diff --git a/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/accounts b/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/accounts new file mode 100644 index 0000000..f95634f --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/accounts @@ -0,0 +1,5 @@ +{% if dovecot_users is defined and dovecot_users is iterable %} +{% for user in dovecot_users %} +{{ user.email }}:{{ user.password | password_hash('sha512') }}:::::: +{% endfor %} +{% endif %} diff --git a/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/conf.d/local.conf b/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/conf.d/local.conf new file mode 100644 index 0000000..b3a7cfa --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/conf.d/local.conf @@ -0,0 +1,80 @@ +ssl_min_protocol = TLSv1.2 +ssl_cipher_list = PROFILE=SYSTEM +ssl_server { + cert_file = /etc/dovecot/certificates/pubcert.pem + key_file = /etc/dovecot/certificates/privkey.pem +} + +mail_driver = maildir +mail_path = /var/spool/mail/%{user | domain}/%{user | username} +mail_privileged_group = mail +first_valid_uid = 0 +mail_uid = mail +mail_gid = mail +mail_home = /var/spool/mail/%{user | domain}/%{user | username} + +passdb passwd-file { + driver = passwd-file + passwd_file_path = /etc/dovecot/accounts + default_password_scheme = SHA512-CRYPT + auth_username_format = %{user} +} +userdb static { + driver = static +} + +mail_plugins { + quota = yes +} + +protocols { + imap = yes + lmtp = yes + submission = yes +} + +service lmtp { + inet_listener lmtp { + address = 0.0.0.0 :: + port = 24 + } +} +lmtp_add_received_header = yes + +protocol lmtp { + mail_plugins { + sieve = yes + } +} + +protocol imap { + mail_plugins { + imap_quota = yes + } +} + +service quota-status { + client_limit = 1 + executable = quota-status -p postfix + inet_listener { + # port = 12340 + } +} + +mailbox_list_index = yes +protocol !indexer-worker { + mail_vsize_bg_after_count = 100 +} + +plugin { + quota = count:User quota + quota_rule = *:storage={{ dovecot_quota }} + quota_rule2 = Trash:storage=+100M + quota_rule3 = SPAM:ignore + quota_vsizes = yes +} + +submission_relay_host = localhost +protocol submission { + mail_max_userip_connections = 10 +} diff --git a/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/dovecot.conf b/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/dovecot.conf new file mode 100644 index 0000000..1dd0396 --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/dovecot.conf @@ -0,0 +1,53 @@ +## Dovecot configuration file + +# Dovecot configuration version. This must be the first setting in the +# configuration file. It specifies the configuration syntax, the used setting +# names and the expected default values. +dovecot_config_version = 2.4.4 + +# Dovecot storage file format version. It specifies the oldest Dovecot version +# that must be able to read files written by this Dovecot instance. The +# intention is that when upgrading Dovecot cluster, this setting is first kept +# as the old Dovecot version. Once the cluster is fully upgraded to a new +# version and there is no intention to rollback to the old version anymore, +# this version number can be increased. +dovecot_storage_version = 2.4.4 + +# The configuration below is a minimal configuration file using system user authentication. +# See https://doc.dovecot.org/latest/core/config/quick.html + +# Enable wanted protocols: +protocols { + imap = yes + lmtp = yes +} + +mail_home = /home/%{user} +mail_driver = maildir +mail_path = ~/mail + +# By default first_valid_uid is 1000. If your vmail user's UID is smaller, +# you need to modify this: +first_valid_uid = 1000 + +namespace inbox { + inbox = yes + separator = / +} + +# Authenticate as system users: +passdb pam { +} + +userdb passwd { +} + +ssl = required +ssl_cipher_list = PROFILE=SYSTEM + +ssl_server { + cert_file = /etc/pki/dovecot/certs/dovecot.pem + key_file = /etc/pki/dovecot/private/dovecot.pem +} + +!include_try conf.d/*.conf diff --git a/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.service b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.service new file mode 100644 index 0000000..01546fb --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.service @@ -0,0 +1,12 @@ +[Unit] +Description=Copy TLS Certificates for Dovecot + +[Service] +Type=oneshot +ExecStartPre=mkdir -p /etc/dovecot/certificates +ExecStart=/bin/bash -lc 'cp /etc/httpd/md/domains/{{ dovecot_vhost }}/*.pem /etc/dovecot/certificates/' +ExecStartPost=chown -R root:root /etc/dovecot/certificates + +[Install] +WantedBy=dovecot.service + diff --git a/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.timer b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.timer new file mode 100644 index 0000000..622a8b6 --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.timer @@ -0,0 +1,9 @@ +[Unit] +Description=Copy TLS Certificates for Dovecot + +[Timer] +OnUnitActiveSec=5min + +[Install] +WantedBy=dovecot.service + diff --git a/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-init.service b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-init.service new file mode 100644 index 0000000..33f8679 --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-init.service @@ -0,0 +1,13 @@ +[Unit] +Description=One-time Dovecot init service +ConditionPathExists=|!/etc/pki/dovecot/certs/dovecot.pem + +[Service] +Type=oneshot +RemainAfterExit=no +ExecStart=/bin/sh -c '\ +if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; \ +then\ + SSLDIR=/etc/pki/dovecot/ OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf /usr/libexec/dovecot/mkcert.sh /dev/null 2>&1;\ +fi' + diff --git a/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.service b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.service new file mode 100644 index 0000000..18d6f32 --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.service @@ -0,0 +1,39 @@ +# This file is part of Dovecot +# +# DO NOT CUSTOMIZE THIS FILE, INSTEAD +# create the file: +# `/etc/systemd/system/dovecot.service.d/service.conf'. +# or copy this as +# `/etc/systemd/system/dovecot.service` and edit then +# and put your changes there + +[Unit] +Description=Dovecot IMAP/POP3 email server +Documentation=man:dovecot(1) +Documentation=https://doc.dovecot.org/ +After=local-fs.target network-online.target remote-fs.target time-sync.target dovecot-init.service +Requires=dovecot-init.service +Wants=network-online.target + +[Service] +Type=notify +ExecStart=/usr/bin/dovecot -F +ExecReload=/usr/bin/doveadm reload +ExecStop=/usr/bin/doveadm stop +PrivateTmp=true +NonBlocking=yes +# this will make /usr /boot /etc read only for dovecot +ProtectSystem=full +ProtectHome=no +PrivateDevices=true +OOMPolicy=continue + +# You can add environment variables with e.g.: +#Environment='CORE_OUTOFMEM=1' +# If you have trouble with `Too many open files', increase +LimitNOFILE=65535 +# If you want to allow the Dovecot services to produce core dumps, use: +#LimitCORE=infinity + +[Install] +WantedBy=multi-user.target diff --git a/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.socket b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.socket new file mode 100644 index 0000000..0fdef6f --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.socket @@ -0,0 +1,15 @@ +[Unit] +Description=Dovecot IMAP/POP3 email server activation socket + +[Socket] +#dovecot expects separate IPv4 and IPv6 sockets +BindIPv6Only=ipv6-only +ListenStream=0.0.0.0:143 +ListenStream=[::]:143 +ListenStream=0.0.0.0:993 +ListenStream=[::]:993 +KeepAlive=true + +[Install] +WantedBy=sockets.target + diff --git a/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/accounts b/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/accounts new file mode 100644 index 0000000..f95634f --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/accounts @@ -0,0 +1,5 @@ +{% if dovecot_users is defined and dovecot_users is iterable %} +{% for user in dovecot_users %} +{{ user.email }}:{{ user.password | password_hash('sha512') }}:::::: +{% endfor %} +{% endif %} diff --git a/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/conf.d/local.conf b/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/conf.d/local.conf new file mode 100644 index 0000000..b3a7cfa --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/conf.d/local.conf @@ -0,0 +1,80 @@ +ssl_min_protocol = TLSv1.2 +ssl_cipher_list = PROFILE=SYSTEM +ssl_server { + cert_file = /etc/dovecot/certificates/pubcert.pem + key_file = /etc/dovecot/certificates/privkey.pem +} + +mail_driver = maildir +mail_path = /var/spool/mail/%{user | domain}/%{user | username} +mail_privileged_group = mail +first_valid_uid = 0 +mail_uid = mail +mail_gid = mail +mail_home = /var/spool/mail/%{user | domain}/%{user | username} + +passdb passwd-file { + driver = passwd-file + passwd_file_path = /etc/dovecot/accounts + default_password_scheme = SHA512-CRYPT + auth_username_format = %{user} +} +userdb static { + driver = static +} + +mail_plugins { + quota = yes +} + +protocols { + imap = yes + lmtp = yes + submission = yes +} + +service lmtp { + inet_listener lmtp { + address = 0.0.0.0 :: + port = 24 + } +} +lmtp_add_received_header = yes + +protocol lmtp { + mail_plugins { + sieve = yes + } +} + +protocol imap { + mail_plugins { + imap_quota = yes + } +} + +service quota-status { + client_limit = 1 + executable = quota-status -p postfix + inet_listener { + # port = 12340 + } +} + +mailbox_list_index = yes +protocol !indexer-worker { + mail_vsize_bg_after_count = 100 +} + +plugin { + quota = count:User quota + quota_rule = *:storage={{ dovecot_quota }} + quota_rule2 = Trash:storage=+100M + quota_rule3 = SPAM:ignore + quota_vsizes = yes +} + +submission_relay_host = localhost +protocol submission { + mail_max_userip_connections = 10 +} diff --git a/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/dovecot.conf b/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/dovecot.conf new file mode 100644 index 0000000..1dd0396 --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/dovecot.conf @@ -0,0 +1,53 @@ +## Dovecot configuration file + +# Dovecot configuration version. This must be the first setting in the +# configuration file. It specifies the configuration syntax, the used setting +# names and the expected default values. +dovecot_config_version = 2.4.4 + +# Dovecot storage file format version. It specifies the oldest Dovecot version +# that must be able to read files written by this Dovecot instance. The +# intention is that when upgrading Dovecot cluster, this setting is first kept +# as the old Dovecot version. Once the cluster is fully upgraded to a new +# version and there is no intention to rollback to the old version anymore, +# this version number can be increased. +dovecot_storage_version = 2.4.4 + +# The configuration below is a minimal configuration file using system user authentication. +# See https://doc.dovecot.org/latest/core/config/quick.html + +# Enable wanted protocols: +protocols { + imap = yes + lmtp = yes +} + +mail_home = /home/%{user} +mail_driver = maildir +mail_path = ~/mail + +# By default first_valid_uid is 1000. If your vmail user's UID is smaller, +# you need to modify this: +first_valid_uid = 1000 + +namespace inbox { + inbox = yes + separator = / +} + +# Authenticate as system users: +passdb pam { +} + +userdb passwd { +} + +ssl = required +ssl_cipher_list = PROFILE=SYSTEM + +ssl_server { + cert_file = /etc/pki/dovecot/certs/dovecot.pem + key_file = /etc/pki/dovecot/private/dovecot.pem +} + +!include_try conf.d/*.conf diff --git a/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.service b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.service new file mode 100644 index 0000000..01546fb --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.service @@ -0,0 +1,12 @@ +[Unit] +Description=Copy TLS Certificates for Dovecot + +[Service] +Type=oneshot +ExecStartPre=mkdir -p /etc/dovecot/certificates +ExecStart=/bin/bash -lc 'cp /etc/httpd/md/domains/{{ dovecot_vhost }}/*.pem /etc/dovecot/certificates/' +ExecStartPost=chown -R root:root /etc/dovecot/certificates + +[Install] +WantedBy=dovecot.service + diff --git a/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.timer b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.timer new file mode 100644 index 0000000..622a8b6 --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.timer @@ -0,0 +1,9 @@ +[Unit] +Description=Copy TLS Certificates for Dovecot + +[Timer] +OnUnitActiveSec=5min + +[Install] +WantedBy=dovecot.service + diff --git a/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-init.service b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-init.service new file mode 100644 index 0000000..33f8679 --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-init.service @@ -0,0 +1,13 @@ +[Unit] +Description=One-time Dovecot init service +ConditionPathExists=|!/etc/pki/dovecot/certs/dovecot.pem + +[Service] +Type=oneshot +RemainAfterExit=no +ExecStart=/bin/sh -c '\ +if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; \ +then\ + SSLDIR=/etc/pki/dovecot/ OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf /usr/libexec/dovecot/mkcert.sh /dev/null 2>&1;\ +fi' + diff --git a/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.service b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.service new file mode 100644 index 0000000..18d6f32 --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.service @@ -0,0 +1,39 @@ +# This file is part of Dovecot +# +# DO NOT CUSTOMIZE THIS FILE, INSTEAD +# create the file: +# `/etc/systemd/system/dovecot.service.d/service.conf'. +# or copy this as +# `/etc/systemd/system/dovecot.service` and edit then +# and put your changes there + +[Unit] +Description=Dovecot IMAP/POP3 email server +Documentation=man:dovecot(1) +Documentation=https://doc.dovecot.org/ +After=local-fs.target network-online.target remote-fs.target time-sync.target dovecot-init.service +Requires=dovecot-init.service +Wants=network-online.target + +[Service] +Type=notify +ExecStart=/usr/bin/dovecot -F +ExecReload=/usr/bin/doveadm reload +ExecStop=/usr/bin/doveadm stop +PrivateTmp=true +NonBlocking=yes +# this will make /usr /boot /etc read only for dovecot +ProtectSystem=full +ProtectHome=no +PrivateDevices=true +OOMPolicy=continue + +# You can add environment variables with e.g.: +#Environment='CORE_OUTOFMEM=1' +# If you have trouble with `Too many open files', increase +LimitNOFILE=65535 +# If you want to allow the Dovecot services to produce core dumps, use: +#LimitCORE=infinity + +[Install] +WantedBy=multi-user.target diff --git a/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.socket b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.socket new file mode 100644 index 0000000..0fdef6f --- /dev/null +++ b/roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.socket @@ -0,0 +1,15 @@ +[Unit] +Description=Dovecot IMAP/POP3 email server activation socket + +[Socket] +#dovecot expects separate IPv4 and IPv6 sockets +BindIPv6Only=ipv6-only +ListenStream=0.0.0.0:143 +ListenStream=[::]:143 +ListenStream=0.0.0.0:993 +ListenStream=[::]:993 +KeepAlive=true + +[Install] +WantedBy=sockets.target + diff --git a/roles/ensure_dovecot/vars/Fedora-42-default.yml b/roles/ensure_dovecot/vars/Fedora-42-default.yml index ce0a343..63c9afa 100644 --- a/roles/ensure_dovecot/vars/Fedora-42-default.yml +++ b/roles/ensure_dovecot/vars/Fedora-42-default.yml @@ -96,3 +96,5 @@ template_list: src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service' - dest: '/usr/lib/systemd/system/dovecot-copytls.timer' src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer' +... + diff --git a/roles/ensure_dovecot/vars/Fedora-43-default.yml b/roles/ensure_dovecot/vars/Fedora-43-default.yml new file mode 100644 index 0000000..c2c2694 --- /dev/null +++ b/roles/ensure_dovecot/vars/Fedora-43-default.yml @@ -0,0 +1,44 @@ +--- +# vars file for ensure_dovecot +package_list: + - name: 'dovecot' + state: 'present' + - name: 'dovecot-fts-xapian' + state: 'present' + - name: 'dovecot-mysql' + state: 'present' + - name: 'dovecot-pigeonhole' + state: 'present' +firewall_list: + - permanent: 'yes' + service: 'imap' + state: 'enabled' + - permanent: 'yes' + service: 'imaps' + state: 'enabled' +service_list: + - enabled: 'yes' + name: 'dovecot.service' + state: 'started' + - enabled: 'yes' + name: 'dovecot-copytls.service' + state: 'started' + - enabled: 'yes' + name: 'dovecot-copytls.timer' + state: 'started' +template_list: + - dest: '/etc/dovecot/dovecot.conf' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/dovecot.conf' + - dest: '/etc/dovecot/conf.d/local.conf' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/conf.d/local.conf' + - dest: '/etc/dovecot/accounts' + group: 'dovecot' + mode: '0600' + owner: 'dovecot' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/accounts' + - dest: '/usr/lib/systemd/system/dovecot-copytls.service' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service' + - dest: '/usr/lib/systemd/system/dovecot-copytls.timer' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer' +... + diff --git a/roles/ensure_dovecot/vars/Fedora-44-default.yml b/roles/ensure_dovecot/vars/Fedora-44-default.yml new file mode 100644 index 0000000..48d02fe --- /dev/null +++ b/roles/ensure_dovecot/vars/Fedora-44-default.yml @@ -0,0 +1,43 @@ +--- +# vars file for ensure_dovecot +package_list: + - name: 'dovecot' + state: 'present' + - name: 'dovecot-fts-xapian' + state: 'present' + - name: 'dovecot-mysql' + state: 'present' + - name: 'dovecot-pigeonhole' + state: 'present' +firewall_list: + - permanent: 'yes' + service: 'imap' + state: 'enabled' + - permanent: 'yes' + service: 'imaps' + state: 'enabled' +service_list: + - enabled: 'yes' + name: 'dovecot.service' + state: 'started' + - enabled: 'yes' + name: 'dovecot-copytls.service' + state: 'started' + - enabled: 'yes' + name: 'dovecot-copytls.timer' + state: 'started' +template_list: + - dest: '/etc/dovecot/dovecot.conf' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/dovecot.conf' + - dest: '/etc/dovecot/conf.d/local.conf' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/conf.d/local.conf' + - dest: '/etc/dovecot/accounts' + group: 'dovecot' + mode: '0600' + owner: 'dovecot' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/accounts' + - dest: '/usr/lib/systemd/system/dovecot-copytls.service' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service' + - dest: '/usr/lib/systemd/system/dovecot-copytls.timer' + src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer' +...