require "mailbox";
+# imap4flags: add IMAP flags to stored messages
+require "imap4flags";
+ 
+
+# Just delete spams higher than level 10!
+if header :contains "X-Spam-Level" "**********" {
+    discard;
+    stop;
+}
+ 
+# Move SpamAssassin-tagged mails to "Junk" folder.
+if header :contains "X-Spam-Flag" "YES" {
+    fileinto :create "Junk";
+    setflag "\\Seen";
+    stop;
+}
diff --git a/roles/mail/files/sieve/after.d/51-msgid.sieve b/roles/mail/files/sieve/after.d/51-msgid.sieve
new file mode 100644
index 0000000..ea0e55d
--- /dev/null
+++ b/roles/mail/files/sieve/after.d/51-msgid.sieve
@@ -0,0 +1,22 @@
+#
+# /usr/local/etc/dovecot/sieve/after.d/51-msgid.sieve
+#
+# Global filters to filter messages with invalid "message-id".
+#
+# Aaron LI
+# 2017-04-24
+#
+
+ 
+require "fileinto";
+require "mailbox";
+require "imap4flags";
+require "regex";
+
+
+# Trash messages with improperly formed "message-id"
+if not header :regex "message-id" ".*@.*\\." {
+    fileinto :create "Trash";
+    setflag "\\Seen";
+    stop;
+}
diff --git a/roles/mail/handlers/main.yml b/roles/mail/handlers/main.yml
index 3bb1f53..e9b668e 100644
--- a/roles/mail/handlers/main.yml
+++ b/roles/mail/handlers/main.yml
@@ -2,5 +2,8 @@
 - name: reload-opendkim
   command: rcreload milter-opendkim
 
+- name: reload-dovecot
+  command: rcreload dovecot
+
 - name: update-aliases
   command: postalias /etc/mail/aliases
diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml
index 8191c0d..f7163fd 100644
--- a/roles/mail/tasks/main.yml
+++ b/roles/mail/tasks/main.yml
@@ -74,6 +74,42 @@
 - name: opendkim - enable and start
   command: rcenable milter-opendkim
 
+
+#
+# Dovecot
+#
+
+- name: dovecot - copy sieve filters
+  copy:
+    src: sieve/  # trailing '/' -> directory contents
+    dest: /usr/local/etc/dovecot/sieve/
+  tags: dovecot
+
+- name: dovecot - compile sieve filters
+  command: >
+    find /usr/local/etc/dovecot/sieve/
+    -name '*.sieve'
+    -exec sievec '{}' ';'
+  tags: dovecot
+
+- name: dovecot - copy passwd
+  copy:
+    src: "{{ playbook_dir }}/private/dovecot/passwd"
+    dest: /usr/local/etc/dovecot/passwd
+    group: dovecot
+    mode: 0440
+  tags: dovecot
+
+- name: opendkim - generate config file
+  template:
+    src: dovecot.conf.j2
+    dest: /usr/local/etc/dovecot/dovecot.conf
+  notify: reload-dovecot
+  tags: dovecot
+
+- name: dovecot - enable and start
+  command: rcenable dovecot
+
 - name: aliases - forward root mails
   lineinfile:
     path: /etc/mail/aliases
diff --git a/roles/mail/templates/dovecot.conf.j2 b/roles/mail/templates/dovecot.conf.j2
new file mode 100644
index 0000000..5117796
--- /dev/null
+++ b/roles/mail/templates/dovecot.conf.j2
@@ -0,0 +1,477 @@
+#
+# /usr/local/etc/dovecot/dovecot.conf
+# Dovecot configuration file
+#
+# References
+# ----------
+# * Dovecot - Quick Configuration
+#   http://wiki2.dovecot.org/QuickConfiguration
+# * Dovecot - SSL Configuration
+#   https://wiki.dovecot.org/SSL/DovecotConfiguration
+# * Multiple domains and virtual users (Postfix/Dovecot/SASL)
+#   http://void.ideabite.org/2013/07/28/multiple-domains-and-virtual-users/
+#
+# Aaron LI
+#
+
+{% set mydomain = mail.domains[0] %}
+
+# NOTE
+# ----
+# "doveconf -n" command gives a clean output of the changed settings.
+# Use it instead of copy/pasting files when posting to the mailing list.
+
+# Protocols want to be serving.
+protocols = imap
+
+# A comma separated list of IPs or hosts where to listen.
+#   - "*" listens in all IPv4 interfaces
+#   - "::" listens in all IPv6 interfaces
+listen = *, ::
+
+
+##
+## 10-auth.conf
+## Authentication process, password and user database
+##
+
+# Disable LOGIN command and all other plaintext authentications unless
+# SSL/TLS is used (LOGINDISABLED capability).
+disable_plaintext_auth = yes
+
+# Space separated list of realms for SASL authentication mechanisms
+# that need them.  You can leave it empty if you don't want to support
+# multiple realms.
+#auth_realms =
+
+# Require a valid SSL client certificate or the authentication fails.
+#auth_ssl_require_client_cert = no
+
+# Take the username from client's SSL certificate, using 
+# X509_NAME_get_text_by_NID() which returns the subject's DN's
+# CommonName. 
+#auth_ssl_username_from_cert = no
+
+# Space separated list of wanted authentication mechanisms:
+#   plain login digest-md5 cram-md5 ntlm rpa apop anonymous
+#   gssapi otp skey gss-spnego
+# NOTE: See also disable_plaintext_auth setting.
+auth_mechanisms = plain login
+
+# The password database used by Dovecot to authenticate users.
+#
+# See: https://wiki2.dovecot.org/PasswordDatabase
+#
+# Generate the password with:
+#     $ doveadm pw -s SSHA512
+#
+passdb {
+    driver = passwd-file
+    args = scheme=SSHA512 username_format=%u /usr/local/etc/dovecot/passwd
+
+    # This is not a database for denied users.
+    deny = no
+    # This is not a database for master users, which can log in as
+    # other users.
+    master = no
+    pass = no
+    skip = never
+    result_failure = continue
+    result_internalfail = continue
+    result_success = return-ok
+}
+
+# User database, which will be looked up to obtain user's information
+# after the user has been successfully authenticated.  The userdb lookup
+# is also done by LDA to find out how to deliver mails for the user.
+#
+# Dovecot doesn't need to verify the username or the password.
+#
+# See: https://wiki2.dovecot.org/UserDatabase
+#
+userdb {
+    driver = static
+    #
+    # Set 'allow_all_users=yes' will make Dovecot ignore the user lookup
+    # from the userdb and entirely rely on the passdb lookup.  Therefore,
+    # the username may be repeated to have multiple passwords, which can
+    # be utilized to achieve device-specific passwords.
+    #
+    args = allow_all_users=yes
+}
+
+
+##
+## 10-logging.conf
+## Log destination, verbosity, and debugging.
+##
+
+# Log unsuccessful authentication attempts and the reasons why they
+# failed.
+auth_verbose = yes
+
+# In case of password mismatches, log the attempted password.
+# Valid values are no, plain and sha1.
+# sha1 can be useful for detecting brute force password attempts vs.
+# user simply trying the same password over and over again.
+auth_verbose_passwords = sha1
+
+# Space-separated list of elements we want to log.  The elements which
+# have a non-empty variable value are joined together to form a
+# comma-separated string.
+#
+# Since we set up device-specific passwords, therefore the full
+# username (%u) is the authenticated user after replacing by the auth
+# process.  Use %{orig_user}, which expands to the original username
+# the client sent before any changes by auth process, to keep track of
+# the actual usages.
+#
+login_log_format_elements = user=<%{orig_user}> method=%m rip=%r lip=%l mpid=%e %c
+
+
+##
+## 10-mail.conf
+## Mailbox settings and mail handling.
+##
+
+# Home directories for virtual users, where Dovecot can save user-specific
+# files.  Home directory shouldn't be the same as mail directory with mbox
+# or Maildir formats (but with dbox/obox it's fine).
+mail_home = {{ mail.user.home }}/%d/%n
+
+# Location for users' mailboxes. The default is empty, which means that Dovecot
+# tries to find the mailboxes automatically. This won't work if the user
+# doesn't yet have any mail, so you should explicitly tell Dovecot the full
+# location.
+#
+# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u)
+# isn't enough. You'll also need to tell Dovecot where the other mailboxes are
+# kept. This is called the "root mail directory", and it must be the first
+# path given in the mail_location setting.
+#
+# There are a few special variables you can use, eg.:
+#
+#   %u - username
+#   %n - user part in user@domain, same as %u if there's no domain
+#   %d - domain part in user@domain, empty if there's no domain
+#   %h - home directory
+#
+# See doc/wiki/Variables.txt for full list.
+#
+mail_location = maildir:{{ mail.user.home }}/%d/%n/mail:LAYOUT=fs
+
+# System user and group used to access mails.  If you use multiple,
+# userdb can override these by returning uid or gid fields.  You can
+# use either numbers or names.
+mail_uid = {{ mail.user.name }}
+mail_gid = {{ mail.user.name }}
+
+# Use the dedicated virtual mail user to restrict the temporary
+# privileged operations.
+mail_privileged_group = {{ mail.user.name }}
+
+# Only allow Dovecot use the dedicated virtual mail user.
+first_valid_uid = {{ mail.user.id }}
+last_valid_uid  = {{ mail.user.id }}
+first_valid_gid = {{ mail.user.id }}
+last_valid_gid  = {{ mail.user.id }}
+
+# Mailbox list indexes can be used to optimize IMAP STATUS commands.
+# They are also required for IMAP NOTIFY extension to be enabled.
+mailbox_list_index = yes
+
+# Assume Dovecot is the only MUA accessing Maildir:
+# Scan cur/ directory only when its mtime changes unexpectedly or when
+# we can't find the mail otherwise.
+maildir_very_dirty_syncs = no
+
+# If enabled, Dovecot doesn't use the S=<size> in the Maildir filenames
+# for getting the mail's physical size, except when recalculating
+# Maildir++ quota.  This can be useful in systems where a lot of the
+# Maildir filenames have a broken size.  The performance hit for
+# enabling this is very small.
+#maildir_broken_filename_sizes = no
+
+# If you need to set multiple mailbox locations or want to change default
+# namespace settings, you can do it by defining namespace sections.
+#
+namespace inbox {
+  # There can be only one INBOX, and this setting defines which namespace
+  # has it.
+  inbox = yes
+
+  # 15-mailboxes.conf
+  # Mailbox definitions
+  #
+  # Each mailbox is specified in a separate mailbox section.  The
+  # section name specifies the mailbox name.  If it has spaces, you can
+  # put the name "in quotes".  These sections can contain the following
+  # mailbox settings:
+  #
+  # auto:
+  #   Indicates whether the mailbox with this name is automatically
+  #   created implicitly when it is first accessed.  The user can also
+  #   be automatically subscribed to the mailbox after creation.  The
+  #   following values are defined for this setting:
+  # 
+  #     no        - Never created automatically.
+  #     create    - Automatically created, but no automatic subscription.
+  #     subscribe - Automatically created and subscribed.
+  #  
+  # special_use:
+  #   A space-separated list of SPECIAL-USE flags (RFC 6154) to use for
+  #   the mailbox.  There are no validity checks, so you could specify
+  #   anything you want in here, but it's not a good idea to use flags
+  #   other than the standard ones specified in the RFC:
+  #
+  #     \All      - This (virtual) mailbox presents all messages in the
+  #                 user's message store. 
+  #     \Archive  - This mailbox is used to archive messages.
+  #     \Drafts   - This mailbox is used to hold draft messages.
+  #     \Flagged  - This (virtual) mailbox presents all messages in the
+  #                 user's message store marked with the IMAP \Flagged
+  #                 flag.
+  #     \Junk     - This mailbox is where messages deemed to be junk
+  #                 mail are held.
+  #     \Sent     - This mailbox is used to hold copies of messages that
+  #                 have been sent.
+  #     \Trash    - This mailbox is used to hold messages that have been
+  #                 deleted.
+  #
+  # comment:
+  #   Defines a default comment or note associated with the mailbox.
+  #   This value is accessible through the IMAP METADATA mailbox entries
+  #   "/shared/comment" and "/private/comment". Users with sufficient
+  #   privileges can override the default value for entries with a custom
+  #   value.
+  #
+  mailbox Drafts {
+    special_use = \Drafts
+    # Automatically created and subscribed.
+    auto = subscribe
+  }
+  mailbox Junk {
+    special_use = \Junk
+    auto = subscribe
+  }
+  mailbox Trash {
+    special_use = \Trash
+    auto = subscribe
+  }
+  mailbox Sent {
+    special_use = \Sent
+    auto = subscribe
+  }
+
+  mailbox Archive {
+    special_use = \Archive
+    auto = subscribe
+  }
+
+  # If you have a virtual "All messages" mailbox:
+  #mailbox virtual/All {
+  #  special_use = \All
+  #  comment = All my messages
+  #}
+
+  # If you have a virtual "Flagged" mailbox:
+  #mailbox virtual/Flagged {
+  #  special_use = \Flagged
+  #  comment = All my flagged messages
+  #}
+}
+
+
+##
+## 10-master.conf
+##
+
+service imap-login {
+  inet_listener imap {
+    # Disable non-SSL IMAP!
+    port = 0
+  }
+
+  inet_listener imaps {
+    #port = 993
+    #ssl = yes
+  }
+}
+
+service auth {
+  # This userdb socket is typically used by dovecot-lda, doveadm,
+  # possibly imap process, etc.  Users that have full permissions to
+  # this socket are able to get a list of all usernames and get the
+  # results of everyone's userdb lookups.
+  #
+  # The default 0666 mode allows anyone to connect to the socket, but
+  # the userdb lookups will succeed only if the userdb returns an "uid"
+  # field that matches the caller process's UID.  Also if caller's uid
+  # or gid matches the socket's uid or gid the lookup succeeds.
+  # Anything else causes a failure.
+  unix_listener auth-userdb {
+    mode = 0600
+    user = {{ mail.user.name }}
+    group = {{ mail.user.name }}
+  }
+
+  # Postfix smtp-auth
+  unix_listener /var/spool/postfix/private/auth {
+    mode = 0660
+    user = postfix
+    group = postfix
+  }
+}
+
+
+##
+## 10-ssl.conf
+##
+
+# SSL/TLS support: yes, no, required.
+# NOTE: If only plaintext auth mechanisms enabled (e.g., "plain",
+# "login"), "ssl=yes" and "ssl=required" is equivalent.
+ssl = required
+
+# PEM encoded X.509 SSL/TLS certificate and private key.
+# They're opened before dropping root privileges, so preferred
+# permissions is: root:root, 0400.
+ssl_cert = </usr/local/etc/ssl/acme/{{ mydomain }}/fullchain.pem
+ssl_key = </usr/local/etc/ssl/acme/private/{{ mydomain }}.pem
+
+# DH parameters file.
+#ssl_dh = </usr/local/etc/ssl/dhparam4096.pem
+
+# DH parameters length to use. (version == 2.2)
+#
+# NOTE: to re-generate DH-parameters, first manually delete current
+#       parameters: "/var/db/dovecot/ssl-parameters.dat", and then
+#       restart Dovecot.
+#
+ssl_dh_parameters_length = 2048
+
+# PEM encoded trusted certificate authority.
+# Set this only if you intend to use "ssl_verify_client_cert=yes".
+# The file should contain the CA certificate(s) followed by the
+# matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
+#ssl_ca = 
+
+# Request client to send a certificate.  If you also want to require
+# it, set "auth_ssl_require_client_cert=yes" in auth section.
+#ssl_verify_client_cert = no
+
+# Which field from certificate to use for username.  commonName and
+# x500UniqueIdentifier are the usual choices. You'll also need to set
+# "auth_ssl_username_from_cert=yes".
+#ssl_cert_username_field = commonName
+
+# SSL protocols to use: disable SSL, use TLS only!
+ssl_protocols = !SSLv3 !SSLv2
+
+# SSL ciphers to use
+ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES12
+
+# Prefer the server's order of ciphers over client's.
+ssl_prefer_server_ciphers = yes
+
+
+##
+## 15-lda.conf
+## LDA specific settings (also used by LMTP)
+##
+
+protocol lda {
+  # Space separated list of plugins to load
+  # (default is global mail_plugins).
+  mail_plugins = $mail_plugins sieve
+}
+
+
+##
+## 20-imap.conf
+## IMAP specific settings
+##
+
+# How long to wait between "OK Still here" notifications when client is
+# IDLEing.
+imap_idle_notify_interval = 4 mins
+
+# Workarounds for various client bugs:
+#   delay-newmail:
+#     Send EXISTS/RECENT new mail notifications only when replying to NOOP
+#     and CHECK commands. Some clients ignore them otherwise, for example OSX
+#     Mail (<v2.1). Outlook Express breaks more badly though, without this it
+#     may show user "Message no longer in server" errors. Note that OE6 still
+#     breaks even with this workaround if synchronization is set to
+#     "Headers Only".
+#   tb-extra-mailbox-sep:
+#     Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
+#     adds extra '/' suffixes to mailbox names. This option causes Dovecot to
+#     ignore the extra '/' instead of treating it as invalid mailbox name.
+#   tb-lsub-flags:
+#     Show \Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
+#     This makes Thunderbird realize they aren't selectable and show them
+#     greyed out, instead of only later giving "not selectable" popup error.
+#
+# The list is space-separated.
+imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
+
+protocol imap {
+  # Space separated list of plugins to load (default is global mail_plugins).
+  #mail_plugins = $mail_plugins
+
+  # Maximum number of IMAP connections allowed for a user from each IP address.
+  # NOTE: The username is compared case-sensitively.
+  #mail_max_userip_connections = 10
+}
+
+
+##
+## 90-plugin.conf
+## Plugin settings
+##
+
+# NOTE:
+# All wanted plugins must be listed in mail_plugins setting before any
+# of the settings take effect.
+
+plugin {
+  #setting_name = value
+
+  #
+  # Sieve: from package 'dovecot-pigeonhole'
+  # See: https://wiki.dovecot.org/Pigeonhole/Sieve/Configuration
+  #
+
+  # The location of the user's main script storage.  The active script
+  # in this storage is used as the main user script executed during
+  # delivery.  The "include" extension fetches the ":personal" scripts
+  # from this location.  When "ManageSieve" is used, this is also where
+  # scripts are uploaded.
+  # Here we use the file system as storage, with all the user's scripts
+  # located in the directory "~/sieve" and the active script (symbolic
+  # link) located at "~/.dovecot.sieve".
+  sieve = file:~/sieve;active=~/.dovecot.sieve
+
+  # Multiple global scripts that will been executed sequentially
+  # before/after the user's private script.
+  #
+  # If the "file" location path points to a directory, all the Sieve
+  # scripts contained therein (with the proper ".sieve" extension) are
+  # executed.
+  #
+  # Gobal scripts executed before the user's personal script.
+  sieve_before = /usr/local/etc/dovecot/sieve/before.d
+  #
+  # User-specific scripts executed before the user's personal script.
+  # (e.g., a vacation script managed through a non-ManageSieve tool.)
+  sieve_before2 = ~/sieve-before.d
+  #
+  # User-specific scripts executed after the user's personal script.
+  # NOTE: only when "keep" is still in effect.
+  sieve_after = ~/sieve-after.d
+  #
+  # Gobal scripts executed after the user's personal script.
+  # NOTE: only when "keep" is still in effect.
+  sieve_after2 = /usr/local/etc/dovecot/sieve/after.d
+}