Merge remote-tracking branch 'origin/master' into core-updates
[jackhill/guix/guix.git] / gnu / services / mail.scm
1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2015 Andy Wingo <wingo@igalia.com>
3 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
4 ;;; Copyright © 2017 Carlo Zancanaro <carlo@zancanaro.id.au>
5 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
6 ;;;
7 ;;; This file is part of GNU Guix.
8 ;;;
9 ;;; GNU Guix is free software; you can redistribute it and/or modify it
10 ;;; under the terms of the GNU General Public License as published by
11 ;;; the Free Software Foundation; either version 3 of the License, or (at
12 ;;; your option) any later version.
13 ;;;
14 ;;; GNU Guix is distributed in the hope that it will be useful, but
15 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
16 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 ;;; GNU General Public License for more details.
18 ;;;
19 ;;; You should have received a copy of the GNU General Public License
20 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
21 ;;;
22 ;;; Some of the help text was taken from the default dovecot.conf files.
23
24 (define-module (gnu services mail)
25 #:use-module (gnu services)
26 #:use-module (gnu services base)
27 #:use-module (gnu services configuration)
28 #:use-module (gnu services shepherd)
29 #:use-module (gnu system pam)
30 #:use-module (gnu system shadow)
31 #:use-module (gnu packages mail)
32 #:use-module (gnu packages admin)
33 #:use-module (gnu packages tls)
34 #:use-module (guix records)
35 #:use-module (guix packages)
36 #:use-module (guix gexp)
37 #:use-module (ice-9 match)
38 #:use-module (ice-9 format)
39 #:use-module (srfi srfi-1)
40 #:export (dovecot-service
41 dovecot-service-type
42 dovecot-configuration
43 opaque-dovecot-configuration
44
45 dict-configuration
46 passdb-configuration
47 userdb-configuration
48 unix-listener-configuration
49 fifo-listener-configuration
50 inet-listener-configuration
51 service-configuration
52 protocol-configuration
53 plugin-configuration
54 mailbox-configuration
55 namespace-configuration
56
57 opensmtpd-configuration
58 opensmtpd-configuration?
59 opensmtpd-service-type
60 %default-opensmtpd-config-file
61
62 mail-aliases-service-type
63
64 exim-configuration
65 exim-configuration?
66 exim-service-type
67 %default-exim-config-file))
68
69 ;;; Commentary:
70 ;;;
71 ;;; This module provides service definitions for the Dovecot POP3 and IMAP
72 ;;; mail server.
73 ;;;
74 ;;; Code:
75
76 (define (uglify-field-name field-name)
77 (let ((str (symbol->string field-name)))
78 (string-join (string-split (if (string-suffix? "?" str)
79 (substring str 0 (1- (string-length str)))
80 str)
81 #\-)
82 "_")))
83
84 (define (serialize-field field-name val)
85 (format #t "~a=~a\n" (uglify-field-name field-name) val))
86
87 (define (serialize-string field-name val)
88 (serialize-field field-name val))
89
90 (define (space-separated-string-list? val)
91 (and (list? val)
92 (and-map (lambda (x)
93 (and (string? x) (not (string-index x #\space))))
94 val)))
95 (define (serialize-space-separated-string-list field-name val)
96 (serialize-field field-name (string-join val " ")))
97
98 (define (comma-separated-string-list? val)
99 (and (list? val)
100 (and-map (lambda (x)
101 (and (string? x) (not (string-index x #\,))))
102 val)))
103 (define (serialize-comma-separated-string-list field-name val)
104 (serialize-field field-name (string-join val ",")))
105
106 (define (file-name? val)
107 (and (string? val)
108 (string-prefix? "/" val)))
109 (define (serialize-file-name field-name val)
110 (serialize-string field-name val))
111
112 (define (colon-separated-file-name-list? val)
113 (and (list? val)
114 ;; Trailing slashes not needed and not
115 (and-map file-name? val)))
116 (define (serialize-colon-separated-file-name-list field-name val)
117 (serialize-field field-name (string-join val ":")))
118
119 (define (serialize-boolean field-name val)
120 (serialize-string field-name (if val "yes" "no")))
121
122 (define (non-negative-integer? val)
123 (and (exact-integer? val) (not (negative? val))))
124 (define (serialize-non-negative-integer field-name val)
125 (serialize-field field-name val))
126
127 (define (hours? val) (non-negative-integer? val))
128 (define (serialize-hours field-name val)
129 (serialize-field field-name (format #f "~a hours" val)))
130
131 (define (free-form-fields? val)
132 (match val
133 (() #t)
134 ((((? symbol?) . (? string)) . val) (free-form-fields? val))
135 (_ #f)))
136 (define (serialize-free-form-fields field-name val)
137 (for-each (match-lambda ((k . v) (serialize-field k v))) val))
138
139 (define (free-form-args? val)
140 (match val
141 (() #t)
142 ((((? symbol?) . (? string)) . val) (free-form-args? val))
143 (_ #f)))
144 (define (serialize-free-form-args field-name val)
145 (serialize-field field-name
146 (string-join
147 (map (match-lambda ((k . v) (format #t "~a=~a" k v))) val)
148 " ")))
149
150 (define-configuration dict-configuration
151 (entries
152 (free-form-fields '())
153 "A list of key-value pairs that this dict should hold."))
154
155 (define (serialize-dict-configuration field-name val)
156 (format #t "dict {\n")
157 (serialize-configuration val dict-configuration-fields)
158 (format #t "}\n"))
159
160 (define-configuration passdb-configuration
161 (driver
162 (string "pam")
163 "The driver that the passdb should use. Valid values include
164 @samp{pam}, @samp{passwd}, @samp{shadow}, @samp{bsdauth}, and
165 @samp{static}.")
166 (args
167 (space-separated-string-list '())
168 "Space separated list of arguments to the passdb driver."))
169
170 (define (serialize-passdb-configuration field-name val)
171 (format #t "passdb {\n")
172 (serialize-configuration val passdb-configuration-fields)
173 (format #t "}\n"))
174 (define (passdb-configuration-list? val)
175 (and (list? val) (and-map passdb-configuration? val)))
176 (define (serialize-passdb-configuration-list field-name val)
177 (for-each (lambda (val) (serialize-passdb-configuration field-name val)) val))
178
179 (define-configuration userdb-configuration
180 (driver
181 (string "passwd")
182 "The driver that the userdb should use. Valid values include
183 @samp{passwd} and @samp{static}.")
184 (args
185 (space-separated-string-list '())
186 "Space separated list of arguments to the userdb driver.")
187 (override-fields
188 (free-form-args '())
189 "Override fields from passwd."))
190
191 (define (serialize-userdb-configuration field-name val)
192 (format #t "userdb {\n")
193 (serialize-configuration val userdb-configuration-fields)
194 (format #t "}\n"))
195 (define (userdb-configuration-list? val)
196 (and (list? val) (and-map userdb-configuration? val)))
197 (define (serialize-userdb-configuration-list field-name val)
198 (for-each (lambda (val) (serialize-userdb-configuration field-name val)) val))
199
200 (define-configuration unix-listener-configuration
201 (path
202 (string (configuration-missing-field 'unix-listener 'path))
203 "Path to the file, relative to @code{base-dir} field. This is also used as
204 the section name.")
205 (mode
206 (string "0600")
207 "The access mode for the socket.")
208 (user
209 (string "")
210 "The user to own the the socket.")
211 (group
212 (string "")
213 "The group to own the socket."))
214
215 (define (serialize-unix-listener-configuration field-name val)
216 (format #t "unix_listener ~a {\n" (unix-listener-configuration-path val))
217 (serialize-configuration val (cdr unix-listener-configuration-fields))
218 (format #t "}\n"))
219
220 (define-configuration fifo-listener-configuration
221 (path
222 (string (configuration-missing-field 'fifo-listener 'path))
223 "Path to the file, relative to @code{base-dir} field. This is also used as
224 the section name.")
225 (mode
226 (string "0600")
227 "The access mode for the socket.")
228 (user
229 (string "")
230 "The user to own the the socket.")
231 (group
232 (string "")
233 "The group to own the socket."))
234
235 (define (serialize-fifo-listener-configuration field-name val)
236 (format #t "fifo_listener ~a {\n" (fifo-listener-configuration-path val))
237 (serialize-configuration val (cdr fifo-listener-configuration-fields))
238 (format #t "}\n"))
239
240 (define-configuration inet-listener-configuration
241 (protocol
242 (string (configuration-missing-field 'inet-listener 'protocol))
243 "The protocol to listen for.")
244 (address
245 (string "")
246 "The address on which to listen, or empty for all addresses.")
247 (port
248 (non-negative-integer
249 (configuration-missing-field 'inet-listener 'port))
250 "The port on which to listen.")
251 (ssl?
252 (boolean #t)
253 "Whether to use SSL for this service; @samp{yes}, @samp{no}, or
254 @samp{required}."))
255
256 (define (serialize-inet-listener-configuration field-name val)
257 (format #t "inet_listener ~a {\n" (inet-listener-configuration-protocol val))
258 (serialize-configuration val (cdr inet-listener-configuration-fields))
259 (format #t "}\n"))
260
261 (define (listener-configuration? val)
262 (or (unix-listener-configuration? val)
263 (fifo-listener-configuration? val)
264 (inet-listener-configuration? val)))
265 (define (serialize-listener-configuration field-name val)
266 (cond
267 ((unix-listener-configuration? val)
268 (serialize-unix-listener-configuration field-name val))
269 ((fifo-listener-configuration? val)
270 (serialize-fifo-listener-configuration field-name val))
271 ((inet-listener-configuration? val)
272 (serialize-inet-listener-configuration field-name val))
273 (else (configuration-field-error field-name val))))
274 (define (listener-configuration-list? val)
275 (and (list? val) (and-map listener-configuration? val)))
276 (define (serialize-listener-configuration-list field-name val)
277 (for-each (lambda (val)
278 (serialize-listener-configuration field-name val))
279 val))
280
281 (define-configuration service-configuration
282 (kind
283 (string (configuration-missing-field 'service 'kind))
284 "The service kind. Valid values include @code{director},
285 @code{imap-login}, @code{pop3-login}, @code{lmtp}, @code{imap},
286 @code{pop3}, @code{auth}, @code{auth-worker}, @code{dict},
287 @code{tcpwrap}, @code{quota-warning}, or anything else.")
288 (listeners
289 (listener-configuration-list '())
290 "Listeners for the service. A listener is either an
291 @code{unix-listener-configuration}, a @code{fifo-listener-configuration}, or
292 an @code{inet-listener-configuration}.")
293 (service-count
294 (non-negative-integer 1)
295 "Number of connections to handle before starting a new process.
296 Typically the only useful values are 0 (unlimited) or 1. 1 is more
297 secure, but 0 is faster. <doc/wiki/LoginProcess.txt>.")
298 (process-min-avail
299 (non-negative-integer 0)
300 "Number of processes to always keep waiting for more connections.")
301 ;; FIXME: Need to be able to take the default for this value from other
302 ;; parts of the config.
303 (vsz-limit
304 (non-negative-integer #e256e6)
305 "If you set @samp{service-count 0}, you probably need to grow
306 this."))
307
308 (define (serialize-service-configuration field-name val)
309 (format #t "service ~a {\n" (service-configuration-kind val))
310 (serialize-configuration val (cdr service-configuration-fields))
311 (format #t "}\n"))
312 (define (service-configuration-list? val)
313 (and (list? val) (and-map service-configuration? val)))
314 (define (serialize-service-configuration-list field-name val)
315 (for-each (lambda (val)
316 (serialize-service-configuration field-name val))
317 val))
318
319 (define-configuration protocol-configuration
320 (name
321 (string (configuration-missing-field 'protocol 'name))
322 "The name of the protocol.")
323 (auth-socket-path
324 (string "/var/run/dovecot/auth-userdb")
325 "UNIX socket path to master authentication server to find users.
326 This is used by imap (for shared users) and lda.")
327 (mail-plugins
328 (space-separated-string-list '("$mail_plugins"))
329 "Space separated list of plugins to load.")
330 (mail-max-userip-connections
331 (non-negative-integer 10)
332 "Maximum number of IMAP connections allowed for a user from each IP
333 address. NOTE: The username is compared case-sensitively."))
334
335 (define (serialize-protocol-configuration field-name val)
336 (format #t "protocol ~a {\n" (protocol-configuration-name val))
337 (serialize-configuration val (cdr protocol-configuration-fields))
338 (format #t "}\n"))
339 (define (protocol-configuration-list? val)
340 (and (list? val) (and-map protocol-configuration? val)))
341 (define (serialize-protocol-configuration-list field-name val)
342 (serialize-field 'protocols
343 (string-join (map protocol-configuration-name val) " "))
344 (for-each (lambda (val)
345 (serialize-protocol-configuration field-name val))
346 val))
347
348 (define-configuration plugin-configuration
349 (entries
350 (free-form-fields '())
351 "A list of key-value pairs that this dict should hold."))
352
353 (define (serialize-plugin-configuration field-name val)
354 (format #t "plugin {\n")
355 (serialize-configuration val plugin-configuration-fields)
356 (format #t "}\n"))
357
358 (define-configuration mailbox-configuration
359 (name
360 (string (error "mailbox name is required"))
361 "Name for this mailbox.")
362
363 (auto
364 (string "no")
365 "@samp{create} will automatically create this mailbox.
366 @samp{subscribe} will both create and subscribe to the mailbox.")
367
368 (special-use
369 (space-separated-string-list '())
370 "List of IMAP @code{SPECIAL-USE} attributes as specified by RFC 6154.
371 Valid values are @code{\\All}, @code{\\Archive}, @code{\\Drafts},
372 @code{\\Flagged}, @code{\\Junk}, @code{\\Sent}, and @code{\\Trash}."))
373
374 (define (serialize-mailbox-configuration field-name val)
375 (format #t "mailbox \"~a\" {\n" (mailbox-configuration-name val))
376 (serialize-configuration val (cdr mailbox-configuration-fields))
377 (format #t "}\n"))
378 (define (mailbox-configuration-list? val)
379 (and (list? val) (and-map mailbox-configuration? val)))
380 (define (serialize-mailbox-configuration-list field-name val)
381 (for-each (lambda (val)
382 (serialize-mailbox-configuration field-name val))
383 val))
384
385 (define-configuration namespace-configuration
386 (name
387 (string (error "namespace name is required"))
388 "Name for this namespace.")
389
390 (type
391 (string "private")
392 "Namespace type: @samp{private}, @samp{shared} or @samp{public}.")
393
394 (separator
395 (string "")
396 "Hierarchy separator to use. You should use the same separator for
397 all namespaces or some clients get confused. @samp{/} is usually a good
398 one. The default however depends on the underlying mail storage
399 format.")
400
401 (prefix
402 (string "")
403 "Prefix required to access this namespace. This needs to be
404 different for all namespaces. For example @samp{Public/}.")
405
406 (location
407 (string "")
408 "Physical location of the mailbox. This is in same format as
409 mail_location, which is also the default for it.")
410
411 (inbox?
412 (boolean #f)
413 "There can be only one INBOX, and this setting defines which
414 namespace has it.")
415
416 (hidden?
417 (boolean #f)
418 "If namespace is hidden, it's not advertised to clients via NAMESPACE
419 extension. You'll most likely also want to set @samp{list? #f}. This is mostly
420 useful when converting from another server with different namespaces
421 which you want to deprecate but still keep working. For example you can
422 create hidden namespaces with prefixes @samp{~/mail/}, @samp{~%u/mail/}
423 and @samp{mail/}.")
424
425 (list?
426 (boolean #t)
427 "Show the mailboxes under this namespace with LIST command. This
428 makes the namespace visible for clients that don't support NAMESPACE
429 extension. The special @code{children} value lists child mailboxes, but
430 hides the namespace prefix.")
431
432 (subscriptions?
433 (boolean #t)
434 "Namespace handles its own subscriptions. If set to @code{#f}, the
435 parent namespace handles them. The empty prefix should always have this
436 as @code{#t}.)")
437
438 (mailboxes
439 (mailbox-configuration-list '())
440 "List of predefined mailboxes in this namespace."))
441
442 (define (serialize-namespace-configuration field-name val)
443 (format #t "namespace ~a {\n" (namespace-configuration-name val))
444 (serialize-configuration val (cdr namespace-configuration-fields))
445 (format #t "}\n"))
446 (define (list-of-namespace-configuration? val)
447 (and (list? val) (and-map namespace-configuration? val)))
448 (define (serialize-list-of-namespace-configuration field-name val)
449 (for-each (lambda (val)
450 (serialize-namespace-configuration field-name val))
451 val))
452
453 (define-configuration dovecot-configuration
454 (dovecot
455 (package dovecot)
456 "The dovecot package.")
457
458 (listen
459 (comma-separated-string-list '("*" "::"))
460 "A list of IPs or hosts where to listen in for connections. @samp{*}
461 listens in all IPv4 interfaces, @samp{::} listens in all IPv6
462 interfaces. If you want to specify non-default ports or anything more
463 complex, customize the address and port fields of the
464 @samp{inet-listener} of the specific services you are interested in.")
465
466 (protocols
467 (protocol-configuration-list
468 (list (protocol-configuration
469 (name "imap"))))
470 "List of protocols we want to serve. Available protocols include
471 @samp{imap}, @samp{pop3}, and @samp{lmtp}.")
472
473 (services
474 (service-configuration-list
475 (list
476 (service-configuration
477 (kind "imap-login")
478 (listeners
479 (list
480 (inet-listener-configuration (protocol "imap") (port 143) (ssl? #f))
481 (inet-listener-configuration (protocol "imaps") (port 993) (ssl? #t)))))
482 (service-configuration
483 (kind "pop3-login")
484 (listeners
485 (list
486 (inet-listener-configuration (protocol "pop3") (port 110) (ssl? #f))
487 (inet-listener-configuration (protocol "pop3s") (port 995) (ssl? #t)))))
488 (service-configuration
489 (kind "lmtp")
490 (listeners
491 (list (unix-listener-configuration (path "lmtp") (mode "0666")))))
492 (service-configuration (kind "imap"))
493 (service-configuration (kind "pop3"))
494 (service-configuration (kind "auth")
495 ;; In what could be taken to be a bug, the default value of 1 for
496 ;; service-count makes it so that a PAM auth worker can't fork off
497 ;; subprocesses for making blocking queries. The result is that nobody
498 ;; can log in -- very secure, but not very useful! If we simply omit
499 ;; the service-count, it will default to the value of
500 ;; auth-worker-max-count, which is 30, instead of defaulting to 1, which
501 ;; is the default for all other services. As a hack, bump this value to
502 ;; 30.
503 (service-count 30)
504 (listeners
505 (list (unix-listener-configuration (path "auth-userdb")))))
506 (service-configuration (kind "auth-worker"))
507 (service-configuration (kind "dict")
508 (listeners (list (unix-listener-configuration (path "dict")))))))
509 "List of services to enable. Available services include @samp{imap},
510 @samp{imap-login}, @samp{pop3}, @samp{pop3-login}, @samp{auth}, and
511 @samp{lmtp}.")
512
513 (dict
514 (dict-configuration (dict-configuration))
515 "Dict configuration, as created by the @code{dict-configuration}
516 constructor.")
517
518 (passdbs
519 (passdb-configuration-list (list (passdb-configuration (driver "pam"))))
520 "List of passdb configurations, each one created by the
521 @code{passdb-configuration} constructor.")
522
523 (userdbs
524 (userdb-configuration-list (list (userdb-configuration (driver "passwd"))))
525 "List of userdb configurations, each one created by the
526 @code{userdb-configuration} constructor.")
527
528 (plugin-configuration
529 (plugin-configuration (plugin-configuration))
530 "Plug-in configuration, created by the @code{plugin-configuration}
531 constructor.")
532
533 (namespaces
534 (list-of-namespace-configuration
535 (list
536 (namespace-configuration
537 (name "inbox")
538 (prefix "")
539 (inbox? #t)
540 (mailboxes
541 (list
542 (mailbox-configuration (name "Drafts") (special-use '("\\Drafts")))
543 (mailbox-configuration (name "Junk") (special-use '("\\Junk")))
544 (mailbox-configuration (name "Trash") (special-use '("\\Trash")))
545 (mailbox-configuration (name "Sent") (special-use '("\\Sent")))
546 (mailbox-configuration (name "Sent Messages") (special-use '("\\Sent")))
547 (mailbox-configuration (name "Drafts") (special-use '("\\Drafts"))))))))
548 "List of namespaces. Each item in the list is created by the
549 @code{namespace-configuration} constructor.")
550
551 (base-dir
552 (file-name "/var/run/dovecot/")
553 "Base directory where to store runtime data.")
554
555 (login-greeting
556 (string "Dovecot ready.")
557 "Greeting message for clients.")
558
559 (login-trusted-networks
560 (space-separated-string-list '())
561 "List of trusted network ranges. Connections from these IPs are
562 allowed to override their IP addresses and ports (for logging and for
563 authentication checks). @samp{disable-plaintext-auth} is also ignored
564 for these networks. Typically you'd specify your IMAP proxy servers
565 here.")
566
567 (login-access-sockets
568 (space-separated-string-list '())
569 "List of login access check sockets (e.g. tcpwrap).")
570
571 (verbose-proctitle?
572 (boolean #f)
573 "Show more verbose process titles (in ps). Currently shows user name
574 and IP address. Useful for seeing who are actually using the IMAP
575 processes (e.g. shared mailboxes or if same uid is used for multiple
576 accounts).")
577
578 (shutdown-clients?
579 (boolean #t)
580 "Should all processes be killed when Dovecot master process shuts down.
581 Setting this to @code{#f} means that Dovecot can be upgraded without
582 forcing existing client connections to close (although that could also
583 be a problem if the upgrade is e.g. because of a security fix).")
584
585 (doveadm-worker-count
586 (non-negative-integer 0)
587 "If non-zero, run mail commands via this many connections to doveadm
588 server, instead of running them directly in the same process.")
589
590 (doveadm-socket-path
591 (string "doveadm-server")
592 "UNIX socket or host:port used for connecting to doveadm server.")
593
594 (import-environment
595 (space-separated-string-list '("TZ"))
596 "List of environment variables that are preserved on Dovecot startup
597 and passed down to all of its child processes. You can also give
598 key=value pairs to always set specific settings.")
599
600 ;;; Authentication processes
601
602 (disable-plaintext-auth?
603 (boolean #t)
604 "Disable LOGIN command and all other plaintext authentications unless
605 SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
606 matches the local IP (i.e. you're connecting from the same computer),
607 the connection is considered secure and plaintext authentication is
608 allowed. See also ssl=required setting.")
609
610 (auth-cache-size
611 (non-negative-integer 0)
612 "Authentication cache size (e.g. @samp{#e10e6}). 0 means it's disabled.
613 Note that bsdauth, PAM and vpopmail require @samp{cache-key} to be set
614 for caching to be used.")
615
616 (auth-cache-ttl
617 (string "1 hour")
618 "Time to live for cached data. After TTL expires the cached record
619 is no longer used, *except* if the main database lookup returns internal
620 failure. We also try to handle password changes automatically: If
621 user's previous authentication was successful, but this one wasn't, the
622 cache isn't used. For now this works only with plaintext
623 authentication.")
624
625 (auth-cache-negative-ttl
626 (string "1 hour")
627 "TTL for negative hits (user not found, password mismatch).
628 0 disables caching them completely.")
629
630 (auth-realms
631 (space-separated-string-list '())
632 "List of realms for SASL authentication mechanisms that need them.
633 You can leave it empty if you don't want to support multiple realms.
634 Many clients simply use the first one listed here, so keep the default
635 realm first.")
636
637 (auth-default-realm
638 (string "")
639 "Default realm/domain to use if none was specified. This is used for
640 both SASL realms and appending @@domain to username in plaintext
641 logins.")
642
643 (auth-username-chars
644 (string
645 "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@")
646 "List of allowed characters in username. If the user-given username
647 contains a character not listed in here, the login automatically fails.
648 This is just an extra check to make sure user can't exploit any
649 potential quote escaping vulnerabilities with SQL/LDAP databases. If
650 you want to allow all characters, set this value to empty.")
651
652 (auth-username-translation
653 (string "")
654 "Username character translations before it's looked up from
655 databases. The value contains series of from -> to characters. For
656 example @samp{#@@/@@} means that @samp{#} and @samp{/} characters are
657 translated to @samp{@@}.")
658
659 (auth-username-format
660 (string "%Lu")
661 "Username formatting before it's looked up from databases. You can
662 use the standard variables here, e.g. %Lu would lowercase the username,
663 %n would drop away the domain if it was given, or @samp{%n-AT-%d} would
664 change the @samp{@@} into @samp{-AT-}. This translation is done after
665 @samp{auth-username-translation} changes.")
666
667 (auth-master-user-separator
668 (string "")
669 "If you want to allow master users to log in by specifying the master
670 username within the normal username string (i.e. not using SASL
671 mechanism's support for it), you can specify the separator character
672 here. The format is then <username><separator><master username>.
673 UW-IMAP uses @samp{*} as the separator, so that could be a good
674 choice.")
675
676 (auth-anonymous-username
677 (string "anonymous")
678 "Username to use for users logging in with ANONYMOUS SASL
679 mechanism.")
680
681 (auth-worker-max-count
682 (non-negative-integer 30)
683 "Maximum number of dovecot-auth worker processes. They're used to
684 execute blocking passdb and userdb queries (e.g. MySQL and PAM).
685 They're automatically created and destroyed as needed.")
686
687 (auth-gssapi-hostname
688 (string "")
689 "Host name to use in GSSAPI principal names. The default is to use
690 the name returned by gethostname(). Use @samp{$ALL} (with quotes) to
691 allow all keytab entries.")
692
693 (auth-krb5-keytab
694 (string "")
695 "Kerberos keytab to use for the GSSAPI mechanism. Will use the
696 system default (usually /etc/krb5.keytab) if not specified. You may
697 need to change the auth service to run as root to be able to read this
698 file.")
699
700 (auth-use-winbind?
701 (boolean #f)
702 "Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon
703 and @samp{ntlm-auth} helper.
704 <doc/wiki/Authentication/Mechanisms/Winbind.txt>.")
705
706 (auth-winbind-helper-path
707 (file-name "/usr/bin/ntlm_auth")
708 "Path for Samba's @samp{ntlm-auth} helper binary.")
709
710 (auth-failure-delay
711 (string "2 secs")
712 "Time to delay before replying to failed authentications.")
713
714 (auth-ssl-require-client-cert?
715 (boolean #f)
716 "Require a valid SSL client certificate or the authentication
717 fails.")
718
719 (auth-ssl-username-from-cert?
720 (boolean #f)
721 "Take the username from client's SSL certificate, using
722 @code{X509_NAME_get_text_by_NID()} which returns the subject's DN's
723 CommonName.")
724
725 (auth-mechanisms
726 (space-separated-string-list '("plain"))
727 "List of wanted authentication mechanisms. Supported mechanisms are:
728 @samp{plain}, @samp{login}, @samp{digest-md5}, @samp{cram-md5},
729 @samp{ntlm}, @samp{rpa}, @samp{apop}, @samp{anonymous}, @samp{gssapi},
730 @samp{otp}, @samp{skey}, and @samp{gss-spnego}. NOTE: See also
731 @samp{disable-plaintext-auth} setting.")
732
733 (director-servers
734 (space-separated-string-list '())
735 "List of IPs or hostnames to all director servers, including ourself.
736 Ports can be specified as ip:port. The default port is the same as what
737 director service's @samp{inet-listener} is using.")
738
739 (director-mail-servers
740 (space-separated-string-list '())
741 "List of IPs or hostnames to all backend mail servers. Ranges are
742 allowed too, like 10.0.0.10-10.0.0.30.")
743
744 (director-user-expire
745 (string "15 min")
746 "How long to redirect users to a specific server after it no longer
747 has any connections.")
748
749 (director-username-hash
750 (string "%Lu")
751 "How the username is translated before being hashed. Useful values
752 include %Ln if user can log in with or without @@domain, %Ld if mailboxes
753 are shared within domain.")
754
755 ;;; Log destination.
756
757 (log-path
758 (string "syslog")
759 "Log file to use for error messages. @samp{syslog} logs to syslog,
760 @samp{/dev/stderr} logs to stderr.")
761
762 (info-log-path
763 (string "")
764 "Log file to use for informational messages. Defaults to
765 @samp{log-path}.")
766
767 (debug-log-path
768 (string "")
769 "Log file to use for debug messages. Defaults to
770 @samp{info-log-path}.")
771
772 (syslog-facility
773 (string "mail")
774 "Syslog facility to use if you're logging to syslog. Usually if you
775 don't want to use @samp{mail}, you'll use local0..local7. Also other
776 standard facilities are supported.")
777
778 (auth-verbose?
779 (boolean #f)
780 "Log unsuccessful authentication attempts and the reasons why they
781 failed.")
782
783 (auth-verbose-passwords?
784 (boolean #f)
785 "In case of password mismatches, log the attempted password. Valid
786 values are no, plain and sha1. sha1 can be useful for detecting brute
787 force password attempts vs. user simply trying the same password over
788 and over again. You can also truncate the value to n chars by appending
789 \":n\" (e.g. sha1:6).")
790
791 (auth-debug?
792 (boolean #f)
793 "Even more verbose logging for debugging purposes. Shows for example
794 SQL queries.")
795
796 (auth-debug-passwords?
797 (boolean #f)
798 "In case of password mismatches, log the passwords and used scheme so
799 the problem can be debugged. Enabling this also enables
800 @samp{auth-debug}.")
801
802 (mail-debug?
803 (boolean #f)
804 "Enable mail process debugging. This can help you figure out why
805 Dovecot isn't finding your mails.")
806
807 (verbose-ssl?
808 (boolean #f)
809 "Show protocol level SSL errors.")
810
811 (log-timestamp
812 (string "\"%b %d %H:%M:%S \"")
813 "Prefix for each line written to log file. % codes are in
814 strftime(3) format.")
815
816 (login-log-format-elements
817 (space-separated-string-list
818 '("user=<%u>" "method=%m" "rip=%r" "lip=%l" "mpid=%e" "%c"))
819 "List of elements we want to log. The elements which have a
820 non-empty variable value are joined together to form a comma-separated
821 string.")
822
823 (login-log-format
824 (string "%$: %s")
825 "Login log format. %s contains @samp{login-log-format-elements}
826 string, %$ contains the data we want to log.")
827
828 (mail-log-prefix
829 (string "\"%s(%u)<%{pid}><%{session}>: \"")
830 "Log prefix for mail processes. See doc/wiki/Variables.txt for list
831 of possible variables you can use.")
832
833 (deliver-log-format
834 (string "msgid=%m: %$")
835 "Format to use for logging mail deliveries. You can use variables:
836 @table @code
837 @item %$
838 Delivery status message (e.g. @samp{saved to INBOX})
839 @item %m
840 Message-ID
841 @item %s
842 Subject
843 @item %f
844 From address
845 @item %p
846 Physical size
847 @item %w
848 Virtual size.
849 @end table")
850
851 ;;; Mailbox locations and namespaces
852
853 (mail-location
854 (string "")
855 "Location for users' mailboxes. The default is empty, which means
856 that Dovecot tries to find the mailboxes automatically. This won't work
857 if the user doesn't yet have any mail, so you should explicitly tell
858 Dovecot the full location.
859
860 If you're using mbox, giving a path to the INBOX
861 file (e.g. /var/mail/%u) isn't enough. You'll also need to tell Dovecot
862 where the other mailboxes are kept. This is called the \"root mail
863 directory\", and it must be the first path given in the
864 @samp{mail-location} setting.
865
866 There are a few special variables you can use, eg.:
867
868 @table @samp
869 @item %u
870 username
871 @item %n
872 user part in user@@domain, same as %u if there's no domain
873 @item %d
874 domain part in user@@domain, empty if there's no domain
875 @item %h
876 home director
877 @end table
878
879 See doc/wiki/Variables.txt for full list. Some examples:
880 @table @samp
881 @item maildir:~/Maildir
882 @item mbox:~/mail:INBOX=/var/mail/%u
883 @item mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%
884 @end table")
885
886 (mail-uid
887 (string "")
888 "System user and group used to access mails. If you use multiple,
889 userdb can override these by returning uid or gid fields. You can use
890 either numbers or names. <doc/wiki/UserIds.txt>.")
891
892 (mail-gid
893 (string "")
894 "")
895
896 (mail-privileged-group
897 (string "")
898 "Group to enable temporarily for privileged operations. Currently
899 this is used only with INBOX when either its initial creation or
900 dotlocking fails. Typically this is set to \"mail\" to give access to
901 /var/mail.")
902
903 (mail-access-groups
904 (string "")
905 "Grant access to these supplementary groups for mail processes.
906 Typically these are used to set up access to shared mailboxes. Note
907 that it may be dangerous to set these if users can create
908 symlinks (e.g. if \"mail\" group is set here, ln -s /var/mail ~/mail/var
909 could allow a user to delete others' mailboxes, or ln -s
910 /secret/shared/box ~/mail/mybox would allow reading it).")
911
912 (mail-full-filesystem-access?
913 (boolean #f)
914 "Allow full file system access to clients. There's no access checks
915 other than what the operating system does for the active UID/GID. It
916 works with both maildir and mboxes, allowing you to prefix mailboxes
917 names with e.g. /path/ or ~user/.")
918
919 ;;; Mail processes
920
921 (mmap-disable?
922 (boolean #f)
923 "Don't use mmap() at all. This is required if you store indexes to
924 shared file systems (NFS or clustered file system).")
925
926 (dotlock-use-excl?
927 (boolean #t)
928 "Rely on @samp{O_EXCL} to work when creating dotlock files. NFS
929 supports @samp{O_EXCL} since version 3, so this should be safe to use
930 nowadays by default.")
931
932 (mail-fsync
933 (string "optimized")
934 "When to use fsync() or fdatasync() calls:
935 @table @code
936 @item optimized
937 Whenever necessary to avoid losing important data
938 @item always
939 Useful with e.g. NFS when write()s are delayed
940 @item never
941 Never use it (best performance, but crashes can lose data).
942 @end table")
943
944 (mail-nfs-storage?
945 (boolean #f)
946 "Mail storage exists in NFS. Set this to yes to make Dovecot flush
947 NFS caches whenever needed. If you're using only a single mail server
948 this isn't needed.")
949
950 (mail-nfs-index?
951 (boolean #f)
952 "Mail index files also exist in NFS. Setting this to yes requires
953 @samp{mmap-disable? #t} and @samp{fsync-disable? #f}.")
954
955 (lock-method
956 (string "fcntl")
957 "Locking method for index files. Alternatives are fcntl, flock and
958 dotlock. Dotlocking uses some tricks which may create more disk I/O
959 than other locking methods. NFS users: flock doesn't work, remember to
960 change @samp{mmap-disable}.")
961
962 (mail-temp-dir
963 (file-name "/tmp")
964 "Directory in which LDA/LMTP temporarily stores incoming mails >128
965 kB.")
966
967 (first-valid-uid
968 (non-negative-integer 500)
969 "Valid UID range for users. This is mostly to make sure that users can't
970 log in as daemons or other system users. Note that denying root logins is
971 hardcoded to dovecot binary and can't be done even if @samp{first-valid-uid}
972 is set to 0.")
973
974 (last-valid-uid
975 (non-negative-integer 0)
976 "")
977
978 (first-valid-gid
979 (non-negative-integer 1)
980 "Valid GID range for users. Users having non-valid GID as primary group ID
981 aren't allowed to log in. If user belongs to supplementary groups with
982 non-valid GIDs, those groups are not set.")
983
984 (last-valid-gid
985 (non-negative-integer 0)
986 "")
987
988 (mail-max-keyword-length
989 (non-negative-integer 50)
990 "Maximum allowed length for mail keyword name. It's only forced when
991 trying to create new keywords.")
992
993 (valid-chroot-dirs
994 (colon-separated-file-name-list '())
995 "List of directories under which chrooting is allowed for mail
996 processes (i.e. /var/mail will allow chrooting to /var/mail/foo/bar
997 too). This setting doesn't affect @samp{login-chroot}
998 @samp{mail-chroot} or auth chroot settings. If this setting is empty,
999 \"/./\" in home dirs are ignored. WARNING: Never add directories here
1000 which local users can modify, that may lead to root exploit. Usually
1001 this should be done only if you don't allow shell access for users.
1002 <doc/wiki/Chrooting.txt>.")
1003
1004 (mail-chroot
1005 (string "")
1006 "Default chroot directory for mail processes. This can be overridden
1007 for specific users in user database by giving /./ in user's home
1008 directory (e.g. /home/./user chroots into /home). Note that usually
1009 there is no real need to do chrooting, Dovecot doesn't allow users to
1010 access files outside their mail directory anyway. If your home
1011 directories are prefixed with the chroot directory, append \"/.\" to
1012 @samp{mail-chroot}. <doc/wiki/Chrooting.txt>.")
1013
1014 (auth-socket-path
1015 (file-name "/var/run/dovecot/auth-userdb")
1016 "UNIX socket path to master authentication server to find users.
1017 This is used by imap (for shared users) and lda.")
1018
1019 (mail-plugin-dir
1020 (file-name "/usr/lib/dovecot")
1021 "Directory where to look up mail plugins.")
1022
1023 (mail-plugins
1024 (space-separated-string-list '())
1025 "List of plugins to load for all services. Plugins specific to IMAP,
1026 LDA, etc. are added to this list in their own .conf files.")
1027
1028
1029 (mail-cache-min-mail-count
1030 (non-negative-integer 0)
1031 "The minimum number of mails in a mailbox before updates are done to
1032 cache file. This allows optimizing Dovecot's behavior to do less disk
1033 writes at the cost of more disk reads.")
1034
1035 (mailbox-idle-check-interval
1036 (string "30 secs")
1037 "When IDLE command is running, mailbox is checked once in a while to
1038 see if there are any new mails or other changes. This setting defines
1039 the minimum time to wait between those checks. Dovecot can also use
1040 dnotify, inotify and kqueue to find out immediately when changes
1041 occur.")
1042
1043 (mail-save-crlf?
1044 (boolean #f)
1045 "Save mails with CR+LF instead of plain LF. This makes sending those
1046 mails take less CPU, especially with sendfile() syscall with Linux and
1047 FreeBSD. But it also creates a bit more disk I/O which may just make it
1048 slower. Also note that if other software reads the mboxes/maildirs,
1049 they may handle the extra CRs wrong and cause problems.")
1050
1051 (maildir-stat-dirs?
1052 (boolean #f)
1053 "By default LIST command returns all entries in maildir beginning
1054 with a dot. Enabling this option makes Dovecot return only entries
1055 which are directories. This is done by stat()ing each entry, so it
1056 causes more disk I/O.
1057 (For systems setting struct @samp{dirent->d_type} this check is free
1058 and it's done always regardless of this setting).")
1059
1060 (maildir-copy-with-hardlinks?
1061 (boolean #t)
1062 "When copying a message, do it with hard links whenever possible.
1063 This makes the performance much better, and it's unlikely to have any
1064 side effects.")
1065
1066 (maildir-very-dirty-syncs?
1067 (boolean #f)
1068 "Assume Dovecot is the only MUA accessing Maildir: Scan cur/
1069 directory only when its mtime changes unexpectedly or when we can't find
1070 the mail otherwise.")
1071
1072 (mbox-read-locks
1073 (space-separated-string-list '("fcntl"))
1074 "Which locking methods to use for locking mbox. There are four
1075 available:
1076
1077 @table @code
1078 @item dotlock
1079 Create <mailbox>.lock file. This is the oldest and most NFS-safe
1080 solution. If you want to use /var/mail/ like directory, the users will
1081 need write access to that directory.
1082 @item dotlock-try
1083 Same as dotlock, but if it fails because of permissions or because there
1084 isn't enough disk space, just skip it.
1085 @item fcntl
1086 Use this if possible. Works with NFS too if lockd is used.
1087 @item flock
1088 May not exist in all systems. Doesn't work with NFS.
1089 @item lockf
1090 May not exist in all systems. Doesn't work with NFS.
1091 @end table
1092
1093 You can use multiple locking methods; if you do the order they're declared
1094 in is important to avoid deadlocks if other MTAs/MUAs are using multiple
1095 locking methods as well. Some operating systems don't allow using some of
1096 them simultaneously.")
1097
1098 (mbox-write-locks
1099 (space-separated-string-list '("dotlock" "fcntl"))
1100 "")
1101
1102 (mbox-lock-timeout
1103 (string "5 mins")
1104 "Maximum time to wait for lock (all of them) before aborting.")
1105
1106 (mbox-dotlock-change-timeout
1107 (string "2 mins")
1108 "If dotlock exists but the mailbox isn't modified in any way,
1109 override the lock file after this much time.")
1110
1111 (mbox-dirty-syncs?
1112 (boolean #t)
1113 "When mbox changes unexpectedly we have to fully read it to find out
1114 what changed. If the mbox is large this can take a long time. Since
1115 the change is usually just a newly appended mail, it'd be faster to
1116 simply read the new mails. If this setting is enabled, Dovecot does
1117 this but still safely fallbacks to re-reading the whole mbox file
1118 whenever something in mbox isn't how it's expected to be. The only real
1119 downside to this setting is that if some other MUA changes message
1120 flags, Dovecot doesn't notice it immediately. Note that a full sync is
1121 done with SELECT, EXAMINE, EXPUNGE and CHECK commands.")
1122
1123 (mbox-very-dirty-syncs?
1124 (boolean #f)
1125 "Like @samp{mbox-dirty-syncs}, but don't do full syncs even with SELECT,
1126 EXAMINE, EXPUNGE or CHECK commands. If this is set,
1127 @samp{mbox-dirty-syncs} is ignored.")
1128
1129 (mbox-lazy-writes?
1130 (boolean #t)
1131 "Delay writing mbox headers until doing a full write sync (EXPUNGE
1132 and CHECK commands and when closing the mailbox). This is especially
1133 useful for POP3 where clients often delete all mails. The downside is
1134 that our changes aren't immediately visible to other MUAs.")
1135
1136 (mbox-min-index-size
1137 (non-negative-integer 0)
1138 "If mbox size is smaller than this (e.g. 100k), don't write index
1139 files. If an index file already exists it's still read, just not
1140 updated.")
1141
1142 (mdbox-rotate-size
1143 (non-negative-integer #e10e6)
1144 "Maximum dbox file size until it's rotated.")
1145
1146 (mdbox-rotate-interval
1147 (string "1d")
1148 "Maximum dbox file age until it's rotated. Typically in days. Day
1149 begins from midnight, so 1d = today, 2d = yesterday, etc. 0 = check
1150 disabled.")
1151
1152 (mdbox-preallocate-space?
1153 (boolean #f)
1154 "When creating new mdbox files, immediately preallocate their size to
1155 @samp{mdbox-rotate-size}. This setting currently works only in Linux
1156 with some file systems (ext4, xfs).")
1157
1158 (mail-attachment-dir
1159 (string "")
1160 "sdbox and mdbox support saving mail attachments to external files,
1161 which also allows single instance storage for them. Other backends
1162 don't support this for now.
1163
1164 WARNING: This feature hasn't been tested much yet. Use at your own risk.
1165
1166 Directory root where to store mail attachments. Disabled, if empty.")
1167
1168 (mail-attachment-min-size
1169 (non-negative-integer #e128e3)
1170 "Attachments smaller than this aren't saved externally. It's also
1171 possible to write a plugin to disable saving specific attachments
1172 externally.")
1173
1174 (mail-attachment-fs
1175 (string "sis posix")
1176 "File system backend to use for saving attachments:
1177 @table @code
1178 @item posix
1179 No SiS done by Dovecot (but this might help FS's own deduplication)
1180 @item sis posix
1181 SiS with immediate byte-by-byte comparison during saving
1182 @item sis-queue posix
1183 SiS with delayed comparison and deduplication.
1184 @end table")
1185
1186 (mail-attachment-hash
1187 (string "%{sha1}")
1188 "Hash format to use in attachment filenames. You can add any text and
1189 variables: @code{%@{md4@}}, @code{%@{md5@}}, @code{%@{sha1@}},
1190 @code{%@{sha256@}}, @code{%@{sha512@}}, @code{%@{size@}}. Variables can be
1191 truncated, e.g. @code{%@{sha256:80@}} returns only first 80 bits.")
1192
1193 (default-process-limit
1194 (non-negative-integer 100)
1195 "")
1196
1197 (default-client-limit
1198 (non-negative-integer 1000)
1199 "")
1200
1201 (default-vsz-limit
1202 (non-negative-integer #e256e6)
1203 "Default VSZ (virtual memory size) limit for service processes.
1204 This is mainly intended to catch and kill processes that leak memory
1205 before they eat up everything.")
1206
1207 (default-login-user
1208 (string "dovenull")
1209 "Login user is internally used by login processes. This is the most
1210 untrusted user in Dovecot system. It shouldn't have access to anything
1211 at all.")
1212
1213 (default-internal-user
1214 (string "dovecot")
1215 "Internal user is used by unprivileged processes. It should be
1216 separate from login user, so that login processes can't disturb other
1217 processes.")
1218
1219 (ssl?
1220 (string "required")
1221 "SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>.")
1222
1223 (ssl-cert
1224 (string "</etc/dovecot/default.pem")
1225 "PEM encoded X.509 SSL/TLS certificate (public key).")
1226
1227 (ssl-key
1228 (string "</etc/dovecot/private/default.pem")
1229 "PEM encoded SSL/TLS private key. The key is opened before
1230 dropping root privileges, so keep the key file unreadable by anyone but
1231 root.")
1232
1233 (ssl-key-password
1234 (string "")
1235 "If key file is password protected, give the password here.
1236 Alternatively give it when starting dovecot with -p parameter. Since
1237 this file is often world-readable, you may want to place this setting
1238 instead to a different.")
1239
1240 (ssl-ca
1241 (string "")
1242 "PEM encoded trusted certificate authority. Set this only if you
1243 intend to use @samp{ssl-verify-client-cert? #t}. The file should
1244 contain the CA certificate(s) followed by the matching
1245 CRL(s). (e.g. @samp{ssl-ca </etc/ssl/certs/ca.pem}).")
1246 (ssl-require-crl?
1247 (boolean #t)
1248 "Require that CRL check succeeds for client certificates.")
1249 (ssl-verify-client-cert?
1250 (boolean #f)
1251 "Request client to send a certificate. If you also want to require
1252 it, set @samp{auth-ssl-require-client-cert? #t} in auth section.")
1253
1254 (ssl-cert-username-field
1255 (string "commonName")
1256 "Which field from certificate to use for username. commonName and
1257 x500UniqueIdentifier are the usual choices. You'll also need to set
1258 @samp{auth-ssl-username-from-cert? #t}.")
1259
1260 (ssl-min-protocol
1261 (string "TLSv1")
1262 "Minimum SSL protocol version to accept.")
1263
1264 (ssl-cipher-list
1265 (string "ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH")
1266 "SSL ciphers to use.")
1267
1268 (ssl-crypto-device
1269 (string "")
1270 "SSL crypto device to use, for valid values run \"openssl engine\".")
1271
1272 (postmaster-address
1273 (string "postmaster@%d")
1274 "Address to use when sending rejection mails.
1275 Default is postmaster@@<your domain>. %d expands to recipient domain.")
1276
1277 (hostname
1278 (string "")
1279 "Hostname to use in various parts of sent mails (e.g. in Message-Id)
1280 and in LMTP replies. Default is the system's real hostname@@domain.")
1281
1282 (quota-full-tempfail?
1283 (boolean #f)
1284 "If user is over quota, return with temporary failure instead of
1285 bouncing the mail.")
1286
1287 (sendmail-path
1288 (file-name "/usr/sbin/sendmail")
1289 "Binary to use for sending mails.")
1290
1291 (submission-host
1292 (string "")
1293 "If non-empty, send mails via this SMTP host[:port] instead of
1294 sendmail.")
1295
1296 (rejection-subject
1297 (string "Rejected: %s")
1298 "Subject: header to use for rejection mails. You can use the same
1299 variables as for @samp{rejection-reason} below.")
1300
1301 (rejection-reason
1302 (string "Your message to <%t> was automatically rejected:%n%r")
1303 "Human readable error message for rejection mails. You can use
1304 variables:
1305
1306 @table @code
1307 @item %n
1308 CRLF
1309 @item %r
1310 reason
1311 @item %s
1312 original subject
1313 @item %t
1314 recipient
1315 @end table")
1316
1317 (recipient-delimiter
1318 (string "+")
1319 "Delimiter character between local-part and detail in email
1320 address.")
1321
1322 (lda-original-recipient-header
1323 (string "")
1324 "Header where the original recipient address (SMTP's RCPT TO:
1325 address) is taken from if not available elsewhere. With dovecot-lda -a
1326 parameter overrides this. A commonly used header for this is
1327 X-Original-To.")
1328
1329 (lda-mailbox-autocreate?
1330 (boolean #f)
1331 "Should saving a mail to a nonexistent mailbox automatically create
1332 it?.")
1333
1334 (lda-mailbox-autosubscribe?
1335 (boolean #f)
1336 "Should automatically created mailboxes be also automatically
1337 subscribed?.")
1338
1339
1340 (imap-max-line-length
1341 (non-negative-integer #e64e3)
1342 "Maximum IMAP command line length. Some clients generate very long
1343 command lines with huge mailboxes, so you may need to raise this if you
1344 get \"Too long argument\" or \"IMAP command line too large\" errors
1345 often.")
1346
1347 (imap-logout-format
1348 (string "in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes}")
1349 "IMAP logout format string:
1350 @table @code
1351 @item %i
1352 total number of bytes read from client
1353 @item %o
1354 total number of bytes sent to client.
1355 @end table
1356 See @file{doc/wiki/Variables.txt} for a list of all the variables you can use.")
1357
1358 (imap-capability
1359 (string "")
1360 "Override the IMAP CAPABILITY response. If the value begins with '+',
1361 add the given capabilities on top of the defaults (e.g. +XFOO XBAR).")
1362
1363 (imap-idle-notify-interval
1364 (string "2 mins")
1365 "How long to wait between \"OK Still here\" notifications when client
1366 is IDLEing.")
1367
1368 (imap-id-send
1369 (string "")
1370 "ID field names and values to send to clients. Using * as the value
1371 makes Dovecot use the default value. The following fields have default
1372 values currently: name, version, os, os-version, support-url,
1373 support-email.")
1374
1375 (imap-id-log
1376 (string "")
1377 "ID fields sent by client to log. * means everything.")
1378
1379 (imap-client-workarounds
1380 (space-separated-string-list '())
1381 "Workarounds for various client bugs:
1382
1383 @table @code
1384 @item delay-newmail
1385 Send EXISTS/RECENT new mail notifications only when replying to NOOP and
1386 CHECK commands. Some clients ignore them otherwise, for example OSX
1387 Mail (<v2.1). Outlook Express breaks more badly though, without this it
1388 may show user \"Message no longer in server\" errors. Note that OE6
1389 still breaks even with this workaround if synchronization is set to
1390 \"Headers Only\".
1391
1392 @item tb-extra-mailbox-sep
1393 Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
1394 adds extra @samp{/} suffixes to mailbox names. This option causes Dovecot to
1395 ignore the extra @samp{/} instead of treating it as invalid mailbox name.
1396
1397 @item tb-lsub-flags
1398 Show \\Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
1399 This makes Thunderbird realize they aren't selectable and show them
1400 greyed out, instead of only later giving \"not selectable\" popup error.
1401 @end table
1402 ")
1403
1404 (imap-urlauth-host
1405 (string "")
1406 "Host allowed in URLAUTH URLs sent by client. \"*\" allows all.") )
1407
1408 (define-configuration opaque-dovecot-configuration
1409 (dovecot
1410 (package dovecot)
1411 "The dovecot package.")
1412
1413 (string
1414 (string (configuration-missing-field 'opaque-dovecot-configuration
1415 'string))
1416 "The contents of the @code{dovecot.conf} to use."))
1417
1418 (define %dovecot-accounts
1419 ;; Account and group for the Dovecot daemon.
1420 (list (user-group (name "dovecot") (system? #t))
1421 (user-account
1422 (name "dovecot")
1423 (group "dovecot")
1424 (system? #t)
1425 (comment "Dovecot daemon user")
1426 (home-directory "/var/empty")
1427 (shell (file-append shadow "/sbin/nologin")))
1428
1429 (user-group (name "dovenull") (system? #t))
1430 (user-account
1431 (name "dovenull")
1432 (group "dovenull")
1433 (system? #t)
1434 (comment "Dovecot daemon login user")
1435 (home-directory "/var/empty")
1436 (shell (file-append shadow "/sbin/nologin")))))
1437
1438 (define %dovecot-activation
1439 ;; Activation gexp.
1440 #~(begin
1441 (use-modules (guix build utils))
1442 (define (mkdir-p/perms directory owner perms)
1443 (mkdir-p directory)
1444 (chown "/var/run/dovecot" (passwd:uid owner) (passwd:gid owner))
1445 (chmod directory perms))
1446 (define (build-subject parameters)
1447 (string-concatenate
1448 (map (lambda (pair)
1449 (let ((k (car pair)) (v (cdr pair)))
1450 (define (escape-char str chr)
1451 (string-join (string-split str chr) (string #\\ chr)))
1452 (string-append "/" k "="
1453 (escape-char (escape-char v #\=) #\/))))
1454 (filter (lambda (pair) (cdr pair)) parameters))))
1455 (define* (create-self-signed-certificate-if-absent
1456 #:key private-key public-key (owner (getpwnam "root"))
1457 (common-name (gethostname))
1458 (organization-name "GuixSD")
1459 (organization-unit-name "Default Self-Signed Certificate")
1460 (subject-parameters `(("CN" . ,common-name)
1461 ("O" . ,organization-name)
1462 ("OU" . ,organization-unit-name)))
1463 (subject (build-subject subject-parameters)))
1464 ;; Note that by default, OpenSSL outputs keys in PEM format. This
1465 ;; is what we want.
1466 (unless (file-exists? private-key)
1467 (cond
1468 ((zero? (system* (string-append #$openssl "/bin/openssl")
1469 "genrsa" "-out" private-key "2048"))
1470 (chown private-key (passwd:uid owner) (passwd:gid owner))
1471 (chmod private-key #o400))
1472 (else
1473 (format (current-error-port)
1474 "Failed to create private key at ~a.\n" private-key))))
1475 (unless (file-exists? public-key)
1476 (cond
1477 ((zero? (system* (string-append #$openssl "/bin/openssl")
1478 "req" "-new" "-x509" "-key" private-key
1479 "-out" public-key "-days" "3650"
1480 "-batch" "-subj" subject))
1481 (chown public-key (passwd:uid owner) (passwd:gid owner))
1482 (chmod public-key #o444))
1483 (else
1484 (format (current-error-port)
1485 "Failed to create public key at ~a.\n" public-key)))))
1486 (let ((user (getpwnam "dovecot")))
1487 (mkdir-p/perms "/var/run/dovecot" user #o755)
1488 (mkdir-p/perms "/var/lib/dovecot" user #o755)
1489 (mkdir-p/perms "/etc/dovecot" user #o755)
1490 (mkdir-p/perms "/etc/dovecot/private" user #o700)
1491 (create-self-signed-certificate-if-absent
1492 #:private-key "/etc/dovecot/private/default.pem"
1493 #:public-key "/etc/dovecot/default.pem"
1494 #:owner (getpwnam "root")
1495 #:common-name (format #f "Dovecot service on ~a" (gethostname))))))
1496
1497 (define (dovecot-shepherd-service config)
1498 "Return a list of <shepherd-service> for CONFIG."
1499 (let* ((config-str
1500 (cond
1501 ((opaque-dovecot-configuration? config)
1502 (opaque-dovecot-configuration-string config))
1503 (else
1504 (with-output-to-string
1505 (lambda ()
1506 (serialize-configuration config
1507 dovecot-configuration-fields))))))
1508 (config-file (plain-file "dovecot.conf" config-str))
1509 (dovecot (if (opaque-dovecot-configuration? config)
1510 (opaque-dovecot-configuration-dovecot config)
1511 (dovecot-configuration-dovecot config))))
1512 (list (shepherd-service
1513 (documentation "Run the Dovecot POP3/IMAP mail server.")
1514 (provision '(dovecot))
1515 (requirement '(networking))
1516 (start #~(make-forkexec-constructor
1517 (list (string-append #$dovecot "/sbin/dovecot")
1518 "-F" "-c" #$config-file)))
1519 (stop #~(make-forkexec-constructor
1520 (list (string-append #$dovecot "/sbin/dovecot")
1521 "-c" #$config-file "stop")))))))
1522
1523 (define %dovecot-pam-services
1524 (list (unix-pam-service "dovecot")))
1525
1526 (define dovecot-service-type
1527 (service-type (name 'dovecot)
1528 (extensions
1529 (list (service-extension shepherd-root-service-type
1530 dovecot-shepherd-service)
1531 (service-extension account-service-type
1532 (const %dovecot-accounts))
1533 (service-extension pam-root-service-type
1534 (const %dovecot-pam-services))
1535 (service-extension activation-service-type
1536 (const %dovecot-activation))))))
1537
1538 (define* (dovecot-service #:key (config (dovecot-configuration)))
1539 "Return a service that runs @command{dovecot}, a mail server that can run
1540 POP3, IMAP, and LMTP. @var{config} should be a configuration object created
1541 by @code{dovecot-configuration}. @var{config} may also be created by
1542 @code{opaque-dovecot-configuration}, which allows specification of the
1543 @code{dovecot.conf} as a string."
1544 (validate-configuration config
1545 (if (opaque-dovecot-configuration? config)
1546 opaque-dovecot-configuration-fields
1547 dovecot-configuration-fields))
1548 (service dovecot-service-type config))
1549
1550 ;; A little helper to make it easier to document all those fields.
1551 (define (generate-dovecot-documentation)
1552 (generate-documentation
1553 `((dovecot-configuration
1554 ,dovecot-configuration-fields
1555 (dict dict-configuration)
1556 (namespaces namespace-configuration)
1557 (plugin plugin-configuration)
1558 (passdbs passdb-configuration)
1559 (userdbs userdb-configuration)
1560 (services service-configuration)
1561 (protocols protocol-configuration))
1562 (dict-configuration ,dict-configuration-fields)
1563 (plugin-configuration ,plugin-configuration-fields)
1564 (passdb-configuration ,passdb-configuration-fields)
1565 (userdb-configuration ,userdb-configuration-fields)
1566 (unix-listener-configuration ,unix-listener-configuration-fields)
1567 (fifo-listener-configuration ,fifo-listener-configuration-fields)
1568 (inet-listener-configuration ,inet-listener-configuration-fields)
1569 (namespace-configuration
1570 ,namespace-configuration-fields
1571 (mailboxes mailbox-configuration))
1572 (mailbox-configuration ,mailbox-configuration-fields)
1573 (service-configuration
1574 ,service-configuration-fields
1575 (listeners unix-listener-configuration fifo-listener-configuration
1576 inet-listener-configuration))
1577 (protocol-configuration ,protocol-configuration-fields))
1578 'dovecot-configuration))
1579
1580 \f
1581 ;;;
1582 ;;; OpenSMTPD.
1583 ;;;
1584
1585 (define-record-type* <opensmtpd-configuration>
1586 opensmtpd-configuration make-opensmtpd-configuration
1587 opensmtpd-configuration?
1588 (package opensmtpd-configuration-package
1589 (default opensmtpd))
1590 (config-file opensmtpd-configuration-config-file
1591 (default %default-opensmtpd-config-file)))
1592
1593 (define %default-opensmtpd-config-file
1594 (plain-file "smtpd.conf" "
1595 listen on lo
1596 accept from any for local deliver to mbox
1597 accept from local for any relay
1598 "))
1599
1600 (define opensmtpd-shepherd-service
1601 (match-lambda
1602 (($ <opensmtpd-configuration> package config-file)
1603 (list (shepherd-service
1604 (provision '(smtpd))
1605 (requirement '(loopback))
1606 (documentation "Run the OpenSMTPD daemon.")
1607 (start (let ((smtpd (file-append package "/sbin/smtpd")))
1608 #~(make-forkexec-constructor
1609 (list #$smtpd "-f" #$config-file)
1610 #:pid-file "/var/run/smtpd.pid")))
1611 (stop #~(make-kill-destructor)))))))
1612
1613 (define %opensmtpd-accounts
1614 (list (user-group
1615 (name "smtpq")
1616 (system? #t))
1617 (user-account
1618 (name "smtpd")
1619 (group "nogroup")
1620 (system? #t)
1621 (comment "SMTP Daemon")
1622 (home-directory "/var/empty")
1623 (shell (file-append shadow "/sbin/nologin")))
1624 (user-account
1625 (name "smtpq")
1626 (group "smtpq")
1627 (system? #t)
1628 (comment "SMTPD Queue")
1629 (home-directory "/var/empty")
1630 (shell (file-append shadow "/sbin/nologin")))))
1631
1632 (define opensmtpd-activation
1633 (match-lambda
1634 (($ <opensmtpd-configuration> package config-file)
1635 (let ((smtpd (file-append package "/sbin/smtpd")))
1636 #~(begin
1637 (use-modules (guix build utils))
1638 ;; Create mbox and spool directories.
1639 (mkdir-p "/var/mail")
1640 (mkdir-p "/var/spool/smtpd")
1641 (chmod "/var/spool/smtpd" #o711))))))
1642
1643 (define opensmtpd-service-type
1644 (service-type
1645 (name 'opensmtpd)
1646 (extensions
1647 (list (service-extension account-service-type
1648 (const %opensmtpd-accounts))
1649 (service-extension activation-service-type
1650 opensmtpd-activation)
1651 (service-extension profile-service-type
1652 (compose list opensmtpd-configuration-package))
1653 (service-extension shepherd-root-service-type
1654 opensmtpd-shepherd-service)))))
1655
1656 \f
1657 ;;;
1658 ;;; mail aliases.
1659 ;;;
1660
1661 (define (mail-aliases-etc aliases)
1662 `(("aliases" ,(plain-file "aliases"
1663 ;; Ideally we'd use a format string like
1664 ;; "~:{~a: ~{~a~^,~}\n~}", but it gives a
1665 ;; warning that I can't figure out how to fix,
1666 ;; so we'll just use string-join below instead.
1667 (format #f "~:{~a: ~a\n~}"
1668 (map (match-lambda
1669 ((alias addresses ...)
1670 (list alias (string-join addresses ","))))
1671 aliases))))))
1672
1673 (define mail-aliases-service-type
1674 (service-type
1675 (name 'mail-aliases)
1676 (extensions
1677 (list (service-extension etc-service-type mail-aliases-etc)))
1678 (compose concatenate)
1679 (extend append)))
1680
1681 \f
1682 ;;;
1683 ;;; Exim.
1684 ;;;
1685
1686 (define-record-type* <exim-configuration> exim-configuration
1687 make-exim-configuration
1688 exim-configuration?
1689 (package exim-configuration-package ;<package>
1690 (default exim))
1691 (config-file exim-configuration-config-file ;file-like
1692 (default #f)))
1693
1694 (define %exim-accounts
1695 (list (user-group
1696 (name "exim")
1697 (system? #t))
1698 (user-account
1699 (name "exim")
1700 (group "exim")
1701 (system? #t)
1702 (comment "Exim Daemon")
1703 (home-directory "/var/empty")
1704 (shell (file-append shadow "/sbin/nologin")))))
1705
1706 (define (exim-computed-config-file package config-file)
1707 (computed-file "exim.conf"
1708 #~(call-with-output-file #$output
1709 (lambda (port)
1710 (format port "
1711 exim_user = exim
1712 exim_group = exim
1713 .include ~a"
1714 #$(or config-file
1715 (file-append package "/etc/exim.conf")))))))
1716
1717 (define exim-shepherd-service
1718 (match-lambda
1719 (($ <exim-configuration> package config-file)
1720 (list (shepherd-service
1721 (provision '(exim mta))
1722 (documentation "Run the exim daemon.")
1723 (requirement '(networking))
1724 (start #~(make-forkexec-constructor
1725 '(#$(file-append package "/bin/exim")
1726 "-bd" "-v" "-C"
1727 #$(exim-computed-config-file package config-file))))
1728 (stop #~(make-kill-destructor)))))))
1729
1730 (define exim-activation
1731 (match-lambda
1732 (($ <exim-configuration> package config-file)
1733 (with-imported-modules '((guix build utils))
1734 #~(begin
1735 (use-modules (guix build utils))
1736
1737 (let ((uid (passwd:uid (getpw "exim")))
1738 (gid (group:gid (getgr "exim"))))
1739 (mkdir-p "/var/spool/exim")
1740 (chown "/var/spool/exim" uid gid))
1741
1742 (zero? (system* #$(file-append package "/bin/exim")
1743 "-bV" "-C" #$(exim-computed-config-file package config-file))))))))
1744
1745 (define exim-profile
1746 (compose list exim-configuration-package))
1747
1748 (define exim-service-type
1749 (service-type
1750 (name 'exim)
1751 (extensions
1752 (list (service-extension shepherd-root-service-type exim-shepherd-service)
1753 (service-extension account-service-type (const %exim-accounts))
1754 (service-extension activation-service-type exim-activation)
1755 (service-extension profile-service-type exim-profile)
1756 (service-extension mail-aliases-service-type (const '()))))))