fripost-ansible/roles/IMAP/files/etc/dovecot, branch master Fripost ansible scripts IMAP: Adjust dovecot configuration to bullseye. 2024-09-08T00:10:41+00:00 Guilhem Moulin guilhem@fripost.org 2024-09-08T00:10:41+00:00 4977d7c1d80ac0caf94914fbf9be8471d056c906 Provisioning /etc/dovecot/conf.d/*.conf is a pain on upgrade so we consolidate that by reverting these files to the distro-provided ones and shipping a single /etc/dovecot/conf.d/99-local.conf override instead. 
Provisioning /etc/dovecot/conf.d/*.conf is a pain on upgrade so we
consolidate that by reverting these files to the distro-provided ones
and shipping a single /etc/dovecot/conf.d/99-local.conf override
instead.
IMAP: Update role to Debian Buster. 2020-05-19T05:56:01+00:00 Guilhem Moulin guilhem@fripost.org 2020-05-19T00:40:48+00:00 829f4d830aefedd95a75e61cfc9aa3e03f039c6f For `ssl_cipher_list` we pick the suggested value from https://ssl-config.mozilla.org/#server=dovecot&version=2.3.9&config=intermediate&openssl=1.1.1d At the moment it's equivalent (modulo order) to adding ‘EDH+AESGCM+aRSA’ to ‘EECDH+AESGCM:EECDH+CHACHA20!MEDIUM!LOW!EXP!aNULL!eNULL’. 
For `ssl_cipher_list` we pick the suggested value from
https://ssl-config.mozilla.org/#server=dovecot&version=2.3.9&config=intermediate&openssl=1.1.1d

At the moment it's equivalent (modulo order) to adding ‘EDH+AESGCM+aRSA’
to ‘EECDH+AESGCM:EECDH+CHACHA20!MEDIUM!LOW!EXP!aNULL!eNULL’.
AEAD ciphers: Add EECDH+CHACHA20 macro. 2020-05-18T02:34:17+00:00 Guilhem Moulin guilhem@fripost.org 2020-05-18T02:34:00+00:00 61ba2a2fe12ffd5578429dfe1d354a1c5d16517a This adds the following two ciphers: ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD 
This adds the following two ciphers:

  ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH  Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
  ECDHE-RSA-CHACHA20-POLY1305   TLSv1.2 Kx=ECDH  Au=RSA   Enc=CHACHA20/POLY1305(256) Mac=AEAD
Update 'IMAP', 'MSA' and 'LDAP-provider' roles to Debian Stretch. 2018-12-09T19:25:40+00:00 Guilhem Moulin guilhem@fripost.org 2018-12-09T17:41:06+00:00 e2ddcfc51f66c2a52a401064eab005e793f148ee 






dovecot: enable user iteration and add a cronjob for `doveadm purge -A`
2017-06-05T14:44:46+00:00

Guilhem Moulin
guilhem@fripost.org

2017-06-02T12:25:21+00:00

b7a7ceb88ed5b44959920cde170bc6aaa83026bb












dovecot: use Single-Instance Storage for mail attachments.
2016-12-10T16:40:49+00:00

Guilhem Moulin
guilhem@fripost.org

2016-12-10T16:40:49+00:00

1038fa3d50bda90377117559a9f685e2e7389d8f












Dovecot: use fallocate(2) to preallocate new mdbox files.
2016-12-08T18:39:54+00:00

Guilhem Moulin
guilhem@fripost.org

2016-12-08T18:39:54+00:00

7ac4fc84987535a5b592bbfc7ecb3e3794afac93












IMAP: don't include mailbox under the virtual namespace in LIST responses.
2016-07-06T15:51:28+00:00

Guilhem Moulin
guilhem@fripost.org

2016-07-06T15:51:28+00:00

d237ec31f785c801b29d679f10f8f2d618ff1585

Clients now have to use the NAMESPACE extension [RFC 2342] to discover
mailboxes under the “virtual/” namespace.  (Plus an extra LIST command,
causing an overhead two roundtrips.)  Of course the downside is that non
namespace-aware clients lose access to the “virtual/{all,flagged,…}”
mailboxes, but on second thought it's probably better this way rather
than having such clients treat these mailboxes as regular mailboxes.





Clients now have to use the NAMESPACE extension [RFC 2342] to discover
mailboxes under the “virtual/” namespace.  (Plus an extra LIST command,
causing an overhead two roundtrips.)  Of course the downside is that non
namespace-aware clients lose access to the “virtual/{all,flagged,…}”
mailboxes, but on second thought it's probably better this way rather
than having such clients treat these mailboxes as regular mailboxes.







dovecot: use the MSA postfix instance for sieve redirection.
2016-07-01T11:13:30+00:00

Guilhem Moulin
guilhem@fripost.org

2016-07-01T10:20:32+00:00

8e24d7703401e1858a73eb1d713b4c80b3d799a9

We don't want to use the default instance since its SIZE limit is
tighter than the ones on the MX:es.





We don't want to use the default instance since its SIZE limit is
tighter than the ones on the MX:es.







dovecot: also listen on the virtual IP dedicated to IPSec.
2016-05-22T16:02:37+00:00

Guilhem Moulin
guilhem@fripost.org

2016-05-22T16:02:37+00:00

73b2a602ee85706b2a1797632142058c6253ea5d

(On port 143.)  Moreover, add the whole IPSec virtual subnet to
‘login_trusted_networks’ since our IPSec tunnels provide end-to-end
encryption and we therefore don't need the extra SSL/TLS protection.





(On port 143.)  Moreover, add the whole IPSec virtual subnet to
‘login_trusted_networks’ since our IPSec tunnels provide end-to-end
encryption and we therefore don't need the extra SSL/TLS protection.