gnu/services/mail.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 Andy Wingo <wingo@igalia.com>
   3 ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
   4 ;;; Copyright © 2017 Carlo Zancanaro <carlo@zancanaro.id.au>
   5 ;;; Copyright © 2017, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
   6 ;;; Copyright © 2019 Kristofer Buffington <kristoferbuffington@gmail.com>
   7 ;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de>
   8 ;;;
   9 ;;; This file is part of GNU Guix.
  10 ;;;
  11 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  12 ;;; under the terms of the GNU General Public License as published by
  13 ;;; the Free Software Foundation; either version 3 of the License, or (at
  14 ;;; your option) any later version.
  15 ;;;
  16 ;;; GNU Guix is distributed in the hope that it will be useful, but
  17 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  18 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 ;;; GNU General Public License for more details.
  20 ;;;
  21 ;;; You should have received a copy of the GNU General Public License
  22 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  23 ;;;
  24 ;;; Some of the help text was taken from the default dovecot.conf files.
  25
  26 (define-module (gnu services mail)
  27   #:use-module (gnu services)
  28   #:use-module (gnu services base)
  29   #:use-module (gnu services configuration)
  30   #:use-module (gnu services shepherd)
  31   #:use-module (gnu system pam)
  32   #:use-module (gnu system shadow)
  33   #:use-module (gnu packages mail)
  34   #:use-module (gnu packages admin)
  35   #:use-module (gnu packages dav)
  36   #:use-module (gnu packages tls)
  37   #:use-module (guix records)
  38   #:use-module (guix packages)
  39   #:use-module (guix gexp)
  40   #:use-module (ice-9 match)
  41   #:use-module (ice-9 format)
  42   #:use-module (srfi srfi-1)
  43   #:export (dovecot-service
  44             dovecot-service-type
  45             dovecot-configuration
  46             opaque-dovecot-configuration
  47
  48             dict-configuration
  49             passdb-configuration
  50             userdb-configuration
  51             unix-listener-configuration
  52             fifo-listener-configuration
  53             inet-listener-configuration
  54             service-configuration
  55             protocol-configuration
  56             plugin-configuration
  57             mailbox-configuration
  58             namespace-configuration
  59
  60             opensmtpd-configuration
  61             opensmtpd-configuration?
  62             opensmtpd-service-type
  63             %default-opensmtpd-config-file
  64
  65             mail-aliases-service-type
  66
  67             exim-configuration
  68             exim-configuration?
  69             exim-service-type
  70             %default-exim-config-file
  71
  72             imap4d-configuration
  73             imap4d-configuration?
  74             imap4d-service-type
  75             %default-imap4d-config-file
  76
  77             radicale-configuration
  78             radicale-configuration?
  79             radicale-service-type
  80             %default-radicale-config-file))
  81
  82 ;;; Commentary:
  83 ;;;
  84 ;;; This module provides service definitions for the Dovecot POP3 and IMAP
  85 ;;; mail server.
  86 ;;;
  87 ;;; Code:
  88
  89 (define (uglify-field-name field-name)
  90   (let ((str (symbol->string field-name)))
  91     (string-join (string-split (if (string-suffix? "?" str)
  92                                    (substring str 0 (1- (string-length str)))
  93                                    str)
  94                                #\-)
  95                  "_")))
  96
  97 (define (serialize-field field-name val)
  98   (format #t "~a=~a\n" (uglify-field-name field-name) val))
  99
 100 (define (serialize-string field-name val)
 101   (serialize-field field-name val))
 102
 103 (define (space-separated-string-list? val)
 104   (and (list? val)
 105        (and-map (lambda (x)
 106                   (and (string? x) (not (string-index x #\space))))
 107                 val)))
 108 (define (serialize-space-separated-string-list field-name val)
 109   (match val
 110     (() #f)
 111     (_ (serialize-field field-name (string-join val " ")))))
 112
 113 (define (comma-separated-string-list? val)
 114   (and (list? val)
 115        (and-map (lambda (x)
 116                   (and (string? x) (not (string-index x #\,))))
 117                 val)))
 118 (define (serialize-comma-separated-string-list field-name val)
 119   (serialize-field field-name (string-join val ",")))
 120
 121 (define (file-name? val)
 122   (and (string? val)
 123        (string-prefix? "/" val)))
 124 (define (serialize-file-name field-name val)
 125   (serialize-string field-name val))
 126
 127 (define (colon-separated-file-name-list? val)
 128   (and (list? val)
 129        ;; Trailing slashes not needed and not
 130        (and-map file-name? val)))
 131 (define (serialize-colon-separated-file-name-list field-name val)
 132   (serialize-field field-name (string-join val ":")))
 133
 134 (define (serialize-boolean field-name val)
 135   (serialize-string field-name (if val "yes" "no")))
 136
 137 (define (non-negative-integer? val)
 138   (and (exact-integer? val) (not (negative? val))))
 139 (define (serialize-non-negative-integer field-name val)
 140   (serialize-field field-name val))
 141
 142 (define (hours? val) (non-negative-integer? val))
 143 (define (serialize-hours field-name val)
 144   (serialize-field field-name (format #f "~a hours" val)))
 145
 146 (define (free-form-fields? val)
 147   (match val
 148     (() #t)
 149     ((((? symbol?) . (? string?)) . val) (free-form-fields? val))
 150     (_ #f)))
 151 (define (serialize-free-form-fields field-name val)
 152   (for-each (match-lambda ((k . v) (serialize-field k v))) val))
 153
 154 (define (free-form-args? val)
 155   (match val
 156     (() #t)
 157     ((((? symbol?) . (? string?)) . val) (free-form-args? val))
 158     (_ #f)))
 159 (define (serialize-free-form-args field-name val)
 160   (serialize-field field-name
 161                    (string-join
 162                     (map (match-lambda ((k . v) (format #t "~a=~a" k v))) val)
 163                     " ")))
 164
 165 (define-configuration dict-configuration
 166   (entries
 167    (free-form-fields '())
 168    "A list of key-value pairs that this dict should hold."))
 169
 170 (define (serialize-dict-configuration field-name val)
 171   (format #t "dict {\n")
 172   (serialize-configuration val dict-configuration-fields)
 173   (format #t "}\n"))
 174
 175 (define-configuration passdb-configuration
 176   (driver
 177    (string "pam")
 178    "The driver that the passdb should use.  Valid values include
 179 @samp{pam}, @samp{passwd}, @samp{shadow}, @samp{bsdauth}, and
 180 @samp{static}.")
 181   (args
 182    (space-separated-string-list '())
 183    "Space separated list of arguments to the passdb driver."))
 184
 185 (define (serialize-passdb-configuration field-name val)
 186   (format #t "passdb {\n")
 187   (serialize-configuration val passdb-configuration-fields)
 188   (format #t "}\n"))
 189 (define (passdb-configuration-list? val)
 190   (and (list? val) (and-map passdb-configuration? val)))
 191 (define (serialize-passdb-configuration-list field-name val)
 192   (for-each (lambda (val) (serialize-passdb-configuration field-name val)) val))
 193
 194 (define-configuration userdb-configuration
 195   (driver
 196    (string "passwd")
 197    "The driver that the userdb should use.  Valid values include
 198 @samp{passwd} and @samp{static}.")
 199   (args
 200    (space-separated-string-list '())
 201    "Space separated list of arguments to the userdb driver.")
 202   (override-fields
 203    (free-form-args '())
 204    "Override fields from passwd."))
 205
 206 (define (serialize-userdb-configuration field-name val)
 207   (format #t "userdb {\n")
 208   (serialize-configuration val userdb-configuration-fields)
 209   (format #t "}\n"))
 210 (define (userdb-configuration-list? val)
 211   (and (list? val) (and-map userdb-configuration? val)))
 212 (define (serialize-userdb-configuration-list field-name val)
 213   (for-each (lambda (val) (serialize-userdb-configuration field-name val)) val))
 214
 215 (define-configuration unix-listener-configuration
 216   (path
 217    (string (configuration-missing-field 'unix-listener 'path))
 218    "Path to the file, relative to @code{base-dir} field.  This is also used as
 219 the section name.")
 220   (mode
 221    (string "0600")
 222    "The access mode for the socket.")
 223   (user
 224    (string "")
 225    "The user to own the the socket.")
 226   (group
 227    (string "")
 228    "The group to own the socket."))
 229
 230 (define (serialize-unix-listener-configuration field-name val)
 231   (format #t "unix_listener ~a {\n" (unix-listener-configuration-path val))
 232   (serialize-configuration val (cdr unix-listener-configuration-fields))
 233   (format #t "}\n"))
 234
 235 (define-configuration fifo-listener-configuration
 236   (path
 237    (string (configuration-missing-field 'fifo-listener 'path))
 238    "Path to the file, relative to @code{base-dir} field.  This is also used as
 239 the section name.")
 240   (mode
 241    (string "0600")
 242    "The access mode for the socket.")
 243   (user
 244    (string "")
 245    "The user to own the the socket.")
 246   (group
 247    (string "")
 248    "The group to own the socket."))
 249
 250 (define (serialize-fifo-listener-configuration field-name val)
 251   (format #t "fifo_listener ~a {\n" (fifo-listener-configuration-path val))
 252   (serialize-configuration val (cdr fifo-listener-configuration-fields))
 253   (format #t "}\n"))
 254
 255 (define-configuration inet-listener-configuration
 256   (protocol
 257    (string (configuration-missing-field 'inet-listener 'protocol))
 258    "The protocol to listen for.")
 259   (address
 260    (string "")
 261    "The address on which to listen, or empty for all addresses.")
 262   (port
 263    (non-negative-integer
 264     (configuration-missing-field 'inet-listener 'port))
 265    "The port on which to listen.")
 266   (ssl?
 267    (boolean #t)
 268    "Whether to use SSL for this service; @samp{yes}, @samp{no}, or
 269 @samp{required}."))
 270
 271 (define (serialize-inet-listener-configuration field-name val)
 272   (format #t "inet_listener ~a {\n" (inet-listener-configuration-protocol val))
 273   (serialize-configuration val (cdr inet-listener-configuration-fields))
 274   (format #t "}\n"))
 275
 276 (define (listener-configuration? val)
 277   (or (unix-listener-configuration? val)
 278       (fifo-listener-configuration? val)
 279       (inet-listener-configuration? val)))
 280 (define (serialize-listener-configuration field-name val)
 281   (cond
 282    ((unix-listener-configuration? val)
 283     (serialize-unix-listener-configuration field-name val))
 284    ((fifo-listener-configuration? val)
 285     (serialize-fifo-listener-configuration field-name val))
 286    ((inet-listener-configuration? val)
 287     (serialize-inet-listener-configuration field-name val))
 288    (else (configuration-field-error field-name val))))
 289 (define (listener-configuration-list? val)
 290   (and (list? val) (and-map listener-configuration? val)))
 291 (define (serialize-listener-configuration-list field-name val)
 292   (for-each (lambda (val)
 293               (serialize-listener-configuration field-name val))
 294             val))
 295
 296 (define-configuration service-configuration
 297   (kind
 298    (string (configuration-missing-field 'service 'kind))
 299    "The service kind.  Valid values include @code{director},
 300 @code{imap-login}, @code{pop3-login}, @code{lmtp}, @code{imap},
 301 @code{pop3}, @code{auth}, @code{auth-worker}, @code{dict},
 302 @code{tcpwrap}, @code{quota-warning}, or anything else.")
 303   (listeners
 304    (listener-configuration-list '())
 305    "Listeners for the service.  A listener is either an
 306 @code{unix-listener-configuration}, a @code{fifo-listener-configuration}, or
 307 an @code{inet-listener-configuration}.")
 308   (client-limit
 309    (non-negative-integer 0)
 310    "Maximum number of simultaneous client connections per process.  Once this
 311 number of connections is received, the next incoming connection will prompt
 312 Dovecot to spawn another process.  If set to 0, @code{default-client-limit} is
 313 used instead.")
 314   (service-count
 315    (non-negative-integer 1)
 316    "Number of connections to handle before starting a new process.
 317 Typically the only useful values are 0 (unlimited) or 1.  1 is more
 318 secure, but 0 is faster.  <doc/wiki/LoginProcess.txt>.")
 319   (process-limit
 320    (non-negative-integer 0)
 321    "Maximum number of processes that can exist for this service.  If set to 0,
 322 @code{default-process-limit} is used instead.")
 323   (process-min-avail
 324    (non-negative-integer 0)
 325    "Number of processes to always keep waiting for more connections.")
 326   ;; FIXME: Need to be able to take the default for this value from other
 327   ;; parts of the config.
 328   (vsz-limit
 329    (non-negative-integer #e256e6)
 330    "If you set @samp{service-count 0}, you probably need to grow
 331 this."))
 332
 333 (define (serialize-service-configuration field-name val)
 334   (format #t "service ~a {\n" (service-configuration-kind val))
 335   (serialize-configuration val (cdr service-configuration-fields))
 336   (format #t "}\n"))
 337 (define (service-configuration-list? val)
 338   (and (list? val) (and-map service-configuration? val)))
 339 (define (serialize-service-configuration-list field-name val)
 340   (for-each (lambda (val)
 341               (serialize-service-configuration field-name val))
 342             val))
 343
 344 (define-configuration protocol-configuration
 345   (name
 346    (string (configuration-missing-field 'protocol 'name))
 347    "The name of the protocol.")
 348   (auth-socket-path
 349    (string "/var/run/dovecot/auth-userdb")
 350    "UNIX socket path to master authentication server to find users.
 351 This is used by imap (for shared users) and lda.")
 352   (mail-plugins
 353    (space-separated-string-list '("$mail_plugins"))
 354    "Space separated list of plugins to load.")
 355   (mail-max-userip-connections
 356    (non-negative-integer 10)
 357    "Maximum number of IMAP connections allowed for a user from each IP
 358 address.  NOTE: The username is compared case-sensitively."))
 359
 360 (define (serialize-protocol-configuration field-name val)
 361   (format #t "protocol ~a {\n" (protocol-configuration-name val))
 362   (serialize-configuration val (cdr protocol-configuration-fields))
 363   (format #t "}\n"))
 364 (define (protocol-configuration-list? val)
 365   (and (list? val) (and-map protocol-configuration? val)))
 366 (define (serialize-protocol-configuration-list field-name val)
 367   (serialize-field 'protocols
 368                    (string-join (map protocol-configuration-name val) " "))
 369   (for-each (lambda (val)
 370               (serialize-protocol-configuration field-name val))
 371             val))
 372
 373 (define-configuration plugin-configuration
 374   (entries
 375    (free-form-fields '())
 376    "A list of key-value pairs that this dict should hold."))
 377
 378 (define (serialize-plugin-configuration field-name val)
 379   (format #t "plugin {\n")
 380   (serialize-configuration val plugin-configuration-fields)
 381   (format #t "}\n"))
 382
 383 (define-configuration mailbox-configuration
 384   (name
 385    (string (error "mailbox name is required"))
 386    "Name for this mailbox.")
 387
 388   (auto
 389    (string "no")
 390    "@samp{create} will automatically create this mailbox.
 391 @samp{subscribe} will both create and subscribe to the mailbox.")
 392
 393   (special-use
 394    (space-separated-string-list '())
 395    "List of IMAP @code{SPECIAL-USE} attributes as specified by RFC 6154.
 396 Valid values are @code{\\All}, @code{\\Archive}, @code{\\Drafts},
 397 @code{\\Flagged}, @code{\\Junk}, @code{\\Sent}, and @code{\\Trash}."))
 398
 399 (define (serialize-mailbox-configuration field-name val)
 400   (format #t "mailbox \"~a\" {\n" (mailbox-configuration-name val))
 401   (serialize-configuration val (cdr mailbox-configuration-fields))
 402   (format #t "}\n"))
 403 (define (mailbox-configuration-list? val)
 404   (and (list? val) (and-map mailbox-configuration? val)))
 405 (define (serialize-mailbox-configuration-list field-name val)
 406   (for-each (lambda (val)
 407               (serialize-mailbox-configuration field-name val))
 408             val))
 409
 410 (define-configuration namespace-configuration
 411   (name
 412    (string (error "namespace name is required"))
 413    "Name for this namespace.")
 414
 415   (type
 416    (string "private")
 417    "Namespace type: @samp{private}, @samp{shared} or @samp{public}.")
 418
 419   (separator
 420    (string "")
 421    "Hierarchy separator to use. You should use the same separator for
 422 all namespaces or some clients get confused.  @samp{/} is usually a good
 423 one.  The default however depends on the underlying mail storage
 424 format.")
 425
 426   (prefix
 427    (string "")
 428    "Prefix required to access this namespace.  This needs to be
 429 different for all namespaces. For example @samp{Public/}.")
 430
 431   (location
 432    (string "")
 433    "Physical location of the mailbox. This is in same format as
 434 mail_location, which is also the default for it.")
 435
 436   (inbox?
 437    (boolean #f)
 438    "There can be only one INBOX, and this setting defines which
 439 namespace has it.")
 440
 441   (hidden?
 442    (boolean #f)
 443    "If namespace is hidden, it's not advertised to clients via NAMESPACE
 444 extension. You'll most likely also want to set @samp{list? #f}.  This is mostly
 445 useful when converting from another server with different namespaces
 446 which you want to deprecate but still keep working.  For example you can
 447 create hidden namespaces with prefixes @samp{~/mail/}, @samp{~%u/mail/}
 448 and @samp{mail/}.")
 449
 450   (list?
 451    (boolean #t)
 452    "Show the mailboxes under this namespace with LIST command. This
 453 makes the namespace visible for clients that don't support NAMESPACE
 454 extension.  The special @code{children} value lists child mailboxes, but
 455 hides the namespace prefix.")
 456
 457   (subscriptions?
 458    (boolean #t)
 459    "Namespace handles its own subscriptions.  If set to @code{#f}, the
 460 parent namespace handles them.  The empty prefix should always have this
 461 as @code{#t}.)")
 462
 463   (mailboxes
 464    (mailbox-configuration-list '())
 465    "List of predefined mailboxes in this namespace."))
 466
 467 (define (serialize-namespace-configuration field-name val)
 468   (format #t "namespace ~a {\n" (namespace-configuration-name val))
 469   (serialize-configuration val (cdr namespace-configuration-fields))
 470   (format #t "}\n"))
 471 (define (list-of-namespace-configuration? val)
 472   (and (list? val) (and-map namespace-configuration? val)))
 473 (define (serialize-list-of-namespace-configuration field-name val)
 474   (for-each (lambda (val)
 475               (serialize-namespace-configuration field-name val))
 476             val))
 477
 478 (define-configuration dovecot-configuration
 479   (dovecot
 480    (package dovecot)
 481    "The dovecot package.")
 482
 483   (listen
 484    (comma-separated-string-list '("*" "::"))
 485    "A list of IPs or hosts where to listen in for connections.  @samp{*}
 486 listens in all IPv4 interfaces, @samp{::} listens in all IPv6
 487 interfaces.  If you want to specify non-default ports or anything more
 488 complex, customize the address and port fields of the
 489 @samp{inet-listener} of the specific services you are interested in.")
 490
 491   (dict
 492    (dict-configuration (dict-configuration))
 493    "Dict configuration, as created by the @code{dict-configuration}
 494 constructor.")
 495
 496   (passdbs
 497    (passdb-configuration-list (list (passdb-configuration (driver "pam"))))
 498    "List of passdb configurations, each one created by the
 499 @code{passdb-configuration} constructor.")
 500
 501   (userdbs
 502    (userdb-configuration-list (list (userdb-configuration (driver "passwd"))))
 503    "List of userdb configurations, each one created by the
 504 @code{userdb-configuration} constructor.")
 505
 506   (plugin-configuration
 507    (plugin-configuration (plugin-configuration))
 508    "Plug-in configuration, created by the @code{plugin-configuration}
 509 constructor.")
 510
 511   (namespaces
 512    (list-of-namespace-configuration
 513     (list
 514      (namespace-configuration
 515       (name "inbox")
 516       (prefix "")
 517       (inbox? #t)
 518       (mailboxes
 519        (list
 520         (mailbox-configuration (name "Drafts") (special-use '("\\Drafts")))
 521         (mailbox-configuration (name "Junk") (special-use '("\\Junk")))
 522         (mailbox-configuration (name "Trash") (special-use '("\\Trash")))
 523         (mailbox-configuration (name "Sent") (special-use '("\\Sent")))
 524         (mailbox-configuration (name "Sent Messages") (special-use '("\\Sent")))
 525         (mailbox-configuration (name "Drafts") (special-use '("\\Drafts"))))))))
 526    "List of namespaces.  Each item in the list is created by the
 527 @code{namespace-configuration} constructor.")
 528
 529   (base-dir
 530    (file-name "/var/run/dovecot/")
 531    "Base directory where to store runtime data.")
 532
 533   (login-greeting
 534    (string "Dovecot ready.")
 535    "Greeting message for clients.")
 536
 537   (login-trusted-networks
 538    (space-separated-string-list '())
 539    "List of trusted network ranges.  Connections from these IPs are
 540 allowed to override their IP addresses and ports (for logging and for
 541 authentication checks).  @samp{disable-plaintext-auth} is also ignored
 542 for these networks.  Typically you'd specify your IMAP proxy servers
 543 here.")
 544
 545   (login-access-sockets
 546    (space-separated-string-list '())
 547    "List of login access check sockets (e.g. tcpwrap).")
 548
 549   (verbose-proctitle?
 550    (boolean #f)
 551    "Show more verbose process titles (in ps).  Currently shows user name
 552 and IP address.  Useful for seeing who are actually using the IMAP
 553 processes (e.g. shared mailboxes or if same uid is used for multiple
 554 accounts).")
 555
 556   (shutdown-clients?
 557    (boolean #t)
 558    "Should all processes be killed when Dovecot master process shuts down.
 559 Setting this to @code{#f} means that Dovecot can be upgraded without
 560 forcing existing client connections to close (although that could also
 561 be a problem if the upgrade is e.g. because of a security fix).")
 562
 563   (doveadm-worker-count
 564    (non-negative-integer 0)
 565    "If non-zero, run mail commands via this many connections to doveadm
 566 server, instead of running them directly in the same process.")
 567
 568   (doveadm-socket-path
 569    (string "doveadm-server")
 570    "UNIX socket or host:port used for connecting to doveadm server.")
 571
 572   (import-environment
 573    (space-separated-string-list '("TZ"))
 574    "List of environment variables that are preserved on Dovecot startup
 575 and passed down to all of its child processes.  You can also give
 576 key=value pairs to always set specific settings.")
 577
 578 ;;; Authentication processes
 579
 580   (disable-plaintext-auth?
 581    (boolean #t)
 582    "Disable LOGIN command and all other plaintext authentications unless
 583 SSL/TLS is used (LOGINDISABLED capability).  Note that if the remote IP
 584 matches the local IP (i.e. you're connecting from the same computer),
 585 the connection is considered secure and plaintext authentication is
 586 allowed.  See also ssl=required setting.")
 587
 588   (auth-cache-size
 589    (non-negative-integer 0)
 590    "Authentication cache size (e.g. @samp{#e10e6}).  0 means it's disabled.
 591 Note that bsdauth, PAM and vpopmail require @samp{cache-key} to be set
 592 for caching to be used.")
 593
 594   (auth-cache-ttl
 595    (string "1 hour")
 596    "Time to live for cached data.  After TTL expires the cached record
 597 is no longer used, *except* if the main database lookup returns internal
 598 failure.  We also try to handle password changes automatically: If
 599 user's previous authentication was successful, but this one wasn't, the
 600 cache isn't used.  For now this works only with plaintext
 601 authentication.")
 602
 603   (auth-cache-negative-ttl
 604    (string "1 hour")
 605    "TTL for negative hits (user not found, password mismatch).
 606 0 disables caching them completely.")
 607
 608   (auth-realms
 609    (space-separated-string-list '())
 610    "List of realms for SASL authentication mechanisms that need them.
 611 You can leave it empty if you don't want to support multiple realms.
 612 Many clients simply use the first one listed here, so keep the default
 613 realm first.")
 614
 615   (auth-default-realm
 616    (string "")
 617    "Default realm/domain to use if none was specified.  This is used for
 618 both SASL realms and appending @@domain to username in plaintext
 619 logins.")
 620
 621   (auth-username-chars
 622    (string
 623     "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@")
 624    "List of allowed characters in username.  If the user-given username
 625 contains a character not listed in here, the login automatically fails.
 626 This is just an extra check to make sure user can't exploit any
 627 potential quote escaping vulnerabilities with SQL/LDAP databases.  If
 628 you want to allow all characters, set this value to empty.")
 629
 630   (auth-username-translation
 631    (string "")
 632    "Username character translations before it's looked up from
 633 databases.  The value contains series of from -> to characters.  For
 634 example @samp{#@@/@@} means that @samp{#} and @samp{/} characters are
 635 translated to @samp{@@}.")
 636
 637   (auth-username-format
 638    (string "%Lu")
 639    "Username formatting before it's looked up from databases.  You can
 640 use the standard variables here, e.g. %Lu would lowercase the username,
 641 %n would drop away the domain if it was given, or @samp{%n-AT-%d} would
 642 change the @samp{@@} into @samp{-AT-}.  This translation is done after
 643 @samp{auth-username-translation} changes.")
 644
 645   (auth-master-user-separator
 646    (string "")
 647    "If you want to allow master users to log in by specifying the master
 648 username within the normal username string (i.e. not using SASL
 649 mechanism's support for it), you can specify the separator character
 650 here.  The format is then <username><separator><master username>.
 651 UW-IMAP uses @samp{*} as the separator, so that could be a good
 652 choice.")
 653
 654   (auth-anonymous-username
 655    (string "anonymous")
 656    "Username to use for users logging in with ANONYMOUS SASL
 657 mechanism.")
 658
 659   (auth-worker-max-count
 660    (non-negative-integer 30)
 661    "Maximum number of dovecot-auth worker processes.  They're used to
 662 execute blocking passdb and userdb queries (e.g. MySQL and PAM).
 663 They're automatically created and destroyed as needed.")
 664
 665   (auth-gssapi-hostname
 666    (string "")
 667    "Host name to use in GSSAPI principal names.  The default is to use
 668 the name returned by gethostname().  Use @samp{$ALL} (with quotes) to
 669 allow all keytab entries.")
 670
 671   (auth-krb5-keytab
 672    (string "")
 673    "Kerberos keytab to use for the GSSAPI mechanism.  Will use the
 674 system default (usually /etc/krb5.keytab) if not specified.  You may
 675 need to change the auth service to run as root to be able to read this
 676 file.")
 677
 678   (auth-use-winbind?
 679    (boolean #f)
 680    "Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon
 681 and @samp{ntlm-auth} helper.
 682 <doc/wiki/Authentication/Mechanisms/Winbind.txt>.")
 683
 684   (auth-winbind-helper-path
 685    (file-name "/usr/bin/ntlm_auth")
 686    "Path for Samba's @samp{ntlm-auth} helper binary.")
 687
 688   (auth-failure-delay
 689    (string "2 secs")
 690    "Time to delay before replying to failed authentications.")
 691
 692   (auth-ssl-require-client-cert?
 693    (boolean #f)
 694    "Require a valid SSL client certificate or the authentication
 695 fails.")
 696
 697   (auth-ssl-username-from-cert?
 698    (boolean #f)
 699    "Take the username from client's SSL certificate, using
 700 @code{X509_NAME_get_text_by_NID()} which returns the subject's DN's
 701 CommonName.")
 702
 703   (auth-mechanisms
 704    (space-separated-string-list '("plain"))
 705    "List of wanted authentication mechanisms.  Supported mechanisms are:
 706 @samp{plain}, @samp{login}, @samp{digest-md5}, @samp{cram-md5},
 707 @samp{ntlm}, @samp{rpa}, @samp{apop}, @samp{anonymous}, @samp{gssapi},
 708 @samp{otp}, @samp{skey}, and @samp{gss-spnego}.  NOTE: See also
 709 @samp{disable-plaintext-auth} setting.")
 710
 711   (director-servers
 712    (space-separated-string-list '())
 713    "List of IPs or hostnames to all director servers, including ourself.
 714 Ports can be specified as ip:port.  The default port is the same as what
 715 director service's @samp{inet-listener} is using.")
 716
 717   (director-mail-servers
 718    (space-separated-string-list '())
 719    "List of IPs or hostnames to all backend mail servers.  Ranges are
 720 allowed too, like 10.0.0.10-10.0.0.30.")
 721
 722   (director-user-expire
 723    (string "15 min")
 724    "How long to redirect users to a specific server after it no longer
 725 has any connections.")
 726
 727   (director-username-hash
 728    (string "%Lu")
 729    "How the username is translated before being hashed.  Useful values
 730 include %Ln if user can log in with or without @@domain, %Ld if mailboxes
 731 are shared within domain.")
 732
 733 ;;; Log destination.
 734
 735   (log-path
 736    (string "syslog")
 737    "Log file to use for error messages.  @samp{syslog} logs to syslog,
 738 @samp{/dev/stderr} logs to stderr.")
 739
 740   (info-log-path
 741    (string "")
 742    "Log file to use for informational messages.  Defaults to
 743 @samp{log-path}.")
 744
 745   (debug-log-path
 746    (string "")
 747    "Log file to use for debug messages.  Defaults to
 748 @samp{info-log-path}.")
 749
 750   (syslog-facility
 751    (string "mail")
 752    "Syslog facility to use if you're logging to syslog.  Usually if you
 753 don't want to use @samp{mail}, you'll use local0..local7.  Also other
 754 standard facilities are supported.")
 755
 756   (auth-verbose?
 757    (boolean #f)
 758    "Log unsuccessful authentication attempts and the reasons why they
 759 failed.")
 760
 761   (auth-verbose-passwords
 762    (string "no")
 763    "In case of password mismatches, log the attempted password.  Valid
 764 values are no, plain and sha1.  sha1 can be useful for detecting brute
 765 force password attempts vs.  user simply trying the same password over
 766 and over again.  You can also truncate the value to n chars by appending
 767 \":n\" (e.g. sha1:6).")
 768
 769   (auth-debug?
 770    (boolean #f)
 771    "Even more verbose logging for debugging purposes.  Shows for example
 772 SQL queries.")
 773
 774   (auth-debug-passwords?
 775    (boolean #f)
 776    "In case of password mismatches, log the passwords and used scheme so
 777 the problem can be debugged.  Enabling this also enables
 778 @samp{auth-debug}.")
 779
 780   (mail-debug?
 781    (boolean #f)
 782    "Enable mail process debugging.  This can help you figure out why
 783 Dovecot isn't finding your mails.")
 784
 785   (verbose-ssl?
 786    (boolean #f)
 787    "Show protocol level SSL errors.")
 788
 789   (log-timestamp
 790    (string "\"%b %d %H:%M:%S \"")
 791    "Prefix for each line written to log file.  % codes are in
 792 strftime(3) format.")
 793
 794   (login-log-format-elements
 795    (space-separated-string-list
 796     '("user=<%u>" "method=%m" "rip=%r" "lip=%l" "mpid=%e" "%c"))
 797    "List of elements we want to log.  The elements which have a
 798 non-empty variable value are joined together to form a comma-separated
 799 string.")
 800
 801   (login-log-format
 802    (string "%$: %s")
 803    "Login log format.  %s contains @samp{login-log-format-elements}
 804 string, %$ contains the data we want to log.")
 805
 806   (mail-log-prefix
 807    (string "\"%s(%u)<%{pid}><%{session}>: \"")
 808    "Log prefix for mail processes.  See doc/wiki/Variables.txt for list
 809 of possible variables you can use.")
 810
 811   (deliver-log-format
 812    (string "msgid=%m: %$")
 813    "Format to use for logging mail deliveries.  You can use variables:
 814 @table @code
 815 @item %$
 816 Delivery status message (e.g. @samp{saved to INBOX})
 817 @item %m
 818 Message-ID
 819 @item %s
 820 Subject
 821 @item %f
 822 From address
 823 @item %p
 824 Physical size
 825 @item %w
 826 Virtual size.
 827 @end table")
 828
 829 ;;; Mailbox locations and namespaces
 830
 831   (mail-location
 832    (string "")
 833    "Location for users' mailboxes.  The default is empty, which means
 834 that Dovecot tries to find the mailboxes automatically.  This won't work
 835 if the user doesn't yet have any mail, so you should explicitly tell
 836 Dovecot the full location.
 837
 838 If you're using mbox, giving a path to the INBOX
 839 file (e.g. /var/mail/%u) isn't enough.  You'll also need to tell Dovecot
 840 where the other mailboxes are kept.  This is called the \"root mail
 841 directory\", and it must be the first path given in the
 842 @samp{mail-location} setting.
 843
 844 There are a few special variables you can use, eg.:
 845
 846 @table @samp
 847 @item %u
 848 username
 849 @item %n
 850 user part in user@@domain, same as %u if there's no domain
 851 @item %d
 852 domain part in user@@domain, empty if there's no domain
 853 @item %h
 854 home director
 855 @end table
 856
 857 See doc/wiki/Variables.txt for full list.  Some examples:
 858 @table @samp
 859 @item maildir:~/Maildir
 860 @item mbox:~/mail:INBOX=/var/mail/%u
 861 @item mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%
 862 @end table")
 863
 864   (mail-uid
 865    (string "")
 866    "System user and group used to access mails.  If you use multiple,
 867 userdb can override these by returning uid or gid fields.  You can use
 868 either numbers or names.  <doc/wiki/UserIds.txt>.")
 869
 870   (mail-gid
 871    (string "")
 872    "")
 873
 874   (mail-privileged-group
 875    (string "")
 876    "Group to enable temporarily for privileged operations.  Currently
 877 this is used only with INBOX when either its initial creation or
 878 dotlocking fails.  Typically this is set to \"mail\" to give access to
 879 /var/mail.")
 880
 881   (mail-access-groups
 882    (string "")
 883    "Grant access to these supplementary groups for mail processes.
 884 Typically these are used to set up access to shared mailboxes.  Note
 885 that it may be dangerous to set these if users can create
 886 symlinks (e.g. if \"mail\" group is set here, ln -s /var/mail ~/mail/var
 887 could allow a user to delete others' mailboxes, or ln -s
 888 /secret/shared/box ~/mail/mybox would allow reading it).")
 889
 890   (mail-full-filesystem-access?
 891    (boolean #f)
 892    "Allow full file system access to clients.  There's no access checks
 893 other than what the operating system does for the active UID/GID.  It
 894 works with both maildir and mboxes, allowing you to prefix mailboxes
 895 names with e.g. /path/ or ~user/.")
 896
 897 ;;; Mail processes
 898
 899   (mmap-disable?
 900    (boolean #f)
 901    "Don't use mmap() at all.  This is required if you store indexes to
 902 shared file systems (NFS or clustered file system).")
 903
 904   (dotlock-use-excl?
 905    (boolean #t)
 906    "Rely on @samp{O_EXCL} to work when creating dotlock files.  NFS
 907 supports @samp{O_EXCL} since version 3, so this should be safe to use
 908 nowadays by default.")
 909
 910   (mail-fsync
 911    (string "optimized")
 912    "When to use fsync() or fdatasync() calls:
 913 @table @code
 914 @item optimized
 915 Whenever necessary to avoid losing important data
 916 @item always
 917 Useful with e.g. NFS when write()s are delayed
 918 @item never
 919 Never use it (best performance, but crashes can lose data).
 920 @end table")
 921
 922   (mail-nfs-storage?
 923    (boolean #f)
 924    "Mail storage exists in NFS.  Set this to yes to make Dovecot flush
 925 NFS caches whenever needed.  If you're using only a single mail server
 926 this isn't needed.")
 927
 928   (mail-nfs-index?
 929    (boolean #f)
 930    "Mail index files also exist in NFS.  Setting this to yes requires
 931 @samp{mmap-disable? #t} and @samp{fsync-disable? #f}.")
 932
 933   (lock-method
 934    (string "fcntl")
 935    "Locking method for index files.  Alternatives are fcntl, flock and
 936 dotlock.  Dotlocking uses some tricks which may create more disk I/O
 937 than other locking methods.  NFS users: flock doesn't work, remember to
 938 change @samp{mmap-disable}.")
 939
 940   (mail-temp-dir
 941    (file-name "/tmp")
 942    "Directory in which LDA/LMTP temporarily stores incoming mails >128
 943 kB.")
 944
 945   (first-valid-uid
 946    (non-negative-integer 500)
 947    "Valid UID range for users.  This is mostly to make sure that users can't
 948 log in as daemons or other system users.  Note that denying root logins is
 949 hardcoded to dovecot binary and can't be done even if @samp{first-valid-uid}
 950 is set to 0.")
 951
 952   (last-valid-uid
 953    (non-negative-integer 0)
 954    "")
 955
 956   (first-valid-gid
 957    (non-negative-integer 1)
 958    "Valid GID range for users.  Users having non-valid GID as primary group ID
 959 aren't allowed to log in.  If user belongs to supplementary groups with
 960 non-valid GIDs, those groups are not set.")
 961
 962   (last-valid-gid
 963    (non-negative-integer 0)
 964    "")
 965
 966   (mail-max-keyword-length
 967    (non-negative-integer 50)
 968    "Maximum allowed length for mail keyword name.  It's only forced when
 969 trying to create new keywords.")
 970
 971   (valid-chroot-dirs
 972    (colon-separated-file-name-list '())
 973    "List of directories under which chrooting is allowed for mail
 974 processes (i.e. /var/mail will allow chrooting to /var/mail/foo/bar
 975 too).  This setting doesn't affect @samp{login-chroot}
 976 @samp{mail-chroot} or auth chroot settings.  If this setting is empty,
 977 \"/./\" in home dirs are ignored.  WARNING: Never add directories here
 978 which local users can modify, that may lead to root exploit.  Usually
 979 this should be done only if you don't allow shell access for users.
 980 <doc/wiki/Chrooting.txt>.")
 981
 982   (mail-chroot
 983    (string "")
 984    "Default chroot directory for mail processes.  This can be overridden
 985 for specific users in user database by giving /./ in user's home
 986 directory (e.g. /home/./user chroots into /home).  Note that usually
 987 there is no real need to do chrooting, Dovecot doesn't allow users to
 988 access files outside their mail directory anyway.  If your home
 989 directories are prefixed with the chroot directory, append \"/.\" to
 990 @samp{mail-chroot}.  <doc/wiki/Chrooting.txt>.")
 991
 992   (auth-socket-path
 993    (file-name "/var/run/dovecot/auth-userdb")
 994    "UNIX socket path to master authentication server to find users.
 995 This is used by imap (for shared users) and lda.")
 996
 997   (mail-plugin-dir
 998    (file-name "/usr/lib/dovecot")
 999    "Directory where to look up mail plugins.")
1000
1001   (mail-plugins
1002    (space-separated-string-list '())
1003    "List of plugins to load for all services.  Plugins specific to IMAP,
1004 LDA, etc. are added to this list in their own .conf files.")
1005
1006
1007   (mail-cache-min-mail-count
1008    (non-negative-integer 0)
1009    "The minimum number of mails in a mailbox before updates are done to
1010 cache file.  This allows optimizing Dovecot's behavior to do less disk
1011 writes at the cost of more disk reads.")
1012
1013   (mailbox-idle-check-interval
1014    (string "30 secs")
1015    "When IDLE command is running, mailbox is checked once in a while to
1016 see if there are any new mails or other changes.  This setting defines
1017 the minimum time to wait between those checks.  Dovecot can also use
1018 dnotify, inotify and kqueue to find out immediately when changes
1019 occur.")
1020
1021   (mail-save-crlf?
1022    (boolean #f)
1023    "Save mails with CR+LF instead of plain LF.  This makes sending those
1024 mails take less CPU, especially with sendfile() syscall with Linux and
1025 FreeBSD.  But it also creates a bit more disk I/O which may just make it
1026 slower.  Also note that if other software reads the mboxes/maildirs,
1027 they may handle the extra CRs wrong and cause problems.")
1028
1029   (maildir-stat-dirs?
1030    (boolean #f)
1031    "By default LIST command returns all entries in maildir beginning
1032 with a dot.  Enabling this option makes Dovecot return only entries
1033 which are directories.  This is done by stat()ing each entry, so it
1034 causes more disk I/O.
1035  (For systems setting struct @samp{dirent->d_type} this check is free
1036 and it's done always regardless of this setting).")
1037
1038   (maildir-copy-with-hardlinks?
1039    (boolean #t)
1040    "When copying a message, do it with hard links whenever possible.
1041 This makes the performance much better, and it's unlikely to have any
1042 side effects.")
1043
1044   (maildir-very-dirty-syncs?
1045    (boolean #f)
1046    "Assume Dovecot is the only MUA accessing Maildir: Scan cur/
1047 directory only when its mtime changes unexpectedly or when we can't find
1048 the mail otherwise.")
1049
1050   (mbox-read-locks
1051    (space-separated-string-list '("fcntl"))
1052    "Which locking methods to use for locking mbox.  There are four
1053 available:
1054
1055 @table @code
1056 @item dotlock
1057 Create <mailbox>.lock file.  This is the oldest and most NFS-safe
1058 solution.  If you want to use /var/mail/ like directory, the users will
1059 need write access to that directory.
1060 @item dotlock-try
1061 Same as dotlock, but if it fails because of permissions or because there
1062 isn't enough disk space, just skip it.
1063 @item fcntl
1064 Use this if possible.  Works with NFS too if lockd is used.
1065 @item flock
1066 May not exist in all systems.  Doesn't work with NFS.
1067 @item lockf
1068 May not exist in all systems.  Doesn't work with NFS.
1069 @end table
1070
1071 You can use multiple locking methods; if you do the order they're declared
1072 in is important to avoid deadlocks if other MTAs/MUAs are using multiple
1073 locking methods as well.  Some operating systems don't allow using some of
1074 them simultaneously.")
1075
1076   (mbox-write-locks
1077    (space-separated-string-list '("dotlock" "fcntl"))
1078    "")
1079
1080   (mbox-lock-timeout
1081    (string "5 mins")
1082    "Maximum time to wait for lock (all of them) before aborting.")
1083
1084   (mbox-dotlock-change-timeout
1085    (string "2 mins")
1086    "If dotlock exists but the mailbox isn't modified in any way,
1087 override the lock file after this much time.")
1088
1089   (mbox-dirty-syncs?
1090    (boolean #t)
1091    "When mbox changes unexpectedly we have to fully read it to find out
1092 what changed.  If the mbox is large this can take a long time.  Since
1093 the change is usually just a newly appended mail, it'd be faster to
1094 simply read the new mails.  If this setting is enabled, Dovecot does
1095 this but still safely fallbacks to re-reading the whole mbox file
1096 whenever something in mbox isn't how it's expected to be.  The only real
1097 downside to this setting is that if some other MUA changes message
1098 flags, Dovecot doesn't notice it immediately.  Note that a full sync is
1099 done with SELECT, EXAMINE, EXPUNGE and CHECK commands.")
1100
1101   (mbox-very-dirty-syncs?
1102    (boolean #f)
1103    "Like @samp{mbox-dirty-syncs}, but don't do full syncs even with SELECT,
1104 EXAMINE, EXPUNGE or CHECK commands.  If this is set,
1105 @samp{mbox-dirty-syncs} is ignored.")
1106
1107   (mbox-lazy-writes?
1108    (boolean #t)
1109    "Delay writing mbox headers until doing a full write sync (EXPUNGE
1110 and CHECK commands and when closing the mailbox).  This is especially
1111 useful for POP3 where clients often delete all mails.  The downside is
1112 that our changes aren't immediately visible to other MUAs.")
1113
1114   (mbox-min-index-size
1115    (non-negative-integer 0)
1116    "If mbox size is smaller than this (e.g. 100k), don't write index
1117 files.  If an index file already exists it's still read, just not
1118 updated.")
1119
1120   (mdbox-rotate-size
1121    (non-negative-integer #e10e6)
1122    "Maximum dbox file size until it's rotated.")
1123
1124   (mdbox-rotate-interval
1125    (string "1d")
1126    "Maximum dbox file age until it's rotated.  Typically in days.  Day
1127 begins from midnight, so 1d = today, 2d = yesterday, etc.  0 = check
1128 disabled.")
1129
1130   (mdbox-preallocate-space?
1131    (boolean #f)
1132    "When creating new mdbox files, immediately preallocate their size to
1133 @samp{mdbox-rotate-size}.  This setting currently works only in Linux
1134 with some file systems (ext4, xfs).")
1135
1136   (mail-attachment-dir
1137    (string "")
1138    "sdbox and mdbox support saving mail attachments to external files,
1139 which also allows single instance storage for them.  Other backends
1140 don't support this for now.
1141
1142 WARNING: This feature hasn't been tested much yet.  Use at your own risk.
1143
1144 Directory root where to store mail attachments.  Disabled, if empty.")
1145
1146   (mail-attachment-min-size
1147    (non-negative-integer #e128e3)
1148    "Attachments smaller than this aren't saved externally.  It's also
1149 possible to write a plugin to disable saving specific attachments
1150 externally.")
1151
1152   (mail-attachment-fs
1153    (string "sis posix")
1154    "File system backend to use for saving attachments:
1155 @table @code
1156 @item posix
1157 No SiS done by Dovecot (but this might help FS's own deduplication)
1158 @item sis posix
1159 SiS with immediate byte-by-byte comparison during saving
1160 @item sis-queue posix
1161 SiS with delayed comparison and deduplication.
1162 @end table")
1163
1164   (mail-attachment-hash
1165    (string "%{sha1}")
1166    "Hash format to use in attachment filenames.  You can add any text and
1167 variables: @code{%@{md4@}}, @code{%@{md5@}}, @code{%@{sha1@}},
1168 @code{%@{sha256@}}, @code{%@{sha512@}}, @code{%@{size@}}.  Variables can be
1169 truncated, e.g. @code{%@{sha256:80@}} returns only first 80 bits.")
1170
1171   (default-process-limit
1172     (non-negative-integer 100)
1173     "")
1174
1175   (default-client-limit
1176     (non-negative-integer 1000)
1177     "")
1178
1179   (default-vsz-limit
1180     (non-negative-integer #e256e6)
1181     "Default VSZ (virtual memory size) limit for service processes.
1182 This is mainly intended to catch and kill processes that leak memory
1183 before they eat up everything.")
1184
1185   (default-login-user
1186     (string "dovenull")
1187     "Login user is internally used by login processes.  This is the most
1188 untrusted user in Dovecot system.  It shouldn't have access to anything
1189 at all.")
1190
1191   (default-internal-user
1192     (string "dovecot")
1193     "Internal user is used by unprivileged processes.  It should be
1194 separate from login user, so that login processes can't disturb other
1195 processes.")
1196
1197   (ssl?
1198    (string "required")
1199    "SSL/TLS support: yes, no, required.  <doc/wiki/SSL.txt>.")
1200
1201   (ssl-cert
1202    (string "</etc/dovecot/default.pem")
1203    "PEM encoded X.509 SSL/TLS certificate (public key).")
1204
1205   (ssl-key
1206    (string "</etc/dovecot/private/default.pem")
1207    "PEM encoded SSL/TLS private key.  The key is opened before
1208 dropping root privileges, so keep the key file unreadable by anyone but
1209 root.")
1210
1211   (ssl-key-password
1212    (string "")
1213    "If key file is password protected, give the password here.
1214 Alternatively give it when starting dovecot with -p parameter.  Since
1215 this file is often world-readable, you may want to place this setting
1216 instead to a different.")
1217
1218   (ssl-ca
1219    (string "")
1220    "PEM encoded trusted certificate authority.  Set this only if you
1221 intend to use @samp{ssl-verify-client-cert? #t}.  The file should
1222 contain the CA certificate(s) followed by the matching
1223 CRL(s).  (e.g. @samp{ssl-ca </etc/ssl/certs/ca.pem}).")
1224   (ssl-require-crl?
1225    (boolean #t)
1226    "Require that CRL check succeeds for client certificates.")
1227   (ssl-verify-client-cert?
1228    (boolean #f)
1229    "Request client to send a certificate.  If you also want to require
1230 it, set @samp{auth-ssl-require-client-cert? #t} in auth section.")
1231
1232   (ssl-cert-username-field
1233    (string "commonName")
1234    "Which field from certificate to use for username.  commonName and
1235 x500UniqueIdentifier are the usual choices.  You'll also need to set
1236 @samp{auth-ssl-username-from-cert? #t}.")
1237
1238   (ssl-min-protocol
1239    (string "TLSv1")
1240    "Minimum SSL protocol version to accept.")
1241
1242   (ssl-cipher-list
1243    (string "ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH")
1244    "SSL ciphers to use.")
1245
1246   (ssl-crypto-device
1247    (string "")
1248    "SSL crypto device to use, for valid values run \"openssl engine\".")
1249
1250   (postmaster-address
1251    (string "postmaster@%d")
1252    "Address to use when sending rejection mails.
1253 Default is postmaster@@<your domain>.  %d expands to recipient domain.")
1254
1255   (hostname
1256    (string "")
1257    "Hostname to use in various parts of sent mails (e.g. in Message-Id)
1258 and in LMTP replies.  Default is the system's real hostname@@domain.")
1259
1260   (quota-full-tempfail?
1261    (boolean #f)
1262    "If user is over quota, return with temporary failure instead of
1263 bouncing the mail.")
1264
1265   (sendmail-path
1266    (file-name "/usr/sbin/sendmail")
1267    "Binary to use for sending mails.")
1268
1269   (submission-host
1270    (string "")
1271    "If non-empty, send mails via this SMTP host[:port] instead of
1272 sendmail.")
1273
1274   (rejection-subject
1275    (string "Rejected: %s")
1276    "Subject: header to use for rejection mails.  You can use the same
1277 variables as for @samp{rejection-reason} below.")
1278
1279   (rejection-reason
1280    (string "Your message to <%t> was automatically rejected:%n%r")
1281    "Human readable error message for rejection mails.  You can use
1282 variables:
1283
1284 @table @code
1285 @item %n
1286 CRLF
1287 @item %r
1288 reason
1289 @item %s
1290 original subject
1291 @item %t
1292 recipient
1293 @end table")
1294
1295   (recipient-delimiter
1296    (string "+")
1297    "Delimiter character between local-part and detail in email
1298 address.")
1299
1300   (lda-original-recipient-header
1301    (string "")
1302    "Header where the original recipient address (SMTP's RCPT TO:
1303 address) is taken from if not available elsewhere.  With dovecot-lda -a
1304 parameter overrides this.  A commonly used header for this is
1305 X-Original-To.")
1306
1307   (lda-mailbox-autocreate?
1308    (boolean #f)
1309    "Should saving a mail to a nonexistent mailbox automatically create
1310 it?.")
1311
1312   (lda-mailbox-autosubscribe?
1313    (boolean #f)
1314    "Should automatically created mailboxes be also automatically
1315 subscribed?.")
1316
1317
1318   (imap-max-line-length
1319    (non-negative-integer #e64e3)
1320    "Maximum IMAP command line length.  Some clients generate very long
1321 command lines with huge mailboxes, so you may need to raise this if you
1322 get \"Too long argument\" or \"IMAP command line too large\" errors
1323 often.")
1324
1325   (imap-logout-format
1326    (string "in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes}")
1327    "IMAP logout format string:
1328 @table @code
1329 @item %i
1330 total number of bytes read from client
1331 @item %o
1332 total number of bytes sent to client.
1333 @end table
1334 See @file{doc/wiki/Variables.txt} for a list of all the variables you can use.")
1335
1336   (imap-capability
1337    (string "")
1338    "Override the IMAP CAPABILITY response.  If the value begins with '+',
1339 add the given capabilities on top of the defaults (e.g. +XFOO XBAR).")
1340
1341   (imap-idle-notify-interval
1342    (string "2 mins")
1343    "How long to wait between \"OK Still here\" notifications when client
1344 is IDLEing.")
1345
1346   (imap-id-send
1347    (string "")
1348    "ID field names and values to send to clients.  Using * as the value
1349 makes Dovecot use the default value.  The following fields have default
1350 values currently: name, version, os, os-version, support-url,
1351 support-email.")
1352
1353   (imap-id-log
1354    (string "")
1355    "ID fields sent by client to log.  * means everything.")
1356
1357   (imap-client-workarounds
1358    (space-separated-string-list '())
1359    "Workarounds for various client bugs:
1360
1361 @table @code
1362 @item delay-newmail
1363 Send EXISTS/RECENT new mail notifications only when replying to NOOP and
1364 CHECK commands.  Some clients ignore them otherwise, for example OSX
1365 Mail (<v2.1).  Outlook Express breaks more badly though, without this it
1366 may show user \"Message no longer in server\" errors.  Note that OE6
1367 still breaks even with this workaround if synchronization is set to
1368 \"Headers Only\".
1369
1370 @item tb-extra-mailbox-sep
1371 Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
1372 adds extra @samp{/} suffixes to mailbox names.  This option causes Dovecot to
1373 ignore the extra @samp{/} instead of treating it as invalid mailbox name.
1374
1375 @item tb-lsub-flags
1376 Show \\Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
1377 This makes Thunderbird realize they aren't selectable and show them
1378 greyed out, instead of only later giving \"not selectable\" popup error.
1379 @end table
1380 ")
1381
1382   (imap-urlauth-host
1383    (string "")
1384    "Host allowed in URLAUTH URLs sent by client.  \"*\" allows all.")
1385
1386   (protocols
1387    (protocol-configuration-list
1388     (list (protocol-configuration
1389            (name "imap"))))
1390    "List of protocols we want to serve.  Available protocols include
1391 @samp{imap}, @samp{pop3}, and @samp{lmtp}.")
1392
1393   (services
1394    (service-configuration-list
1395     (list
1396      (service-configuration
1397       (kind "imap-login")
1398       (client-limit 0)
1399       (process-limit 0)
1400       (listeners
1401        (list
1402         (inet-listener-configuration (protocol "imap") (port 143) (ssl? #f))
1403         (inet-listener-configuration (protocol "imaps") (port 993) (ssl? #t)))))
1404      (service-configuration
1405       (kind "pop3-login")
1406       (listeners
1407        (list
1408         (inet-listener-configuration (protocol "pop3") (port 110) (ssl? #f))
1409         (inet-listener-configuration (protocol "pop3s") (port 995) (ssl? #t)))))
1410      (service-configuration
1411       (kind "lmtp")
1412       (client-limit 1)
1413       (process-limit 0)
1414       (listeners
1415        (list (unix-listener-configuration (path "lmtp") (mode "0666")))))
1416      (service-configuration
1417       (kind "imap")
1418       (client-limit 1)
1419       (process-limit 1024))
1420      (service-configuration
1421       (kind "pop3")
1422       (client-limit 1)
1423       (process-limit 1024))
1424      (service-configuration
1425       (kind "auth")
1426       (service-count 0)
1427       (client-limit 0)
1428       (process-limit 1)
1429       (listeners
1430        (list (unix-listener-configuration (path "auth-userdb")))))
1431      (service-configuration
1432       (kind "auth-worker")
1433       (client-limit 1)
1434       (process-limit 0))
1435      (service-configuration
1436       (kind "dict")
1437       (client-limit 1)
1438       (process-limit 0)
1439       (listeners (list (unix-listener-configuration (path "dict")))))))
1440    "List of services to enable.  Available services include @samp{imap},
1441 @samp{imap-login}, @samp{pop3}, @samp{pop3-login}, @samp{auth}, and
1442 @samp{lmtp}."))
1443
1444 (define-configuration opaque-dovecot-configuration
1445   (dovecot
1446    (package dovecot)
1447    "The dovecot package.")
1448
1449   (string
1450    (string (configuration-missing-field 'opaque-dovecot-configuration
1451                                         'string))
1452    "The contents of the @code{dovecot.conf} to use."))
1453
1454 (define %dovecot-accounts
1455   ;; Account and group for the Dovecot daemon.
1456   (list (user-group (name "dovecot") (system? #t))
1457         (user-account
1458          (name "dovecot")
1459          (group "dovecot")
1460          (system? #t)
1461          (comment "Dovecot daemon user")
1462          (home-directory "/var/empty")
1463          (shell (file-append shadow "/sbin/nologin")))
1464
1465         (user-group (name "dovenull") (system? #t))
1466         (user-account
1467          (name "dovenull")
1468          (group "dovenull")
1469          (system? #t)
1470          (comment "Dovecot daemon login user")
1471          (home-directory "/var/empty")
1472          (shell (file-append shadow "/sbin/nologin")))))
1473
1474 (define (%dovecot-activation config)
1475   ;; Activation gexp.
1476   (let ((config-str
1477          (cond
1478           ((opaque-dovecot-configuration? config)
1479            (opaque-dovecot-configuration-string config))
1480           (else
1481            (with-output-to-string
1482              (lambda ()
1483                (serialize-configuration config
1484                                         dovecot-configuration-fields)))))))
1485     #~(begin
1486         (use-modules (guix build utils))
1487         (define (mkdir-p/perms directory owner perms)
1488           (mkdir-p directory)
1489           (chown "/var/run/dovecot" (passwd:uid owner) (passwd:gid owner))
1490           (chmod directory perms))
1491         (define (build-subject parameters)
1492           (string-concatenate
1493            (map (lambda (pair)
1494                   (let ((k (car pair)) (v (cdr pair)))
1495                     (define (escape-char str chr)
1496                       (string-join (string-split str chr) (string #\\ chr)))
1497                     (string-append "/" k "="
1498                                    (escape-char (escape-char v #\=) #\/))))
1499                 (filter (lambda (pair) (cdr pair)) parameters))))
1500         (define* (create-self-signed-certificate-if-absent
1501                   #:key private-key public-key (owner (getpwnam "root"))
1502                   (common-name (gethostname))
1503                   (organization-name "Guix")
1504                   (organization-unit-name "Default Self-Signed Certificate")
1505                   (subject-parameters `(("CN" . ,common-name)
1506                                         ("O" . ,organization-name)
1507                                         ("OU" . ,organization-unit-name)))
1508                   (subject (build-subject subject-parameters)))
1509           ;; Note that by default, OpenSSL outputs keys in PEM format.  This
1510           ;; is what we want.
1511           (unless (file-exists? private-key)
1512             (cond
1513              ((zero? (system* (string-append #$openssl "/bin/openssl")
1514                               "genrsa" "-out" private-key "2048"))
1515               (chown private-key (passwd:uid owner) (passwd:gid owner))
1516               (chmod private-key #o400))
1517              (else
1518               (format (current-error-port)
1519                       "Failed to create private key at ~a.\n" private-key))))
1520           (unless (file-exists? public-key)
1521             (cond
1522              ((zero? (system* (string-append #$openssl "/bin/openssl")
1523                               "req" "-new" "-x509" "-key" private-key
1524                               "-out" public-key "-days" "3650"
1525                               "-batch" "-subj" subject))
1526               (chown public-key (passwd:uid owner) (passwd:gid owner))
1527               (chmod public-key #o444))
1528              (else
1529               (format (current-error-port)
1530                       "Failed to create public key at ~a.\n" public-key)))))
1531         (let ((user (getpwnam "dovecot")))
1532           (mkdir-p/perms "/var/run/dovecot" user #o755)
1533           (mkdir-p/perms "/var/lib/dovecot" user #o755)
1534           (mkdir-p/perms "/etc/dovecot" user #o755)
1535           (copy-file #$(plain-file "dovecot.conf" config-str)
1536                      "/etc/dovecot/dovecot.conf")
1537           (mkdir-p/perms "/etc/dovecot/private" user #o700)
1538           (create-self-signed-certificate-if-absent
1539            #:private-key "/etc/dovecot/private/default.pem"
1540            #:public-key "/etc/dovecot/default.pem"
1541            #:owner (getpwnam "root")
1542            #:common-name (format #f "Dovecot service on ~a" (gethostname)))))))
1543
1544 (define (dovecot-shepherd-service config)
1545   "Return a list of <shepherd-service> for CONFIG."
1546   (let ((dovecot (if (opaque-dovecot-configuration? config)
1547                      (opaque-dovecot-configuration-dovecot config)
1548                      (dovecot-configuration-dovecot config))))
1549     (list (shepherd-service
1550            (documentation "Run the Dovecot POP3/IMAP mail server.")
1551            (provision '(dovecot))
1552            (requirement '(networking))
1553            (start #~(make-forkexec-constructor
1554                      (list (string-append #$dovecot "/sbin/dovecot")
1555                            "-F")))
1556            (stop #~(lambda _
1557                      (invoke #$(file-append dovecot "/sbin/dovecot")
1558                              "stop")
1559                      #f))))))
1560
1561 (define %dovecot-pam-services
1562   (list (unix-pam-service "dovecot")))
1563
1564 (define dovecot-service-type
1565   (service-type (name 'dovecot)
1566                 (extensions
1567                  (list (service-extension shepherd-root-service-type
1568                                           dovecot-shepherd-service)
1569                        (service-extension account-service-type
1570                                           (const %dovecot-accounts))
1571                        (service-extension pam-root-service-type
1572                                           (const %dovecot-pam-services))
1573                        (service-extension activation-service-type
1574                                           %dovecot-activation)))))
1575
1576 (define* (dovecot-service #:key (config (dovecot-configuration)))
1577   "Return a service that runs @command{dovecot}, a mail server that can run
1578 POP3, IMAP, and LMTP.  @var{config} should be a configuration object created
1579 by @code{dovecot-configuration}.  @var{config} may also be created by
1580 @code{opaque-dovecot-configuration}, which allows specification of the
1581 @code{dovecot.conf} as a string."
1582   (validate-configuration config
1583                           (if (opaque-dovecot-configuration? config)
1584                               opaque-dovecot-configuration-fields
1585                               dovecot-configuration-fields))
1586   (service dovecot-service-type config))
1587
1588 ;; A little helper to make it easier to document all those fields.
1589 (define (generate-dovecot-documentation)
1590   (generate-documentation
1591     `((dovecot-configuration
1592        ,dovecot-configuration-fields
1593        (dict dict-configuration)
1594        (namespaces namespace-configuration)
1595        (plugin plugin-configuration)
1596        (passdbs passdb-configuration)
1597        (userdbs userdb-configuration)
1598        (services service-configuration)
1599        (protocols protocol-configuration))
1600       (dict-configuration ,dict-configuration-fields)
1601       (plugin-configuration ,plugin-configuration-fields)
1602       (passdb-configuration ,passdb-configuration-fields)
1603       (userdb-configuration ,userdb-configuration-fields)
1604       (unix-listener-configuration ,unix-listener-configuration-fields)
1605       (fifo-listener-configuration ,fifo-listener-configuration-fields)
1606       (inet-listener-configuration ,inet-listener-configuration-fields)
1607       (namespace-configuration
1608        ,namespace-configuration-fields
1609        (mailboxes mailbox-configuration))
1610       (mailbox-configuration ,mailbox-configuration-fields)
1611       (service-configuration
1612        ,service-configuration-fields
1613        (listeners unix-listener-configuration fifo-listener-configuration
1614                   inet-listener-configuration))
1615       (protocol-configuration ,protocol-configuration-fields))
1616   'dovecot-configuration))
1617
1618 \f
1619 ;;;
1620 ;;; OpenSMTPD.
1621 ;;;
1622
1623 (define-record-type* <opensmtpd-configuration>
1624   opensmtpd-configuration make-opensmtpd-configuration
1625   opensmtpd-configuration?
1626   (package     opensmtpd-configuration-package
1627                (default opensmtpd))
1628   (config-file opensmtpd-configuration-config-file
1629                (default %default-opensmtpd-config-file)))
1630
1631 (define %default-opensmtpd-config-file
1632   (plain-file "smtpd.conf" "
1633 listen on lo
1634
1635 action inbound mbox
1636 match for local action inbound
1637
1638 action outbound relay
1639 match from local for any action outbound
1640 "))
1641
1642 (define opensmtpd-shepherd-service
1643   (match-lambda
1644     (($ <opensmtpd-configuration> package config-file)
1645      (list (shepherd-service
1646             (provision '(smtpd))
1647             (requirement '(loopback))
1648             (documentation "Run the OpenSMTPD daemon.")
1649             (start (let ((smtpd (file-append package "/sbin/smtpd")))
1650                      #~(make-forkexec-constructor
1651                         (list #$smtpd "-f" #$config-file)
1652                         #:pid-file "/var/run/smtpd.pid")))
1653             (stop #~(make-kill-destructor)))))))
1654
1655 (define %opensmtpd-accounts
1656   (list (user-group
1657          (name "smtpq")
1658          (system? #t))
1659         (user-account
1660          (name "smtpd")
1661          (group "nogroup")
1662          (system? #t)
1663          (comment "SMTP Daemon")
1664          (home-directory "/var/empty")
1665          (shell (file-append shadow "/sbin/nologin")))
1666         (user-account
1667          (name "smtpq")
1668          (group "smtpq")
1669          (system? #t)
1670          (comment "SMTPD Queue")
1671          (home-directory "/var/empty")
1672          (shell (file-append shadow "/sbin/nologin")))))
1673
1674 (define opensmtpd-activation
1675   (match-lambda
1676     (($ <opensmtpd-configuration> package config-file)
1677      (let ((smtpd (file-append package "/sbin/smtpd")))
1678        #~(begin
1679            (use-modules (guix build utils))
1680            ;; Create mbox and spool directories.
1681            (mkdir-p "/var/mail")
1682            (mkdir-p "/var/spool/smtpd")
1683            (chmod "/var/spool/smtpd" #o711)
1684            (mkdir-p "/var/spool/mail")
1685            (chmod "/var/spool/mail" #o711))))))
1686
1687 (define %opensmtpd-pam-services
1688   (list (unix-pam-service "smtpd")))
1689
1690 (define opensmtpd-service-type
1691   (service-type
1692    (name 'opensmtpd)
1693    (extensions
1694     (list (service-extension account-service-type
1695                              (const %opensmtpd-accounts))
1696           (service-extension activation-service-type
1697                              opensmtpd-activation)
1698           (service-extension pam-root-service-type
1699                              (const %opensmtpd-pam-services))
1700           (service-extension profile-service-type
1701                              (compose list opensmtpd-configuration-package))
1702           (service-extension shepherd-root-service-type
1703                              opensmtpd-shepherd-service)))))
1704
1705 \f
1706 ;;;
1707 ;;; mail aliases.
1708 ;;;
1709
1710 (define (mail-aliases-etc aliases)
1711   `(("aliases" ,(plain-file "aliases"
1712                             ;; Ideally we'd use a format string like
1713                             ;; "~:{~a: ~{~a~^,~}\n~}", but it gives a
1714                             ;; warning that I can't figure out how to fix,
1715                             ;; so we'll just use string-join below instead.
1716                             (format #f "~:{~a: ~a\n~}"
1717                                     (map (match-lambda
1718                                            ((alias addresses ...)
1719                                             (list alias (string-join addresses ","))))
1720                                          aliases))))))
1721
1722 (define mail-aliases-service-type
1723   (service-type
1724    (name 'mail-aliases)
1725    (extensions
1726     (list (service-extension etc-service-type mail-aliases-etc)))
1727    (compose concatenate)
1728    (extend append)))
1729
1730 \f
1731 ;;;
1732 ;;; Exim.
1733 ;;;
1734
1735 (define-record-type* <exim-configuration> exim-configuration
1736   make-exim-configuration
1737   exim-configuration?
1738   (package       exim-configuration-package ;<package>
1739                  (default exim))
1740   (config-file   exim-configuration-config-file ;file-like
1741                  (default #f)))
1742
1743 (define %exim-accounts
1744   (list (user-group
1745          (name "exim")
1746          (system? #t))
1747         (user-account
1748          (name "exim")
1749          (group "exim")
1750          (system? #t)
1751          (comment "Exim Daemon")
1752          (home-directory "/var/empty")
1753          (shell (file-append shadow "/sbin/nologin")))))
1754
1755 (define (exim-computed-config-file package config-file)
1756   (computed-file "exim.conf"
1757                  #~(call-with-output-file #$output
1758                      (lambda (port)
1759                        (format port "
1760 exim_user = exim
1761 exim_group = exim
1762 .include ~a"
1763                                #$(or config-file
1764                                      (file-append package "/etc/exim.conf")))))))
1765
1766 (define exim-shepherd-service
1767   (match-lambda
1768     (($ <exim-configuration> package config-file)
1769      (list (shepherd-service
1770             (provision '(exim mta))
1771             (documentation "Run the exim daemon.")
1772             (requirement '(networking))
1773             (start #~(make-forkexec-constructor
1774                       '(#$(file-append package "/bin/exim")
1775                         "-bd" "-v" "-C"
1776                         #$(exim-computed-config-file package config-file))))
1777             (stop #~(make-kill-destructor)))))))
1778
1779 (define exim-activation
1780   (match-lambda
1781     (($ <exim-configuration> package config-file)
1782      (with-imported-modules '((guix build utils))
1783        #~(begin
1784            (use-modules (guix build utils))
1785
1786            (let ((uid (passwd:uid (getpw "exim")))
1787                  (gid (group:gid (getgr "exim"))))
1788              (mkdir-p "/var/spool/exim")
1789              (chown "/var/spool/exim" uid gid))
1790
1791            (zero? (system* #$(file-append package "/bin/exim")
1792                            "-bV" "-C" #$(exim-computed-config-file package config-file))))))))
1793
1794 (define exim-profile
1795   (compose list exim-configuration-package))
1796
1797 (define exim-service-type
1798   (service-type
1799    (name 'exim)
1800    (extensions
1801     (list (service-extension shepherd-root-service-type exim-shepherd-service)
1802           (service-extension account-service-type (const %exim-accounts))
1803           (service-extension activation-service-type exim-activation)
1804           (service-extension profile-service-type exim-profile)
1805           (service-extension mail-aliases-service-type (const '()))))))
1806
1807 \f
1808 ;;;
1809 ;;; GNU Mailutils IMAP4 Daemon.
1810 ;;;
1811
1812 (define %default-imap4d-config-file
1813   (plain-file "imap4d.conf" "server localhost {};\n"))
1814
1815 (define-record-type* <imap4d-configuration>
1816   imap4d-configuration make-imap4d-configuration imap4d-configuration?
1817   (package     imap4d-configuration-package
1818                (default mailutils))
1819   (config-file imap4d-configuration-config-file
1820                (default %default-imap4d-config-file)))
1821
1822 (define imap4d-shepherd-service
1823   (match-lambda
1824     (($ <imap4d-configuration> package config-file)
1825      (list (shepherd-service
1826             (provision '(imap4d))
1827             (requirement '(networking syslogd))
1828             (documentation "Run the imap4d daemon.")
1829             (start (let ((imap4d (file-append package "/sbin/imap4d")))
1830                      #~(make-forkexec-constructor
1831                         (list #$imap4d "--daemon" "--foreground"
1832                               "--config-file" #$config-file))))
1833             (stop #~(make-kill-destructor)))))))
1834
1835 (define imap4d-service-type
1836   (service-type
1837    (name 'imap4d)
1838    (description
1839     "Run the GNU @command{imap4d} to serve e-mail messages through IMAP.")
1840    (extensions
1841     (list (service-extension
1842            shepherd-root-service-type imap4d-shepherd-service)))
1843    (default-value (imap4d-configuration))))
1844
1845 \f
1846 ;;;
1847 ;;; Radicale.
1848 ;;;
1849
1850 (define-record-type* <radicale-configuration>
1851   radicale-configuration make-radicale-configuration
1852   radicale-configuration?
1853   (package     radicale-configuration-package
1854                (default radicale))
1855   (config-file radicale-configuration-config-file
1856                (default %default-radicale-config-file)))
1857
1858 (define %default-radicale-config-file
1859   (plain-file "radicale.conf" "
1860 [auth]
1861 type = htpasswd
1862 htpasswd_filename = /var/lib/radicale/users
1863 htpasswd_encryption = plain
1864
1865 [server]
1866 hosts = localhost:5232"))
1867
1868 (define %radicale-accounts
1869   (list (user-group
1870          (name "radicale")
1871          (system? #t))
1872         (user-account
1873          (name "radicale")
1874          (group "radicale")
1875          (system? #t)
1876          (comment "Radicale Daemon")
1877          (home-directory "/var/empty")
1878          (shell (file-append shadow "/sbin/nologin")))))
1879
1880 (define radicale-shepherd-service
1881   (match-lambda
1882     (($ <radicale-configuration> package config-file)
1883      (list (shepherd-service
1884             (provision '(radicale))
1885             (documentation "Run the radicale daemon.")
1886             (requirement '(networking))
1887             (start #~(make-forkexec-constructor
1888                       (list #$(file-append package "/bin/radicale")
1889                         "-C" #$config-file)
1890                       #:user "radicale"
1891                       #:group "radicale"))
1892             (stop #~(make-kill-destructor)))))))
1893
1894 (define radicale-activation
1895   (match-lambda
1896     (($ <radicale-configuration> package config-file)
1897      (with-imported-modules '((guix build utils))
1898        #~(begin
1899            (use-modules (guix build utils))
1900            (let ((uid (passwd:uid (getpw "radicale")))
1901                  (gid (group:gid (getgr "radicale"))))
1902              (mkdir-p "/var/lib/radicale/collections")
1903              (chown "/var/lib/radicale" uid gid)
1904              (chown "/var/lib/radicale/collections" uid gid)
1905              (chmod "/var/lib/radicale" #o700)))))))
1906
1907 (define radicale-service-type
1908   (service-type
1909    (name 'radicale)
1910    (description "Run radicale, a small CalDAV and CardDAV server.")
1911    (extensions
1912     (list (service-extension shepherd-root-service-type radicale-shepherd-service)
1913           (service-extension account-service-type (const %radicale-accounts))
1914           (service-extension activation-service-type radicale-activation)))
1915    (default-value (radicale-configuration))))