feat: add support for Dovecot deployment on Fedora 43 and 44 with systemd unit files and configuration templates

roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/accounts

@@ -0,0 +1,5 @@
+{% if dovecot_users is defined and dovecot_users is iterable %}
+{% for user in dovecot_users %}
+{{ user.email }}:{{ user.password | password_hash('sha512') }}::::::
+{% endfor %}
+{% endif %}

roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/conf.d/local.conf

@@ -0,0 +1,80 @@
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = PROFILE=SYSTEM
+ssl_server {
+  cert_file = /etc/dovecot/certificates/pubcert.pem
+  key_file = /etc/dovecot/certificates/privkey.pem
+}
+
+mail_driver = maildir
+mail_path = /var/spool/mail/%{user | domain}/%{user | username}
+mail_privileged_group = mail
+first_valid_uid = 0
+mail_uid = mail
+mail_gid = mail
+mail_home = /var/spool/mail/%{user | domain}/%{user | username}
+
+passdb passwd-file {
+  driver = passwd-file
+  passwd_file_path = /etc/dovecot/accounts
+  default_password_scheme = SHA512-CRYPT
+  auth_username_format = %{user}
+}
+userdb static {
+  driver = static
+}
+
+mail_plugins {
+  quota = yes
+}
+
+protocols {
+  imap = yes
+  lmtp = yes
+  submission = yes
+}
+
+service lmtp {
+  inet_listener lmtp {
+    address = 0.0.0.0 ::
+    port = 24
+  }
+}
+lmtp_add_received_header = yes
+
+protocol lmtp {
+  mail_plugins {
+    sieve = yes
+  }
+}
+
+protocol imap {
+  mail_plugins {
+    imap_quota = yes
+  }
+}
+
+service quota-status {
+  client_limit = 1
+  executable = quota-status -p postfix
+  inet_listener {
+    # port = 12340
+  }
+}
+
+mailbox_list_index = yes
+protocol !indexer-worker {
+  mail_vsize_bg_after_count = 100
+}
+
+plugin {
+  quota = count:User quota
+  quota_rule = *:storage={{ dovecot_quota }}
+  quota_rule2 = Trash:storage=+100M
+  quota_rule3 = SPAM:ignore
+  quota_vsizes = yes
+}
+
+submission_relay_host = localhost
+protocol submission {
+  mail_max_userip_connections = 10
+}

roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/dovecot.conf

@@ -0,0 +1,53 @@
+## Dovecot configuration file
+
+# Dovecot configuration version. This must be the first setting in the
+# configuration file. It specifies the configuration syntax, the used setting
+# names and the expected default values.
+dovecot_config_version = 2.4.4
+
+# Dovecot storage file format version. It specifies the oldest Dovecot version
+# that must be able to read files written by this Dovecot instance. The
+# intention is that when upgrading Dovecot cluster, this setting is first kept
+# as the old Dovecot version. Once the cluster is fully upgraded to a new
+# version and there is no intention to rollback to the old version anymore,
+# this version number can be increased.
+dovecot_storage_version = 2.4.4
+
+# The configuration below is a minimal configuration file using system user authentication.
+# See https://doc.dovecot.org/latest/core/config/quick.html
+
+# Enable wanted protocols:
+protocols {
+  imap = yes
+  lmtp = yes
+}
+
+mail_home = /home/%{user}
+mail_driver = maildir
+mail_path = ~/mail
+
+# By default first_valid_uid is 1000. If your vmail user's UID is smaller,
+# you need to modify this:
+first_valid_uid = 1000
+
+namespace inbox {
+  inbox = yes
+  separator = /
+}
+
+# Authenticate as system users:
+passdb pam {
+}
+
+userdb passwd {
+}
+
+ssl = required
+ssl_cipher_list = PROFILE=SYSTEM
+
+ssl_server {
+  cert_file = /etc/pki/dovecot/certs/dovecot.pem
+  key_file = /etc/pki/dovecot/private/dovecot.pem
+}
+
+!include_try conf.d/*.conf

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Copy TLS Certificates for Dovecot
+
+[Service]
+Type=oneshot
+ExecStartPre=mkdir -p /etc/dovecot/certificates
+ExecStart=/bin/bash -lc 'cp /etc/httpd/md/domains/{{ dovecot_vhost }}/*.pem /etc/dovecot/certificates/'
+ExecStartPost=chown -R root:root /etc/dovecot/certificates
+
+[Install]
+WantedBy=dovecot.service
+

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Copy TLS Certificates for Dovecot
+
+[Timer]
+OnUnitActiveSec=5min
+
+[Install]
+WantedBy=dovecot.service
+

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-init.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=One-time Dovecot init service
+ConditionPathExists=|!/etc/pki/dovecot/certs/dovecot.pem
+
+[Service]
+Type=oneshot
+RemainAfterExit=no
+ExecStart=/bin/sh -c '\
+if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; \
+then\
+  SSLDIR=/etc/pki/dovecot/ OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf /usr/libexec/dovecot/mkcert.sh /dev/null 2>&1;\
+fi'
+

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.service

@@ -0,0 +1,39 @@
+# This file is part of Dovecot
+#
+# DO NOT CUSTOMIZE THIS FILE, INSTEAD
+# create the file:
+#	`/etc/systemd/system/dovecot.service.d/service.conf'.
+# or copy this as
+#	`/etc/systemd/system/dovecot.service` and edit then
+# and put your changes there
+
+[Unit]
+Description=Dovecot IMAP/POP3 email server
+Documentation=man:dovecot(1)
+Documentation=https://doc.dovecot.org/
+After=local-fs.target network-online.target remote-fs.target time-sync.target dovecot-init.service
+Requires=dovecot-init.service
+Wants=network-online.target
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/dovecot -F
+ExecReload=/usr/bin/doveadm reload
+ExecStop=/usr/bin/doveadm stop
+PrivateTmp=true
+NonBlocking=yes
+# this will make /usr /boot /etc read only for dovecot
+ProtectSystem=full
+ProtectHome=no
+PrivateDevices=true
+OOMPolicy=continue
+
+# You can add environment variables with e.g.:
+#Environment='CORE_OUTOFMEM=1'
+# If you have trouble with `Too many open files', increase
+LimitNOFILE=65535
+# If you want to allow the Dovecot services to produce core dumps, use:
+#LimitCORE=infinity
+
+[Install]
+WantedBy=multi-user.target

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.socket

@@ -0,0 +1,15 @@
+[Unit]
+Description=Dovecot IMAP/POP3 email server activation socket
+
+[Socket]
+#dovecot expects separate IPv4 and IPv6 sockets
+BindIPv6Only=ipv6-only
+ListenStream=0.0.0.0:143
+ListenStream=[::]:143
+ListenStream=0.0.0.0:993
+ListenStream=[::]:993
+KeepAlive=true
+
+[Install]
+WantedBy=sockets.target
+

roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/accounts

@@ -0,0 +1,5 @@
+{% if dovecot_users is defined and dovecot_users is iterable %}
+{% for user in dovecot_users %}
+{{ user.email }}:{{ user.password | password_hash('sha512') }}::::::
+{% endfor %}
+{% endif %}

roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/conf.d/local.conf

@@ -0,0 +1,80 @@
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = PROFILE=SYSTEM
+ssl_server {
+  cert_file = /etc/dovecot/certificates/pubcert.pem
+  key_file = /etc/dovecot/certificates/privkey.pem
+}
+
+mail_driver = maildir
+mail_path = /var/spool/mail/%{user | domain}/%{user | username}
+mail_privileged_group = mail
+first_valid_uid = 0
+mail_uid = mail
+mail_gid = mail
+mail_home = /var/spool/mail/%{user | domain}/%{user | username}
+
+passdb passwd-file {
+  driver = passwd-file
+  passwd_file_path = /etc/dovecot/accounts
+  default_password_scheme = SHA512-CRYPT
+  auth_username_format = %{user}
+}
+userdb static {
+  driver = static
+}
+
+mail_plugins {
+  quota = yes
+}
+
+protocols {
+  imap = yes
+  lmtp = yes
+  submission = yes
+}
+
+service lmtp {
+  inet_listener lmtp {
+    address = 0.0.0.0 ::
+    port = 24
+  }
+}
+lmtp_add_received_header = yes
+
+protocol lmtp {
+  mail_plugins {
+    sieve = yes
+  }
+}
+
+protocol imap {
+  mail_plugins {
+    imap_quota = yes
+  }
+}
+
+service quota-status {
+  client_limit = 1
+  executable = quota-status -p postfix
+  inet_listener {
+    # port = 12340
+  }
+}
+
+mailbox_list_index = yes
+protocol !indexer-worker {
+  mail_vsize_bg_after_count = 100
+}
+
+plugin {
+  quota = count:User quota
+  quota_rule = *:storage={{ dovecot_quota }}
+  quota_rule2 = Trash:storage=+100M
+  quota_rule3 = SPAM:ignore
+  quota_vsizes = yes
+}
+
+submission_relay_host = localhost
+protocol submission {
+  mail_max_userip_connections = 10
+}

roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/dovecot.conf

@@ -0,0 +1,53 @@
+## Dovecot configuration file
+
+# Dovecot configuration version. This must be the first setting in the
+# configuration file. It specifies the configuration syntax, the used setting
+# names and the expected default values.
+dovecot_config_version = 2.4.4
+
+# Dovecot storage file format version. It specifies the oldest Dovecot version
+# that must be able to read files written by this Dovecot instance. The
+# intention is that when upgrading Dovecot cluster, this setting is first kept
+# as the old Dovecot version. Once the cluster is fully upgraded to a new
+# version and there is no intention to rollback to the old version anymore,
+# this version number can be increased.
+dovecot_storage_version = 2.4.4
+
+# The configuration below is a minimal configuration file using system user authentication.
+# See https://doc.dovecot.org/latest/core/config/quick.html
+
+# Enable wanted protocols:
+protocols {
+  imap = yes
+  lmtp = yes
+}
+
+mail_home = /home/%{user}
+mail_driver = maildir
+mail_path = ~/mail
+
+# By default first_valid_uid is 1000. If your vmail user's UID is smaller,
+# you need to modify this:
+first_valid_uid = 1000
+
+namespace inbox {
+  inbox = yes
+  separator = /
+}
+
+# Authenticate as system users:
+passdb pam {
+}
+
+userdb passwd {
+}
+
+ssl = required
+ssl_cipher_list = PROFILE=SYSTEM
+
+ssl_server {
+  cert_file = /etc/pki/dovecot/certs/dovecot.pem
+  key_file = /etc/pki/dovecot/private/dovecot.pem
+}
+
+!include_try conf.d/*.conf

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Copy TLS Certificates for Dovecot
+
+[Service]
+Type=oneshot
+ExecStartPre=mkdir -p /etc/dovecot/certificates
+ExecStart=/bin/bash -lc 'cp /etc/httpd/md/domains/{{ dovecot_vhost }}/*.pem /etc/dovecot/certificates/'
+ExecStartPost=chown -R root:root /etc/dovecot/certificates
+
+[Install]
+WantedBy=dovecot.service
+

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Copy TLS Certificates for Dovecot
+
+[Timer]
+OnUnitActiveSec=5min
+
+[Install]
+WantedBy=dovecot.service
+

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-init.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=One-time Dovecot init service
+ConditionPathExists=|!/etc/pki/dovecot/certs/dovecot.pem
+
+[Service]
+Type=oneshot
+RemainAfterExit=no
+ExecStart=/bin/sh -c '\
+if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; \
+then\
+  SSLDIR=/etc/pki/dovecot/ OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf /usr/libexec/dovecot/mkcert.sh /dev/null 2>&1;\
+fi'
+

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.service

@@ -0,0 +1,39 @@
+# This file is part of Dovecot
+#
+# DO NOT CUSTOMIZE THIS FILE, INSTEAD
+# create the file:
+#	`/etc/systemd/system/dovecot.service.d/service.conf'.
+# or copy this as
+#	`/etc/systemd/system/dovecot.service` and edit then
+# and put your changes there
+
+[Unit]
+Description=Dovecot IMAP/POP3 email server
+Documentation=man:dovecot(1)
+Documentation=https://doc.dovecot.org/
+After=local-fs.target network-online.target remote-fs.target time-sync.target dovecot-init.service
+Requires=dovecot-init.service
+Wants=network-online.target
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/dovecot -F
+ExecReload=/usr/bin/doveadm reload
+ExecStop=/usr/bin/doveadm stop
+PrivateTmp=true
+NonBlocking=yes
+# this will make /usr /boot /etc read only for dovecot
+ProtectSystem=full
+ProtectHome=no
+PrivateDevices=true
+OOMPolicy=continue
+
+# You can add environment variables with e.g.:
+#Environment='CORE_OUTOFMEM=1'
+# If you have trouble with `Too many open files', increase
+LimitNOFILE=65535
+# If you want to allow the Dovecot services to produce core dumps, use:
+#LimitCORE=infinity
+
+[Install]
+WantedBy=multi-user.target

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.socket

@@ -0,0 +1,15 @@
+[Unit]
+Description=Dovecot IMAP/POP3 email server activation socket
+
+[Socket]
+#dovecot expects separate IPv4 and IPv6 sockets
+BindIPv6Only=ipv6-only
+ListenStream=0.0.0.0:143
+ListenStream=[::]:143
+ListenStream=0.0.0.0:993
+ListenStream=[::]:993
+KeepAlive=true
+
+[Install]
+WantedBy=sockets.target
+

roles/ensure_dovecot/vars/Fedora-42-default.yml

@@ -96,3 +96,5 @@ template_list:
     src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service'
   - dest: '/usr/lib/systemd/system/dovecot-copytls.timer'
     src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer'
+...
+

roles/ensure_dovecot/vars/Fedora-43-default.yml

@@ -0,0 +1,44 @@
+---
+# vars file for ensure_dovecot
+package_list:
+  - name: 'dovecot'
+    state: 'present'
+  - name: 'dovecot-fts-xapian'
+    state: 'present'
+  - name: 'dovecot-mysql'
+    state: 'present'
+  - name: 'dovecot-pigeonhole'
+    state: 'present'
+firewall_list:
+  - permanent: 'yes'
+    service: 'imap'
+    state: 'enabled'
+  - permanent: 'yes'
+    service: 'imaps'
+    state: 'enabled'
+service_list:
+  - enabled: 'yes'
+    name: 'dovecot.service'
+    state: 'started'
+  - enabled: 'yes'
+    name: 'dovecot-copytls.service'
+    state: 'started'
+  - enabled: 'yes'
+    name: 'dovecot-copytls.timer'
+    state: 'started'
+template_list:
+  - dest: '/etc/dovecot/dovecot.conf'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/dovecot.conf'
+  - dest: '/etc/dovecot/conf.d/local.conf'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/conf.d/local.conf'
+  - dest: '/etc/dovecot/accounts'
+    group: 'dovecot'
+    mode: '0600'
+    owner: 'dovecot'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/accounts'
+  - dest: '/usr/lib/systemd/system/dovecot-copytls.service'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service'
+  - dest: '/usr/lib/systemd/system/dovecot-copytls.timer'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer'
+...
+

roles/ensure_dovecot/vars/Fedora-44-default.yml

@@ -0,0 +1,43 @@
+---
+# vars file for ensure_dovecot
+package_list:
+  - name: 'dovecot'
+    state: 'present'
+  - name: 'dovecot-fts-xapian'
+    state: 'present'
+  - name: 'dovecot-mysql'
+    state: 'present'
+  - name: 'dovecot-pigeonhole'
+    state: 'present'
+firewall_list:
+  - permanent: 'yes'
+    service: 'imap'
+    state: 'enabled'
+  - permanent: 'yes'
+    service: 'imaps'
+    state: 'enabled'
+service_list:
+  - enabled: 'yes'
+    name: 'dovecot.service'
+    state: 'started'
+  - enabled: 'yes'
+    name: 'dovecot-copytls.service'
+    state: 'started'
+  - enabled: 'yes'
+    name: 'dovecot-copytls.timer'
+    state: 'started'
+template_list:
+  - dest: '/etc/dovecot/dovecot.conf'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/dovecot.conf'
+  - dest: '/etc/dovecot/conf.d/local.conf'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/conf.d/local.conf'
+  - dest: '/etc/dovecot/accounts'
+    group: 'dovecot'
+    mode: '0600'
+    owner: 'dovecot'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/accounts'
+  - dest: '/usr/lib/systemd/system/dovecot-copytls.service'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service'
+  - dest: '/usr/lib/systemd/system/dovecot-copytls.timer'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer'
+...