1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2015 Andy Wingo <wingo@igalia.com>
3 ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
4 ;;; Copyright © 2017 Carlo Zancanaro <carlo@zancanaro.id.au>
5 ;;; Copyright © 2017, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
6 ;;; Copyright © 2019 Kristofer Buffington <kristoferbuffington@gmail.com>
7 ;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de>
9 ;;; This file is part of GNU Guix.
11 ;;; GNU Guix is free software; you can redistribute it and/or modify it
12 ;;; under the terms of the GNU General Public License as published by
13 ;;; the Free Software Foundation; either version 3 of the License, or (at
14 ;;; your option) any later version.
16 ;;; GNU Guix is distributed in the hope that it will be useful, but
17 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
18 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 ;;; GNU General Public License for more details.
21 ;;; You should have received a copy of the GNU General Public License
22 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
24 ;;; Some of the help text was taken from the default dovecot.conf files.
26 (define-module (gnu services mail)
27 #:use-module (gnu services)
28 #:use-module (gnu services base)
29 #:use-module (gnu services configuration)
30 #:use-module (gnu services shepherd)
31 #:use-module (gnu system pam)
32 #:use-module (gnu system shadow)
33 #:use-module (gnu packages mail)
34 #:use-module (gnu packages admin)
35 #:use-module (gnu packages dav)
36 #:use-module (gnu packages tls)
37 #:use-module (guix records)
38 #:use-module (guix packages)
39 #:use-module (guix gexp)
40 #:use-module (ice-9 match)
41 #:use-module (ice-9 format)
42 #:use-module (srfi srfi-1)
43 #:export (dovecot-service
46 opaque-dovecot-configuration
51 unix-listener-configuration
52 fifo-listener-configuration
53 inet-listener-configuration
55 protocol-configuration
58 namespace-configuration
60 opensmtpd-configuration
61 opensmtpd-configuration?
62 opensmtpd-service-type
63 %default-opensmtpd-config-file
65 mail-aliases-service-type
70 %default-exim-config-file
75 %default-imap4d-config-file
77 radicale-configuration
78 radicale-configuration?
80 %default-radicale-config-file))
84 ;;; This module provides service definitions for the Dovecot POP3 and IMAP
89 (define (uglify-field-name field-name)
90 (let ((str (symbol->string field-name)))
91 (string-join (string-split (if (string-suffix? "?" str)
92 (substring str 0 (1- (string-length str)))
97 (define (serialize-field field-name val)
98 (format #t "~a=~a\n" (uglify-field-name field-name) val))
100 (define (serialize-string field-name val)
101 (serialize-field field-name val))
103 (define (space-separated-string-list? val)
106 (and (string? x) (not (string-index x #\space))))
108 (define (serialize-space-separated-string-list field-name val)
111 (_ (serialize-field field-name (string-join val " ")))))
113 (define (comma-separated-string-list? val)
116 (and (string? x) (not (string-index x #\,))))
118 (define (serialize-comma-separated-string-list field-name val)
119 (serialize-field field-name (string-join val ",")))
121 (define (file-name? val)
123 (string-prefix? "/" val)))
124 (define (serialize-file-name field-name val)
125 (serialize-string field-name val))
127 (define (colon-separated-file-name-list? val)
129 ;; Trailing slashes not needed and not
130 (and-map file-name? val)))
131 (define (serialize-colon-separated-file-name-list field-name val)
132 (serialize-field field-name (string-join val ":")))
134 (define (serialize-boolean field-name val)
135 (serialize-string field-name (if val "yes" "no")))
137 (define (non-negative-integer? val)
138 (and (exact-integer? val) (not (negative? val))))
139 (define (serialize-non-negative-integer field-name val)
140 (serialize-field field-name val))
142 (define (hours? val) (non-negative-integer? val))
143 (define (serialize-hours field-name val)
144 (serialize-field field-name (format #f "~a hours" val)))
146 (define (free-form-fields? val)
149 ((((? symbol?) . (? string?)) . val) (free-form-fields? val))
151 (define (serialize-free-form-fields field-name val)
152 (for-each (match-lambda ((k . v) (serialize-field k v))) val))
154 (define (free-form-args? val)
157 ((((? symbol?) . (? string?)) . val) (free-form-args? val))
159 (define (serialize-free-form-args field-name val)
160 (serialize-field field-name
162 (map (match-lambda ((k . v) (format #f "~a=~a" k v))) val)
165 (define-configuration dict-configuration
167 (free-form-fields '())
168 "A list of key-value pairs that this dict should hold."))
170 (define (serialize-dict-configuration field-name val)
171 (format #t "dict {\n")
172 (serialize-configuration val dict-configuration-fields)
175 (define-configuration passdb-configuration
178 "The driver that the passdb should use. Valid values include
179 @samp{pam}, @samp{passwd}, @samp{shadow}, @samp{bsdauth}, and
182 (space-separated-string-list '())
183 "Space separated list of arguments to the passdb driver."))
185 (define (serialize-passdb-configuration field-name val)
186 (format #t "passdb {\n")
187 (serialize-configuration val passdb-configuration-fields)
189 (define (passdb-configuration-list? val)
190 (and (list? val) (and-map passdb-configuration? val)))
191 (define (serialize-passdb-configuration-list field-name val)
192 (for-each (lambda (val) (serialize-passdb-configuration field-name val)) val))
194 (define-configuration userdb-configuration
197 "The driver that the userdb should use. Valid values include
198 @samp{passwd} and @samp{static}.")
200 (space-separated-string-list '())
201 "Space separated list of arguments to the userdb driver.")
204 "Override fields from passwd."))
206 (define (serialize-userdb-configuration field-name val)
207 (format #t "userdb {\n")
208 (serialize-configuration val userdb-configuration-fields)
210 (define (userdb-configuration-list? val)
211 (and (list? val) (and-map userdb-configuration? val)))
212 (define (serialize-userdb-configuration-list field-name val)
213 (for-each (lambda (val) (serialize-userdb-configuration field-name val)) val))
215 (define-configuration unix-listener-configuration
217 (string (configuration-missing-field 'unix-listener 'path))
218 "Path to the file, relative to @code{base-dir} field. This is also used as
222 "The access mode for the socket.")
225 "The user to own the the socket.")
228 "The group to own the socket."))
230 (define (serialize-unix-listener-configuration field-name val)
231 (format #t "unix_listener ~a {\n" (unix-listener-configuration-path val))
232 (serialize-configuration val (cdr unix-listener-configuration-fields))
235 (define-configuration fifo-listener-configuration
237 (string (configuration-missing-field 'fifo-listener 'path))
238 "Path to the file, relative to @code{base-dir} field. This is also used as
242 "The access mode for the socket.")
245 "The user to own the the socket.")
248 "The group to own the socket."))
250 (define (serialize-fifo-listener-configuration field-name val)
251 (format #t "fifo_listener ~a {\n" (fifo-listener-configuration-path val))
252 (serialize-configuration val (cdr fifo-listener-configuration-fields))
255 (define-configuration inet-listener-configuration
257 (string (configuration-missing-field 'inet-listener 'protocol))
258 "The protocol to listen for.")
261 "The address on which to listen, or empty for all addresses.")
263 (non-negative-integer
264 (configuration-missing-field 'inet-listener 'port))
265 "The port on which to listen.")
268 "Whether to use SSL for this service; @samp{yes}, @samp{no}, or
271 (define (serialize-inet-listener-configuration field-name val)
272 (format #t "inet_listener ~a {\n" (inet-listener-configuration-protocol val))
273 (serialize-configuration val (cdr inet-listener-configuration-fields))
276 (define (listener-configuration? val)
277 (or (unix-listener-configuration? val)
278 (fifo-listener-configuration? val)
279 (inet-listener-configuration? val)))
280 (define (serialize-listener-configuration field-name val)
282 ((unix-listener-configuration? val)
283 (serialize-unix-listener-configuration field-name val))
284 ((fifo-listener-configuration? val)
285 (serialize-fifo-listener-configuration field-name val))
286 ((inet-listener-configuration? val)
287 (serialize-inet-listener-configuration field-name val))
288 (else (configuration-field-error field-name val))))
289 (define (listener-configuration-list? val)
290 (and (list? val) (and-map listener-configuration? val)))
291 (define (serialize-listener-configuration-list field-name val)
292 (for-each (lambda (val)
293 (serialize-listener-configuration field-name val))
296 (define-configuration service-configuration
298 (string (configuration-missing-field 'service 'kind))
299 "The service kind. Valid values include @code{director},
300 @code{imap-login}, @code{pop3-login}, @code{lmtp}, @code{imap},
301 @code{pop3}, @code{auth}, @code{auth-worker}, @code{dict},
302 @code{tcpwrap}, @code{quota-warning}, or anything else.")
304 (listener-configuration-list '())
305 "Listeners for the service. A listener is either an
306 @code{unix-listener-configuration}, a @code{fifo-listener-configuration}, or
307 an @code{inet-listener-configuration}.")
309 (non-negative-integer 0)
310 "Maximum number of simultaneous client connections per process. Once this
311 number of connections is received, the next incoming connection will prompt
312 Dovecot to spawn another process. If set to 0, @code{default-client-limit} is
315 (non-negative-integer 1)
316 "Number of connections to handle before starting a new process.
317 Typically the only useful values are 0 (unlimited) or 1. 1 is more
318 secure, but 0 is faster. <doc/wiki/LoginProcess.txt>.")
320 (non-negative-integer 0)
321 "Maximum number of processes that can exist for this service. If set to 0,
322 @code{default-process-limit} is used instead.")
324 (non-negative-integer 0)
325 "Number of processes to always keep waiting for more connections.")
326 ;; FIXME: Need to be able to take the default for this value from other
327 ;; parts of the config.
329 (non-negative-integer #e256e6)
330 "If you set @samp{service-count 0}, you probably need to grow
333 (define (serialize-service-configuration field-name val)
334 (format #t "service ~a {\n" (service-configuration-kind val))
335 (serialize-configuration val (cdr service-configuration-fields))
337 (define (service-configuration-list? val)
338 (and (list? val) (and-map service-configuration? val)))
339 (define (serialize-service-configuration-list field-name val)
340 (for-each (lambda (val)
341 (serialize-service-configuration field-name val))
344 (define-configuration protocol-configuration
346 (string (configuration-missing-field 'protocol 'name))
347 "The name of the protocol.")
349 (string "/var/run/dovecot/auth-userdb")
350 "UNIX socket path to master authentication server to find users.
351 This is used by imap (for shared users) and lda.")
353 (space-separated-string-list '("$mail_plugins"))
354 "Space separated list of plugins to load.")
355 (mail-max-userip-connections
356 (non-negative-integer 10)
357 "Maximum number of IMAP connections allowed for a user from each IP
358 address. NOTE: The username is compared case-sensitively.")
361 "Whether to enable the @code{IMAP METADATA} extension as defined in
362 @uref{https://tools.ietf.org/html/rfc5464, RFC@tie{}5464}, which provides
363 a means for clients to set and retrieve per-mailbox, per-user metadata
364 and annotations over IMAP.
366 If this is @samp{#t}, you must also specify a dictionary @i{via} the
367 @code{mail-attribute-dict} setting.")
368 (managesieve-notify-capability
369 (space-separated-string-list '())
370 "Which NOTIFY capabilities to report to clients that first connect to
371 the ManageSieve service, before authentication. These may differ from the
372 capabilities offered to authenticated users. If this field is left empty,
373 report what the Sieve interpreter supports by default.")
374 (managesieve-sieve-capability
375 (space-separated-string-list '())
376 "Which SIEVE capabilities to report to clients that first connect to
377 the ManageSieve service, before authentication. These may differ from the
378 capabilities offered to authenticated users. If this field is left empty,
379 report what the Sieve interpreter supports by default."))
381 (define (serialize-protocol-configuration field-name val)
382 (format #t "protocol ~a {\n" (protocol-configuration-name val))
383 (serialize-configuration val (cdr protocol-configuration-fields))
385 (define (protocol-configuration-list? val)
386 (and (list? val) (and-map protocol-configuration? val)))
387 (define (serialize-protocol-configuration-list field-name val)
388 (serialize-field 'protocols
389 (string-join (map protocol-configuration-name val) " "))
390 (for-each (lambda (val)
391 (serialize-protocol-configuration field-name val))
394 (define-configuration plugin-configuration
396 (free-form-fields '())
397 "A list of key-value pairs that this dict should hold."))
399 (define (serialize-plugin-configuration field-name val)
400 (format #t "plugin {\n")
401 (serialize-configuration val plugin-configuration-fields)
404 (define-configuration mailbox-configuration
406 (string (error "mailbox name is required"))
407 "Name for this mailbox.")
411 "@samp{create} will automatically create this mailbox.
412 @samp{subscribe} will both create and subscribe to the mailbox.")
415 (space-separated-string-list '())
416 "List of IMAP @code{SPECIAL-USE} attributes as specified by RFC 6154.
417 Valid values are @code{\\All}, @code{\\Archive}, @code{\\Drafts},
418 @code{\\Flagged}, @code{\\Junk}, @code{\\Sent}, and @code{\\Trash}."))
420 (define (serialize-mailbox-configuration field-name val)
421 (format #t "mailbox \"~a\" {\n" (mailbox-configuration-name val))
422 (serialize-configuration val (cdr mailbox-configuration-fields))
424 (define (mailbox-configuration-list? val)
425 (and (list? val) (and-map mailbox-configuration? val)))
426 (define (serialize-mailbox-configuration-list field-name val)
427 (for-each (lambda (val)
428 (serialize-mailbox-configuration field-name val))
431 (define-configuration namespace-configuration
433 (string (error "namespace name is required"))
434 "Name for this namespace.")
438 "Namespace type: @samp{private}, @samp{shared} or @samp{public}.")
442 "Hierarchy separator to use. You should use the same separator for
443 all namespaces or some clients get confused. @samp{/} is usually a good
444 one. The default however depends on the underlying mail storage
449 "Prefix required to access this namespace. This needs to be
450 different for all namespaces. For example @samp{Public/}.")
454 "Physical location of the mailbox. This is in same format as
455 mail_location, which is also the default for it.")
459 "There can be only one INBOX, and this setting defines which
464 "If namespace is hidden, it's not advertised to clients via NAMESPACE
465 extension. You'll most likely also want to set @samp{list? #f}. This is mostly
466 useful when converting from another server with different namespaces
467 which you want to deprecate but still keep working. For example you can
468 create hidden namespaces with prefixes @samp{~/mail/}, @samp{~%u/mail/}
473 "Show the mailboxes under this namespace with LIST command. This
474 makes the namespace visible for clients that don't support NAMESPACE
475 extension. The special @code{children} value lists child mailboxes, but
476 hides the namespace prefix.")
480 "Namespace handles its own subscriptions. If set to @code{#f}, the
481 parent namespace handles them. The empty prefix should always have this
485 (mailbox-configuration-list '())
486 "List of predefined mailboxes in this namespace."))
488 (define (serialize-namespace-configuration field-name val)
489 (format #t "namespace ~a {\n" (namespace-configuration-name val))
490 (serialize-configuration val (cdr namespace-configuration-fields))
492 (define (list-of-namespace-configuration? val)
493 (and (list? val) (and-map namespace-configuration? val)))
494 (define (serialize-list-of-namespace-configuration field-name val)
495 (for-each (lambda (val)
496 (serialize-namespace-configuration field-name val))
499 (define-configuration dovecot-configuration
502 "The dovecot package.")
505 (comma-separated-string-list '("*" "::"))
506 "A list of IPs or hosts where to listen in for connections. @samp{*}
507 listens in all IPv4 interfaces, @samp{::} listens in all IPv6
508 interfaces. If you want to specify non-default ports or anything more
509 complex, customize the address and port fields of the
510 @samp{inet-listener} of the specific services you are interested in.")
513 (dict-configuration (dict-configuration))
514 "Dict configuration, as created by the @code{dict-configuration}
518 (passdb-configuration-list (list (passdb-configuration (driver "pam"))))
519 "List of passdb configurations, each one created by the
520 @code{passdb-configuration} constructor.")
523 (userdb-configuration-list (list (userdb-configuration (driver "passwd"))))
524 "List of userdb configurations, each one created by the
525 @code{userdb-configuration} constructor.")
527 (plugin-configuration
528 (plugin-configuration (plugin-configuration))
529 "Plug-in configuration, created by the @code{plugin-configuration}
533 (list-of-namespace-configuration
535 (namespace-configuration
541 (mailbox-configuration (name "Drafts") (special-use '("\\Drafts")))
542 (mailbox-configuration (name "Junk") (special-use '("\\Junk")))
543 (mailbox-configuration (name "Trash") (special-use '("\\Trash")))
544 (mailbox-configuration (name "Sent") (special-use '("\\Sent")))
545 (mailbox-configuration (name "Sent Messages") (special-use '("\\Sent")))
546 (mailbox-configuration (name "Drafts") (special-use '("\\Drafts"))))))))
547 "List of namespaces. Each item in the list is created by the
548 @code{namespace-configuration} constructor.")
551 (file-name "/var/run/dovecot/")
552 "Base directory where to store runtime data.")
555 (string "Dovecot ready.")
556 "Greeting message for clients.")
558 (login-trusted-networks
559 (space-separated-string-list '())
560 "List of trusted network ranges. Connections from these IPs are
561 allowed to override their IP addresses and ports (for logging and for
562 authentication checks). @samp{disable-plaintext-auth} is also ignored
563 for these networks. Typically you'd specify your IMAP proxy servers
566 (login-access-sockets
567 (space-separated-string-list '())
568 "List of login access check sockets (e.g. tcpwrap).")
572 "Show more verbose process titles (in ps). Currently shows user name
573 and IP address. Useful for seeing who are actually using the IMAP
574 processes (e.g. shared mailboxes or if same uid is used for multiple
579 "Should all processes be killed when Dovecot master process shuts down.
580 Setting this to @code{#f} means that Dovecot can be upgraded without
581 forcing existing client connections to close (although that could also
582 be a problem if the upgrade is e.g. because of a security fix).")
584 (doveadm-worker-count
585 (non-negative-integer 0)
586 "If non-zero, run mail commands via this many connections to doveadm
587 server, instead of running them directly in the same process.")
590 (string "doveadm-server")
591 "UNIX socket or host:port used for connecting to doveadm server.")
594 (space-separated-string-list '("TZ"))
595 "List of environment variables that are preserved on Dovecot startup
596 and passed down to all of its child processes. You can also give
597 key=value pairs to always set specific settings.")
599 ;;; Authentication processes
601 (disable-plaintext-auth?
603 "Disable LOGIN command and all other plaintext authentications unless
604 SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
605 matches the local IP (i.e. you're connecting from the same computer),
606 the connection is considered secure and plaintext authentication is
607 allowed. See also ssl=required setting.")
610 (non-negative-integer 0)
611 "Authentication cache size (e.g. @samp{#e10e6}). 0 means it's disabled.
612 Note that bsdauth, PAM and vpopmail require @samp{cache-key} to be set
613 for caching to be used.")
617 "Time to live for cached data. After TTL expires the cached record
618 is no longer used, *except* if the main database lookup returns internal
619 failure. We also try to handle password changes automatically: If
620 user's previous authentication was successful, but this one wasn't, the
621 cache isn't used. For now this works only with plaintext
624 (auth-cache-negative-ttl
626 "TTL for negative hits (user not found, password mismatch).
627 0 disables caching them completely.")
630 (space-separated-string-list '())
631 "List of realms for SASL authentication mechanisms that need them.
632 You can leave it empty if you don't want to support multiple realms.
633 Many clients simply use the first one listed here, so keep the default
638 "Default realm/domain to use if none was specified. This is used for
639 both SASL realms and appending @@domain to username in plaintext
644 "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@")
645 "List of allowed characters in username. If the user-given username
646 contains a character not listed in here, the login automatically fails.
647 This is just an extra check to make sure user can't exploit any
648 potential quote escaping vulnerabilities with SQL/LDAP databases. If
649 you want to allow all characters, set this value to empty.")
651 (auth-username-translation
653 "Username character translations before it's looked up from
654 databases. The value contains series of from -> to characters. For
655 example @samp{#@@/@@} means that @samp{#} and @samp{/} characters are
656 translated to @samp{@@}.")
658 (auth-username-format
660 "Username formatting before it's looked up from databases. You can
661 use the standard variables here, e.g. %Lu would lowercase the username,
662 %n would drop away the domain if it was given, or @samp{%n-AT-%d} would
663 change the @samp{@@} into @samp{-AT-}. This translation is done after
664 @samp{auth-username-translation} changes.")
666 (auth-master-user-separator
668 "If you want to allow master users to log in by specifying the master
669 username within the normal username string (i.e. not using SASL
670 mechanism's support for it), you can specify the separator character
671 here. The format is then <username><separator><master username>.
672 UW-IMAP uses @samp{*} as the separator, so that could be a good
675 (auth-anonymous-username
677 "Username to use for users logging in with ANONYMOUS SASL
680 (auth-worker-max-count
681 (non-negative-integer 30)
682 "Maximum number of dovecot-auth worker processes. They're used to
683 execute blocking passdb and userdb queries (e.g. MySQL and PAM).
684 They're automatically created and destroyed as needed.")
686 (auth-gssapi-hostname
688 "Host name to use in GSSAPI principal names. The default is to use
689 the name returned by gethostname(). Use @samp{$ALL} (with quotes) to
690 allow all keytab entries.")
694 "Kerberos keytab to use for the GSSAPI mechanism. Will use the
695 system default (usually /etc/krb5.keytab) if not specified. You may
696 need to change the auth service to run as root to be able to read this
701 "Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon
702 and @samp{ntlm-auth} helper.
703 <doc/wiki/Authentication/Mechanisms/Winbind.txt>.")
705 (auth-winbind-helper-path
706 (file-name "/usr/bin/ntlm_auth")
707 "Path for Samba's @samp{ntlm-auth} helper binary.")
711 "Time to delay before replying to failed authentications.")
713 (auth-ssl-require-client-cert?
715 "Require a valid SSL client certificate or the authentication
718 (auth-ssl-username-from-cert?
720 "Take the username from client's SSL certificate, using
721 @code{X509_NAME_get_text_by_NID()} which returns the subject's DN's
725 (space-separated-string-list '("plain"))
726 "List of wanted authentication mechanisms. Supported mechanisms are:
727 @samp{plain}, @samp{login}, @samp{digest-md5}, @samp{cram-md5},
728 @samp{ntlm}, @samp{rpa}, @samp{apop}, @samp{anonymous}, @samp{gssapi},
729 @samp{otp}, @samp{skey}, and @samp{gss-spnego}. NOTE: See also
730 @samp{disable-plaintext-auth} setting.")
733 (space-separated-string-list '())
734 "List of IPs or hostnames to all director servers, including ourself.
735 Ports can be specified as ip:port. The default port is the same as what
736 director service's @samp{inet-listener} is using.")
738 (director-mail-servers
739 (space-separated-string-list '())
740 "List of IPs or hostnames to all backend mail servers. Ranges are
741 allowed too, like 10.0.0.10-10.0.0.30.")
743 (director-user-expire
745 "How long to redirect users to a specific server after it no longer
746 has any connections.")
748 (director-username-hash
750 "How the username is translated before being hashed. Useful values
751 include %Ln if user can log in with or without @@domain, %Ld if mailboxes
752 are shared within domain.")
758 "Log file to use for error messages. @samp{syslog} logs to syslog,
759 @samp{/dev/stderr} logs to stderr.")
763 "Log file to use for informational messages. Defaults to
768 "Log file to use for debug messages. Defaults to
769 @samp{info-log-path}.")
773 "Syslog facility to use if you're logging to syslog. Usually if you
774 don't want to use @samp{mail}, you'll use local0..local7. Also other
775 standard facilities are supported.")
779 "Log unsuccessful authentication attempts and the reasons why they
782 (auth-verbose-passwords
784 "In case of password mismatches, log the attempted password. Valid
785 values are no, plain and sha1. sha1 can be useful for detecting brute
786 force password attempts vs. user simply trying the same password over
787 and over again. You can also truncate the value to n chars by appending
788 \":n\" (e.g. sha1:6).")
792 "Even more verbose logging for debugging purposes. Shows for example
795 (auth-debug-passwords?
797 "In case of password mismatches, log the passwords and used scheme so
798 the problem can be debugged. Enabling this also enables
803 "Enable mail process debugging. This can help you figure out why
804 Dovecot isn't finding your mails.")
808 "Show protocol level SSL errors.")
811 (string "\"%b %d %H:%M:%S \"")
812 "Prefix for each line written to log file. % codes are in
813 strftime(3) format.")
815 (login-log-format-elements
816 (space-separated-string-list
817 '("user=<%u>" "method=%m" "rip=%r" "lip=%l" "mpid=%e" "%c"))
818 "List of elements we want to log. The elements which have a
819 non-empty variable value are joined together to form a comma-separated
824 "Login log format. %s contains @samp{login-log-format-elements}
825 string, %$ contains the data we want to log.")
828 (string "\"%s(%u)<%{pid}><%{session}>: \"")
829 "Log prefix for mail processes. See doc/wiki/Variables.txt for list
830 of possible variables you can use.")
833 (string "msgid=%m: %$")
834 "Format to use for logging mail deliveries. You can use variables:
837 Delivery status message (e.g. @samp{saved to INBOX})
850 ;;; Mailbox locations and namespaces
854 "Location for users' mailboxes. The default is empty, which means
855 that Dovecot tries to find the mailboxes automatically. This won't work
856 if the user doesn't yet have any mail, so you should explicitly tell
857 Dovecot the full location.
859 If you're using mbox, giving a path to the INBOX
860 file (e.g. /var/mail/%u) isn't enough. You'll also need to tell Dovecot
861 where the other mailboxes are kept. This is called the \"root mail
862 directory\", and it must be the first path given in the
863 @samp{mail-location} setting.
865 There are a few special variables you can use, eg.:
871 user part in user@@domain, same as %u if there's no domain
873 domain part in user@@domain, empty if there's no domain
878 See doc/wiki/Variables.txt for full list. Some examples:
880 @item maildir:~/Maildir
881 @item mbox:~/mail:INBOX=/var/mail/%u
882 @item mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%
887 "System user and group used to access mails. If you use multiple,
888 userdb can override these by returning uid or gid fields. You can use
889 either numbers or names. <doc/wiki/UserIds.txt>.")
895 (mail-privileged-group
897 "Group to enable temporarily for privileged operations. Currently
898 this is used only with INBOX when either its initial creation or
899 dotlocking fails. Typically this is set to \"mail\" to give access to
904 "Grant access to these supplementary groups for mail processes.
905 Typically these are used to set up access to shared mailboxes. Note
906 that it may be dangerous to set these if users can create
907 symlinks (e.g. if \"mail\" group is set here, ln -s /var/mail ~/mail/var
908 could allow a user to delete others' mailboxes, or ln -s
909 /secret/shared/box ~/mail/mybox would allow reading it).")
911 (mail-full-filesystem-access?
913 "Allow full file system access to clients. There's no access checks
914 other than what the operating system does for the active UID/GID. It
915 works with both maildir and mboxes, allowing you to prefix mailboxes
916 names with e.g. /path/ or ~user/.")
922 "Don't use mmap() at all. This is required if you store indexes to
923 shared file systems (NFS or clustered file system).")
927 "Rely on @samp{O_EXCL} to work when creating dotlock files. NFS
928 supports @samp{O_EXCL} since version 3, so this should be safe to use
929 nowadays by default.")
933 "When to use fsync() or fdatasync() calls:
936 Whenever necessary to avoid losing important data
938 Useful with e.g. NFS when write()s are delayed
940 Never use it (best performance, but crashes can lose data).
945 "Mail storage exists in NFS. Set this to yes to make Dovecot flush
946 NFS caches whenever needed. If you're using only a single mail server
951 "Mail index files also exist in NFS. Setting this to yes requires
952 @samp{mmap-disable? #t} and @samp{fsync-disable? #f}.")
956 "Locking method for index files. Alternatives are fcntl, flock and
957 dotlock. Dotlocking uses some tricks which may create more disk I/O
958 than other locking methods. NFS users: flock doesn't work, remember to
959 change @samp{mmap-disable}.")
963 "Directory in which LDA/LMTP temporarily stores incoming mails >128
967 (non-negative-integer 500)
968 "Valid UID range for users. This is mostly to make sure that users can't
969 log in as daemons or other system users. Note that denying root logins is
970 hardcoded to dovecot binary and can't be done even if @samp{first-valid-uid}
974 (non-negative-integer 0)
978 (non-negative-integer 1)
979 "Valid GID range for users. Users having non-valid GID as primary group ID
980 aren't allowed to log in. If user belongs to supplementary groups with
981 non-valid GIDs, those groups are not set.")
984 (non-negative-integer 0)
987 (mail-max-keyword-length
988 (non-negative-integer 50)
989 "Maximum allowed length for mail keyword name. It's only forced when
990 trying to create new keywords.")
993 (colon-separated-file-name-list '())
994 "List of directories under which chrooting is allowed for mail
995 processes (i.e. /var/mail will allow chrooting to /var/mail/foo/bar
996 too). This setting doesn't affect @samp{login-chroot}
997 @samp{mail-chroot} or auth chroot settings. If this setting is empty,
998 \"/./\" in home dirs are ignored. WARNING: Never add directories here
999 which local users can modify, that may lead to root exploit. Usually
1000 this should be done only if you don't allow shell access for users.
1001 <doc/wiki/Chrooting.txt>.")
1005 "Default chroot directory for mail processes. This can be overridden
1006 for specific users in user database by giving /./ in user's home
1007 directory (e.g. /home/./user chroots into /home). Note that usually
1008 there is no real need to do chrooting, Dovecot doesn't allow users to
1009 access files outside their mail directory anyway. If your home
1010 directories are prefixed with the chroot directory, append \"/.\" to
1011 @samp{mail-chroot}. <doc/wiki/Chrooting.txt>.")
1014 (file-name "/var/run/dovecot/auth-userdb")
1015 "UNIX socket path to master authentication server to find users.
1016 This is used by imap (for shared users) and lda.")
1019 (file-name "/usr/lib/dovecot")
1020 "Directory where to look up mail plugins.")
1023 (space-separated-string-list '())
1024 "List of plugins to load for all services. Plugins specific to IMAP,
1025 LDA, etc. are added to this list in their own .conf files.")
1028 (mail-cache-min-mail-count
1029 (non-negative-integer 0)
1030 "The minimum number of mails in a mailbox before updates are done to
1031 cache file. This allows optimizing Dovecot's behavior to do less disk
1032 writes at the cost of more disk reads.")
1034 (mailbox-idle-check-interval
1036 "When IDLE command is running, mailbox is checked once in a while to
1037 see if there are any new mails or other changes. This setting defines
1038 the minimum time to wait between those checks. Dovecot can also use
1039 dnotify, inotify and kqueue to find out immediately when changes
1044 "Save mails with CR+LF instead of plain LF. This makes sending those
1045 mails take less CPU, especially with sendfile() syscall with Linux and
1046 FreeBSD. But it also creates a bit more disk I/O which may just make it
1047 slower. Also note that if other software reads the mboxes/maildirs,
1048 they may handle the extra CRs wrong and cause problems.")
1052 "By default LIST command returns all entries in maildir beginning
1053 with a dot. Enabling this option makes Dovecot return only entries
1054 which are directories. This is done by stat()ing each entry, so it
1055 causes more disk I/O.
1056 (For systems setting struct @samp{dirent->d_type} this check is free
1057 and it's done always regardless of this setting).")
1059 (maildir-copy-with-hardlinks?
1061 "When copying a message, do it with hard links whenever possible.
1062 This makes the performance much better, and it's unlikely to have any
1065 (maildir-very-dirty-syncs?
1067 "Assume Dovecot is the only MUA accessing Maildir: Scan cur/
1068 directory only when its mtime changes unexpectedly or when we can't find
1069 the mail otherwise.")
1072 (space-separated-string-list '("fcntl"))
1073 "Which locking methods to use for locking mbox. There are four
1078 Create <mailbox>.lock file. This is the oldest and most NFS-safe
1079 solution. If you want to use /var/mail/ like directory, the users will
1080 need write access to that directory.
1082 Same as dotlock, but if it fails because of permissions or because there
1083 isn't enough disk space, just skip it.
1085 Use this if possible. Works with NFS too if lockd is used.
1087 May not exist in all systems. Doesn't work with NFS.
1089 May not exist in all systems. Doesn't work with NFS.
1092 You can use multiple locking methods; if you do the order they're declared
1093 in is important to avoid deadlocks if other MTAs/MUAs are using multiple
1094 locking methods as well. Some operating systems don't allow using some of
1095 them simultaneously.")
1098 (space-separated-string-list '("dotlock" "fcntl"))
1103 "Maximum time to wait for lock (all of them) before aborting.")
1105 (mbox-dotlock-change-timeout
1107 "If dotlock exists but the mailbox isn't modified in any way,
1108 override the lock file after this much time.")
1112 "When mbox changes unexpectedly we have to fully read it to find out
1113 what changed. If the mbox is large this can take a long time. Since
1114 the change is usually just a newly appended mail, it'd be faster to
1115 simply read the new mails. If this setting is enabled, Dovecot does
1116 this but still safely fallbacks to re-reading the whole mbox file
1117 whenever something in mbox isn't how it's expected to be. The only real
1118 downside to this setting is that if some other MUA changes message
1119 flags, Dovecot doesn't notice it immediately. Note that a full sync is
1120 done with SELECT, EXAMINE, EXPUNGE and CHECK commands.")
1122 (mbox-very-dirty-syncs?
1124 "Like @samp{mbox-dirty-syncs}, but don't do full syncs even with SELECT,
1125 EXAMINE, EXPUNGE or CHECK commands. If this is set,
1126 @samp{mbox-dirty-syncs} is ignored.")
1130 "Delay writing mbox headers until doing a full write sync (EXPUNGE
1131 and CHECK commands and when closing the mailbox). This is especially
1132 useful for POP3 where clients often delete all mails. The downside is
1133 that our changes aren't immediately visible to other MUAs.")
1135 (mbox-min-index-size
1136 (non-negative-integer 0)
1137 "If mbox size is smaller than this (e.g. 100k), don't write index
1138 files. If an index file already exists it's still read, just not
1142 (non-negative-integer #e10e6)
1143 "Maximum dbox file size until it's rotated.")
1145 (mdbox-rotate-interval
1147 "Maximum dbox file age until it's rotated. Typically in days. Day
1148 begins from midnight, so 1d = today, 2d = yesterday, etc. 0 = check
1151 (mdbox-preallocate-space?
1153 "When creating new mdbox files, immediately preallocate their size to
1154 @samp{mdbox-rotate-size}. This setting currently works only in Linux
1155 with some file systems (ext4, xfs).")
1157 (mail-attribute-dict
1159 "The location of a dictionary used to store @code{IMAP METADATA}
1160 as defined by @uref{https://tools.ietf.org/html/rfc5464, RFC@tie{}5464}.
1162 The IMAP METADATA commands are available only if the ``imap''
1163 protocol configuration's @code{imap-metadata?} field is @samp{#t}.")
1165 (mail-attachment-dir
1167 "sdbox and mdbox support saving mail attachments to external files,
1168 which also allows single instance storage for them. Other backends
1169 don't support this for now.
1171 WARNING: This feature hasn't been tested much yet. Use at your own risk.
1173 Directory root where to store mail attachments. Disabled, if empty.")
1175 (mail-attachment-min-size
1176 (non-negative-integer #e128e3)
1177 "Attachments smaller than this aren't saved externally. It's also
1178 possible to write a plugin to disable saving specific attachments
1182 (string "sis posix")
1183 "File system backend to use for saving attachments:
1186 No SiS done by Dovecot (but this might help FS's own deduplication)
1188 SiS with immediate byte-by-byte comparison during saving
1189 @item sis-queue posix
1190 SiS with delayed comparison and deduplication.
1193 (mail-attachment-hash
1195 "Hash format to use in attachment filenames. You can add any text and
1196 variables: @code{%@{md4@}}, @code{%@{md5@}}, @code{%@{sha1@}},
1197 @code{%@{sha256@}}, @code{%@{sha512@}}, @code{%@{size@}}. Variables can be
1198 truncated, e.g. @code{%@{sha256:80@}} returns only first 80 bits.")
1200 (default-process-limit
1201 (non-negative-integer 100)
1204 (default-client-limit
1205 (non-negative-integer 1000)
1209 (non-negative-integer #e256e6)
1210 "Default VSZ (virtual memory size) limit for service processes.
1211 This is mainly intended to catch and kill processes that leak memory
1212 before they eat up everything.")
1216 "Login user is internally used by login processes. This is the most
1217 untrusted user in Dovecot system. It shouldn't have access to anything
1220 (default-internal-user
1222 "Internal user is used by unprivileged processes. It should be
1223 separate from login user, so that login processes can't disturb other
1228 "SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>.")
1231 (string "</etc/dovecot/default.pem")
1232 "PEM encoded X.509 SSL/TLS certificate (public key).")
1235 (string "</etc/dovecot/private/default.pem")
1236 "PEM encoded SSL/TLS private key. The key is opened before
1237 dropping root privileges, so keep the key file unreadable by anyone but
1242 "If key file is password protected, give the password here.
1243 Alternatively give it when starting dovecot with -p parameter. Since
1244 this file is often world-readable, you may want to place this setting
1245 instead to a different.")
1249 "PEM encoded trusted certificate authority. Set this only if you
1250 intend to use @samp{ssl-verify-client-cert? #t}. The file should
1251 contain the CA certificate(s) followed by the matching
1252 CRL(s). (e.g. @samp{ssl-ca </etc/ssl/certs/ca.pem}).")
1255 "Require that CRL check succeeds for client certificates.")
1256 (ssl-verify-client-cert?
1258 "Request client to send a certificate. If you also want to require
1259 it, set @samp{auth-ssl-require-client-cert? #t} in auth section.")
1261 (ssl-cert-username-field
1262 (string "commonName")
1263 "Which field from certificate to use for username. commonName and
1264 x500UniqueIdentifier are the usual choices. You'll also need to set
1265 @samp{auth-ssl-username-from-cert? #t}.")
1269 "Minimum SSL protocol version to accept.")
1272 (string "ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH")
1273 "SSL ciphers to use.")
1277 "SSL crypto device to use, for valid values run \"openssl engine\".")
1280 (string "postmaster@%d")
1281 "Address to use when sending rejection mails.
1282 Default is postmaster@@<your domain>. %d expands to recipient domain.")
1286 "Hostname to use in various parts of sent mails (e.g. in Message-Id)
1287 and in LMTP replies. Default is the system's real hostname@@domain.")
1289 (quota-full-tempfail?
1291 "If user is over quota, return with temporary failure instead of
1292 bouncing the mail.")
1295 (file-name "/usr/sbin/sendmail")
1296 "Binary to use for sending mails.")
1300 "If non-empty, send mails via this SMTP host[:port] instead of
1304 (string "Rejected: %s")
1305 "Subject: header to use for rejection mails. You can use the same
1306 variables as for @samp{rejection-reason} below.")
1309 (string "Your message to <%t> was automatically rejected:%n%r")
1310 "Human readable error message for rejection mails. You can use
1324 (recipient-delimiter
1326 "Delimiter character between local-part and detail in email
1329 (lda-original-recipient-header
1331 "Header where the original recipient address (SMTP's RCPT TO:
1332 address) is taken from if not available elsewhere. With dovecot-lda -a
1333 parameter overrides this. A commonly used header for this is
1336 (lda-mailbox-autocreate?
1338 "Should saving a mail to a nonexistent mailbox automatically create
1341 (lda-mailbox-autosubscribe?
1343 "Should automatically created mailboxes be also automatically
1347 (imap-max-line-length
1348 (non-negative-integer #e64e3)
1349 "Maximum IMAP command line length. Some clients generate very long
1350 command lines with huge mailboxes, so you may need to raise this if you
1351 get \"Too long argument\" or \"IMAP command line too large\" errors
1355 (string "in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes}")
1356 "IMAP logout format string:
1359 total number of bytes read from client
1361 total number of bytes sent to client.
1363 See @file{doc/wiki/Variables.txt} for a list of all the variables you can use.")
1367 "Override the IMAP CAPABILITY response. If the value begins with '+',
1368 add the given capabilities on top of the defaults (e.g. +XFOO XBAR).")
1370 (imap-idle-notify-interval
1372 "How long to wait between \"OK Still here\" notifications when client
1377 "ID field names and values to send to clients. Using * as the value
1378 makes Dovecot use the default value. The following fields have default
1379 values currently: name, version, os, os-version, support-url,
1384 "ID fields sent by client to log. * means everything.")
1386 (imap-client-workarounds
1387 (space-separated-string-list '())
1388 "Workarounds for various client bugs:
1392 Send EXISTS/RECENT new mail notifications only when replying to NOOP and
1393 CHECK commands. Some clients ignore them otherwise, for example OSX
1394 Mail (<v2.1). Outlook Express breaks more badly though, without this it
1395 may show user \"Message no longer in server\" errors. Note that OE6
1396 still breaks even with this workaround if synchronization is set to
1399 @item tb-extra-mailbox-sep
1400 Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
1401 adds extra @samp{/} suffixes to mailbox names. This option causes Dovecot to
1402 ignore the extra @samp{/} instead of treating it as invalid mailbox name.
1405 Show \\Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
1406 This makes Thunderbird realize they aren't selectable and show them
1407 greyed out, instead of only later giving \"not selectable\" popup error.
1413 "Host allowed in URLAUTH URLs sent by client. \"*\" allows all.")
1416 (protocol-configuration-list
1417 (list (protocol-configuration
1419 "List of protocols we want to serve. Available protocols include
1420 @samp{imap}, @samp{pop3}, and @samp{lmtp}.")
1423 (service-configuration-list
1425 (service-configuration
1431 (inet-listener-configuration (protocol "imap") (port 143) (ssl? #f))
1432 (inet-listener-configuration (protocol "imaps") (port 993) (ssl? #t)))))
1433 (service-configuration
1437 (inet-listener-configuration (protocol "pop3") (port 110) (ssl? #f))
1438 (inet-listener-configuration (protocol "pop3s") (port 995) (ssl? #t)))))
1439 (service-configuration
1444 (list (unix-listener-configuration (path "lmtp") (mode "0666")))))
1445 (service-configuration
1448 (process-limit 1024))
1449 (service-configuration
1452 (process-limit 1024))
1453 (service-configuration
1459 (list (unix-listener-configuration (path "auth-userdb")))))
1460 (service-configuration
1461 (kind "auth-worker")
1464 (service-configuration
1468 (listeners (list (unix-listener-configuration (path "dict")))))))
1469 "List of services to enable. Available services include @samp{imap},
1470 @samp{imap-login}, @samp{pop3}, @samp{pop3-login}, @samp{auth}, and
1473 (define-configuration opaque-dovecot-configuration
1476 "The dovecot package.")
1479 (string (configuration-missing-field 'opaque-dovecot-configuration
1481 "The contents of the @code{dovecot.conf} to use."))
1483 (define %dovecot-accounts
1484 ;; Account and group for the Dovecot daemon.
1485 (list (user-group (name "dovecot") (system? #t))
1490 (comment "Dovecot daemon user")
1491 (home-directory "/var/empty")
1492 (shell (file-append shadow "/sbin/nologin")))
1494 (user-group (name "dovenull") (system? #t))
1499 (comment "Dovecot daemon login user")
1500 (home-directory "/var/empty")
1501 (shell (file-append shadow "/sbin/nologin")))))
1503 (define (%dovecot-activation config)
1507 ((opaque-dovecot-configuration? config)
1508 (opaque-dovecot-configuration-string config))
1510 (with-output-to-string
1512 (serialize-configuration config
1513 dovecot-configuration-fields)))))))
1515 (use-modules (guix build utils))
1516 (define (mkdir-p/perms directory owner perms)
1518 (chown "/var/run/dovecot" (passwd:uid owner) (passwd:gid owner))
1519 (chmod directory perms))
1520 (define (build-subject parameters)
1523 (let ((k (car pair)) (v (cdr pair)))
1524 (define (escape-char str chr)
1525 (string-join (string-split str chr) (string #\\ chr)))
1526 (string-append "/" k "="
1527 (escape-char (escape-char v #\=) #\/))))
1528 (filter (lambda (pair) (cdr pair)) parameters))))
1529 (define* (create-self-signed-certificate-if-absent
1530 #:key private-key public-key (owner (getpwnam "root"))
1531 (common-name (gethostname))
1532 (organization-name "Guix")
1533 (organization-unit-name "Default Self-Signed Certificate")
1534 (subject-parameters `(("CN" . ,common-name)
1535 ("O" . ,organization-name)
1536 ("OU" . ,organization-unit-name)))
1537 (subject (build-subject subject-parameters)))
1538 ;; Note that by default, OpenSSL outputs keys in PEM format. This
1540 (unless (file-exists? private-key)
1542 ((zero? (system* (string-append #$openssl "/bin/openssl")
1543 "genrsa" "-out" private-key "2048"))
1544 (chown private-key (passwd:uid owner) (passwd:gid owner))
1545 (chmod private-key #o400))
1547 (format (current-error-port)
1548 "Failed to create private key at ~a.\n" private-key))))
1549 (unless (file-exists? public-key)
1551 ((zero? (system* (string-append #$openssl "/bin/openssl")
1552 "req" "-new" "-x509" "-key" private-key
1553 "-out" public-key "-days" "3650"
1554 "-batch" "-subj" subject))
1555 (chown public-key (passwd:uid owner) (passwd:gid owner))
1556 (chmod public-key #o444))
1558 (format (current-error-port)
1559 "Failed to create public key at ~a.\n" public-key)))))
1560 (let ((user (getpwnam "dovecot")))
1561 (mkdir-p/perms "/var/run/dovecot" user #o755)
1562 (mkdir-p/perms "/var/lib/dovecot" user #o755)
1563 (mkdir-p/perms "/etc/dovecot" user #o755)
1564 (copy-file #$(plain-file "dovecot.conf" config-str)
1565 "/etc/dovecot/dovecot.conf")
1566 (mkdir-p/perms "/etc/dovecot/private" user #o700)
1567 (create-self-signed-certificate-if-absent
1568 #:private-key "/etc/dovecot/private/default.pem"
1569 #:public-key "/etc/dovecot/default.pem"
1570 #:owner (getpwnam "root")
1571 #:common-name (format #f "Dovecot service on ~a" (gethostname)))))))
1573 (define (dovecot-shepherd-service config)
1574 "Return a list of <shepherd-service> for CONFIG."
1575 (let ((dovecot (if (opaque-dovecot-configuration? config)
1576 (opaque-dovecot-configuration-dovecot config)
1577 (dovecot-configuration-dovecot config))))
1578 (list (shepherd-service
1579 (documentation "Run the Dovecot POP3/IMAP mail server.")
1580 (provision '(dovecot))
1581 (requirement '(networking))
1582 (start #~(make-forkexec-constructor
1583 (list (string-append #$dovecot "/sbin/dovecot")
1586 (invoke #$(file-append dovecot "/sbin/dovecot")
1590 (define %dovecot-pam-services
1591 (list (unix-pam-service "dovecot")))
1593 (define dovecot-service-type
1594 (service-type (name 'dovecot)
1596 (list (service-extension shepherd-root-service-type
1597 dovecot-shepherd-service)
1598 (service-extension account-service-type
1599 (const %dovecot-accounts))
1600 (service-extension pam-root-service-type
1601 (const %dovecot-pam-services))
1602 (service-extension activation-service-type
1603 %dovecot-activation)))
1604 (description "Run Dovecot, a mail server that can run POP3,
1607 (define* (dovecot-service #:key (config (dovecot-configuration)))
1608 "Return a service that runs @command{dovecot}, a mail server that can run
1609 POP3, IMAP, and LMTP. @var{config} should be a configuration object created
1610 by @code{dovecot-configuration}. @var{config} may also be created by
1611 @code{opaque-dovecot-configuration}, which allows specification of the
1612 @code{dovecot.conf} as a string."
1613 (validate-configuration config
1614 (if (opaque-dovecot-configuration? config)
1615 opaque-dovecot-configuration-fields
1616 dovecot-configuration-fields))
1617 (service dovecot-service-type config))
1619 ;; A little helper to make it easier to document all those fields.
1620 (define (generate-dovecot-documentation)
1621 (generate-documentation
1622 `((dovecot-configuration
1623 ,dovecot-configuration-fields
1624 (dict dict-configuration)
1625 (namespaces namespace-configuration)
1626 (plugin plugin-configuration)
1627 (passdbs passdb-configuration)
1628 (userdbs userdb-configuration)
1629 (services service-configuration)
1630 (protocols protocol-configuration))
1631 (dict-configuration ,dict-configuration-fields)
1632 (plugin-configuration ,plugin-configuration-fields)
1633 (passdb-configuration ,passdb-configuration-fields)
1634 (userdb-configuration ,userdb-configuration-fields)
1635 (unix-listener-configuration ,unix-listener-configuration-fields)
1636 (fifo-listener-configuration ,fifo-listener-configuration-fields)
1637 (inet-listener-configuration ,inet-listener-configuration-fields)
1638 (namespace-configuration
1639 ,namespace-configuration-fields
1640 (mailboxes mailbox-configuration))
1641 (mailbox-configuration ,mailbox-configuration-fields)
1642 (service-configuration
1643 ,service-configuration-fields
1644 (listeners unix-listener-configuration fifo-listener-configuration
1645 inet-listener-configuration))
1646 (protocol-configuration ,protocol-configuration-fields))
1647 'dovecot-configuration))
1654 (define-record-type* <opensmtpd-configuration>
1655 opensmtpd-configuration make-opensmtpd-configuration
1656 opensmtpd-configuration?
1657 (package opensmtpd-configuration-package
1658 (default opensmtpd))
1659 (config-file opensmtpd-configuration-config-file
1660 (default %default-opensmtpd-config-file)))
1662 (define %default-opensmtpd-config-file
1663 (plain-file "smtpd.conf" "
1667 match for local action inbound
1669 action outbound relay
1670 match from local for any action outbound
1673 (define opensmtpd-shepherd-service
1675 (($ <opensmtpd-configuration> package config-file)
1676 (list (shepherd-service
1677 (provision '(smtpd))
1678 (requirement '(loopback))
1679 (documentation "Run the OpenSMTPD daemon.")
1680 (start (let ((smtpd (file-append package "/sbin/smtpd")))
1681 #~(make-forkexec-constructor
1682 (list #$smtpd "-f" #$config-file)
1683 #:pid-file "/var/run/smtpd.pid")))
1684 (stop #~(make-kill-destructor)))))))
1686 (define %opensmtpd-accounts
1694 (comment "SMTP Daemon")
1695 (home-directory "/var/empty")
1696 (shell (file-append shadow "/sbin/nologin")))
1701 (comment "SMTPD Queue")
1702 (home-directory "/var/empty")
1703 (shell (file-append shadow "/sbin/nologin")))))
1705 (define opensmtpd-activation
1707 (($ <opensmtpd-configuration> package config-file)
1708 (let ((smtpd (file-append package "/sbin/smtpd")))
1710 (use-modules (guix build utils))
1711 ;; Create mbox and spool directories.
1712 (mkdir-p "/var/mail")
1713 (mkdir-p "/var/spool/smtpd")
1714 (chmod "/var/spool/smtpd" #o711)
1715 (mkdir-p "/var/spool/mail")
1716 (chmod "/var/spool/mail" #o711))))))
1718 (define %opensmtpd-pam-services
1719 (list (unix-pam-service "smtpd")))
1721 (define opensmtpd-service-type
1725 (list (service-extension account-service-type
1726 (const %opensmtpd-accounts))
1727 (service-extension activation-service-type
1728 opensmtpd-activation)
1729 (service-extension pam-root-service-type
1730 (const %opensmtpd-pam-services))
1731 (service-extension profile-service-type
1732 (compose list opensmtpd-configuration-package))
1733 (service-extension shepherd-root-service-type
1734 opensmtpd-shepherd-service)))
1735 (description "Run the OpenSMTPD, a lightweight @acronym{SMTP, Simple Mail
1736 Transfer Protocol} server.")))
1743 (define (mail-aliases-etc aliases)
1744 `(("aliases" ,(plain-file "aliases"
1745 ;; Ideally we'd use a format string like
1746 ;; "~:{~a: ~{~a~^,~}\n~}", but it gives a
1747 ;; warning that I can't figure out how to fix,
1748 ;; so we'll just use string-join below instead.
1749 (format #f "~:{~a: ~a\n~}"
1751 ((alias addresses ...)
1752 (list alias (string-join addresses ","))))
1755 (define mail-aliases-service-type
1757 (name 'mail-aliases)
1759 (list (service-extension etc-service-type mail-aliases-etc)))
1760 (compose concatenate)
1762 (description "Provide a @file{/etc/aliases} file---an email alias
1763 database---computed from the given alias list.")))
1770 (define-record-type* <exim-configuration> exim-configuration
1771 make-exim-configuration
1773 (package exim-configuration-package ;file-like
1775 (config-file exim-configuration-config-file ;file-like
1778 (define %exim-accounts
1786 (comment "Exim Daemon")
1787 (home-directory "/var/empty")
1788 (shell (file-append shadow "/sbin/nologin")))))
1790 (define (exim-computed-config-file package config-file)
1791 (computed-file "exim.conf"
1792 #~(call-with-output-file #$output
1799 (file-append package "/etc/exim.conf")))))))
1801 (define exim-shepherd-service
1803 (($ <exim-configuration> package config-file)
1804 (list (shepherd-service
1805 (provision '(exim mta))
1806 (documentation "Run the exim daemon.")
1807 (requirement '(networking))
1808 (start #~(make-forkexec-constructor
1809 '(#$(file-append package "/bin/exim")
1811 #$(exim-computed-config-file package config-file))))
1812 (stop #~(make-kill-destructor)))))))
1814 (define exim-activation
1816 (($ <exim-configuration> package config-file)
1817 (with-imported-modules '((guix build utils))
1819 (use-modules (guix build utils))
1821 (let ((uid (passwd:uid (getpw "exim")))
1822 (gid (group:gid (getgr "exim"))))
1823 (mkdir-p "/var/spool/exim")
1824 (chown "/var/spool/exim" uid gid))
1826 (zero? (system* #$(file-append package "/bin/exim")
1827 "-bV" "-C" #$(exim-computed-config-file package config-file))))))))
1829 (define exim-profile
1830 (compose list exim-configuration-package))
1832 (define exim-service-type
1836 (list (service-extension shepherd-root-service-type exim-shepherd-service)
1837 (service-extension account-service-type (const %exim-accounts))
1838 (service-extension activation-service-type exim-activation)
1839 (service-extension profile-service-type exim-profile)
1840 (service-extension mail-aliases-service-type (const '()))))
1841 (description "Run the Exim mail transfer agent (MTA).")))
1845 ;;; GNU Mailutils IMAP4 Daemon.
1848 (define %default-imap4d-config-file
1849 (plain-file "imap4d.conf" "server localhost {};\n"))
1851 (define-record-type* <imap4d-configuration>
1852 imap4d-configuration make-imap4d-configuration imap4d-configuration?
1853 (package imap4d-configuration-package
1854 (default mailutils))
1855 (config-file imap4d-configuration-config-file
1856 (default %default-imap4d-config-file)))
1858 (define imap4d-shepherd-service
1860 (($ <imap4d-configuration> package config-file)
1861 (list (shepherd-service
1862 (provision '(imap4d))
1863 (requirement '(networking syslogd))
1864 (documentation "Run the imap4d daemon.")
1865 (start (let ((imap4d (file-append package "/sbin/imap4d")))
1866 #~(make-forkexec-constructor
1867 (list #$imap4d "--daemon" "--foreground"
1868 "--config-file" #$config-file))))
1869 (stop #~(make-kill-destructor)))))))
1871 (define imap4d-service-type
1875 "Run the GNU @command{imap4d} to serve e-mail messages through IMAP.")
1877 (list (service-extension
1878 shepherd-root-service-type imap4d-shepherd-service)))
1879 (default-value (imap4d-configuration))))
1886 (define-record-type* <radicale-configuration>
1887 radicale-configuration make-radicale-configuration
1888 radicale-configuration?
1889 (package radicale-configuration-package
1891 (config-file radicale-configuration-config-file
1892 (default %default-radicale-config-file)))
1894 (define %default-radicale-config-file
1895 (plain-file "radicale.conf" "
1898 htpasswd_filename = /var/lib/radicale/users
1899 htpasswd_encryption = plain
1902 hosts = localhost:5232"))
1904 (define %radicale-accounts
1912 (comment "Radicale Daemon")
1913 (home-directory "/var/empty")
1914 (shell (file-append shadow "/sbin/nologin")))))
1916 (define radicale-shepherd-service
1918 (($ <radicale-configuration> package config-file)
1919 (list (shepherd-service
1920 (provision '(radicale))
1921 (documentation "Run the radicale daemon.")
1922 (requirement '(networking))
1923 (start #~(make-forkexec-constructor
1924 (list #$(file-append package "/bin/radicale")
1927 #:group "radicale"))
1928 (stop #~(make-kill-destructor)))))))
1930 (define radicale-activation
1932 (($ <radicale-configuration> package config-file)
1933 (with-imported-modules '((guix build utils))
1935 (use-modules (guix build utils))
1936 (let ((uid (passwd:uid (getpw "radicale")))
1937 (gid (group:gid (getgr "radicale"))))
1938 (mkdir-p "/var/lib/radicale/collections")
1939 (chown "/var/lib/radicale" uid gid)
1940 (chown "/var/lib/radicale/collections" uid gid)
1941 (chmod "/var/lib/radicale" #o700)))))))
1943 (define radicale-service-type
1946 (description "Run radicale, a small CalDAV and CardDAV server.")
1948 (list (service-extension shepherd-root-service-type radicale-shepherd-service)
1949 (service-extension account-service-type (const %radicale-accounts))
1950 (service-extension activation-service-type radicale-activation)))
1951 (default-value (radicale-configuration))))