Update to trixie

LICENSE.txt

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019 ibu radempa
+Copyright (c) 2026 ibu radempa
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

journal-postfix.yml

@@ -27,7 +27,7 @@
 # on the destination hosts and run systemctl start journal-postfix
 # manually.
 
-- name: install journal-postfix
+- name: Install journal-postfix
   user: root
   hosts: mail
   roles:

journal-postfix/files/srv/settings.py

@@ -9,6 +9,7 @@ import datetime
 from typing import Union, Optional
 from systemd import journal
 from yaml import load
+from yaml import CLoader as Loader
 
 
 main_config_file: str = '/etc/journal-postfix/main.yml'
@@ -85,7 +86,7 @@ def get_config() -> Optional[dict]:
         journal.send(msg, PRIORITY=journal.LOG_CRIT)
         return None
     try:
-        config = load(config_raw)
+        config = load(config_raw, Loader=Loader)
     except Exception as err:
         msg = f'ERROR: invalid yaml syntax in {filename}: {err}'
         journal.send(msg, PRIORITY=journal.LOG_CRIT)

journal-postfix/tasks/main.yml

@@ -1,42 +1,42 @@
-- name: user journal-postfix
+- name: User journal-postfix
-  user:
+  ansible.builtin.user:
     name: journal-postfix
     group: systemd-journal
     state: present
-    system: yes
+    system: true
     uid: 420
-    create_home: no
+    create_home: false
     home: /srv/journal-postfix
     password: '!'
-    password_lock: yes
+    password_lock: true
     comment: created by ansible role journal-postfix
 
-- name: directories /srv/journal-postfix, /etc/journal-postfix
+- name: Directories /srv/journal-postfix, /etc/journal-postfix
-  file:
+  ansible.builtin.file:
     path: "{{ item }}"
     state: directory
     owner: journal-postfix
     group: systemd-journal
-    mode: 0755
+    mode: "0755"
   loop:
     - /srv/journal-postfix
     - /etc/journal-postfix
 
-- name: install dependencies
+- name: Install dependencies
-  apt:
+  ansible.builtin.apt:
     name: python3-psycopg2,python3-systemd,python3-yaml
     state: present
-    update_cache: yes
+    update_cache: true
-    install_recommends: no
+    install_recommends: false
 
-- name: files in /srv/journal-postfix
+- name: Files in /srv/journal-postfix
-  copy:
+  ansible.builtin.copy:
     src: "srv/{{ item }}"
     dest: "/srv/journal-postfix/{{ item }}"
     owner: journal-postfix
     group: systemd-journal
-    mode: 0644
+    mode: "0644"
-    force: yes
+    force: true
   loop:
     - run.py
     - settings.py
@@ -47,44 +47,49 @@
     - README.md
     - setup.cfg
 
-- name: make some files executable
+- name: Make some files executable
-  file:
+  ansible.builtin.file:
     path: "{{ item }}"
-    mode: 0755
+    mode: "0755"
   loop:
     - /srv/journal-postfix/run.py
     - /srv/journal-postfix/settings.py
 
-- name: determine whether to startup
+- name: Determine whether to startup
-  set_fact:
+  ansible.builtin.set_fact:
-    startup: "{{ mailserver.postgresql.host is defined and mailserver.postgresql.port is defined and mailserver.postgresql.dbname is defined and mailserver.postgresql.username is defined and mailserver.postgresql.password is defined }}"
+    startup: >-
+      {{ (mailserver.postgresql.host is defined
+      and mailserver.postgresql.port is defined
+      and mailserver.postgresql.dbname is defined
+      and mailserver.postgresql.username is defined
+      and mailserver.postgresql.password is defined) | bool }}
 
-- name: file /etc/journal-postfix/main.yml
+- name: File /etc/journal-postfix/main.yml
-  template:
+  ansible.builtin.template:
     src: main.yml
     dest: /etc/journal-postfix/main.yml
     owner: journal-postfix
     group: systemd-journal
-    mode: 0600
+    mode: "0600"
-    force: no
+    force: false
 
-- name: file journal-postfix.service
+- name: File journal-postfix.service
-  copy:
+  ansible.builtin.copy:
     src: journal-postfix.service
     dest: /etc/systemd/system/journal-postfix.service
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
-    force: yes
+    force: true
 
-- name: enable systemd unit journal-postfix.service
+- name: Enable systemd unit journal-postfix.service
-  systemd:
+  ansible.builtin.systemd:
-    enabled: yes
+    enabled: true
-    daemon_reload: yes
+    daemon_reload: true
     name: journal-postfix.service
 
-- name: restart systemd unit journal-postfix.service
+- name: Restart systemd unit journal-postfix.service
-  systemd:
+  ansible.builtin.systemd:
     state: restarted
     name: journal-postfix.service
   when: startup

journal-postfix/templates/main.yml

@@ -1,7 +1,7 @@
 # Configuration for journal-postfix, see /srv/journal-postfix
 
-# To enable startup of systemd unit journal-postfix set this to yes:
+# startup of systemd unit journal-postfix
-startup: {{ 'yes' if startup else 'no' }}
+startup: true if startup else false
 
 # PostgreSQL database connection parameters
 postgresql:

mail_system.yml

@@ -32,39 +32,91 @@
 #     verp_marker: rstxyz
 #   dovecot:
 #     auth_default_realm: mymaindomain.org
+#     postmaster_email: root@mymaindomain.org
 #
-# Take care thate the verp_marker only contains [a-z0-9]+ (NO UPPER CASE LETTERS!).
+# Setup a Postgresql database (named as in dbname, owned by username, reachable on
+# host and port) with something like that:
 #
-# (Use ansible-vault encrypt_string to encrypt the password.)
+#   createuser -P mailserver
+#   createdb -E utf8 -O mailserver -T template1 mailserver
+#
+# Use `ansible-vault encrypt_string` to obtain the encrypted password.
+#
+# Take care that the verp_marker only contains [a-z0-9]+ (NO UPPER CASE LETTERS!).
 #
 # TODOs after running this playbook:
 #
-# Open the firewall:
+# Configure mail DNS:
-#
-#     - open or DNAT the TCP ports 25, 143, 587, 4190 to the host (incoming)
-#     - allow outgoing traffic
-#
-# Configure mail DNS for your host:
 #
 #     - MX
 #     - PTR (IPv4 and IPv6)
 #
-# Add SPF, DMARC and DKIM DNS records whenever you add a mail domain:
+# SPF, DMARC and DKIM DNS records should be created when adding a domain:
 #
-#     - SPF ('IN TXT "v=spf1 mx"' or more)
+#     - SPF (`IN TXT "v=spf1 mx" or more`)
-#     - DMARC ('_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:admin@mymaindomain.org; adkim=s; aspf=s;"')
+#     - DMARC (`_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:admin@mymaindomain.org; adkim=s; aspf=s;"`)
 #     - DKIM (rspamadm dkim_keygen -d mymaindomain.org -s 20190911 -b 4096;
-#             get the DNS entry and also save the private key)
+#             put the DNS entry in your zone file and save the private key
+#             into /var/lib/rspamd/dkim/mymaindomain.org.20190911.key
+#             and
+#                 chown _rspamd /var/lib/rspamd/dkim/*
+#                 chmod 400 /var/lib/rspamd/dkim/*
+#             and enable it by putting a line
+#                 mymaindomain.org 20190911
+#             into /etc/rspamd/dkim_selectors.map
+#             followed by systemctl reload rspamd)
 #
-# Replace the ssl certificates with signed ones.
+# Please open the firewall: open or DNAT tcp ports 25, 143, 587, 4190 to the host (incoming)
+#
+# Replace the dovecot and postfix ssl certificates in /etc/dovecot/private with signed ones.
 #
 # Users and domains can be added to the PostgreSQL tables;
 # code for that is not part of this playbook.
+#
+#     - put the domain name in table domains
+#     - create a user in table users using `doveadm pw -s PBKDF2`
+#     - create aliases
+#
+#
 # Mind that if you create a catchall alias, you must also
 # add an alias for each account to the aliases, or you can
 # prepend the following to the SELECT in /etc/postfix/aliases.cf
 #     SELECT u.username || '@' || d.name FROM users u JOIN domains d ON u.domain_id=d.id WHERE d.relay_transport is null AND u.username || '@' || d.name = '%s'
 #     UNION
+#
+# Users should use the following parameters for IMAP and mail submission.
+# Note you will need to use the server_name for which you have installed the ssl certificates.
+# Or you will have to configure dovecot to use multiple certs:
+# https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/#with-client-tls-sni-server-name-indication-support
+#
+# IMAP:
+#
+#     - server_name: mail.mydomain.org
+#     - port: 143
+#     - connection_security: starttls
+#     - auth_method: normal password
+#     - username: {user}@{configured_domain}
+#
+# Mail submission:
+#
+#     - server_name: mail.mydomain.org
+#     - port: 587
+#     - connection_security: starttls
+#     - auth_method: normal password
+#     - username: {user}@{configured_domain}
+#
+# UPGRADING to the trixie version:
+#
+# Note that the database schema has slightly changed.
+#
+# When installing on a new host, transfer this data:
+# * postgres db `mailserver` (data only, not schema)
+# * contents of /var/lib/rspamd/dkim/
+# * /etc/rspamd/dkim_selectors.map
+# * /srv/mailstore (keep uid:gid 5000:5000)
+# * tls key(s) and certificate(s) for postgres and dovecot
+#
+# And open the firewall. If the external IPs have changed, also update DNS entries.
 
 - name: install mail_system
   user: root

mail_system/README.md

@@ -0,0 +1,28 @@
+# Ansible role: mailserver
+
+Installs a mailsystem on debian trixie.
+
+## Requirements
+
+TODO
+
+## Role variables
+
+TODO
+
+## Dependencies
+
+  - community.general
+  - community.postgresql
+
+## Example playbook
+
+See `../mail_system.yml`.
+
+## License
+
+MIT
+
+## Author Information
+
+@ibu:matrix.multiname.org

mail_system/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+mailserver_version: 0.3.0

mail_system/files/dovecot/sieve/pipes/learn-ham.sieve

@@ -0,0 +1,8 @@
+# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
+
+
+require ["vnd.dovecot.pipe", "copy", "imapsieve", "variables"];
+if string "${mailbox}" "Trash" {
+  stop;
+}
+pipe :copy "rspamd-learn-ham.sh";

mail_system/files/dovecot/sieve/pipes/learn-spam.sieve

@@ -0,0 +1,5 @@
+# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
+
+
+require ["vnd.dovecot.pipe", "copy", "imapsieve"];
+pipe :copy "rspamd-learn-spam.sh";

mail_system/files/dovecot/sieve/pipes/rspamd-learn-ham.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+/usr/bin/rspamc learn_ham
+exit 0

mail_system/files/dovecot/sieve/pipes/rspamd-learn-spam.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+/usr/bin/rspamc learn_spam
+exit 0

mail_system/meta/main.yml

@@ -0,0 +1,16 @@
+---
+galaxy_info:
+  role_name: mail_system
+  namespace: TODO
+  author: ibu radempa
+  description: Install a mail system with postfix, dovecot, rspamd.
+  issue_tracker_url: TODO
+  license: MIT
+  min_ansible_version: 2.19
+dependencies:
+#  - community.general
+#  - community.postgresql
+
+argument_specs:
+  main:
+    TODO

mail_system/tasks/clamav.yml

@@ -2,49 +2,50 @@
 # we run freshclam (with daemons stopped) and then starting the daemons should work
 # (avoiding 'clamav-daemon not started: "ConditionPathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc} was not met"')
 
-- name: install clamav
+- name: Install clamav
-  apt:
+  ansible.builtin.apt:
     name: "{{ packages }}"
   vars:
     packages:
-    - clamav
+      - clamav
-    - clamav-daemon
+      - clamav-daemon
-    - clamav-freshclam
+      - clamav-freshclam
 
-- name: stop clamav daemons
+- name: Stop clamav daemons
-  systemd:
+  ansible.builtin.systemd:
     name: "{{ item }}"
     state: stopped
   loop:
     - clamav-freshclam
     - clamav-daemon
 
-- name: run freshclam
+- name: Run freshclam
-  shell: freshclam
+  ansible.builtin.command: freshclam
+  register: out
+  changed_when: out.rc != 0
 
-- name: start clamav daemons
+- name: Start clamav daemons
-  systemd:
+  ansible.builtin.systemd:
     name: "{{ item }}"
     state: started
   loop:
     - clamav-daemon
     - clamav-freshclam
 
-- name: install clamav-unofficial-sigs, clamdscan
+- name: Install clamdscan
-  apt:
+  ansible.builtin.apt:
     name: "{{ packages }}"
   vars:
     packages:
-    - clamav-unofficial-sigs
+      - clamdscan
-    - clamdscan
 
-- name: set clamav BytecodeSecurity to Paranoid
+- name: Set clamav BytecodeSecurity to Paranoid
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/clamav/clamd.conf
     regexp: '^BytecodeSecurity'
     line: 'BytecodeSecurity Paranoid'
 
-- name: restart clamav-daemon
+- name: Restart clamav-daemon
-  systemd:
+  ansible.builtin.systemd:
     name: clamav-daemon
     state: restarted

mail_system/tasks/database.yml

@@ -1,173 +1,175 @@
-- name: apt install python3-psycopg2
+- name: Install package python3-psycopg2
-  apt:
+  ansible.builtin.apt:
     name: python3-psycopg2
     state: present
 
-- name: database table domains
+- name: Database table domains
-  postgresql_table:
+  community.postgresql.postgresql_table:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     name: domains
     columns:
-    - id bigserial primary key
+      - id BIGSERIAL PRIMARY KEY
-    - name varchar(128) not null unique
+      - name VARCHAR(128) NOT NULL UNIQUE
-    - relay_transport text null
+      - relay_transport TEXT NULL
 
-- name: database table users
+- name: Database table users
-  postgresql_table:
+  community.postgresql.postgresql_table:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     name: users
     columns:
-    - id BIGSERIAL PRIMARY KEY
+      - id BIGSERIAL PRIMARY KEY
-    - domain_id BIGINT references domains(id) on delete cascade
+      - domain_id BIGINT references domains(id) on delete cascade
-    - username VARCHAR(128) NOT NULL
+      - username VARCHAR(128) NOT NULL
-    - realname VARCHAR(250) NOT NULL
+      - realname VARCHAR(250) NOT NULL
-    - password VARCHAR(128) NOT NULL
+      - password VARCHAR(128) NOT NULL
-    - suspend_submission BOOL NOT NULL DEFAULT false
+      - suspend_submission BOOL NOT NULL DEFAULT false
-    - suspend_imap_reason TEXT NULL
+      - suspend_imap_reason TEXT NULL
-    - quota_storage_bytes BIGINT NOT NULL DEFAULT {{ mailserver.dovecot.mailbox_max_bytes | default(100000000000) }}
+      - quota_storage_bytes BIGINT NOT NULL DEFAULT {{ mailserver.dovecot.mailbox_max_bytes | default(100000000000) }}
-    - quota_inbox_messages INT NOT NULL DEFAULT {{ mailserver.dovecot.mailbox_max_messages | default(500000) }}
+      - quota_inbox_messages INT NOT NULL DEFAULT {{ mailserver.dovecot.mailbox_max_messages | default(500000) }}
-    - unique(domain_id, username)
+      - unique(domain_id, username)
 
-- name: database index users__domain_username
+- name: Database index users__domain_username
-  postgresql_idx:
+  community.postgresql.postgresql_idx:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     table: users
     columns: domain_id, username
     idxname: users__domain_username
 
-- name: database table aliases
+- name: Database table aliases
-  postgresql_table:
+  community.postgresql.postgresql_table:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     name: aliases
     columns:
-    - id bigserial primary key
+      - id bigserial primary key
-    - alias_domain_id bigint references domains(id) on delete cascade
+      - alias_domain_id bigint references domains(id) on delete cascade
-    - alias varchar(250) not null
+      - alias varchar(250) not null
-    - forwardings varchar(250)[] not null
+      - forwardings varchar(250)[] not null
-    - t timestamp without time zone not null default now()
+      - t timestamp without time zone not null default now()
-    - comment text null
+      - comment text null
-    - unique(alias_domain_id, alias)
+      - unique(alias_domain_id, alias)
 
-- name: database index aliases__alias
+- name: Database index aliases__alias
-  postgresql_idx:
+  community.postgresql.postgresql_idx:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     table: aliases
     columns: alias
     idxname: aliases__alias
 
-- name: database table shared_folders
+- name: Database table shared_folders
-  postgresql_table:
+  community.postgresql.postgresql_table:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     name: shared_folders
     columns:
-    - id bigserial primary key
+      - id bigserial primary key
-    - from_user varchar(128) not null
+      - from_user varchar(128) not null
-    - to_user varchar(128) not null
+      - to_user varchar(128) not null
-    - dummy char(1) DEFAULT '1'
+      - dummy char(1) DEFAULT '1'
 
-- name: database index shared_folders__from_to
+- name: Database index shared_folders__from_to
-  postgresql_idx:
+  community.postgresql.postgresql_idx:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     table: shared_folders
     columns: from_user, to_user
     idxname: shared_folders__from_to
+    unique: true
 
-- name: database table shared_folders_anyone
+- name: Database table shared_folders_anyone
-  postgresql_table:
+  community.postgresql.postgresql_table:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     name: shared_folders_anyone
     columns:
-    - id bigserial primary key
+      - id bigserial primary key
-    - from_user varchar(128) not null
+      - from_user varchar(128) not null
-    - dummy char(1) DEFAULT '1'
+      - dummy char(1) DEFAULT '1'
 
-- name: database index shared_folders_anyone__from
+- name: Database index shared_folders_anyone__from
-  postgresql_idx:
+  community.postgresql.postgresql_idx:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     table: shared_folders_anyone
     columns: from_user
     idxname: shared_folders__from
+    unique: true
 
-- name: database table mail_from
+- name: Database table mail_from
-  postgresql_table:
+  community.postgresql.postgresql_table:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     name: mail_from
     columns:
-    - id bigserial primary key
+      - id bigserial primary key
-    - t timestamp default now()
+      - t timestamp default now()
-    - original varchar(250) not null
+      - original varchar(250) not null
-    - rewritten varchar(250) not null
+      - rewritten varchar(250) not null
-    - srs_id bigint
+      - srs_id bigint
 
-- name: database index mail_from__rewritten
+- name: Database index mail_from__rewritten
-  postgresql_idx:
+  community.postgresql.postgresql_idx:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     table: mail_from
     columns: rewritten
     idxname: mail_from__rewritten
 
-- name: database index mail_from__srs_id
+- name: Database index mail_from__srs_id
-  postgresql_idx:
+  community.postgresql.postgresql_idx:
     login_host: "{{ mailserver.postgresql.host }}"
-    port: "{{ mailserver.postgresql.port }}"
+    login_port: "{{ mailserver.postgresql.port }}"
     login_user: "{{ mailserver.postgresql.username }}"
     login_password: "{{ mailserver.postgresql.password }}"
-    db: "{{ mailserver.postgresql.dbname }}"
+    login_db: "{{ mailserver.postgresql.dbname }}"
     ssl_mode: disable
     table: mail_from
     columns: srs_id

mail_system/tasks/dovecot.yml

@@ -1,126 +1,87 @@
 # here we assume that postfix.yml has run such that user 'mailstore' exists
 
-- name: install dovecot packages
+
-  apt:
+# sieve scripts
-    name: dovecot-imapd,dovecot-lmtpd,dovecot-pgsql,dovecot-managesieved,dovecot-lucene
+
+
+- name: Install dovecot packages
+  ansible.builtin.apt:
+    name: dovecot-core,dovecot-flatcurve,dovecot-imapd,dovecot-lmtpd,dovecot-managesieved,dovecot-pgsql,dovecot-sieve
     state: present
 
-- name: install dovecot config files
+- name: Remove inclusion of conf.d/*.conf from dovecot.conf
-  template:
+  ansible.builtin.lineinfile:
-    src: "dovecot/{{ item }}"
+    path: /etc/dovecot/dovecot.conf
-    dest: "/etc/dovecot/conf.d/{{ item }}"
+    regexp: '^!include conf\.d/\*\.conf'
-    owner: root
+    line: '#!include conf.d/*.conf'
-    group: root
-    mode: 0644
-    force: yes
-  loop:
-    - 10-auth.conf
-    - auth-sql.conf.ext
-    - 10-mail.conf
-    - 10-master.conf
-    - 10-ssl.conf
-    - 15-mailboxes.conf
-    - 20-lmtp.conf
-    - 20-imap.conf
-    - 90-sieve.conf
-    - 90-sieve-extprograms.conf
-    - 90-plugin.conf
-    - 90-acl.conf
-    - 90-quota.conf
 
-- name: install more dovecot config files
+- name: Set dovecot_config_version to 2.4.1
-  template:
+  ansible.builtin.lineinfile:
+    path: /etc/dovecot/dovecot.conf
+    regexp: '^dovecot_config_version = .*'
+    line: 'dovecot_config_version = 2.4.1'
+
+- name: Set dovecot_storage_version to 2.4.1
+  ansible.builtin.lineinfile:
+    path: /etc/dovecot/dovecot.conf
+    regexp: '^dovecot_storage_version = .*'
+    line: 'dovecot_storage_version = 2.4.1'
+
+- name: Install /etc/dovecot/local.conf
+  ansible.builtin.template:
     src: "dovecot/{{ item }}"
     dest: "/etc/dovecot/{{ item }}"
     owner: root
-    group: dovecot
+    group: root
-    mode: 0640
+    mode: "0600"
-    force: yes
+    force: true
   loop:
-    - dovecot.conf
+    - local.conf
-    - dovecot-sql.conf.ext
-    - dovecot-dict-sql.conf.ext
 
-- name: directories /etc/dovecot/sieve_before /etc/dovecot/sieve_after
+- name: File quota-warning.sh
-  file:
+  ansible.builtin.template:
-    path: "/etc/dovecot/{{ item }}"
+    src: dovecot/quota-warning.sh
+    dest: /usr/local/bin/quota-warning.sh
+    owner: root
+    group: root
+    mode: "0755"
+    force: true
+
+- name: Directory /var/lib/dovecot/sieve
+  ansible.builtin.file:
+    path: "/var/lib/dovecot/sieve"
     state: directory
-    owner: root
-    group: root
-    mode: 0755
-  loop:
-    - sieve_pipes
-    - sieve_filters
-    - sieve_execute
-    - sieve_before
-    - sieve_after
-
-- name: file /etc/dovecot/sieve_after/spam-to-folder.sieve
-  template:
-    src: dovecot/spam-to-folder.sieve
-    dest: /etc/dovecot/sieve_after/spam-to-folder.sieve
-    owner: root
-    group: root
-    mode: 0644
-    force: yes
-
-- name: files /etc/dovecot/sieve_pipes/*.sieve
-  template:
-    src: "dovecot/{{ item }}"
-    dest: "/etc/dovecot/sieve_pipes/{{ item }}"
     owner: mailstore
     group: mailstore
-    mode: 0600
+    mode: "0755"
-    force: yes
-  loop:
-    - learn-spam.sieve
-    - learn-ham.sieve
 
-- name: files /etc/dovecot/sieve_pipes/*.sh
+- name: Copy sieve files
-  template:
+  ansible.builtin.copy:
-    src: "dovecot/{{ item }}"
+    src: dovecot/sieve
-    dest: "/etc/dovecot/sieve_pipes/{{ item }}"
+    dest: /var/lib/dovecot/
     owner: mailstore
     group: mailstore
-    mode: 0700
+    mode: "0600"
-    force: yes
+    directory_mode: "0755"
+
+- name: Directory permissions sieve pipes
+  ansible.builtin.file:
+    path: "/var/lib/dovecot/sieve/pipes"
+    owner: mailstore
+    group: mailstore
+    mode: "0777"
+
+- name: Execution flag for spam training scripts
+  ansible.builtin.file:
+    path: "/var/lib/dovecot/sieve/pipes/{{ item }}"
+    owner: mailstore
+    group: mailstore
+    mode: "0700"
   loop:
     - rspamd-learn-spam.sh
     - rspamd-learn-ham.sh
 
-- name: README files
+- name: Restart dovecot
-  template:
+  ansible.builtin.systemd:
-    src: "dovecot/README_{{ item }}"
-    dest: "/etc/dovecot/sieve_{{ item }}/README"
-    owner: mailstore
-    group: mailstore
-    mode: 0600
-    force: yes
-  loop:
-    - filters
-    - execute
-    - before
-    - after
-
-- name: restart dovecot
-  systemd:
     name: dovecot
     state: restarted
-
-- name: compile sieve files
-  shell: "/usr/bin/sievec /etc/dovecot/{{ item }}"
-  loop:
-    - "sieve_after/spam-to-folder.sieve"
-    - "sieve_pipes/learn-spam.sieve"
-    - "sieve_pipes/learn-ham.sieve"
-
-- name: permissions of .svbin
-  file:
-    path: "/etc/dovecot/{{ item }}"
-    owner: mailstore
-    group: mailstore
-    mode: 0600
-  loop:
-    - "sieve_after/spam-to-folder.sieve"
-    - "sieve_pipes/learn-spam.svbin"
-    - "sieve_pipes/learn-ham.svbin"

mail_system/tasks/main.yml

@@ -1,6 +1,12 @@
-- include: remove_other_mtas.yml
+- name: Remove other MTAs
-- include: database.yml
+  ansible.builtin.include_tasks: remove_other_mtas.yml
-- include: postfix.yml
+- name: Setup database tables and indexes
-- include: dovecot.yml
+  ansible.builtin.include_tasks: database.yml
-- include: clamav.yml
+- name: Setup postfix
-- include: rspamd.yml
+  ansible.builtin.include_tasks: postfix.yml
+- name: Setup dovecot
+  ansible.builtin.include_tasks: dovecot.yml
+- name: Setup clamav
+  ansible.builtin.include_tasks: clamav.yml
+- name: Setup rspamd
+  ansible.builtin.include_tasks: rspamd.yml

mail_system/tasks/postfix.yml

@@ -1,70 +1,76 @@
-- name: install postfix packages
+- name: Install postfix packages
-  apt:
+  ansible.builtin.apt:
     name: postfix,postfix-pgsql,postfix-doc
     state: present
-    update_cache: yes
+    update_cache: true
-    install_recommends: no
+    install_recommends: false
 
-- name: divert /etc/postfix/main.cf
+- name: Divert /etc/postfix/main.cf
-  shell: dpkg-divert --add --rename --divert /etc/postfix/main.cf.orig /etc/postfix/main.cf
+  community.general.dpkg_divert:
+    path: /etc/postfix/main.cf
+    divert: /etc/postfix/main.cf.orig
+    rename: true
 
-- name: divert /etc/postfix/master.cf
+- name: Divert /etc/postfix/master.cf
-  shell: dpkg-divert --add --rename --divert /etc/postfix/master.cf.orig /etc/postfix/master.cf
+  community.general.dpkg_divert:
+    path: /etc/postfix/master.cf
+    divert: /etc/postfix/master.cf.orig
+    rename: true
 
-- name: group 'mailstore'
+- name: Group 'mailstore'
-  group:
+  ansible.builtin.group:
     name: mailstore
     state: present
-    system: yes
+    system: true
     gid: 5000
 
-- name: user 'mailstore'
+- name: User 'mailstore'
-  user:
+  ansible.builtin.user:
     name: mailstore
     group: mailstore
     state: present
     shell: /usr/sbin/nologin
-    system: yes
+    system: true
     uid: 5000
-    create_home: no
+    create_home: false
     home: /srv/mailstore
     password: '!'
-    password_lock: yes
+    password_lock: true
     comment: created by ansible
 
-- name: directories /srv/mailstore /srv/mailstore/role_specific
+- name: Directories /srv/mailstore /srv/mailstore/role_specific
-  file:
+  ansible.builtin.file:
     path: "{{ item }}"
     state: directory
     owner: mailstore
     group: mailstore
-    mode: 0755
+    mode: "0755"
   loop:
     - /srv/mailstore
     - /srv/mailstore/role_specific
     - /srv/mailstore/role_specific/roles
 
-- name: postfix configuration files
+- name: Postfix configuration files
-  template:
+  ansible.builtin.template:
     src: "postfix/{{ item }}"
     dest: "/etc/postfix/{{ item }}"
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
     force: "{{ mailserver.postfix.overwrite_config }}"
   loop:
     - main.cf
     - master.cf
     - header_checks
 
-- name: postfix database queries
+- name: Postfix database queries
-  template:
+  ansible.builtin.template:
     src: "postfix/{{ item }}"
     dest: "/etc/postfix/{{ item }}"
     owner: root
     group: root
-    mode: 0600
+    mode: "0600"
-    force: yes
+    force: true
   loop:
     - domains.cf
     - mailboxes.cf
@@ -76,7 +82,7 @@
     - sender_canonical_maps.cf
     - recipient_canonical_maps.cf
 
-- name: restart postfix
+- name: Restart postfix
-  systemd:
+  ansible.builtin.systemd:
     name: postfix
     state: restarted

mail_system/tasks/remove_other_mtas.yml

@@ -1,10 +1,13 @@
-- name: find all installed versions of mail-transport-agent except postfix
+- name: Find all installed versions of mail-transport-agent except postfix
-  shell: aptitude search '~i~Pmail-transport-agent' | sed -e 's/^...\(.*\)/\1/' | awk '{ print $1 }' | grep -v postfix || /bin/true
+  ansible.builtin.shell:
+    cmd: set -o pipefail && aptitude search '~i~Pmail-transport-agent' | sed -e 's/^...\(.*\)/\1/' | awk '{ print $1 }' | grep -v postfix || /bin/true
+    executable: /bin/bash
   register: mtas
+  changed_when: false
 
-- name: purge MTAs other than postfix
+- name: Purge MTAs other than postfix
-  apt:
+  ansible.builtin.apt:
     name: "{{ item }}"
     state: absent
-    purge: yes
+    purge: true
-  loop: "{{ mtas.stdout_lines|list }}"
+  loop: "{{ mtas.stdout_lines | list }}"

mail_system/tasks/rspamd.yml

@@ -1,52 +1,52 @@
-- name: apt install rspamd
+- name: Install package rspamd
-  apt:
+  ansible.builtin.apt:
     name: rspamd
     state: present
 
 # postfix integration
 
-- name: postfix setting milter_mail_macros
+- name: Postfix setting milter_mail_macros
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/postfix/main.cf
     regexp: '^milter_mail_macros='
     line: 'milter_mail_macros=i {mail_addr} {client_addr} {client_name} {auth_authen}'
     insertafter: '^# rspamd'
 
-- name: postfix setting milter_protocol
+- name: Postfix setting milter_protocol
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/postfix/main.cf
     regexp: '^milter_protocol='
     line: 'milter_protocol=6'
     insertafter: '^# rspamd'
 
-- name: postfix setting non_smtpd_milters
+- name: Postfix setting non_smtpd_milters
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/postfix/main.cf
     regexp: '^non_smtpd_milters='
     line: 'non_smtpd_milters=inet:127.0.0.1:11332'
     insertafter: '^# rspamd'
 
-- name: postfix setting smtpd_milters
+- name: Postfix setting smtpd_milters
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/postfix/main.cf
     regexp: '^smtpd_milters='
     line: 'smtpd_milters=inet:127.0.0.1:11332'
     insertafter: '^# rspamd'
 
-- name: restart postfix
+- name: Restart postfix
-  systemd:
+  ansible.builtin.systemd:
     name: postfix
     state: restarted
 
 # rspamd configuration
 
-- name: rspamd configure extended_spam_headers true
+- name: Rspamd configure extended_spam_headers true
-  template:
+  ansible.builtin.template:
     src: "rspamd/{{ item }}"
     dest: "/etc/rspamd/override.d/{{ item }}"
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   loop:
     - milter_headers.conf
     - classifier-bayes.conf
@@ -54,28 +54,28 @@
 
 # install dkim
 
-- name: mkdir /var/lib/rspamd/dkim
+- name: Mkdir /var/lib/rspamd/dkim
-  file:
+  ansible.builtin.file:
     path: /var/lib/rspamd/dkim
     state: directory
     owner: _rspamd
     group: _rspamd
-    mode: '0755'
+    mode: "0755"
 
-- name: rspamd config dkim_signing.conf and arc.conf
+- name: Rspamd config dkim_signing.conf and arc.conf
-  template:
+  ansible.builtin.template:
     src: "rspamd/{{ item }}"
     dest: "/etc/rspamd/local.d/{{ item }}"
     owner: root
     group: root
-    mode: 0644
+    mode: "0644"
   loop:
     - dkim_signing.conf
     - arc.conf
 
 # restart rspamd
 
-- name: restart rspamd
+- name: Restart rspamd
-  systemd:
+  ansible.builtin.systemd:
     name: rspamd
     state: restarted

mail_system/templates/dovecot/10-auth.conf

@@ -1,131 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## Authentication processes
-##
-
-# Disable LOGIN command and all other plaintext authentications unless
-# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
-# matches the local IP (ie. you're connecting from the same computer), the
-# connection is considered secure and plaintext authentication is allowed.
-# See also ssl=required setting.
-#disable_plaintext_auth = yes
-
-# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
-# bsdauth and PAM require cache_key to be set for caching to be used.
-#auth_cache_size = 0
-# Time to live for cached data. After TTL expires the cached record is no
-# longer used, *except* if the main database lookup returns internal failure.
-# We also try to handle password changes automatically: If user's previous
-# authentication was successful, but this one wasn't, the cache isn't used.
-# For now this works only with plaintext authentication.
-#auth_cache_ttl = 1 hour
-# TTL for negative hits (user not found, password mismatch).
-# 0 disables caching them completely.
-#auth_cache_negative_ttl = 1 hour
-
-# Space separated list of realms for SASL authentication mechanisms that need
-# them. You can leave it empty if you don't want to support multiple realms.
-# Many clients simply use the first one listed here, so keep the default realm
-# first.
-#auth_realms =
-
-# Default realm/domain to use if none was specified. This is used for both
-# SASL realms and appending @domain to username in plaintext logins.
-#auth_default_realm = 
-auth_default_realm = {{ mailserver.dovecot.auth_default_realm }}
-
-# List of allowed characters in username. If the user-given username contains
-# a character not listed in here, the login automatically fails. This is just
-# an extra check to make sure user can't exploit any potential quote escaping
-# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
-# set this value to empty.
-#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
-
-# Username character translations before it's looked up from databases. The
-# value contains series of from -> to characters. For example "#@/@" means
-# that '#' and '/' characters are translated to '@'.
-#auth_username_translation =
-
-# Username formatting before it's looked up from databases. You can use
-# the standard variables here, eg. %Lu would lowercase the username, %n would
-# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
-# "-AT-". This translation is done after auth_username_translation changes.
-#auth_username_format = %Lu
-
-# If you want to allow master users to log in by specifying the master
-# username within the normal username string (ie. not using SASL mechanism's
-# support for it), you can specify the separator character here. The format
-# is then <username><separator><master username>. UW-IMAP uses "*" as the
-# separator, so that could be a good choice.
-#auth_master_user_separator =
-
-# Username to use for users logging in with ANONYMOUS SASL mechanism
-#auth_anonymous_username = anonymous
-
-# Maximum number of dovecot-auth worker processes. They're used to execute
-# blocking passdb and userdb queries (eg. MySQL and PAM). They're
-# automatically created and destroyed as needed.
-#auth_worker_max_count = 30
-
-# Host name to use in GSSAPI principal names. The default is to use the
-# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab
-# entries.
-#auth_gssapi_hostname =
-
-# Kerberos keytab to use for the GSSAPI mechanism. Will use the system
-# default (usually /etc/krb5.keytab) if not specified. You may need to change
-# the auth service to run as root to be able to read this file.
-#auth_krb5_keytab = 
-
-# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
-# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>
-#auth_use_winbind = no
-
-# Path for Samba's ntlm_auth helper binary.
-#auth_winbind_helper_path = /usr/bin/ntlm_auth
-
-# Time to delay before replying to failed authentications.
-#auth_failure_delay = 2 secs
-
-# Require a valid SSL client certificate or the authentication fails.
-#auth_ssl_require_client_cert = no
-
-# Take the username from client's SSL certificate, using 
-# X509_NAME_get_text_by_NID() which returns the subject's DN's
-# CommonName. 
-#auth_ssl_username_from_cert = no
-
-# Space separated list of wanted authentication mechanisms:
-#   plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp
-#   gss-spnego
-# NOTE: See also disable_plaintext_auth setting.
-auth_mechanisms = plain login
-
-##
-## Password and user databases
-##
-
-#
-# Password database is used to verify user's password (and nothing more).
-# You can have multiple passdbs and userdbs. This is useful if you want to
-# allow both system users (/etc/passwd) and virtual users to login without
-# duplicating the system users into virtual database.
-#
-# <doc/wiki/PasswordDatabase.txt>
-#
-# User database specifies where mails are located and what user/group IDs
-# own them. For single-UID configuration use "static" userdb.
-#
-# <doc/wiki/UserDatabase.txt>
-
-#!include auth-deny.conf.ext
-#!include auth-master.conf.ext
-
-#!include auth-system.conf.ext
-!include auth-sql.conf.ext
-#!include auth-ldap.conf.ext
-#!include auth-passwdfile.conf.ext
-#!include auth-checkpassword.conf.ext
-#!include auth-static.conf.ext

mail_system/templates/dovecot/10-mail.conf

@@ -1,461 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## Mailbox locations and namespaces
-##
-
-# Location for users' mailboxes. The default is empty, which means that Dovecot
-# tries to find the mailboxes automatically. This won't work if the user
-# doesn't yet have any mail, so you should explicitly tell Dovecot the full
-# location.
-#
-# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u)
-# isn't enough. You'll also need to tell Dovecot where the other mailboxes are
-# kept. This is called the "root mail directory", and it must be the first
-# path given in the mail_location setting.
-#
-# There are a few special variables you can use, eg.:
-#
-#   %u - username
-#   %n - user part in user@domain, same as %u if there's no domain
-#   %d - domain part in user@domain, empty if there's no domain
-#   %h - home directory
-#
-# See doc/wiki/Variables.txt for full list. Some examples:
-#
-#   mail_location = maildir:~/Maildir
-#   mail_location = mbox:~/mail:INBOX=/var/mail/%u
-#   mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n
-#
-# <doc/wiki/MailLocation.txt>
-#
-#mail_location = mbox:~/mail:INBOX=/var/mail/%u
-mail_location = maildir:/srv/mailstore/%d/%n/Maildir:LAYOUT=fs
-
-# If you need to set multiple mailbox locations or want to change default
-# namespace settings, you can do it by defining namespace sections.
-#
-# You can have private, shared and public namespaces. Private namespaces
-# are for user's personal mails. Shared namespaces are for accessing other
-# users' mailboxes that have been shared. Public namespaces are for shared
-# mailboxes that are managed by sysadmin. If you create any shared or public
-# namespaces you'll typically want to enable ACL plugin also, otherwise all
-# users can access all the shared mailboxes, assuming they have permissions
-# on filesystem level to do so.
-namespace inbox {
-  # Namespace type: private, shared or public
-  #type = private
-
-  # Hierarchy separator to use. You should use the same separator for all
-  # namespaces or some clients get confused. '/' is usually a good one.
-  # The default however depends on the underlying mail storage format.
-  #separator = 
-  separator = /
-
-  # Prefix required to access this namespace. This needs to be different for
-  # all namespaces. For example "Public/".
-  #prefix = 
-
-  # Physical location of the mailbox. This is in same format as
-  # mail_location, which is also the default for it.
-  #location =
-
-  # There can be only one INBOX, and this setting defines which namespace
-  # has it.
-  inbox = yes
-
-  # If namespace is hidden, it's not advertised to clients via NAMESPACE
-  # extension. You'll most likely also want to set list=no. This is mostly
-  # useful when converting from another server with different namespaces which
-  # you want to deprecate but still keep working. For example you can create
-  # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/".
-  #hidden = no
-
-  # Show the mailboxes under this namespace with LIST command. This makes the
-  # namespace visible for clients that don't support NAMESPACE extension.
-  # "children" value lists child mailboxes, but hides the namespace prefix.
-  #list = yes
-
-  # Namespace handles its own subscriptions. If set to "no", the parent
-  # namespace handles them (empty prefix should always have this as "yes")
-  #subscriptions = yes
-
-  # See 15-mailboxes.conf for definitions of special mailboxes.
-}
-
-# Example shared namespace configuration
-#namespace {
-  #type = shared
-  #separator = /
-
-  # Mailboxes are visible under "shared/user@domain/"
-  # %%n, %%d and %%u are expanded to the destination user.
-  #prefix = shared/%%u/
-
-  # Mail location for other users' mailboxes. Note that %variables and ~/
-  # expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the
-  # destination user's data.
-  #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u
-
-  # Use the default namespace for saving subscriptions.
-  #subscriptions = no
-
-  # List the shared/ namespace only if there are visible shared mailboxes.
-  #list = children
-#}
-namespace shared {
-  type = shared
-  separator = /
-  prefix = shared/%%d/%%n/
-  # a) Per-user seen flags. Maildir indexes are shared. (INDEXPVT requires v2.2+)
-  #location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/shared/%%d/%%n/
-  location = maildir:/srv/mailstore/%%d/%%n/Maildir:LAYOUT=fs:INDEXPVT=~/shared/%%d/%%n/
-  # b) Per-user seen flags. Maildir indexes are not shared. If users have direct filesystem level access to their mails, this is a safer option:
-  #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u
-  subscriptions = no
-  list = yes
-  inbox = no
-}
-namespace roles {
-  type = shared
-  separator = /
-  prefix = roles/
-  # a) Per-user seen flags. Maildir indexes are shared. (INDEXPVT requires v2.2+)
-  #location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/shared/%%d/%%n/
-  location = maildir:/srv/mailstore/role_specific/roles/Maildir:LAYOUT=fs:INDEXPVT=~/role_specific/roles/
-  # b) Per-user seen flags. Maildir indexes are not shared. If users have direct filesystem level access to their$
-  #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u
-  subscriptions = no
-  list = yes
-  inbox = no
-}
-namespace virtual {
-  separator = /
-  prefix = virtual/
-  location = virtual:/srv/mailstore/%d/%n/Maildir_virtual
-}
-# Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"?
-#mail_shared_explicit_inbox = no
-
-# System user and group used to access mails. If you use multiple, userdb
-# can override these by returning uid or gid fields. You can use either numbers
-# or names. <doc/wiki/UserIds.txt>
-#mail_uid =
-#mail_gid =
-mail_uid = mailstore
-mail_gid = mailstore
-
-# Group to enable temporarily for privileged operations. Currently this is
-# used only with INBOX when either its initial creation or dotlocking fails.
-# Typically this is set to "mail" to give access to /var/mail.
-mail_privileged_group = mail
-
-# Grant access to these supplementary groups for mail processes. Typically
-# these are used to set up access to shared mailboxes. Note that it may be
-# dangerous to set these if users can create symlinks (e.g. if "mail" group is
-# set here, ln -s /var/mail ~/mail/var could allow a user to delete others'
-# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it).
-#mail_access_groups =
-
-# Allow full filesystem access to clients. There's no access checks other than
-# what the operating system does for the active UID/GID. It works with both
-# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/
-# or ~user/.
-#mail_full_filesystem_access = no
-
-# Dictionary for key=value mailbox attributes. This is used for example by
-# URLAUTH and METADATA extensions.
-#mail_attribute_dict =
-
-# A comment or note that is associated with the server. This value is
-# accessible for authenticated users through the IMAP METADATA server
-# entry "/shared/comment". 
-#mail_server_comment = ""
-
-# Indicates a method for contacting the server administrator. According to
-# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that
-# is currently not enforced. Use for example mailto:admin@example.com. This
-# value is accessible for authenticated users through the IMAP METADATA server
-# entry "/shared/admin".
-#mail_server_admin = 
-
-##
-## Mail processes
-##
-
-# Don't use mmap() at all. This is required if you store indexes to shared
-# filesystems (NFS or clustered filesystem).
-#mmap_disable = no
-
-# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL
-# since version 3, so this should be safe to use nowadays by default.
-#dotlock_use_excl = yes
-
-# When to use fsync() or fdatasync() calls:
-#   optimized (default): Whenever necessary to avoid losing important data
-#   always: Useful with e.g. NFS when write()s are delayed
-#   never: Never use it (best performance, but crashes can lose data)
-#mail_fsync = optimized
-
-# Locking method for index files. Alternatives are fcntl, flock and dotlock.
-# Dotlocking uses some tricks which may create more disk I/O than other locking
-# methods. NFS users: flock doesn't work, remember to change mmap_disable.
-#lock_method = fcntl
-
-# Directory where mails can be temporarily stored. Usually it's used only for
-# mails larger than >= 128 kB. It's used by various parts of Dovecot, for
-# example LDA/LMTP while delivering large mails or zlib plugin for keeping
-# uncompressed mails.
-#mail_temp_dir = /tmp
-
-# Valid UID range for users, defaults to 500 and above. This is mostly
-# to make sure that users can't log in as daemons or other system users.
-# Note that denying root logins is hardcoded to dovecot binary and can't
-# be done even if first_valid_uid is set to 0.
-#first_valid_uid = 500
-#last_valid_uid = 0
-
-# Valid GID range for users, defaults to non-root/wheel. Users having
-# non-valid GID as primary group ID aren't allowed to log in. If user
-# belongs to supplementary groups with non-valid GIDs, those groups are
-# not set.
-#first_valid_gid = 1
-#last_valid_gid = 0
-
-# Maximum allowed length for mail keyword name. It's only forced when trying
-# to create new keywords.
-#mail_max_keyword_length = 50
-
-# ':' separated list of directories under which chrooting is allowed for mail
-# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too).
-# This setting doesn't affect login_chroot, mail_chroot or auth chroot
-# settings. If this setting is empty, "/./" in home dirs are ignored.
-# WARNING: Never add directories here which local users can modify, that
-# may lead to root exploit. Usually this should be done only if you don't
-# allow shell access for users. <doc/wiki/Chrooting.txt>
-#valid_chroot_dirs = 
-
-# Default chroot directory for mail processes. This can be overridden for
-# specific users in user database by giving /./ in user's home directory
-# (eg. /home/./user chroots into /home). Note that usually there is no real
-# need to do chrooting, Dovecot doesn't allow users to access files outside
-# their mail directory anyway. If your home directories are prefixed with
-# the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt>
-#mail_chroot = 
-
-# UNIX socket path to master authentication server to find users.
-# This is used by imap (for shared users) and lda.
-#auth_socket_path = /var/run/dovecot/auth-userdb
-
-# Directory where to look up mail plugins.
-#mail_plugin_dir = /usr/lib/dovecot/modules
-
-# Space separated list of plugins to load for all services. Plugins specific to
-# IMAP, LDA, etc. are added to this list in their own .conf files.
-#mail_plugins = 
-mail_plugins = acl quota fts fts_lucene virtual
-
-##
-## Mailbox handling optimizations
-##
-
-# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are
-# also required for IMAP NOTIFY extension to be enabled.
-#mailbox_list_index = yes
-
-# Trust mailbox list index to be up-to-date. This reduces disk I/O at the cost
-# of potentially returning out-of-date results after e.g. server crashes.
-# The results will be automatically fixed once the folders are opened.
-#mailbox_list_index_very_dirty_syncs = yes
-
-# Should INBOX be kept up-to-date in the mailbox list index? By default it's
-# not, because most of the mailbox accesses will open INBOX anyway.
-#mailbox_list_index_include_inbox = no
-
-# The minimum number of mails in a mailbox before updates are done to cache
-# file. This allows optimizing Dovecot's behavior to do less disk writes at
-# the cost of more disk reads.
-#mail_cache_min_mail_count = 0
-
-# When IDLE command is running, mailbox is checked once in a while to see if
-# there are any new mails or other changes. This setting defines the minimum
-# time to wait between those checks. Dovecot can also use inotify and
-# kqueue to find out immediately when changes occur.
-#mailbox_idle_check_interval = 30 secs
-
-# Save mails with CR+LF instead of plain LF. This makes sending those mails
-# take less CPU, especially with sendfile() syscall with Linux and FreeBSD.
-# But it also creates a bit more disk I/O which may just make it slower.
-# Also note that if other software reads the mboxes/maildirs, they may handle
-# the extra CRs wrong and cause problems.
-#mail_save_crlf = no
-
-# Max number of mails to keep open and prefetch to memory. This only works with
-# some mailbox formats and/or operating systems.
-#mail_prefetch_count = 0
-
-# How often to scan for stale temporary files and delete them (0 = never).
-# These should exist only after Dovecot dies in the middle of saving mails.
-#mail_temp_scan_interval = 1w
-
-# How many slow mail accesses sorting can perform before it returns failure.
-# With IMAP the reply is: NO [LIMIT] Requested sort would have taken too long.
-# The untagged SORT reply is still returned, but it's likely not correct.
-#mail_sort_max_read_count = 0
-
-protocol !indexer-worker {
-  # If folder vsize calculation requires opening more than this many mails from
-  # disk (i.e. mail sizes aren't in cache already), return failure and finish
-  # the calculation via indexer process. Disabled by default. This setting must
-  # be 0 for indexer-worker processes.
-  #mail_vsize_bg_after_count = 0
-  mail_vsize_bg_after_count = 100
-}
-
-##
-## Maildir-specific settings
-##
-
-# By default LIST command returns all entries in maildir beginning with a dot.
-# Enabling this option makes Dovecot return only entries which are directories.
-# This is done by stat()ing each entry, so it causes more disk I/O.
-# (For systems setting struct dirent->d_type, this check is free and it's
-# done always regardless of this setting)
-#maildir_stat_dirs = no
-
-# When copying a message, do it with hard links whenever possible. This makes
-# the performance much better, and it's unlikely to have any side effects.
-#maildir_copy_with_hardlinks = yes
-
-# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only
-# when its mtime changes unexpectedly or when we can't find the mail otherwise.
-#maildir_very_dirty_syncs = no
-
-# If enabled, Dovecot doesn't use the S=<size> in the Maildir filenames for
-# getting the mail's physical size, except when recalculating Maildir++ quota.
-# This can be useful in systems where a lot of the Maildir filenames have a
-# broken size. The performance hit for enabling this is very small.
-#maildir_broken_filename_sizes = no
-
-# Always move mails from new/ directory to cur/, even when the \Recent flags
-# aren't being reset.
-#maildir_empty_new = no
-
-##
-## mbox-specific settings
-##
-
-# Which locking methods to use for locking mbox. There are four available:
-#  dotlock: Create <mailbox>.lock file. This is the oldest and most NFS-safe
-#           solution. If you want to use /var/mail/ like directory, the users
-#           will need write access to that directory.
-#  dotlock_try: Same as dotlock, but if it fails because of permissions or
-#               because there isn't enough disk space, just skip it.
-#  fcntl  : Use this if possible. Works with NFS too if lockd is used.
-#  flock  : May not exist in all systems. Doesn't work with NFS.
-#  lockf  : May not exist in all systems. Doesn't work with NFS.
-#
-# You can use multiple locking methods; if you do the order they're declared
-# in is important to avoid deadlocks if other MTAs/MUAs are using multiple
-# locking methods as well. Some operating systems don't allow using some of
-# them simultaneously.
-#
-# The Debian value for mbox_write_locks differs from upstream Dovecot. It is
-# changed to be compliant with Debian Policy (section 11.6) for NFS safety.
-#       Dovecot: mbox_write_locks = dotlock fcntl
-#       Debian:  mbox_write_locks = fcntl dotlock
-#
-#mbox_read_locks = fcntl
-#mbox_write_locks = fcntl dotlock
-
-# Maximum time to wait for lock (all of them) before aborting.
-#mbox_lock_timeout = 5 mins
-
-# If dotlock exists but the mailbox isn't modified in any way, override the
-# lock file after this much time.
-#mbox_dotlock_change_timeout = 2 mins
-
-# When mbox changes unexpectedly we have to fully read it to find out what
-# changed. If the mbox is large this can take a long time. Since the change
-# is usually just a newly appended mail, it'd be faster to simply read the
-# new mails. If this setting is enabled, Dovecot does this but still safely
-# fallbacks to re-reading the whole mbox file whenever something in mbox isn't
-# how it's expected to be. The only real downside to this setting is that if
-# some other MUA changes message flags, Dovecot doesn't notice it immediately.
-# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK 
-# commands.
-#mbox_dirty_syncs = yes
-
-# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE,
-# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored.
-#mbox_very_dirty_syncs = no
-
-# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK
-# commands and when closing the mailbox). This is especially useful for POP3
-# where clients often delete all mails. The downside is that our changes
-# aren't immediately visible to other MUAs.
-#mbox_lazy_writes = yes
-
-# If mbox size is smaller than this (e.g. 100k), don't write index files.
-# If an index file already exists it's still read, just not updated.
-#mbox_min_index_size = 0
-
-# Mail header selection algorithm to use for MD5 POP3 UIDLs when
-# pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired
-# algorithm, but it fails if the first Received: header isn't unique in all
-# mails. An alternative algorithm is "all" that selects all headers.
-#mbox_md5 = apop3d
-
-##
-## mdbox-specific settings
-##
-
-# Maximum dbox file size until it's rotated.
-#mdbox_rotate_size = 10M
-
-# Maximum dbox file age until it's rotated. Typically in days. Day begins
-# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled.
-#mdbox_rotate_interval = 0
-
-# When creating new mdbox files, immediately preallocate their size to
-# mdbox_rotate_size. This setting currently works only in Linux with some
-# filesystems (ext4, xfs).
-#mdbox_preallocate_space = no
-
-##
-## Mail attachments
-##
-
-# sdbox and mdbox support saving mail attachments to external files, which
-# also allows single instance storage for them. Other backends don't support
-# this for now.
-
-# Directory root where to store mail attachments. Disabled, if empty.
-#mail_attachment_dir =
-
-# Attachments smaller than this aren't saved externally. It's also possible to
-# write a plugin to disable saving specific attachments externally.
-#mail_attachment_min_size = 128k
-
-# Filesystem backend to use for saving attachments:
-#  posix : No SiS done by Dovecot (but this might help FS's own deduplication)
-#  sis posix : SiS with immediate byte-by-byte comparison during saving
-#  sis-queue posix : SiS with delayed comparison and deduplication
-#mail_attachment_fs = sis posix
-
-# Hash format to use in attachment filenames. You can add any text and
-# variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}.
-# Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits
-#mail_attachment_hash = %{sha1}
-
-# Settings to control adding $HasAttachment or $HasNoAttachment keywords.
-# By default, all MIME parts with Content-Disposition=attachment, or inlines
-# with filename parameter are consired attachments.
-#   add-flags - Add the keywords when saving new mails or when fetching can
-#      do it efficiently.
-#   content-type=type or !type - Include/exclude content type. Excluding will
-#     never consider the matched MIME part as attachment. Including will only
-#     negate an exclusion (e.g. content-type=!foo/* content-type=foo/bar).
-#   exclude-inlined - Exclude any Content-Disposition=inline MIME part.
-#mail_attachment_detection_options =

mail_system/templates/dovecot/10-master.conf

@@ -1,154 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-#default_process_limit = 100
-#default_client_limit = 1000
-
-# Default VSZ (virtual memory size) limit for service processes. This is mainly
-# intended to catch and kill processes that leak memory before they eat up
-# everything.
-#default_vsz_limit = 256M
-# for virtual mailbox 'all' we need more memory
-default_vsz_limit = 1G
-
-# Login user is internally used by login processes. This is the most untrusted
-# user in Dovecot system. It shouldn't have access to anything at all.
-#default_login_user = dovenull
-
-# Internal user is used by unprivileged processes. It should be separate from
-# login user, so that login processes can't disturb other processes.
-#default_internal_user = dovecot
-
-service imap-login {
-  inet_listener imap {
-    #port = 143
-  }
-  inet_listener imaps {
-    #port = 993
-    #ssl = yes
-  }
-
-  # Number of connections to handle before starting a new process. Typically
-  # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
-  # is faster. <doc/wiki/LoginProcess.txt>
-  #service_count = 1
-
-  # Number of processes to always keep waiting for more connections.
-  #process_min_avail = 0
-
-  # If you set service_count=0, you probably need to grow this.
-  #vsz_limit = $default_vsz_limit
-}
-
-service pop3-login {
-  inet_listener pop3 {
-    #port = 110
-  }
-  inet_listener pop3s {
-    #port = 995
-    #ssl = yes
-  }
-}
-
-service submission-login {
-  inet_listener submission {
-    #port = 587
-  }
-}
-
-service lmtp {
-  unix_listener /var/spool/postfix/private/dovecot-lmtp {
-    group = postfix
-    mode = 0600
-    user = postfix
-  }
-#  unix_listener lmtp {
-#    #mode = 0666
-#  }
-
-  # Create inet listener only if you can't use the above UNIX socket
-  #inet_listener lmtp {
-    # Avoid making LMTP visible for the entire internet
-    #address =
-    #port = 
-  #}
-}
-
-service imap {
-  # Most of the memory goes to mmap()ing files. You may need to increase this
-  # limit if you have huge mailboxes.
-  #vsz_limit = $default_vsz_limit
-
-  # Max. number of IMAP processes (connections)
-  #process_limit = 1024
-}
-
-service pop3 {
-  # Max. number of POP3 processes (connections)
-  #process_limit = 1024
-}
-
-service submission {
-  # Max. number of SMTP Submission processes (connections)
-  #process_limit = 1024
-}
-
-service auth {
-  # auth_socket_path points to this userdb socket by default. It's typically
-  # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
-  # full permissions to this socket are able to get a list of all usernames and
-  # get the results of everyone's userdb lookups.
-  #
-  # The default 0666 mode allows anyone to connect to the socket, but the
-  # userdb lookups will succeed only if the userdb returns an "uid" field that
-  # matches the caller process's UID. Also if caller's uid or gid matches the
-  # socket's uid or gid the lookup succeeds. Anything else causes a failure.
-  #
-  # To give the caller full permissions to lookup all users, set the mode to
-  # something else than 0666 and Dovecot lets the kernel enforce the
-  # permissions (e.g. 0777 allows everyone full permissions).
-  unix_listener auth-userdb {
-    #mode = 0666
-    #user = 
-    #group = 
-  }
-
-  # Postfix smtp-auth
-  #unix_listener /var/spool/postfix/private/auth {
-  #  mode = 0666
-  #}
-  unix_listener /var/spool/postfix/private/auth {
-    mode = 0660
-    user = postfix
-    group = postfix
-  }
-
-  # Auth process is run as this user.
-  #user = $default_internal_user
-}
-
-service auth-worker {
-  # Auth worker process is run as root by default, so that it can access
-  # /etc/shadow. If this isn't necessary, the user should be changed to
-  # $default_internal_user.
-  #user = root
-}
-
-service dict {
-  # If dict proxy is used, mail processes should have access to its socket.
-  # For example: mode=0660, group=vmail and global mail_access_groups=vmail
-  unix_listener dict {
-    mode = 0600
-    user = mailstore
-    group = mailstore
-  }
-}
-
-service quota-status {
-  executable = quota-status -p postfix
-  inet_listener {
-    port = 12480
-    # You can choose any port you want
-  }
-  client_limit = 1
-}

mail_system/templates/dovecot/10-ssl.conf

@@ -1,84 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## SSL settings
-##
-
-# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
-ssl = yes
-
-# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
-# dropping root privileges, so keep the key file unreadable by anyone but
-# root. Included doc/mkcert.sh can be used to easily generate self-signed
-# certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/dovecot/private/dovecot.pem
-ssl_key = </etc/dovecot/private/dovecot.key
-
-# If key file is password protected, give the password here. Alternatively
-# give it when starting dovecot with -p parameter. Since this file is often
-# world-readable, you may want to place this setting instead to a different
-# root owned 0600 file by using ssl_key_password = <path.
-#ssl_key_password =
-
-# PEM encoded trusted certificate authority. Set this only if you intend to use
-# ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
-# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
-#ssl_ca = 
-
-# Require that CRL check succeeds for client certificates.
-#ssl_require_crl = yes
-
-# Directory and/or file for trusted SSL CA certificates. These are used only
-# when Dovecot needs to act as an SSL client (e.g. imapc backend or
-# submission service). The directory is usually /etc/ssl/certs in
-# Debian-based systems and the file is /etc/pki/tls/cert.pem in
-# RedHat-based systems. Note that ssl_client_ca_file isn't recommended with
-# large CA bundles, because it leads to excessive memory usage.
-#ssl_client_ca_dir =
-ssl_client_ca_dir = /etc/ssl/certs
-#ssl_client_ca_file =
-
-# Require valid cert when connecting to a remote server
-#ssl_client_require_valid_cert = yes
-
-# Request client to send a certificate. If you also want to require it, set
-# auth_ssl_require_client_cert=yes in auth section.
-#ssl_verify_client_cert = no
-
-# Which field from certificate to use for username. commonName and
-# x500UniqueIdentifier are the usual choices. You'll also need to set
-# auth_ssl_username_from_cert=yes.
-#ssl_cert_username_field = commonName
-
-# SSL DH parameters
-# Generate new params with `openssl dhparam -out /etc/dovecot/dh.pem 4096`
-# Or migrate from old ssl-parameters.dat file with the command dovecot
-# gives on startup when ssl_dh is unset.
-ssl_dh = </usr/share/dovecot/dh.pem
-
-# Minimum SSL protocol version to use. Potentially recognized values are SSLv3,
-# TLSv1, TLSv1.1, and TLSv1.2, depending on the OpenSSL version used.
-#ssl_min_protocol = TLSv1
-ssl_min_protocol = TLSv1.2
-
-# SSL ciphers to use, the default is:
-#ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
-# To disable non-EC DH, use:
-#ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
-
-# Colon separated list of elliptic curves to use. Empty value (the default)
-# means use the defaults from the SSL library. P-521:P-384:P-256 would be an
-# example of a valid value.
-#ssl_curve_list =
-
-# Prefer the server's order of ciphers over client's.
-#ssl_prefer_server_ciphers = no
-
-# SSL crypto device to use, for valid values run "openssl engine"
-#ssl_crypto_device =
-
-# SSL extra options. Currently supported options are:
-#   compression - Enable compression.
-#   no_ticket - Disable SSL session tickets.
-#ssl_options =

mail_system/templates/dovecot/15-mailboxes.conf

@@ -1,93 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## Mailbox definitions
-##
-
-# Each mailbox is specified in a separate mailbox section. The section name
-# specifies the mailbox name. If it has spaces, you can put the name
-# "in quotes". These sections can contain the following mailbox settings:
-#
-# auto:
-#   Indicates whether the mailbox with this name is automatically created
-#   implicitly when it is first accessed. The user can also be automatically
-#   subscribed to the mailbox after creation. The following values are
-#   defined for this setting:
-# 
-#     no        - Never created automatically.
-#     create    - Automatically created, but no automatic subscription.
-#     subscribe - Automatically created and subscribed.
-#  
-# special_use:
-#   A space-separated list of SPECIAL-USE flags (RFC 6154) to use for the
-#   mailbox. There are no validity checks, so you could specify anything
-#   you want in here, but it's not a good idea to use flags other than the
-#   standard ones specified in the RFC:
-#
-#     \All       - This (virtual) mailbox presents all messages in the
-#                  user's message store.
-#     \Archive   - This mailbox is used to archive messages.
-#     \Drafts    - This mailbox is used to hold draft messages.
-#     \Flagged   - This (virtual) mailbox presents all messages in the
-#                  user's message store marked with the IMAP \Flagged flag.
-#     \Important - This (virtual) mailbox presents all messages in the
-#                  user's message store deemed important to user.
-#     \Junk      - This mailbox is where messages deemed to be junk mail
-#                  are held.
-#     \Sent      - This mailbox is used to hold copies of messages that
-#                  have been sent.
-#     \Trash     - This mailbox is used to hold messages that have been
-#                  deleted.
-#
-# comment:
-#   Defines a default comment or note associated with the mailbox. This
-#   value is accessible through the IMAP METADATA mailbox entries
-#   "/shared/comment" and "/private/comment". Users with sufficient
-#   privileges can override the default value for entries with a custom
-#   value.
-
-# NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf.
-namespace inbox {
-  # These mailboxes are widely used and could perhaps be created automatically:
-  mailbox Drafts {
-    special_use = \Drafts
-  }
-  mailbox Junk {
-    auto = subscribe
-    special_use = \Junk
-    autoexpunge = 180d
-  }
-  mailbox Trash {
-    auto = subscribe
-    special_use = \Trash
-    autoexpunge = 180d
-  }
-
-  # For \Sent mailboxes there are two widely used names. We'll mark both of
-  # them as \Sent. User typically deletes one of them if duplicates are created.
-  mailbox Sent {
-    special_use = \Sent
-  }
-  mailbox "Sent Messages" {
-    special_use = \Sent
-  }
-
-  # If you have a virtual "All messages" mailbox:
-  #mailbox virtual/All {
-  #  special_use = \All
-  #  comment = All my messages
-  #}
-
-  # If you have a virtual "Flagged" mailbox:
-  #mailbox virtual/Flagged {
-  #  special_use = \Flagged
-  #  comment = All my flagged messages
-  #}
-
-  # If you have a virtual "Important" mailbox:
-  #mailbox virtual/Important {
-  #  special_use = \Important
-  #  comment = All my important messages
-  #}
-}

mail_system/templates/dovecot/20-imap.conf

@@ -1,103 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## IMAP specific settings
-##
-
-# If nothing happens for this long while client is IDLEing, move the connection
-# to imap-hibernate process and close the old imap process. This saves memory,
-# because connections use very little memory in imap-hibernate process. The
-# downside is that recreating the imap process back uses some resources.
-#imap_hibernate_timeout = 0
-
-# Maximum IMAP command line length. Some clients generate very long command
-# lines with huge mailboxes, so you may need to raise this if you get
-# "Too long argument" or "IMAP command line too large" errors often.
-#imap_max_line_length = 64k
-
-# IMAP logout format string:
-#  %i - total number of bytes read from client
-#  %o - total number of bytes sent to client
-#  %{fetch_hdr_count} - Number of mails with mail header data sent to client
-#  %{fetch_hdr_bytes} - Number of bytes with mail header data sent to client
-#  %{fetch_body_count} - Number of mails with mail body data sent to client
-#  %{fetch_body_bytes} - Number of bytes with mail body data sent to client
-#  %{deleted} - Number of mails where client added \Deleted flag
-#  %{expunged} - Number of mails that client expunged, which does not
-#                include automatically expunged mails
-#  %{autoexpunged} - Number of mails that were automatically expunged after
-#                    client disconnected
-#  %{trashed} - Number of mails that client copied/moved to the
-#               special_use=\Trash mailbox.
-#  %{appended} - Number of mails saved during the session
-#imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} \
-#  trashed=%{trashed} hdr_count=%{fetch_hdr_count} \
-#  hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} \
-#  body_bytes=%{fetch_body_bytes}
-
-# Override the IMAP CAPABILITY response. If the value begins with '+',
-# add the given capabilities on top of the defaults (e.g. +XFOO XBAR).
-#imap_capability = 
-
-# How long to wait between "OK Still here" notifications when client is
-# IDLEing.
-#imap_idle_notify_interval = 2 mins
-
-# ID field names and values to send to clients. Using * as the value makes
-# Dovecot use the default value. The following fields have default values
-# currently: name, version, os, os-version, support-url, support-email,
-# revision.
-#imap_id_send = 
-
-# ID fields sent by client to log. * means everything.
-#imap_id_log =
-
-# Workarounds for various client bugs:
-#   delay-newmail:
-#     Send EXISTS/RECENT new mail notifications only when replying to NOOP
-#     and CHECK commands. Some clients ignore them otherwise, for example OSX
-#     Mail (<v2.1). Outlook Express breaks more badly though, without this it
-#     may show user "Message no longer in server" errors. Note that OE6 still
-#     breaks even with this workaround if synchronization is set to
-#     "Headers Only".
-#   tb-extra-mailbox-sep:
-#     Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
-#     adds extra '/' suffixes to mailbox names. This option causes Dovecot to
-#     ignore the extra '/' instead of treating it as invalid mailbox name.
-#   tb-lsub-flags:
-#     Show \Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
-#     This makes Thunderbird realize they aren't selectable and show them
-#     greyed out, instead of only later giving "not selectable" popup error.
-#
-# The list is space-separated.
-#imap_client_workarounds = 
-
-# Host allowed in URLAUTH URLs sent by client. "*" allows all.
-#imap_urlauth_host =
-
-# Enable IMAP LITERAL- extension (replaces LITERAL+)
-#imap_literal_minus = no
-
-# What happens when FETCH fails due to some internal error:
-#   disconnect-immediately:
-#     The FETCH is aborted immediately and the IMAP client is disconnected.
-#   disconnect-after:
-#     The FETCH runs for all the requested mails returning as much data as
-#     possible. The client is finally disconnected without a tagged reply.
-#   no-after:
-#     Same as disconnect-after, but tagged NO reply is sent instead of
-#     disconnecting the client. If the client attempts to FETCH the same failed
-#     mail more than once, the client is disconnected. This is to avoid clients
-#     from going into infinite loops trying to FETCH a broken mail.
-#imap_fetch_failure = disconnect-immediately
-
-protocol imap {
-  # Space separated list of plugins to load (default is global mail_plugins).
-  #mail_plugins = $mail_plugins
-  mail_plugins = $mail_plugins imap_sieve imap_acl imap_quota
-
-  # Maximum number of IMAP connections allowed for a user from each IP address.
-  # NOTE: The username is compared case-sensitively.
-  #mail_max_userip_connections = 10
-}

mail_system/templates/dovecot/20-lmtp.conf

@@ -1,44 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## LMTP specific settings
-##
-
-# Support proxying to other LMTP/SMTP servers by performing passdb lookups.
-#lmtp_proxy = no
-
-# When recipient address includes the detail (e.g. user+detail), try to save
-# the mail to the detail mailbox. See also recipient_delimiter and
-# lda_mailbox_autocreate settings.
-#lmtp_save_to_detail_mailbox = no
-
-# Verify quota before replying to RCPT TO. This adds a small overhead.
-#lmtp_rcpt_check_quota = no
-
-# Add "Received:" header to mails delivered.
-#lmtp_add_received_header = yes
-
-# Which recipient address to use for Delivered-To: header and Received:
-# header. The default is "final", which is the same as the one given to
-# RCPT TO command. "original" uses the address given in RCPT TO's ORCPT
-# parameter, "none" uses nothing. Note that "none" is currently always used
-# when a mail has multiple recipients.
-#lmtp_hdr_delivery_address = final
-
-# Workarounds for various client bugs:
-#   whitespace-before-path:
-#     Allow one or more spaces or tabs between `MAIL FROM:' and path and between
-#     `RCPT TO:' and path.
-#   mailbox-for-path:
-#     Allow using bare Mailbox syntax (i.e., without <...>) instead of full path
-#     syntax.
-#
-# The list is space-separated.
-#lmtp_client_workarounds =
-
-protocol lmtp {
-  # Space separated list of plugins to load (default is global mail_plugins).
-  #mail_plugins = $mail_plugins
-  mail_plugins = $mail_plugins sieve
-}

mail_system/templates/dovecot/90-acl.conf

@@ -1,24 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## Mailbox access control lists.
-##
-
-# vfile backend reads ACLs from "dovecot-acl" file from mail directory.
-# You can also optionally give a global ACL directory path where ACLs are
-# applied to all users' mailboxes. The global ACL directory contains
-# one file for each mailbox, eg. INBOX or sub.mailbox. cache_secs parameter
-# specifies how many seconds to wait between stat()ing dovecot-acl file
-# to see if it changed.
-plugin {
-  #acl = vfile:/etc/dovecot/global-acls:cache_secs=300
-  acl = vfile
-}
-
-# To let users LIST mailboxes shared by other users, Dovecot needs a
-# shared mailbox dictionary. For example:
-plugin {
-  #acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes
-  acl_shared_dict = proxy::acl
-}

mail_system/templates/dovecot/90-plugin.conf

@@ -1,18 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## Plugin settings
-##
-
-# All wanted plugins must be listed in mail_plugins setting before any of the
-# settings take effect. See <doc/wiki/Plugins.txt> for list of plugins and
-# their configuration. Note that %variable expansion is done for all values.
-
-plugin {
-  fts = lucene
-  fts_lucene = whitespace_chars=@.
-  fts_autoindex=yes
-  fts_autoindex_exclude = \Junk
-  fts_autoindex_exclude2 = \Trash
-}

mail_system/templates/dovecot/90-quota.conf

@@ -1,107 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## Quota configuration.
-##
-
-# Note that you also have to enable quota plugin in mail_plugins setting.
-# <doc/wiki/Quota.txt>
-
-##
-## Quota limits
-##
-
-# Quota limits are set using "quota_rule" parameters. To get per-user quota
-# limits, you can set/override them by returning "quota_rule" extra field
-# from userdb. It's also possible to give mailbox-specific limits, for example
-# to give additional 100 MB when saving to Trash:
-
-plugin {
-  #quota_rule = *:storage=1G
-  #quota_rule2 = Trash:storage=+100M
-
-  # LDA/LMTP allows saving the last mail to bring user from under quota to
-  # over quota, if the quota doesn't grow too high. Default is to allow as
-  # long as quota will stay under 10% above the limit. Also allowed e.g. 10M.
-  #quota_grace = 10%%
-
-  # Quota plugin can also limit the maximum accepted mail size.
-  #quota_max_mail_size = 100M
-}
-
-##
-## Quota warnings
-##
-
-# You can execute a given command when user exceeds a specified quota limit.
-# Each quota root has separate limits. Only the command for the first
-# exceeded limit is executed, so put the highest limit first.
-# The commands are executed via script service by connecting to the named
-# UNIX socket (quota-warning below).
-# Note that % needs to be escaped as %%, otherwise "% " expands to empty.
-
-plugin {
-  #quota_warning = storage=95%% quota-warning 95 %u
-  #quota_warning2 = storage=80%% quota-warning 80 %u
-}
-
-# Example quota-warning service. The unix listener's permissions should be
-# set in a way that mail processes can connect to it. Below example assumes
-# that mail processes run as vmail user. If you use mode=0666, all system users
-# can generate quota warnings to anyone.
-#service quota-warning {
-#  executable = script /usr/local/bin/quota-warning.sh
-#  user = dovecot
-#  unix_listener quota-warning {
-#    user = vmail
-#  }
-#}
-
-##
-## Quota backends
-##
-
-# Multiple backends are supported:
-#   dirsize: Find and sum all the files found from mail directory.
-#            Extremely SLOW with Maildir. It'll eat your CPU and disk I/O.
-#   dict: Keep quota stored in dictionary (eg. SQL)
-#   maildir: Maildir++ quota
-#   fs: Read-only support for filesystem quota
-
-plugin {
-  #quota = dirsize:User quota
-  #quota = maildir:User quota
-  #quota = dict:User quota::proxy::quota
-  #quota = fs:User quota
-}
-
-# Multiple quota roots are also possible, for example this gives each user
-# their own 100MB quota and one shared 1GB quota within the domain:
-plugin {
-  #quota = dict:user::proxy::quota
-  #quota2 = dict:domain:%d:proxy::quota_domain
-  #quota_rule = *:storage=102400
-  #quota2_rule = *:storage=1048576
-}
-
-plugin {
-  # https://wiki2.dovecot.org/Quota
-  quota_grace = 10%%
-  quota_status_success = DUNNO
-  quota_status_nouser = DUNNO
-  quota_status_overquota = "552 5.2.2 Mailbox is full"
-  quota_exceeded_message = Quota exceeded, please reduce your overall mail volume and/or the number of messages in your inbox.
-
-  # https://wiki2.dovecot.org/Quota/Configuration
-  # https://wiki2.dovecot.org/Quota/Count
-  quota = count:User quota
-  quota_rule = *:storage={{ mailserver.dovecot.mailbox_max_bytes | default(100000000000) }}
-  # ATTENTION: the following rule counts all messages in the mailbox, not just in the inbox
-  quota_rule2 = INBOX:messages=+{{ mailserver.dovecot.mailbox_max_messages | default(500000) }}
-  quota_rule3 = Trash:storage=+200M
-
-  # https://wiki2.dovecot.org/Quota/Count
-  # This is required - it uses "virtual sizes" rather than "physical sizes" for quota counting:
-  quota_vsizes = yes
-}

mail_system/templates/dovecot/90-sieve-extprograms.conf

@@ -1,49 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-# Sieve Extprograms plugin configuration
-
-# Don't forget to add the sieve_extprograms plugin to the sieve_plugins setting.
-# Also enable the extensions you need (one or more of vnd.dovecot.pipe,
-# vnd.dovecot.filter and vnd.dovecot.execute) by adding these   to the
-# sieve_extensions or sieve_global_extensions settings. Restricting these
-# extensions to a global context using sieve_global_extensions is recommended.
-
-plugin {
-
-  # The directory where the program sockets are located for the
-  # vnd.dovecot.pipe, vnd.dovecot.filter and vnd.dovecot.execute extension
-  # respectively. The name of each unix socket contained in that directory
-  # directly maps to a program-name referenced from the Sieve script.
-  #sieve_pipe_socket_dir = sieve-pipe
-  #sieve_filter_socket_dir = sieve-filter
-  #sieve_execute_socket_dir = sieve-execute
-
-  # The directory where the scripts are located for direct execution by the
-  # vnd.dovecot.pipe, vnd.dovecot.filter and vnd.dovecot.execute extension
-  # respectively. The name of each script contained in that directory
-  # directly maps to a program-name referenced from the Sieve script.
-  #sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe
-  #sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter
-  #sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute
-  sieve_pipe_bin_dir = /etc/dovecot/sieve_pipes
-  sieve_filter_bin_dir = /etc/dovecot/sieve_filters
-  sieve_execute_bin_dir = /etc/dovecot/sieve_execute
-}
-
-# An example program service called 'do-something' to pipe messages to
-#service do-something {
-  # Define the executed script as parameter to the sieve service
-  #executable = script /usr/lib/dovecot/sieve-pipe/do-something.sh
-
-  # Use some unprivileged user for executing the program
-  #user = dovenull
-
-  # The unix socket located in the sieve_pipe_socket_dir (as defined in the 
-  # plugin {} section above)
-  #unix_listener sieve-pipe/do-something {
-    # LDA/LMTP must have access
-  #  user = vmail  
-  #  mode = 0600
-  #}
-#}

mail_system/templates/dovecot/90-sieve.conf

@@ -1,234 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-##
-## Settings for the Sieve interpreter
-##
-
-# Do not forget to enable the Sieve plugin in 15-lda.conf and 20-lmtp.conf
-# by adding it to the respective mail_plugins= settings.
-
-# The Sieve interpreter can retrieve Sieve scripts from several types of
-# locations. The default `file' location type is a local filesystem path
-# pointing to a Sieve script file or a directory containing multiple Sieve
-# script files. More complex setups can use other location types such as
-# `ldap' or `dict' to fetch Sieve scripts from remote databases.
-#
-# All settings that specify the location of one ore more Sieve scripts accept
-# the following syntax:
-#
-# location = [<type>:]path[;<option>[=<value>][;...]]
-#
-# If the type prefix is omitted, the script location type is 'file' and the 
-# location is interpreted as a local filesystem path pointing to a Sieve script
-# file or directory. Refer to Pigeonhole wiki or INSTALL file for more
-# information.
-
-plugin {
-  # The location of the user's main Sieve script or script storage. The LDA
-  # Sieve plugin uses this to find the active script for Sieve filtering at
-  # delivery. The "include" extension uses this location for retrieving
-  # :personal" scripts. This is also where the  ManageSieve service will store
-  # the user's scripts, if supported.
-  # 
-  # Currently only the 'file:' location type supports ManageSieve operation.
-  # Other location types like 'dict:' and 'ldap:' can currently only
-  # be used as a read-only script source ().
-  #
-  # For the 'file:' type: use the ';active=' parameter to specify where the
-  # active script symlink is located.
-  # For other types: use the ';name=' parameter to specify the name of the
-  # default/active script.
-  #sieve = file:~/sieve;active=~/.dovecot.sieve
-  sieve = file:/srv/mailstore/%d/%n/sieve;active=/srv/mailstore/%d/%n/.dovecot.sieve
-
-  # The default Sieve script when the user has none. This is the location of a
-  # global sieve script file, which gets executed ONLY if user's personal Sieve
-  # script doesn't exist. Be sure to pre-compile this script manually using the
-  # sievec command line tool if the binary is not stored in a global location.
-  # --> See sieve_before for executing scripts before the user's personal
-  #     script.
-  #sieve_default = /var/lib/dovecot/sieve/default.sieve
-
-  # The name by which the default Sieve script (as configured by the 
-  # sieve_default setting) is visible to the user through ManageSieve. 
-  #sieve_default_name = 
-
-  # Location for ":global" include scripts as used by the "include" extension.
-  #sieve_global =
-
-  # The location of a Sieve script that is run for any message that is about to
-  # be discarded; i.e., it is not delivered anywhere by the normal Sieve
-  # execution. This only happens when the "implicit keep" is canceled, by e.g.
-  # the "discard" action, and no actions that deliver the message are executed.
-  # This "discard script" can prevent discarding the message, by executing
-  # alternative actions. If the discard script does nothing, the message is
-	# still discarded as it would be when no discard script is configured.
-  #sieve_discard =
-
-  # Location Sieve of scripts that need to be executed before the user's
-  # personal script. If a 'file' location path points to a directory, all the 
-  # Sieve scripts contained therein (with the proper `.sieve' extension) are
-  # executed. The order of execution within that directory is determined by the
-  # file names, using a normal 8bit per-character comparison.
-  #
-  # Multiple script locations can be specified by appending an increasing number
-  # to the setting name. The Sieve scripts found from these locations are added
-  # to the script execution sequence in the specified order. Reading the
-  # numbered sieve_before settings stops at the first missing setting, so no
-  # numbers may be skipped.
-  #sieve_before = /var/lib/dovecot/sieve.d/
-  #sieve_before2 = ldap:/etc/sieve-ldap.conf;name=ldap-domain
-  #sieve_before3 = (etc...)
-  sieve_before = /etc/dovecot/sieve_before
-
-  # Identical to sieve_before, only the specified scripts are executed after the
-  # user's script (only when keep is still in effect!). Multiple script
-  # locations can be specified by appending an increasing number.
-  #sieve_after =
-  #sieve_after2 =
-  #sieve_after2 = (etc...)
-  sieve_after = /etc/dovecot/sieve_after
-
-  # Which Sieve language extensions are available to users. By default, all
-  # supported extensions are available, except for deprecated extensions or
-  # those that are still under development. Some system administrators may want
-  # to disable certain Sieve extensions or enable those that are not available
-  # by default. This setting can use '+' and '-' to specify differences relative
-  # to the default. For example `sieve_extensions = +imapflags' will enable the
-  # deprecated imapflags extension in addition to all extensions were already
-  # enabled by default.
-  #sieve_extensions = +notify +imapflags
-
-  # Which Sieve language extensions are ONLY available in global scripts. This
-  # can be used to restrict the use of certain Sieve extensions to administrator
-  # control, for instance when these extensions can cause security concerns.
-  # This setting has higher precedence than the `sieve_extensions' setting
-  # (above), meaning that the extensions enabled with this setting are never
-  # available to the user's personal script no matter what is specified for the
-  # `sieve_extensions' setting. The syntax of this setting is similar to the
-  # `sieve_extensions' setting, with the difference that extensions are
-  # enabled or disabled for exclusive use in global scripts. Currently, no
-  # extensions are marked as such by default.
-  #sieve_global_extensions =
-  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute
-
-  # The Pigeonhole Sieve interpreter can have plugins of its own. Using this
-  # setting, the used plugins can be specified. Check the Dovecot wiki
-  # (wiki2.dovecot.org) or the pigeonhole website
-  # (http://pigeonhole.dovecot.org) for available plugins.
-  # The sieve_extprograms plugin is included in this release.
-  #sieve_plugins =
-  sieve_plugins = sieve_imapsieve sieve_extprograms
-
-  # The separator that is expected between the :user and :detail
-  # address parts introduced by the subaddress extension. This may
-  # also be a sequence of characters (e.g. '--'). The current
-  # implementation looks for the separator from the left of the
-  # localpart and uses the first one encountered. The :user part is
-  # left of the separator and the :detail part is right. This setting
-  # is also used by Dovecot's LMTP service.
-  #recipient_delimiter = +
-
-  # The maximum size of a Sieve script. The compiler will refuse to compile any
-  # script larger than this limit. If set to 0, no limit on the script size is
-  # enforced.
-  #sieve_max_script_size = 1M
-
-  # The maximum number of actions that can be performed during a single script
-  # execution. If set to 0, no limit on the total number of actions is enforced.
-  #sieve_max_actions = 32
-
-  # The maximum number of redirect actions that can be performed during a single
-  # script execution. If set to 0, no redirect actions are allowed.
-  #sieve_max_redirects = 4
-
-  # The maximum number of personal Sieve scripts a single user can have. If set
-  # to 0, no limit on the number of scripts is enforced.
-  # (Currently only relevant for ManageSieve)
-  #sieve_quota_max_scripts = 0
-
-  # The maximum amount of disk storage a single user's scripts may occupy. If
-  # set to 0, no limit on the used amount of disk storage is enforced.
-  # (Currently only relevant for ManageSieve)
-  #sieve_quota_max_storage = 0
-
-  # The primary e-mail address for the user. This is used as a default when no
-  # other appropriate address is available for sending messages. If this setting
-  # is not configured, either the postmaster or null "<>" address is used as a
-  # sender, depending on the action involved. This setting is important when
-  # there is no message envelope to extract addresses from, such as when the
-  # script is executed in IMAP.
-  #sieve_user_email =
-
-  # The path to the file where the user log is written. If not configured, a
-  # default location is used. If the main user's personal Sieve (as configured
-  # with sieve=) is a file, the logfile is set to <filename>.log by default. If
-  # it is not a file, the default user log file is ~/.dovecot.sieve.log.
-  #sieve_user_log =
-
-  # Specifies what envelope sender address is used for redirected messages.
-  # The following values are supported for this setting:
-  #
-  #   "sender"         - The sender address is used (default).
-  #   "recipient"      - The final recipient address is used.
-  #   "orig_recipient" - The original recipient is used.
-  #   "user_email"     - The user's primary address is used. This is
-  #                      configured with the "sieve_user_email" setting. If
-  #                      that setting is unconfigured, "user_mail" is equal to
-  #                      "recipient".
-  #   "postmaster"     - The postmaster_address configured for the LDA.
-  #   "<user@domain>"  - Redirected messages are always sent from user@domain.
-  #                      The angle brackets are mandatory. The null "<>" address
-  #                      is also supported.
-  #
-  # This setting is ignored when the envelope sender is "<>". In that case the
-  # sender of the redirected message is also always "<>".
-  #sieve_redirect_envelope_from = sender
-
-  ## TRACE DEBUGGING
-  # Trace debugging provides detailed insight in the operations performed by
-  # the Sieve script. These settings apply to both the LDA Sieve plugin and the
-  # IMAPSIEVE plugin. 
-  #
-  # WARNING: On a busy server, this functionality can quickly fill up the trace
-  # directory with a lot of trace files. Enable this only temporarily and as
-  # selective as possible.
-  
-  # The directory where trace files are written. Trace debugging is disabled if
-  # this setting is not configured or if the directory does not exist. If the 
-  # path is relative or it starts with "~/" it is interpreted relative to the
-  # current user's home directory.
-  #sieve_trace_dir =
-  
-  # The verbosity level of the trace messages. Trace debugging is disabled if
-  # this setting is not configured. Possible values are:
-  #
-  #   "actions"        - Only print executed action commands, like keep,
-  #                      fileinto, reject and redirect.
-  #   "commands"       - Print any executed command, excluding test commands.
-  #   "tests"          - Print all executed commands and performed tests.
-  #   "matching"       - Print all executed commands, performed tests and the
-  #                      values matched in those tests.
-  #sieve_trace_level =
-  
-  # Enables highly verbose debugging messages that are usually only useful for
-  # developers.
-  #sieve_trace_debug = no
-  
-  # Enables showing byte code addresses in the trace output, rather than only
-  # the source line numbers.
-  #sieve_trace_addresses = no 
-
-
-  # From elsewhere to Junk folder
-  imapsieve_mailbox1_name = Junk
-  imapsieve_mailbox1_causes = COPY
-  imapsieve_mailbox1_before = file:/etc/dovecot/sieve_pipes/learn-spam.sieve
-
-  # From Junk folder to elsewhere
-  imapsieve_mailbox2_name = *
-  imapsieve_mailbox2_from = Junk
-  imapsieve_mailbox2_causes = COPY
-  imapsieve_mailbox2_before = file:/etc/dovecot/sieve_pipes/learn-ham.sieve
-}

mail_system/templates/dovecot/auth-sql.conf.ext

@@ -1,42 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-# Authentication for SQL users. Included from 10-auth.conf.
-#
-# <doc/wiki/AuthDatabase.SQL.txt>
-
-passdb {
-  driver = sql
-
-  # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext
-  args = /etc/dovecot/dovecot-sql.conf.ext
-}
-
-# "prefetch" user database means that the passdb already provided the
-# needed information and there's no need to do a separate userdb lookup.
-# <doc/wiki/UserDatabase.Prefetch.txt>
-#userdb {
-#  driver = prefetch
-#}
-
-userdb {
-  driver = sql
-  args = /etc/dovecot/dovecot-sql.conf.ext
-}
-# using the static driver will cause the iterate_query
-# in /etc/dovecot/dovecot-sql.conf.ext
-# to fail (e.g. for 'doveadm mailbox list -A'),
-# so we also fetch the userdb via sql, even if this would be faster:
-#userdb {
-#  driver = static
-#  args = uid=mailstore gid=mailstore home=/srv/mailstore/%d/%n
-#}
-
-
-# If you don't have any user-specific settings, you can avoid the user_query
-# by using userdb static instead of userdb sql, for example:
-# <doc/wiki/UserDatabase.Static.txt>
-#userdb {
-  #driver = static
-  #args = uid=vmail gid=vmail home=/var/vmail/%u
-#}

mail_system/templates/dovecot/dovecot-dict-sql.conf.ext

@@ -1,65 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-# This file is commonly accessed via dict {} section in dovecot.conf
-
-connect = host={{ mailserver.postgresql.host }} port={{ mailserver.postgresql.port }} dbname={{ mailserver.postgresql.dbname }} user={{ mailserver.postgresql.username }} password={{ mailserver.postgresql.password }}
-
-# CREATE TABLE quota (
-#   username varchar(100) not null,
-#   bytes bigint not null default 0,
-#   messages integer not null default 0,
-#   primary key (username)
-# );
-
-#map {
-#  pattern = priv/quota/storage
-#  table = quota
-#  username_field = username
-#  value_field = bytes
-#}
-#map {
-#  pattern = priv/quota/messages
-#  table = quota
-#  username_field = username
-#  value_field = messages
-#}
-
-# CREATE TABLE expires (
-#   username varchar(100) not null,
-#   mailbox varchar(255) not null,
-#   expire_stamp integer not null,
-#   primary key (username, mailbox)
-# );
-
-#map {
-#  pattern = shared/expire/$user/$mailbox
-#  table = expires
-#  value_field = expire_stamp
-#
-#  fields {
-#    username = $user
-#    mailbox = $mailbox
-#  }
-#}
-
-map {
-  pattern = shared/shared-boxes/user/$to/$from
-  table = shared_folders
-  value_field = dummy
-
-  fields {
-    from_user = $from
-    to_user = $to
-  }
-}
-
-map {
-  pattern = shared/shared-boxes/anyone/$from
-  table = shared_folders_anyone
-  value_field = dummy
-
-  fields {
-    from_user = $from
-  }
-}

mail_system/templates/dovecot/dovecot-sql.conf.ext

@@ -1,174 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-# This file is commonly accessed via passdb {} or userdb {} section in
-# conf.d/auth-sql.conf.ext
-
-# This file is opened as root, so it should be owned by root and mode 0600.
-#
-# http://wiki2.dovecot.org/AuthDatabase/SQL
-#
-# For the sql passdb module, you'll need a database with a table that
-# contains fields for at least the username and password. If you want to
-# use the user@domain syntax, you might want to have a separate domain
-# field as well.
-#
-# If your users all have the same uig/gid, and have predictable home
-# directories, you can use the static userdb module to generate the home
-# dir based on the username and domain. In this case, you won't need fields
-# for home, uid, or gid in the database.
-#
-# If you prefer to use the sql userdb module, you'll want to add fields
-# for home, uid, and gid. Here is an example table:
-#
-# CREATE TABLE users (
-#     username VARCHAR(128) NOT NULL,
-#     domain VARCHAR(128) NOT NULL,
-#     password VARCHAR(64) NOT NULL,
-#     home VARCHAR(255) NOT NULL,
-#     uid INTEGER NOT NULL,
-#     gid INTEGER NOT NULL,
-#     active CHAR(1) DEFAULT 'Y' NOT NULL
-# );
-
-# Database driver: mysql, pgsql, sqlite
-#driver = 
-
-# Database connection string. This is driver-specific setting.
-#
-# HA / round-robin load-balancing is supported by giving multiple host
-# settings, like: host=sql1.host.org host=sql2.host.org
-#
-# pgsql:
-#   For available options, see the PostgreSQL documentation for the
-#   PQconnectdb function of libpq.
-#   Use maxconns=n (default 5) to change how many connections Dovecot can
-#   create to pgsql.
-#
-# mysql:
-#   Basic options emulate PostgreSQL option names:
-#     host, port, user, password, dbname
-#
-#   But also adds some new settings:
-#     client_flags           - See MySQL manual
-#     connect_timeout        - Connect timeout in seconds (default: 5)
-#     read_timeout           - Read timeout in seconds (default: 30)
-#     write_timeout          - Write timeout in seconds (default: 30)
-#     ssl_ca, ssl_ca_path    - Set either one or both to enable SSL
-#     ssl_cert, ssl_key      - For sending client-side certificates to server
-#     ssl_cipher             - Set minimum allowed cipher security (default: HIGH)
-#     ssl_verify_server_cert - Verify that the name in the server SSL certificate
-#                              matches the host (default: no)
-#     option_file            - Read options from the given file instead of
-#                              the default my.cnf location
-#     option_group           - Read options from the given group (default: client)
-# 
-#   You can connect to UNIX sockets by using host: host=/var/run/mysql.sock
-#   Note that currently you can't use spaces in parameters.
-#
-# sqlite:
-#   The path to the database file.
-#
-# Examples:
-#   connect = host=192.168.1.1 dbname=users
-#   connect = host=sql.example.com dbname=virtual user=virtual password=blarg
-#   connect = /etc/dovecot/authdb.sqlite
-#
-#connect =
-
-# Default password scheme.
-#
-# List of supported schemes is in
-# http://wiki2.dovecot.org/Authentication/PasswordSchemes
-#
-#default_pass_scheme = MD5
-
-# passdb query to retrieve the password. It can return fields:
-#   password - The user's password. This field must be returned.
-#   user - user@domain from the database. Needed with case-insensitive lookups.
-#   username and domain - An alternative way to represent the "user" field.
-#
-# The "user" field is often necessary with case-insensitive lookups to avoid
-# e.g. "name" and "nAme" logins creating two different mail directories. If
-# your user and domain names are in separate fields, you can return "username"
-# and "domain" fields instead of "user".
-#
-# The query can also return other fields which have a special meaning, see
-# http://wiki2.dovecot.org/PasswordDatabase/ExtraFields
-#
-# Commonly used available substitutions (see http://wiki2.dovecot.org/Variables
-# for full list):
-#   %u = entire user@domain
-#   %n = user part of user@domain
-#   %d = domain part of user@domain
-# 
-# Note that these can be used only as input to SQL query. If the query outputs
-# any of these substitutions, they're not touched. Otherwise it would be
-# difficult to have eg. usernames containing '%' characters.
-#
-# Example:
-#   password_query = SELECT userid AS user, pw AS password \
-#     FROM users WHERE userid = '%u' AND active = 'Y'
-#
-#password_query = \
-#  SELECT username, domain, password \
-#  FROM users WHERE username = '%n' AND domain = '%d'
-
-# userdb query to retrieve the user information. It can return fields:
-#   uid - System UID (overrides mail_uid setting)
-#   gid - System GID (overrides mail_gid setting)
-#   home - Home directory
-#   mail - Mail location (overrides mail_location setting)
-#
-# None of these are strictly required. If you use a single UID and GID, and
-# home or mail directory fits to a template string, you could use userdb static
-# instead. For a list of all fields that can be returned, see
-# http://wiki2.dovecot.org/UserDatabase/ExtraFields
-#
-# Examples:
-#   user_query = SELECT home, uid, gid FROM users WHERE userid = '%u'
-#   user_query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%u'
-#   user_query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%u'
-#
-#user_query = \
-#  SELECT home, uid, gid \
-#  FROM users WHERE username = '%n' AND domain = '%d'
-
-# If you wish to avoid two SQL lookups (passdb + userdb), you can use
-# userdb prefetch instead of userdb sql in dovecot.conf. In that case you'll
-# also have to return userdb fields in password_query prefixed with "userdb_"
-# string. For example:
-#password_query = \
-#  SELECT userid AS user, password, \
-#    home AS userdb_home, uid AS userdb_uid, gid AS userdb_gid \
-#  FROM users WHERE userid = '%u'
-
-# Query to get a list of all usernames.
-#iterate_query = SELECT username AS user FROM users
-
-driver = pgsql
-connect = host={{ mailserver.postgresql.host }} port={{ mailserver.postgresql.port }} dbname={{ mailserver.postgresql.dbname }} user={{ mailserver.postgresql.username }} password={{ mailserver.postgresql.password }}
-default_pass_scheme = PBKDF2
-password_query = \
-  SELECT \
-    users.username as user, \
-    domains.name as domain, \
-    password, \
-    suspend_imap_reason as nologin \
-  FROM users JOIN domains ON users.domain_id=domains.id \
-  WHERE users.username = split_part('%u', '@', 1) AND domains.name = split_part('%u', '@', 2);
-# iterate_query is used by doveadm sync, doveadm backup etc.
-iterate_query = \
-  SELECT \
-    users.username as username, \
-    domains.name as domain \
-  FROM users JOIN domains ON users.domain_id=domains.id \
-  ORDER BY 2,1;
-user_query = \
-  SELECT \
-    '/srv/mailstore/' || domains.name || '/' || users.username || '/Maildir/' as home, \
-    'mailstore' as uid, 'mailstore' as gid, \
-    '*:bytes=' || quota_storage_bytes as quota_rule, \
-    'INBOX:messages=+' || quota_inbox_messages as quota_rule2 \
-  FROM users JOIN domains ON users.domain_id=domains.id \
-  WHERE users.username = '%n' AND domains.name = '%d';

mail_system/templates/dovecot/dovecot.conf

@@ -1,107 +0,0 @@
-# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
-
-
-## Dovecot configuration file
-
-# If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration
-
-# "doveconf -n" command gives a clean output of the changed settings. Use it
-# instead of copy&pasting files when posting to the Dovecot mailing list.
-
-# '#' character and everything after it is treated as comments. Extra spaces
-# and tabs are ignored. If you want to use either of these explicitly, put the
-# value inside quotes, eg.: key = "# char and trailing whitespace  "
-
-# Most (but not all) settings can be overridden by different protocols and/or
-# source/destination IPs by placing the settings inside sections, for example:
-# protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { }
-
-# Default values are shown for each setting, it's not required to uncomment
-# those. These are exceptions to this though: No sections (e.g. namespace {})
-# or plugin settings are added by default, they're listed only as examples.
-# Paths are also just examples with the real defaults being based on configure
-# options. The paths listed here are for configure --prefix=/usr
-# --sysconfdir=/etc --localstatedir=/var
-
-# Enable installed protocols
-!include_try /usr/share/dovecot/protocols.d/*.protocol
-
-# A comma separated list of IPs or hosts where to listen in for connections. 
-# "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces.
-# If you want to specify non-default ports or anything more complex,
-# edit conf.d/master.conf.
-#listen = *, ::
-
-# Base directory where to store runtime data.
-#base_dir = /var/run/dovecot/
-
-# Name of this instance. In multi-instance setup doveadm and other commands
-# can use -i <instance_name> to select which instance is used (an alternative
-# to -c <config_path>). The instance name is also added to Dovecot processes
-# in ps output.
-#instance_name = dovecot
-
-# Greeting message for clients.
-#login_greeting = Dovecot ready.
-
-# Space separated list of trusted network ranges. Connections from these
-# IPs are allowed to override their IP addresses and ports (for logging and
-# for authentication checks). disable_plaintext_auth is also ignored for
-# these networks. Typically you'd specify your IMAP proxy servers here.
-#login_trusted_networks =
-
-# Space separated list of login access check sockets (e.g. tcpwrap)
-#login_access_sockets = 
-
-# With proxy_maybe=yes if proxy destination matches any of these IPs, don't do
-# proxying. This isn't necessary normally, but may be useful if the destination
-# IP is e.g. a load balancer's IP.
-#auth_proxy_self =
-
-# Show more verbose process titles (in ps). Currently shows user name and
-# IP address. Useful for seeing who are actually using the IMAP processes
-# (eg. shared mailboxes or if same uid is used for multiple accounts).
-#verbose_proctitle = no
-
-# Should all processes be killed when Dovecot master process shuts down.
-# Setting this to "no" means that Dovecot can be upgraded without
-# forcing existing client connections to close (although that could also be
-# a problem if the upgrade is e.g. because of a security fix).
-#shutdown_clients = yes
-
-# If non-zero, run mail commands via this many connections to doveadm server,
-# instead of running them directly in the same process.
-#doveadm_worker_count = 0
-# UNIX socket or host:port used for connecting to doveadm server
-#doveadm_socket_path = doveadm-server
-
-# Space separated list of environment variables that are preserved on Dovecot
-# startup and passed down to all of its child processes. You can also give
-# key=value pairs to always set specific settings.
-#import_environment = TZ
-
-##
-## Dictionary server settings
-##
-
-# Dictionary can be used to store key=value lists. This is used by several
-# plugins. The dictionary can be accessed either directly or though a
-# dictionary server. The following dict block maps dictionary names to URIs
-# when the server is used. These can then be referenced using URIs in format
-# "proxy::<name>".
-
-dict {
-  #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
-  #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext
-  acl = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext
-}
-
-# Most of the actual configuration gets included below. The filenames are
-# first sorted by their ASCII value and parsed in that order. The 00-prefixes
-# in filenames are intended to make it easier to understand the ordering.
-!include conf.d/*.conf
-
-# A config file can also tried to be included without giving an error if
-# it's not found:
-!include_try local.conf
-

mail_system/templates/dovecot/local.conf

@@ -0,0 +1,484 @@
+# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT!
+
+# dovecot config
+
+# Note: debian has some settings in conf.d/* that we cannot override
+# (e.g. we cannot unset passdb pam), so we must disable inclusion of conf.d/*
+# in dovecot.conf
+
+
+# execution
+mail_uid = mailstore
+mail_gid = mailstore
+mail_privileged_group = mailstore
+default_vsz_limit = 512M
+
+
+# tls
+ssl = required
+ssl_server {
+  cert_file = /etc/dovecot/private/dovecot.pem
+  key_file = /etc/dovecot/private/dovecot.key
+}
+ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+
+
+# mail storage
+mail_driver = maildir
+mail_home = /srv/mailstore/%{user | domain}/%{user | username }/
+mail_path = /srv/mailstore/%{user | domain}/%{user | username }/Maildir
+mail_inbox_path = /srv/mailstore/%{user | domain}/%{user | username }/Maildir
+mailbox_list_layout = fs
+
+
+# auth
+auth_verbose = yes
+auth_mechanisms {
+  plain = yes
+  login = yes
+}
+auth_verbose = yes
+auth_default_domain = {{ mailserver.dovecot.auth_default_realm }}
+
+
+# auth service for postfix
+service auth {
+  unix_listener auth-userdb {
+  }
+  unix_listener /var/spool/postfix/private/auth {
+    mode = 0660
+    user = postfix
+    group = postfix
+  }
+}
+service auth-worker {
+}
+
+
+# users and passwords: in postgresql
+pgsql localhost {
+  parameters {
+    port = {{ mailserver.postgresql.port }}
+    user = {{ mailserver.postgresql.username }}
+    password = {{ mailserver.postgresql.password }}
+    dbname = {{ mailserver.postgresql.dbname }}
+  }
+}
+sql_driver = pgsql
+passdb sql {
+  driver = sql
+  default_password_scheme = PBKDF2
+  query = SELECT \
+      users.username as user, \
+      domains.name as domain, \
+      password, \
+      suspend_imap_reason as nologin \
+    FROM users JOIN domains ON users.domain_id=domains.id \
+    WHERE users.username = '%{user | username}' AND domains.name = '%{user | domain }'
+}
+passdb_default_password_scheme = PBKDF2
+userdb sql {
+  query = SELECT \
+      '/srv/mailstore/' || domains.name || '/' || users.username || '/Maildir/' as home, \
+      'mailstore' as uid, \
+      'mailstore' as gid, \
+      CONCAT(quota_storage_bytes, 'B') AS quota_storage_size, \
+      quota_inbox_messages AS quota_message_count \
+    FROM users JOIN domains ON users.domain_id=domains.id \
+    WHERE users.username = '%{user | username}' AND domains.name = '%{user | domain}'
+  iterate_query = SELECT \
+      users.username as username, \
+      domains.name as domain \
+    FROM users JOIN domains ON users.domain_id=domains.id \
+    ORDER BY 2,1
+}
+
+
+# quota
+mail_plugins {
+  quota = yes
+}
+quota_storage_size = 20G
+namespace inbox {
+  mailbox Trash {
+    quota_storage_extra = 100M
+  }
+}
+protocol !indexer-worker {
+  mail_vsize_bg_after_count = 100
+}
+protocol imap {
+  mail_plugins {
+    imap_quota = yes
+  }
+}
+quota "user-quota" {
+  storage_grace = 200M
+  status_success = DUNNO
+  status_nouser = DUNNO
+  status_overquota = "552 5.2.2 Mailbox is full"
+  exceeded_message = "User %{user} is over quota and must reduce the overall mail volume and/or the number of messages in INBOX."
+  warning warn-95 {
+    quota_storage_percentage = 95
+    execute quota-warning {
+      args = 95 %{user}
+    }
+  }
+  warning warn-80 {
+    quota_storage_percentage = 80
+    execute quota-warning {
+      args = 80 %{user}
+    }
+  }
+  warning warn-under {
+    quota_storage_percentage = 95
+    threshold = under
+    execute quota-warning {
+      args = below %{user}
+    }
+  }
+}
+service quota-warning {
+   executable = script /usr/local/bin/quota-warning.sh
+   unix_listener quota-warning {
+     user = dovenull
+     group = dovenull
+     mode = 0660
+   }
+}
+service quota-status {
+  executable = quota-status -p postfix
+  #unix_listener /var/spool/postfix/private/quota-status {
+  #  user = postfix
+  #}
+  inet_listener quota-status {
+    port = 12480
+  }
+  client_limit = 1
+}
+# check:
+# doveadm quota get -A
+# echo -e "recipient=USER@DOMAIN\n" | nc -v 127.0.0.1 12480
+
+
+# namespaces
+namespace inbox {
+  type = private
+  inbox = yes
+  mail_driver = maildir
+  separator = /
+  mail_path = /srv/mailstore/%{user | domain}/%{user | username}/Maildir
+  mailbox_list_layout = fs
+#  location = maildir:/srv/mailstore/%%d/%%n/Maildir:LAYOUT=fs:INDEXPVT=~/shared/%%d/%%n/
+  subscriptions = yes
+  list = yes
+  mailbox Drafts {
+    special_use = \Drafts
+  }
+  mailbox Junk {
+    auto = subscribe
+    special_use = \Junk
+    autoexpunge = 180d
+  }
+  mailbox Trash {
+    auto = subscribe
+    special_use = \Trash
+    autoexpunge = 180d
+  }
+  mailbox Sent {
+    special_use = \Sent
+  }
+  mailbox "Sent Messages" {
+    special_use = \Sent
+  }
+}
+namespace shared {
+  type = shared
+  inbox = no
+  mail_driver = maildir
+  separator = /
+  prefix = shared/$user/
+  #prefix = shared/$domain/$username/
+  mail_path = /srv/mailstore/%{owner_user | domain}/%{owner_user | username}/Maildir
+  #mail_index_path = ~/shared/%{owner_user | domain}/%{owner_user | username}/
+  mail_index_private_path = ~/shared/%{owner_user | domain}/%{owner_user | username}/
+  mailbox_list_layout = fs
+  subscriptions = no
+  list = yes
+}
+#namespace roles {
+#  type = shared
+#  inbox = no
+#  mail_driver = maildir
+#  separator = /
+#  prefix = roles/
+#  mail_path = /srv/mailstore/role_specific/roles/Maildir
+#  mailbox_list_layout = fs
+#  mail_index_private_path = ~/role_specific/roles/
+#  subscriptions = no
+#  list = yes
+#}
+#namespace virtual {
+#  separator = /
+#  prefix = virtual/
+#  mail_path = virtual:/srv/mailstore/%{user | domain}/%{user | username}/Maildir_virtual
+#}
+
+
+# imap service
+service imap {
+}
+service imap-login {
+  inet_listener imap {
+    type = imap
+  }
+  inet_listener imaps {
+    type = imaps
+  }
+}
+
+
+# lmtp service
+service lmtp {
+  unix_listener /var/spool/postfix/private/dovecot-lmtp {
+    group = postfix
+    mode = 0600
+    user = postfix
+  }
+}
+protocol lmtp {
+  postmaster_address = {{ mailserver.dovecot.postmaster_email }}
+  mail_plugins {
+    quota = yes
+  }
+  auth_username_format = %{user | username |lower}@%{user | domain | lower}
+}
+
+
+# acl
+mail_plugins {
+  acl = yes
+}
+acl_driver = vfile
+protocol imap {
+  mail_plugins {
+    imap_acl = yes
+  }
+}
+acl_sharing_map {
+  dict proxy {
+    name = acl
+  }
+}
+imap_acl_allow_anyone = yes
+dict_server {
+  dict acl {
+    driver = sql
+    sql_driver = pgsql
+    pgsql localhost {
+      parameters {
+        port = {{ mailserver.postgresql.port }}
+        user = {{ mailserver.postgresql.username }}
+        password = {{ mailserver.postgresql.password }}
+        dbname = {{ mailserver.postgresql.dbname }}
+      }
+    }
+    dict_map shared/shared-boxes/user/$to/$from {
+      sql_table = shared_folders
+      value_field dummy {
+      }
+      key_field from_user {
+        value = $from
+      }
+      key_field to_user {
+        value = $to
+      }
+    }
+    dict_map shared/shared-user-boxes-rev/$from/$to {
+      sql_table = shared_folders
+      value_field dummy {
+      }
+      key_field from_user {
+	value = $from
+      }
+      key_field to_user {
+        value = $to
+      }
+    }
+    dict_map shared/shared-boxes/anyone/$from {
+      sql_table = shared_folders_anyone
+      value_field dummy {
+      }
+      key_field from_user {
+        value = $from
+      }
+    }
+  }
+}
+service dict {
+  unix_listener dict {
+    mode = 0660
+    user = dovecot
+    group = mailstore
+  }
+}
+# TODO enable in v2.4.2
+#acl_dict_index = yes
+
+# debugging:
+# doveadm acl debug -u ACCESSING_USER@DOMAIN shared/SHARING_USER@DOMAIN/FOLDERNAME
+
+
+# fulltext search
+mail_plugins {
+  fts = yes
+  fts_flatcurve = yes
+}
+fts_autoindex = yes
+#fts_autoindex_max_recent_msgs = 0
+fts_search_add_missing = yes
+language_filters = normalizer-icu snowball stopwords
+language_tokenizers = generic email-address
+language_tokenizer_generic_algorithm = simple
+# Note: the 'language' settings is set mandatory by dovecot but has totally NO impact on FTS flatcurve module
+language en {
+  default = yes
+  filters = lowercase snowball english-possessive stopwords
+}
+language de {
+}
+fts flatcurve {
+  substring_search = yes
+}
+# cf. /usr/share/doc/dovecot-fts-xapian/README.md.gz
+fts flatcurve {
+  driver = flatcurve
+  autoindex = yes
+}
+mailbox Trash {
+  special_use = \Trash
+  fts_autoindex = no
+}
+mailbox Junk {
+  special_use = \Junk
+  fts_autoindex = no
+}
+fts_header_excludes {
+  * = yes
+}
+fts_header_includes {
+  From = yes
+  To = yes
+  Cc = yes
+  Bcc = yes
+  Subject = yes
+  Message-ID = yes
+  Date = yes
+}
+
+
+# sieve plugin
+# Note: we put sieve scripts below /var/lib/dovecot/sieve/ rather than /etc,
+# because dovecot may want to recompile *.svbin and writing under /etc is prohobited
+# by systemd setting ProtectSystem=full
+protocols {
+  sieve = yes
+}
+protocol sieve {
+}
+protocol lmtp {
+  mail_plugins {
+    sieve = yes
+  }
+}
+sieve_script personal {
+  type = personal
+  active_path = /srv/mailstore/%{user | domain}/%{user | username }/.dovecot.sieve
+  path = /srv/mailstore/%{user | domain}/%{user | username }/sieve
+}
+sieve_script before {
+  type = before
+  sieve_script_path = /var/lib/dovecot/sieve/before
+}
+sieve_script after {
+  type = after
+  sieve_script_path = /var/lib/dovecot/sieve/after
+}
+#sieve_user_log_path = /srv/mailstore/%{user | domain}/%{user | username }/.dovecot.sieve.log
+service managesieve {
+}
+service managesieve-login {
+  inet_listener sieve {
+    port = 4190
+  }
+}
+
+
+# sieve-extprograms plugin
+sieve_plugins {
+  sieve_extprograms = yes
+}
+sieve_global_extensions {
+  vnd.dovecot.pipe = yes
+  vnd.dovecot.filter = yes
+  vnd.dovecot.execute = yes
+  vnd.dovecot.debug = yes
+}
+sieve_pipe_bin_dir = /var/lib/dovecot/sieve/pipes
+sieve_execute_bin_dir = /var/lib/dovecot/sieve/pipes
+
+
+# imap-sieve plugin
+protocol imap {
+  mail_plugins {
+    imap_sieve = yes
+  }
+}
+sieve_plugins {
+  sieve_imapsieve = yes
+}
+mailbox Junk {
+  sieve_script learn-spam {
+    type = before
+    cause = copy
+    path = /var/lib/dovecot/sieve/pipes/learn-spam.sieve
+  }
+}
+imapsieve_from Junk {
+  sieve_script learn-ham {
+    type = before
+    cause = copy
+    path = /var/lib/dovecot/sieve/pipes/learn-ham.sieve
+  }
+}
+
+
+# (disabled) service health check
+# cf. https://doc.dovecot.org/main/core/config/health_check.html
+#service health-check {
+#  executable = script -p health-check.sh
+#  inet_listener health-check {
+#    port = 5001
+#  }
+#}
+
+
+#log_debug = category=auth 
+#log_debug = category=imap
+#log_debug = category=lmtp
+#log_debug = category=fts
+#log_debug = category=sieve
+#log_debug = category=imapsieve
+#log_debug = category=acl
+#log_debug = category=dict_server
+#log_debug = category=namespace
+#log_debug = category=mail
+
+
+# More info:
+# doveadm -v service status
+
+# See also
+# * https://monospace.games/posts/20250815-dovecot-24.html
+# * https://workaround.org/ispmail-trixie/
+# * https://thomas-leister.de/en/mailserver-migrate-config-to-dovecot-2.4-debian-trixie/

mail_system/templates/dovecot/quota-warning.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+PERCENT=$1
+USER=$2
+cat << EOF | /usr/bin/mail -s "---- Quota warning ----" $USER
+Your mailbox is now $PERCENT% full.
+EOF

mail_system/templates/dovecot/rspamd-learn-ham.sh

@@ -1,2 +0,0 @@
-#!/bin/sh
-exec /usr/bin/rspamc learn_ham

mail_system/templates/dovecot/rspamd-learn-spam.sh

@@ -1,2 +0,0 @@
-#!/bin/sh
-exec /usr/bin/rspamc learn_spam