1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2015 Andy Wingo <wingo@igalia.com>
4 ;;; This file is part of GNU Guix.
6 ;;; GNU Guix is free software; you can redistribute it and/or modify it
7 ;;; under the terms of the GNU General Public License as published by
8 ;;; the Free Software Foundation; either version 3 of the License, or (at
9 ;;; your option) any later version.
11 ;;; GNU Guix is distributed in the hope that it will be useful, but
12 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
13 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 ;;; GNU General Public License for more details.
16 ;;; You should have received a copy of the GNU General Public License
17 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
19 ;;; Some of the help text was taken from the default dovecot.conf files.
21 (define-module (gnu services mail)
22 #:use-module (gnu services)
23 #:use-module (gnu services base)
24 #:use-module (gnu services shepherd)
25 #:use-module (gnu system pam)
26 #:use-module (gnu system shadow)
27 #:use-module (gnu packages mail)
28 #:use-module (gnu packages admin)
29 #:use-module (gnu packages tls)
30 #:use-module (guix records)
31 #:use-module (guix packages)
32 #:use-module (guix gexp)
33 #:use-module (srfi srfi-34)
34 #:use-module (srfi srfi-35)
35 #:use-module (ice-9 match)
36 #:export (&dovecot-configuation-error
37 dovecot-configuration-error?
41 opaque-dovecot-configuration
46 unix-listener-configuration
47 fifo-listener-configuration
48 inet-listener-configuration
50 protocol-configuration
53 namespace-configuration))
57 ;;; This module provides service definitions for the Dovecot POP3 and IMAP
62 (define-condition-type &dovecot-configuration-error &error
63 dovecot-configuration-error?)
65 (define (dovecot-error message)
66 (raise (condition (&message (message message))
67 (&dovecot-configuration-error))))
68 (define (dovecot-configuration-field-error field val)
70 (format #f "Invalid value for field ~a: ~s" field val)))
71 (define (dovecot-configuration-missing-field kind field)
73 (format #f "~a configuration missing required field ~a" kind field)))
75 (define-record-type* <configuration-field>
76 configuration-field make-configuration-field configuration-field?
77 (name configuration-field-name)
78 (type configuration-field-type)
79 (getter configuration-field-getter)
80 (predicate configuration-field-predicate)
81 (serializer configuration-field-serializer)
82 (default-value-thunk configuration-field-default-value-thunk)
83 (documentation configuration-field-documentation))
85 (define-syntax define-configuration
87 (define (id ctx part . parts)
88 (let ((part (syntax->datum part)))
93 (parts (symbol-append part
94 (syntax->datum (apply id ctx parts))))))))
96 ((_ stem (field (field-type def) doc) ...)
97 (with-syntax (((field-getter ...)
99 (id #'stem #'stem #'- field))
101 ((field-predicate ...)
103 (id #'stem type #'?))
105 ((field-serializer ...)
107 (id #'stem #'serialize- type))
108 #'(field-type ...))))
110 (define-record-type* #,(id #'stem #'< #'stem #'>)
111 stem #,(id #'stem #'make- #'stem) #,(id #'stem #'stem #'?)
112 (field field-getter (default def))
114 (define #,(id #'stem #'stem #'-fields)
115 (list (configuration-field
118 (getter field-getter)
119 (predicate field-predicate)
120 (serializer field-serializer)
121 (default-value-thunk (lambda () def))
125 (define (serialize-configuration config fields)
126 (for-each (lambda (field)
127 ((configuration-field-serializer field)
128 (configuration-field-name field)
129 ((configuration-field-getter field) config)))
132 (define (validate-configuration config fields)
133 (for-each (lambda (field)
134 (let ((val ((configuration-field-getter field) config)))
135 (unless ((configuration-field-predicate field) val)
136 (dovecot-configuration-field-error
137 (configuration-field-name field) val))))
140 (define (validate-package field-name package)
141 (unless (package? package)
142 (dovecot-configuration-field-error field-name package)))
144 (define (uglify-field-name field-name)
145 (let ((str (symbol->string field-name)))
146 (string-join (string-split (if (string-suffix? "?" str)
147 (substring str 0 (1- (string-length str)))
152 (define (serialize-package field-name val)
155 (define (serialize-field field-name val)
156 (format #t "~a=~a\n" (uglify-field-name field-name) val))
158 (define (serialize-string field-name val)
159 (serialize-field field-name val))
161 (define (space-separated-string-list? val)
164 (and (string? x) (not (string-index x #\space))))
166 (define (serialize-space-separated-string-list field-name val)
167 (serialize-field field-name (string-join val " ")))
169 (define (comma-separated-string-list? val)
172 (and (string? x) (not (string-index x #\,))))
174 (define (serialize-comma-separated-string-list field-name val)
175 (serialize-field field-name (string-join val ",")))
177 (define (file-name? val)
179 (string-prefix? "/" val)))
180 (define (serialize-file-name field-name val)
181 (serialize-string field-name val))
183 (define (colon-separated-file-name-list? val)
185 ;; Trailing slashes not needed and not
186 (and-map file-name? val)))
187 (define (serialize-colon-separated-file-name-list field-name val)
188 (serialize-field field-name (string-join val ":")))
190 (define (serialize-boolean field-name val)
191 (serialize-string field-name (if val "yes" "no")))
193 (define (non-negative-integer? val)
194 (and (exact-integer? val) (not (negative? val))))
195 (define (serialize-non-negative-integer field-name val)
196 (serialize-field field-name val))
198 (define (hours? val) (non-negative-integer? val))
199 (define (serialize-hours field-name val)
200 (serialize-field field-name (format #f "~a hours" val)))
202 (define (free-form-fields? val)
205 ((((? symbol?) . (? string)) . val) (free-form-fields? val))
207 (define (serialize-free-form-fields field-name val)
208 (for-each (match-lambda ((k . v) (serialize-field k v))) val))
210 (define (free-form-args? val)
213 ((((? symbol?) . (? string)) . val) (free-form-args? val))
215 (define (serialize-free-form-args field-name val)
216 (serialize-field field-name
218 (map (match-lambda ((k . v) (format #t "~a=~a" k v))) val)
221 (define-configuration dict-configuration
223 (free-form-fields '())
224 "A list of key-value pairs that this dict should hold."))
226 (define (serialize-dict-configuration field-name val)
227 (format #t "dict {\n")
228 (serialize-configuration val dict-configuration-fields)
231 (define-configuration passdb-configuration
234 "The driver that the passdb should use. Valid values include
235 @samp{pam}, @samp{passwd}, @samp{shadow}, @samp{bsdauth}, and
239 "A list of key-value args to the passdb driver."))
241 (define (serialize-passdb-configuration field-name val)
242 (format #t "passdb {\n")
243 (serialize-configuration val passdb-configuration-fields)
245 (define (passdb-configuration-list? val)
246 (and (list? val) (and-map passdb-configuration? val)))
247 (define (serialize-passdb-configuration-list field-name val)
248 (for-each (lambda (val) (serialize-passdb-configuration field-name val)) val))
250 (define-configuration userdb-configuration
253 "The driver that the userdb should use. Valid values include
254 @samp{passwd} and @samp{static}.")
257 "A list of key-value args to the userdb driver.")
260 "Override fields from passwd."))
262 (define (serialize-userdb-configuration field-name val)
263 (format #t "userdb {\n")
264 (serialize-configuration val userdb-configuration-fields)
266 (define (userdb-configuration-list? val)
267 (and (list? val) (and-map userdb-configuration? val)))
268 (define (serialize-userdb-configuration-list field-name val)
269 (for-each (lambda (val) (serialize-userdb-configuration field-name val)) val))
271 (define-configuration unix-listener-configuration
273 (file-name (dovecot-configuration-missing-field 'unix-listener 'path))
274 "The file name on which to listen.")
277 "The access mode for the socket.")
280 "The user to own the the socket.")
283 "The group to own the socket."))
285 (define (serialize-unix-listener-configuration field-name val)
286 (format #t "unix_listener ~a {\n" (unix-listener-configuration-path val))
287 (serialize-configuration val (cdr unix-listener-configuration-fields))
290 (define-configuration fifo-listener-configuration
292 (file-name (dovecot-configuration-missing-field 'fifo-listener 'path))
293 "The file name on which to listen.")
296 "The access mode for the socket.")
299 "The user to own the the socket.")
302 "The group to own the socket."))
304 (define (serialize-fifo-listener-configuration field-name val)
305 (format #t "fifo_listener ~a {\n" (fifo-listener-configuration-path val))
306 (serialize-configuration val (cdr fifo-listener-configuration-fields))
309 (define-configuration inet-listener-configuration
311 (string (dovecot-configuration-missing-field 'inet-listener 'protocol))
312 "The protocol to listen for.")
315 "The address on which to listen, or empty for all addresses.")
317 (non-negative-integer
318 (dovecot-configuration-missing-field 'inet-listener 'port))
319 "The port on which to listen.")
322 "Whether to use SSL for this service; @samp{yes}, @samp{no}, or
325 (define (serialize-inet-listener-configuration field-name val)
326 (format #t "inet_listener ~a {\n" (inet-listener-configuration-protocol val))
327 (serialize-configuration val (cdr inet-listener-configuration-fields))
330 (define (listener-configuration? val)
331 (or (unix-listener-configuration? val)
332 (fifo-listener-configuration? val)
333 (inet-listener-configuration? val)))
334 (define (serialize-listener-configuration field-name val)
336 ((unix-listener-configuration? val)
337 (serialize-unix-listener-configuration field-name val))
338 ((fifo-listener-configuration? val)
339 (serialize-fifo-listener-configuration field-name val))
340 ((inet-listener-configuration? val)
341 (serialize-inet-listener-configuration field-name val))
342 (else (dovecot-configuration-field-error field-name val))))
343 (define (listener-configuration-list? val)
344 (and (list? val) (and-map listener-configuration? val)))
345 (define (serialize-listener-configuration-list field-name val)
346 (for-each (lambda (val)
347 (serialize-listener-configuration field-name val))
350 (define-configuration service-configuration
352 (string (dovecot-configuration-missing-field 'service 'kind))
353 "The service kind. Valid values include @code{director},
354 @code{imap-login}, @code{pop3-login}, @code{lmtp}, @code{imap},
355 @code{pop3}, @code{auth}, @code{auth-worker}, @code{dict},
356 @code{tcpwrap}, @code{quota-warning}, or anything else.")
358 (listener-configuration-list '())
359 "Listeners for the service. A listener is either an
360 @code{unix-listener-configuration}, a @code{fifo-listener-configuration}, or
361 an @code{inet-listener-configuration}.")
363 (non-negative-integer 1)
364 "Number of connections to handle before starting a new process.
365 Typically the only useful values are 0 (unlimited) or 1. 1 is more
366 secure, but 0 is faster. <doc/wiki/LoginProcess.txt>.")
368 (non-negative-integer 0)
369 "Number of processes to always keep waiting for more connections.")
370 ;; FIXME: Need to be able to take the default for this value from other
371 ;; parts of the config.
373 (non-negative-integer #e256e6)
374 "If you set @samp{service-count 0}, you probably need to grow
377 (define (serialize-service-configuration field-name val)
378 (format #t "service ~a {\n" (service-configuration-kind val))
379 (serialize-configuration val (cdr service-configuration-fields))
381 (define (service-configuration-list? val)
382 (and (list? val) (and-map service-configuration? val)))
383 (define (serialize-service-configuration-list field-name val)
384 (for-each (lambda (val)
385 (serialize-service-configuration field-name val))
388 (define-configuration protocol-configuration
390 (string (dovecot-configuration-missing-field 'protocol 'name))
391 "The name of the protocol.")
393 (string "/var/run/dovecot/auth-userdb")
394 "UNIX socket path to master authentication server to find users.
395 This is used by imap (for shared users) and lda.")
397 (space-separated-string-list '("$mail_plugins"))
398 "Space separated list of plugins to load.")
399 (mail-max-userip-connections
400 (non-negative-integer 10)
401 "Maximum number of IMAP connections allowed for a user from each IP
402 address. NOTE: The username is compared case-sensitively."))
404 (define (serialize-protocol-configuration field-name val)
405 (format #t "protocol ~a {\n" (protocol-configuration-name val))
406 (serialize-configuration val (cdr protocol-configuration-fields))
408 (define (protocol-configuration-list? val)
409 (and (list? val) (and-map protocol-configuration? val)))
410 (define (serialize-protocol-configuration-list field-name val)
411 (serialize-field 'protocols
412 (string-join (map protocol-configuration-name val) " "))
413 (for-each (lambda (val)
414 (serialize-protocol-configuration field-name val))
417 (define-configuration plugin-configuration
419 (free-form-fields '())
420 "A list of key-value pairs that this dict should hold."))
422 (define (serialize-plugin-configuration field-name val)
423 (format #t "plugin {\n")
424 (serialize-configuration val plugin-configuration-fields)
427 (define-configuration mailbox-configuration
429 (string (error "mailbox name is required"))
430 "Name for this mailbox.")
434 "@samp{create} will automatically create this mailbox.
435 @samp{subscribe} will both create and subscribe to the mailbox.")
438 (space-separated-string-list '())
439 "List of IMAP @code{SPECIAL-USE} attributes as specified by RFC 6154.
440 Valid values are @code{\\All}, @code{\\Archive}, @code{\\Drafts},
441 @code{\\Flagged}, @code{\\Junk}, @code{\\Sent}, and @code{\\Trash}."))
443 (define (serialize-mailbox-configuration field-name val)
444 (format #t "mailbox \"~a\" {\n" (mailbox-configuration-name val))
445 (serialize-configuration val (cdr mailbox-configuration-fields))
447 (define (mailbox-configuration-list? val)
448 (and (list? val) (and-map mailbox-configuration? val)))
449 (define (serialize-mailbox-configuration-list field-name val)
450 (for-each (lambda (val)
451 (serialize-mailbox-configuration field-name val))
454 (define-configuration namespace-configuration
456 (string (error "namespace name is required"))
457 "Name for this namespace.")
461 "Namespace type: @samp{private}, @samp{shared} or @samp{public}.")
465 "Hierarchy separator to use. You should use the same separator for
466 all namespaces or some clients get confused. @samp{/} is usually a good
467 one. The default however depends on the underlying mail storage
472 "Prefix required to access this namespace. This needs to be
473 different for all namespaces. For example @samp{Public/}.")
477 "Physical location of the mailbox. This is in same format as
478 mail_location, which is also the default for it.")
482 "There can be only one INBOX, and this setting defines which
487 "If namespace is hidden, it's not advertised to clients via NAMESPACE
488 extension. You'll most likely also want to set @samp{list? #f}. This is mostly
489 useful when converting from another server with different namespaces
490 which you want to deprecate but still keep working. For example you can
491 create hidden namespaces with prefixes @samp{~/mail/}, @samp{~%u/mail/}
496 "Show the mailboxes under this namespace with LIST command. This
497 makes the namespace visible for clients that don't support NAMESPACE
498 extension. The special @code{children} value lists child mailboxes, but
499 hides the namespace prefix.")
503 "Namespace handles its own subscriptions. If set to @code{#f}, the
504 parent namespace handles them. The empty prefix should always have this
508 (mailbox-configuration-list '())
509 "List of predefined mailboxes in this namespace."))
511 (define (serialize-namespace-configuration field-name val)
512 (format #t "namespace ~a {\n" (namespace-configuration-name val))
513 (serialize-configuration val (cdr namespace-configuration-fields))
515 (define (list-of-namespace-configuration? val)
516 (and (list? val) (and-map namespace-configuration? val)))
517 (define (serialize-list-of-namespace-configuration field-name val)
518 (for-each (lambda (val)
519 (serialize-namespace-configuration field-name val))
522 (define-configuration dovecot-configuration
525 "The dovecot package.")
528 (comma-separated-string-list '("*" "::"))
529 "A list of IPs or hosts where to listen in for connections. @samp{*}
530 listens in all IPv4 interfaces, @samp{::} listens in all IPv6
531 interfaces. If you want to specify non-default ports or anything more
532 complex, customize the address and port fields of the
533 @samp{inet-listener} of the specific services you are interested in.")
536 (protocol-configuration-list
537 (list (protocol-configuration
539 "List of protocols we want to serve. Available protocols include
540 @samp{imap}, @samp{pop3}, and @samp{lmtp}.")
543 (service-configuration-list
545 (service-configuration
549 (inet-listener-configuration (protocol "imap") (port 143) (ssl? #f))
550 (inet-listener-configuration (protocol "imaps") (port 993) (ssl? #t)))))
551 (service-configuration
555 (inet-listener-configuration (protocol "pop3") (port 110) (ssl? #f))
556 (inet-listener-configuration (protocol "pop3s") (port 995) (ssl? #t)))))
557 (service-configuration
560 (list (unix-listener-configuration (path "lmtp") (mode "0666")))))
561 (service-configuration (kind "imap"))
562 (service-configuration (kind "pop3"))
563 (service-configuration (kind "auth")
564 ;; In what could be taken to be a bug, the default value of 1 for
565 ;; service-count makes it so that a PAM auth worker can't fork off
566 ;; subprocesses for making blocking queries. The result is that nobody
567 ;; can log in -- very secure, but not very useful! If we simply omit
568 ;; the service-count, it will default to the value of
569 ;; auth-worker-max-count, which is 30, instead of defaulting to 1, which
570 ;; is the default for all other services. As a hack, bump this value to
574 (list (unix-listener-configuration (path "auth-userdb")))))
575 (service-configuration (kind "auth-worker"))
576 (service-configuration (kind "dict")
577 (listeners (list (unix-listener-configuration (path "dict")))))))
578 "List of services to enable. Available services include @samp{imap},
579 @samp{imap-login}, @samp{pop3}, @samp{pop3-login}, @samp{auth}, and
583 (dict-configuration (dict-configuration))
584 "Dict configuration, as created by the @code{dict-configuration}
588 (passdb-configuration-list (list (passdb-configuration (driver "pam"))))
589 "List of passdb configurations, each one created by the
590 @code{passdb-configuration} constructor.")
593 (userdb-configuration-list (list (userdb-configuration (driver "passwd"))))
594 "List of userdb configurations, each one created by the
595 @code{userdb-configuration} constructor.")
597 (plugin-configuration
598 (plugin-configuration (plugin-configuration))
599 "Plug-in configuration, created by the @code{plugin-configuration}
603 (list-of-namespace-configuration
605 (namespace-configuration
611 (mailbox-configuration (name "Drafts") (special-use '("\\Drafts")))
612 (mailbox-configuration (name "Junk") (special-use '("\\Junk")))
613 (mailbox-configuration (name "Trash") (special-use '("\\Trash")))
614 (mailbox-configuration (name "Sent") (special-use '("\\Sent")))
615 (mailbox-configuration (name "Sent Messages") (special-use '("\\Sent")))
616 (mailbox-configuration (name "Drafts") (special-use '("\\Drafts"))))))))
617 "List of namespaces. Each item in the list is created by the
618 @code{namespace-configuration} constructor.")
621 (file-name "/var/run/dovecot/")
622 "Base directory where to store runtime data.")
625 (string "Dovecot ready.")
626 "Greeting message for clients.")
628 (login-trusted-networks
629 (space-separated-string-list '())
630 "List of trusted network ranges. Connections from these IPs are
631 allowed to override their IP addresses and ports (for logging and for
632 authentication checks). @samp{disable-plaintext-auth} is also ignored
633 for these networks. Typically you'd specify your IMAP proxy servers
636 (login-access-sockets
637 (space-separated-string-list '())
638 "List of login access check sockets (e.g. tcpwrap).")
642 "Show more verbose process titles (in ps). Currently shows user name
643 and IP address. Useful for seeing who are actually using the IMAP
644 processes (e.g. shared mailboxes or if same uid is used for multiple
649 "Should all processes be killed when Dovecot master process shuts down.
650 Setting this to @code{#f} means that Dovecot can be upgraded without
651 forcing existing client connections to close (although that could also
652 be a problem if the upgrade is e.g. because of a security fix).")
654 (doveadm-worker-count
655 (non-negative-integer 0)
656 "If non-zero, run mail commands via this many connections to doveadm
657 server, instead of running them directly in the same process.")
660 (string "doveadm-server")
661 "UNIX socket or host:port used for connecting to doveadm server.")
664 (space-separated-string-list '("TZ"))
665 "List of environment variables that are preserved on Dovecot startup
666 and passed down to all of its child processes. You can also give
667 key=value pairs to always set specific settings.")
669 ;;; Authentication processes
671 (disable-plaintext-auth?
673 "Disable LOGIN command and all other plaintext authentications unless
674 SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
675 matches the local IP (i.e. you're connecting from the same computer),
676 the connection is considered secure and plaintext authentication is
677 allowed. See also ssl=required setting.")
680 (non-negative-integer 0)
681 "Authentication cache size (e.g. @samp{#e10e6}). 0 means it's disabled.
682 Note that bsdauth, PAM and vpopmail require @samp{cache-key} to be set
683 for caching to be used.")
687 "Time to live for cached data. After TTL expires the cached record
688 is no longer used, *except* if the main database lookup returns internal
689 failure. We also try to handle password changes automatically: If
690 user's previous authentication was successful, but this one wasn't, the
691 cache isn't used. For now this works only with plaintext
694 (auth-cache-negative-ttl
696 "TTL for negative hits (user not found, password mismatch).
697 0 disables caching them completely.")
700 (space-separated-string-list '())
701 "List of realms for SASL authentication mechanisms that need them.
702 You can leave it empty if you don't want to support multiple realms.
703 Many clients simply use the first one listed here, so keep the default
708 "Default realm/domain to use if none was specified. This is used for
709 both SASL realms and appending @@domain to username in plaintext
714 "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@")
715 "List of allowed characters in username. If the user-given username
716 contains a character not listed in here, the login automatically fails.
717 This is just an extra check to make sure user can't exploit any
718 potential quote escaping vulnerabilities with SQL/LDAP databases. If
719 you want to allow all characters, set this value to empty.")
721 (auth-username-translation
723 "Username character translations before it's looked up from
724 databases. The value contains series of from -> to characters. For
725 example @samp{#@@/@@} means that @samp{#} and @samp{/} characters are
726 translated to @samp{@@}.")
728 (auth-username-format
730 "Username formatting before it's looked up from databases. You can
731 use the standard variables here, e.g. %Lu would lowercase the username,
732 %n would drop away the domain if it was given, or @samp{%n-AT-%d} would
733 change the @samp{@@} into @samp{-AT-}. This translation is done after
734 @samp{auth-username-translation} changes.")
736 (auth-master-user-separator
738 "If you want to allow master users to log in by specifying the master
739 username within the normal username string (i.e. not using SASL
740 mechanism's support for it), you can specify the separator character
741 here. The format is then <username><separator><master username>.
742 UW-IMAP uses @samp{*} as the separator, so that could be a good
745 (auth-anonymous-username
747 "Username to use for users logging in with ANONYMOUS SASL
750 (auth-worker-max-count
751 (non-negative-integer 30)
752 "Maximum number of dovecot-auth worker processes. They're used to
753 execute blocking passdb and userdb queries (e.g. MySQL and PAM).
754 They're automatically created and destroyed as needed.")
756 (auth-gssapi-hostname
758 "Host name to use in GSSAPI principal names. The default is to use
759 the name returned by gethostname(). Use @samp{$ALL} (with quotes) to
760 allow all keytab entries.")
764 "Kerberos keytab to use for the GSSAPI mechanism. Will use the
765 system default (usually /etc/krb5.keytab) if not specified. You may
766 need to change the auth service to run as root to be able to read this
771 "Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon
772 and @samp{ntlm-auth} helper.
773 <doc/wiki/Authentication/Mechanisms/Winbind.txt>.")
775 (auth-winbind-helper-path
776 (file-name "/usr/bin/ntlm_auth")
777 "Path for Samba's @samp{ntlm-auth} helper binary.")
781 "Time to delay before replying to failed authentications.")
783 (auth-ssl-require-client-cert?
785 "Require a valid SSL client certificate or the authentication
788 (auth-ssl-username-from-cert?
790 "Take the username from client's SSL certificate, using
791 @code{X509_NAME_get_text_by_NID()} which returns the subject's DN's
795 (space-separated-string-list '("plain"))
796 "List of wanted authentication mechanisms. Supported mechanisms are:
797 @samp{plain}, @samp{login}, @samp{digest-md5}, @samp{cram-md5},
798 @samp{ntlm}, @samp{rpa}, @samp{apop}, @samp{anonymous}, @samp{gssapi},
799 @samp{otp}, @samp{skey}, and @samp{gss-spnego}. NOTE: See also
800 @samp{disable-plaintext-auth} setting.")
803 (space-separated-string-list '())
804 "List of IPs or hostnames to all director servers, including ourself.
805 Ports can be specified as ip:port. The default port is the same as what
806 director service's @samp{inet-listener} is using.")
808 (director-mail-servers
809 (space-separated-string-list '())
810 "List of IPs or hostnames to all backend mail servers. Ranges are
811 allowed too, like 10.0.0.10-10.0.0.30.")
813 (director-user-expire
815 "How long to redirect users to a specific server after it no longer
816 has any connections.")
818 (director-doveadm-port
819 (non-negative-integer 0)
820 "TCP/IP port that accepts doveadm connections (instead of director
821 connections) If you enable this, you'll also need to add
822 @samp{inet-listener} for the port.")
824 (director-username-hash
826 "How the username is translated before being hashed. Useful values
827 include %Ln if user can log in with or without @@domain, %Ld if mailboxes
828 are shared within domain.")
834 "Log file to use for error messages. @samp{syslog} logs to syslog,
835 @samp{/dev/stderr} logs to stderr.")
839 "Log file to use for informational messages. Defaults to
844 "Log file to use for debug messages. Defaults to
845 @samp{info-log-path}.")
849 "Syslog facility to use if you're logging to syslog. Usually if you
850 don't want to use @samp{mail}, you'll use local0..local7. Also other
851 standard facilities are supported.")
855 "Log unsuccessful authentication attempts and the reasons why they
858 (auth-verbose-passwords?
860 "In case of password mismatches, log the attempted password. Valid
861 values are no, plain and sha1. sha1 can be useful for detecting brute
862 force password attempts vs. user simply trying the same password over
863 and over again. You can also truncate the value to n chars by appending
864 \":n\" (e.g. sha1:6).")
868 "Even more verbose logging for debugging purposes. Shows for example
871 (auth-debug-passwords?
873 "In case of password mismatches, log the passwords and used scheme so
874 the problem can be debugged. Enabling this also enables
879 "Enable mail process debugging. This can help you figure out why
880 Dovecot isn't finding your mails.")
884 "Show protocol level SSL errors.")
887 (string "\"%b %d %H:%M:%S \"")
888 "Prefix for each line written to log file. % codes are in
889 strftime(3) format.")
891 (login-log-format-elements
892 (space-separated-string-list
893 '("user=<%u>" "method=%m" "rip=%r" "lip=%l" "mpid=%e" "%c"))
894 "List of elements we want to log. The elements which have a
895 non-empty variable value are joined together to form a comma-separated
900 "Login log format. %s contains @samp{login-log-format-elements}
901 string, %$ contains the data we want to log.")
904 (string "\"%s(%u): \"")
905 "Log prefix for mail processes. See doc/wiki/Variables.txt for list
906 of possible variables you can use.")
909 (string "msgid=%m: %$")
910 "Format to use for logging mail deliveries. You can use variables:
913 Delivery status message (e.g. @samp{saved to INBOX})
926 ;;; Mailbox locations and namespaces
930 "Location for users' mailboxes. The default is empty, which means
931 that Dovecot tries to find the mailboxes automatically. This won't work
932 if the user doesn't yet have any mail, so you should explicitly tell
933 Dovecot the full location.
935 If you're using mbox, giving a path to the INBOX
936 file (e.g. /var/mail/%u) isn't enough. You'll also need to tell Dovecot
937 where the other mailboxes are kept. This is called the \"root mail
938 directory\", and it must be the first path given in the
939 @samp{mail-location} setting.
941 There are a few special variables you can use, eg.:
947 user part in user@@domain, same as %u if there's no domain
949 domain part in user@@domain, empty if there's no domain
954 See doc/wiki/Variables.txt for full list. Some examples:
956 @item maildir:~/Maildir
957 @item mbox:~/mail:INBOX=/var/mail/%u
958 @item mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%
963 "System user and group used to access mails. If you use multiple,
964 userdb can override these by returning uid or gid fields. You can use
965 either numbers or names. <doc/wiki/UserIds.txt>.")
971 (mail-privileged-group
973 "Group to enable temporarily for privileged operations. Currently
974 this is used only with INBOX when either its initial creation or
975 dotlocking fails. Typically this is set to \"mail\" to give access to
980 "Grant access to these supplementary groups for mail processes.
981 Typically these are used to set up access to shared mailboxes. Note
982 that it may be dangerous to set these if users can create
983 symlinks (e.g. if \"mail\" group is set here, ln -s /var/mail ~/mail/var
984 could allow a user to delete others' mailboxes, or ln -s
985 /secret/shared/box ~/mail/mybox would allow reading it).")
987 (mail-full-filesystem-access?
989 "Allow full filesystem access to clients. There's no access checks
990 other than what the operating system does for the active UID/GID. It
991 works with both maildir and mboxes, allowing you to prefix mailboxes
992 names with e.g. /path/ or ~user/.")
998 "Don't use mmap() at all. This is required if you store indexes to
999 shared filesystems (NFS or clustered filesystem).")
1003 "Rely on @samp{O_EXCL} to work when creating dotlock files. NFS
1004 supports @samp{O_EXCL} since version 3, so this should be safe to use
1005 nowadays by default.")
1008 (string "optimized")
1009 "When to use fsync() or fdatasync() calls:
1012 Whenever necessary to avoid losing important data
1014 Useful with e.g. NFS when write()s are delayed
1016 Never use it (best performance, but crashes can lose data).
1021 "Mail storage exists in NFS. Set this to yes to make Dovecot flush
1022 NFS caches whenever needed. If you're using only a single mail server
1023 this isn't needed.")
1027 "Mail index files also exist in NFS. Setting this to yes requires
1028 @samp{mmap-disable? #t} and @samp{fsync-disable? #f}.")
1032 "Locking method for index files. Alternatives are fcntl, flock and
1033 dotlock. Dotlocking uses some tricks which may create more disk I/O
1034 than other locking methods. NFS users: flock doesn't work, remember to
1035 change @samp{mmap-disable}.")
1039 "Directory in which LDA/LMTP temporarily stores incoming mails >128
1043 (non-negative-integer 500)
1044 "Valid UID range for users. This is mostly to make sure that users can't
1045 log in as daemons or other system users. Note that denying root logins is
1046 hardcoded to dovecot binary and can't be done even if @samp{first-valid-uid}
1050 (non-negative-integer 0)
1054 (non-negative-integer 1)
1055 "Valid GID range for users. Users having non-valid GID as primary group ID
1056 aren't allowed to log in. If user belongs to supplementary groups with
1057 non-valid GIDs, those groups are not set.")
1060 (non-negative-integer 0)
1063 (mail-max-keyword-length
1064 (non-negative-integer 50)
1065 "Maximum allowed length for mail keyword name. It's only forced when
1066 trying to create new keywords.")
1069 (colon-separated-file-name-list '())
1070 "List of directories under which chrooting is allowed for mail
1071 processes (i.e. /var/mail will allow chrooting to /var/mail/foo/bar
1072 too). This setting doesn't affect @samp{login-chroot}
1073 @samp{mail-chroot} or auth chroot settings. If this setting is empty,
1074 \"/./\" in home dirs are ignored. WARNING: Never add directories here
1075 which local users can modify, that may lead to root exploit. Usually
1076 this should be done only if you don't allow shell access for users.
1077 <doc/wiki/Chrooting.txt>.")
1081 "Default chroot directory for mail processes. This can be overridden
1082 for specific users in user database by giving /./ in user's home
1083 directory (e.g. /home/./user chroots into /home). Note that usually
1084 there is no real need to do chrooting, Dovecot doesn't allow users to
1085 access files outside their mail directory anyway. If your home
1086 directories are prefixed with the chroot directory, append \"/.\" to
1087 @samp{mail-chroot}. <doc/wiki/Chrooting.txt>.")
1090 (file-name "/var/run/dovecot/auth-userdb")
1091 "UNIX socket path to master authentication server to find users.
1092 This is used by imap (for shared users) and lda.")
1095 (file-name "/usr/lib/dovecot")
1096 "Directory where to look up mail plugins.")
1099 (space-separated-string-list '())
1100 "List of plugins to load for all services. Plugins specific to IMAP,
1101 LDA, etc. are added to this list in their own .conf files.")
1104 (mail-cache-min-mail-count
1105 (non-negative-integer 0)
1106 "The minimum number of mails in a mailbox before updates are done to
1107 cache file. This allows optimizing Dovecot's behavior to do less disk
1108 writes at the cost of more disk reads.")
1110 (mailbox-idle-check-interval
1112 "When IDLE command is running, mailbox is checked once in a while to
1113 see if there are any new mails or other changes. This setting defines
1114 the minimum time to wait between those checks. Dovecot can also use
1115 dnotify, inotify and kqueue to find out immediately when changes
1120 "Save mails with CR+LF instead of plain LF. This makes sending those
1121 mails take less CPU, especially with sendfile() syscall with Linux and
1122 FreeBSD. But it also creates a bit more disk I/O which may just make it
1123 slower. Also note that if other software reads the mboxes/maildirs,
1124 they may handle the extra CRs wrong and cause problems.")
1128 "By default LIST command returns all entries in maildir beginning
1129 with a dot. Enabling this option makes Dovecot return only entries
1130 which are directories. This is done by stat()ing each entry, so it
1131 causes more disk I/O.
1132 (For systems setting struct @samp{dirent->d_type} this check is free
1133 and it's done always regardless of this setting).")
1135 (maildir-copy-with-hardlinks?
1137 "When copying a message, do it with hard links whenever possible.
1138 This makes the performance much better, and it's unlikely to have any
1141 (maildir-very-dirty-syncs?
1143 "Assume Dovecot is the only MUA accessing Maildir: Scan cur/
1144 directory only when its mtime changes unexpectedly or when we can't find
1145 the mail otherwise.")
1148 (space-separated-string-list '("fcntl"))
1149 "Which locking methods to use for locking mbox. There are four
1154 Create <mailbox>.lock file. This is the oldest and most NFS-safe
1155 solution. If you want to use /var/mail/ like directory, the users will
1156 need write access to that directory.
1158 Same as dotlock, but if it fails because of permissions or because there
1159 isn't enough disk space, just skip it.
1161 Use this if possible. Works with NFS too if lockd is used.
1163 May not exist in all systems. Doesn't work with NFS.
1165 May not exist in all systems. Doesn't work with NFS.
1168 You can use multiple locking methods; if you do the order they're declared
1169 in is important to avoid deadlocks if other MTAs/MUAs are using multiple
1170 locking methods as well. Some operating systems don't allow using some of
1171 them simultaneously.")
1174 (space-separated-string-list '("dotlock" "fcntl"))
1179 "Maximum time to wait for lock (all of them) before aborting.")
1181 (mbox-dotlock-change-timeout
1183 "If dotlock exists but the mailbox isn't modified in any way,
1184 override the lock file after this much time.")
1188 "When mbox changes unexpectedly we have to fully read it to find out
1189 what changed. If the mbox is large this can take a long time. Since
1190 the change is usually just a newly appended mail, it'd be faster to
1191 simply read the new mails. If this setting is enabled, Dovecot does
1192 this but still safely fallbacks to re-reading the whole mbox file
1193 whenever something in mbox isn't how it's expected to be. The only real
1194 downside to this setting is that if some other MUA changes message
1195 flags, Dovecot doesn't notice it immediately. Note that a full sync is
1196 done with SELECT, EXAMINE, EXPUNGE and CHECK commands.")
1198 (mbox-very-dirty-syncs?
1200 "Like @samp{mbox-dirty-syncs}, but don't do full syncs even with SELECT,
1201 EXAMINE, EXPUNGE or CHECK commands. If this is set,
1202 @samp{mbox-dirty-syncs} is ignored.")
1206 "Delay writing mbox headers until doing a full write sync (EXPUNGE
1207 and CHECK commands and when closing the mailbox). This is especially
1208 useful for POP3 where clients often delete all mails. The downside is
1209 that our changes aren't immediately visible to other MUAs.")
1211 (mbox-min-index-size
1212 (non-negative-integer 0)
1213 "If mbox size is smaller than this (e.g. 100k), don't write index
1214 files. If an index file already exists it's still read, just not
1218 (non-negative-integer #e2e6)
1219 "Maximum dbox file size until it's rotated.")
1221 (mdbox-rotate-interval
1223 "Maximum dbox file age until it's rotated. Typically in days. Day
1224 begins from midnight, so 1d = today, 2d = yesterday, etc. 0 = check
1227 (mdbox-preallocate-space?
1229 "When creating new mdbox files, immediately preallocate their size to
1230 @samp{mdbox-rotate-size}. This setting currently works only in Linux
1231 with some filesystems (ext4, xfs).")
1233 (mail-attachment-dir
1235 "sdbox and mdbox support saving mail attachments to external files,
1236 which also allows single instance storage for them. Other backends
1237 don't support this for now.
1239 WARNING: This feature hasn't been tested much yet. Use at your own risk.
1241 Directory root where to store mail attachments. Disabled, if empty.")
1243 (mail-attachment-min-size
1244 (non-negative-integer #e128e3)
1245 "Attachments smaller than this aren't saved externally. It's also
1246 possible to write a plugin to disable saving specific attachments
1250 (string "sis posix")
1251 "Filesystem backend to use for saving attachments:
1254 No SiS done by Dovecot (but this might help FS's own deduplication)
1256 SiS with immediate byte-by-byte comparison during saving
1257 @item sis-queue posix
1258 SiS with delayed comparison and deduplication.
1261 (mail-attachment-hash
1263 "Hash format to use in attachment filenames. You can add any text and
1264 variables: @code{%@{md4@}}, @code{%@{md5@}}, @code{%@{sha1@}},
1265 @code{%@{sha256@}}, @code{%@{sha512@}}, @code{%@{size@}}. Variables can be
1266 truncated, e.g. @code{%@{sha256:80@}} returns only first 80 bits.")
1268 (default-process-limit
1269 (non-negative-integer 100)
1272 (default-client-limit
1273 (non-negative-integer 1000)
1277 (non-negative-integer #e256e6)
1278 "Default VSZ (virtual memory size) limit for service processes.
1279 This is mainly intended to catch and kill processes that leak memory
1280 before they eat up everything.")
1284 "Login user is internally used by login processes. This is the most
1285 untrusted user in Dovecot system. It shouldn't have access to anything
1288 (default-internal-user
1290 "Internal user is used by unprivileged processes. It should be
1291 separate from login user, so that login processes can't disturb other
1296 "SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>.")
1299 (string "</etc/dovecot/default.pem")
1300 "PEM encoded X.509 SSL/TLS certificate (public key).")
1303 (string "</etc/dovecot/private/default.pem")
1304 "PEM encoded SSL/TLS private key. The key is opened before
1305 dropping root privileges, so keep the key file unreadable by anyone but
1310 "If key file is password protected, give the password here.
1311 Alternatively give it when starting dovecot with -p parameter. Since
1312 this file is often world-readable, you may want to place this setting
1313 instead to a different.")
1317 "PEM encoded trusted certificate authority. Set this only if you
1318 intend to use @samp{ssl-verify-client-cert? #t}. The file should
1319 contain the CA certificate(s) followed by the matching
1320 CRL(s). (e.g. @samp{ssl-ca </etc/ssl/certs/ca.pem}).")
1323 "Require that CRL check succeeds for client certificates.")
1324 (ssl-verify-client-cert?
1326 "Request client to send a certificate. If you also want to require
1327 it, set @samp{auth-ssl-require-client-cert? #t} in auth section.")
1329 (ssl-cert-username-field
1330 (string "commonName")
1331 "Which field from certificate to use for username. commonName and
1332 x500UniqueIdentifier are the usual choices. You'll also need to set
1333 @samp{auth-ssl-username-from-cert? #t}.")
1335 (ssl-parameters-regenerate
1337 "How often to regenerate the SSL parameters file. Generation is
1338 quite CPU intensive operation. The value is in hours, 0 disables
1339 regeneration entirely.")
1343 "SSL protocols to use.")
1346 (string "ALL:!LOW:!SSLv2:!EXP:!aNULL")
1347 "SSL ciphers to use.")
1351 "SSL crypto device to use, for valid values run \"openssl engine\".")
1355 "Address to use when sending rejection mails.
1356 Default is postmaster@@<your domain>. %d expands to recipient domain.")
1360 "Hostname to use in various parts of sent mails (e.g. in Message-Id)
1361 and in LMTP replies. Default is the system's real hostname@@domain.")
1363 (quota-full-tempfail?
1365 "If user is over quota, return with temporary failure instead of
1366 bouncing the mail.")
1369 (file-name "/usr/sbin/sendmail")
1370 "Binary to use for sending mails.")
1374 "If non-empty, send mails via this SMTP host[:port] instead of
1378 (string "Rejected: %s")
1379 "Subject: header to use for rejection mails. You can use the same
1380 variables as for @samp{rejection-reason} below.")
1383 (string "Your message to <%t> was automatically rejected:%n%r")
1384 "Human readable error message for rejection mails. You can use
1398 (recipient-delimiter
1400 "Delimiter character between local-part and detail in email
1403 (lda-original-recipient-header
1405 "Header where the original recipient address (SMTP's RCPT TO:
1406 address) is taken from if not available elsewhere. With dovecot-lda -a
1407 parameter overrides this. A commonly used header for this is
1410 (lda-mailbox-autocreate?
1412 "Should saving a mail to a nonexistent mailbox automatically create
1415 (lda-mailbox-autosubscribe?
1417 "Should automatically created mailboxes be also automatically
1421 (imap-max-line-length
1422 (non-negative-integer #e64e3)
1423 "Maximum IMAP command line length. Some clients generate very long
1424 command lines with huge mailboxes, so you may need to raise this if you
1425 get \"Too long argument\" or \"IMAP command line too large\" errors
1429 (string "in=%i out=%o")
1430 "IMAP logout format string:
1433 total number of bytes read from client
1435 total number of bytes sent to client.
1440 "Override the IMAP CAPABILITY response. If the value begins with '+',
1441 add the given capabilities on top of the defaults (e.g. +XFOO XBAR).")
1443 (imap-idle-notify-interval
1445 "How long to wait between \"OK Still here\" notifications when client
1450 "ID field names and values to send to clients. Using * as the value
1451 makes Dovecot use the default value. The following fields have default
1452 values currently: name, version, os, os-version, support-url,
1457 "ID fields sent by client to log. * means everything.")
1459 (imap-client-workarounds
1460 (space-separated-string-list '())
1461 "Workarounds for various client bugs:
1465 Send EXISTS/RECENT new mail notifications only when replying to NOOP and
1466 CHECK commands. Some clients ignore them otherwise, for example OSX
1467 Mail (<v2.1). Outlook Express breaks more badly though, without this it
1468 may show user \"Message no longer in server\" errors. Note that OE6
1469 still breaks even with this workaround if synchronization is set to
1472 @item tb-extra-mailbox-sep
1473 Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
1474 adds extra @samp{/} suffixes to mailbox names. This option causes Dovecot to
1475 ignore the extra @samp{/} instead of treating it as invalid mailbox name.
1478 Show \\Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
1479 This makes Thunderbird realize they aren't selectable and show them
1480 greyed out, instead of only later giving \"not selectable\" popup error.
1486 "Host allowed in URLAUTH URLs sent by client. \"*\" allows all.") )
1488 (define-configuration opaque-dovecot-configuration
1491 "The dovecot package.")
1494 (string (dovecot-configuration-missing-field 'opaque-dovecot-configuration
1496 "The contents of the @code{dovecot.conf} to use."))
1498 (define %dovecot-accounts
1499 ;; Account and group for the Dovecot daemon.
1500 (list (user-group (name "dovecot") (system? #t))
1505 (comment "Dovecot daemon user")
1506 (home-directory "/var/empty")
1507 (shell #~(string-append #$shadow "/sbin/nologin")))
1509 (user-group (name "dovenull") (system? #t))
1514 (comment "Dovecot daemon login user")
1515 (home-directory "/var/empty")
1516 (shell #~(string-append #$shadow "/sbin/nologin")))))
1518 (define %dovecot-activation
1521 (use-modules (guix build utils))
1522 (define (mkdir-p/perms directory owner perms)
1524 (chown "/var/run/dovecot" (passwd:uid owner) (passwd:gid owner))
1525 (chmod directory perms))
1526 (define (build-subject parameters)
1529 (let ((k (car pair)) (v (cdr pair)))
1530 (define (escape-char str chr)
1531 (string-join (string-split str chr) (string #\\ chr)))
1532 (string-append "/" k "="
1533 (escape-char (escape-char v #\=) #\/))))
1534 (filter (lambda (pair) (cdr pair)) parameters))))
1535 (define* (create-self-signed-certificate-if-absent
1536 #:key private-key public-key (owner (getpwnam "root"))
1537 (common-name (gethostname))
1538 (organization-name "GuixSD")
1539 (organization-unit-name "Default Self-Signed Certificate")
1540 (subject-parameters `(("CN" . ,common-name)
1541 ("O" . ,organization-name)
1542 ("OU" . ,organization-unit-name)))
1543 (subject (build-subject subject-parameters)))
1544 ;; Note that by default, OpenSSL outputs keys in PEM format. This
1546 (unless (file-exists? private-key)
1548 ((zero? (system* (string-append #$openssl "/bin/openssl")
1549 "genrsa" "-out" private-key "2048"))
1550 (chown private-key (passwd:uid owner) (passwd:gid owner))
1551 (chmod private-key #o400))
1553 (format (current-error-port)
1554 "Failed to create private key at ~a.\n" private-key))))
1555 (unless (file-exists? public-key)
1557 ((zero? (system* (string-append #$openssl "/bin/openssl")
1558 "req" "-new" "-x509" "-key" private-key
1559 "-out" public-key "-days" "3650"
1560 "-batch" "-subj" subject))
1561 (chown public-key (passwd:uid owner) (passwd:gid owner))
1562 (chmod public-key #o444))
1564 (format (current-error-port)
1565 "Failed to create public key at ~a.\n" public-key)))))
1566 (let ((user (getpwnam "dovecot")))
1567 (mkdir-p/perms "/var/run/dovecot" user #o755)
1568 (mkdir-p/perms "/var/lib/dovecot" user #o755)
1569 (mkdir-p/perms "/etc/dovecot" user #o755)
1570 (mkdir-p/perms "/etc/dovecot/private" user #o700)
1571 (create-self-signed-certificate-if-absent
1572 #:private-key "/etc/dovecot/private/default.pem"
1573 #:public-key "/etc/dovecot/default.pem"
1574 #:owner (getpwnam "root")
1575 #:common-name (format #f "Dovecot service on ~a" (gethostname))))))
1577 (define (dovecot-shepherd-service config)
1578 "Return a list of <shepherd-service> for CONFIG."
1581 ((opaque-dovecot-configuration? config)
1582 (opaque-dovecot-configuration-string config))
1584 (with-output-to-string
1586 (serialize-configuration config
1587 dovecot-configuration-fields))))))
1588 (config-file (plain-file "dovecot.conf" config-str))
1589 (dovecot (if (opaque-dovecot-configuration? config)
1590 (opaque-dovecot-configuration-dovecot config)
1591 (dovecot-configuration-dovecot config))))
1592 (list (shepherd-service
1593 (documentation "Run the Dovecot POP3/IMAP mail server.")
1594 (provision '(dovecot))
1595 (requirement '(networking))
1596 (start #~(make-forkexec-constructor
1597 (list (string-append #$dovecot "/sbin/dovecot")
1598 "-F" "-c" #$config-file)))
1599 (stop #~(make-forkexec-constructor
1600 (list (string-append #$dovecot "/sbin/dovecot")
1601 "-c" #$config-file "stop")))))))
1603 (define %dovecot-pam-services
1604 (list (unix-pam-service "dovecot")))
1606 (define dovecot-service-type
1607 (service-type (name 'dovecot)
1609 (list (service-extension shepherd-root-service-type
1610 dovecot-shepherd-service)
1611 (service-extension account-service-type
1612 (const %dovecot-accounts))
1613 (service-extension pam-root-service-type
1614 (const %dovecot-pam-services))
1615 (service-extension activation-service-type
1616 (const %dovecot-activation))))))
1618 (define* (dovecot-service #:key (config (dovecot-configuration)))
1619 "Return a service that runs @command{dovecot}, a mail server that can run
1620 POP3, IMAP, and LMTP. @var{config} should be a configuration object created
1621 by @code{dovecot-configuration}. @var{config} may also be created by
1622 @code{opaque-dovecot-configuration}, which allows specification of the
1623 @code{dovecot.conf} as a string."
1624 (validate-configuration config
1625 (if (opaque-dovecot-configuration? config)
1626 opaque-dovecot-configuration-fields
1627 dovecot-configuration-fields))
1628 (service dovecot-service-type config))
1630 ;; A little helper to make it easier to document all those fields.
1631 (define (generate-documentation)
1632 (define documentation
1633 `((dovecot-configuration
1634 ,dovecot-configuration-fields
1635 (dict dict-configuration)
1636 (namespaces namespace-configuration)
1637 (plugin plugin-configuration)
1638 (passdbs passdb-configuration)
1639 (userdbs userdb-configuration)
1640 (services service-configuration)
1641 (protocols protocol-configuration))
1642 (dict-configuration ,dict-configuration-fields)
1643 (plugin-configuration ,plugin-configuration-fields)
1644 (passdb-configuration ,passdb-configuration-fields)
1645 (userdb-configuration ,userdb-configuration-fields)
1646 (unix-listener-configuration ,unix-listener-configuration-fields)
1647 (fifo-listener-configuration ,fifo-listener-configuration-fields)
1648 (inet-listener-configuration ,inet-listener-configuration-fields)
1649 (namespace-configuration
1650 ,namespace-configuration-fields
1651 (mailboxes mailbox-configuration))
1652 (mailbox-configuration ,mailbox-configuration-fields)
1653 (service-configuration
1654 ,service-configuration-fields
1655 (listeners unix-listener-configuration fifo-listener-configuration
1656 inet-listener-configuration))
1657 (protocol-configuration ,protocol-configuration-fields)))
1658 (define (generate configuration-name)
1659 (match (assq-ref documentation configuration-name)
1660 ((fields . sub-documentation)
1661 (format #t "\nAvailable @code{~a} fields are:\n\n" configuration-name)
1664 (let ((field-name (configuration-field-name f))
1665 (field-type (configuration-field-type f))
1666 (field-docs (string-trim-both
1667 (configuration-field-documentation f)))
1669 (configuration-field-default-value-thunk f)
1671 (define (escape-chars str chars escape)
1672 (with-output-to-string
1674 (string-for-each (lambda (c)
1675 (when (char-set-contains? chars c)
1679 (define (show-default? val)
1680 (or (string? default) (number? default) (boolean? default)
1681 (and (list? val) (and-map show-default? val))))
1682 (format #t "@deftypevr {@code{~a} parameter} ~a ~a\n~a\n"
1683 configuration-name field-type field-name field-docs)
1684 (when (show-default? default)
1685 (format #t "Defaults to @samp{~a}.\n"
1686 (escape-chars (format #f "~s" default)
1687 (char-set #\@ #\{ #\})
1689 (for-each generate (or (assq-ref sub-documentation field-name) '()))
1690 (format #t "@end deftypevr\n\n")))
1692 (generate 'dovecot-configuration))