IMAP: Update role to Debian Buster.

For `ssl_cipher_list` we pick the suggested value from
https://ssl-config.mozilla.org/#server=dovecot&version=2.3.9&config=intermediate&openssl=1.1.1d

At the moment it's equivalent (modulo order) to adding ‘EDH+AESGCM+aRSA’
to ‘EECDH+AESGCM:EECDH+CHACHA20!MEDIUM!LOW!EXP!aNULL!eNULL’.

1 files changed, 21 insertions, 7 deletions

diff --git a/roles/IMAP/templates/etc/dovecot/conf.d/10-master.conf.j2 b/roles/IMAP/templates/etc/dovecot/conf.d/10-master.conf.j2
index 8eef8a1..daeecf4 100644
--- a/roles/IMAP/templates/etc/dovecot/conf.d/10-master.conf.j2
+++ b/roles/IMAP/templates/etc/dovecot/conf.d/10-master.conf.j2
@@ -53,6 +53,19 @@ service pop3-login {
   }
 }
 
+service stats {
+  unix_listener stats-writer {
+    user = vmail
+    mode = 0600
+  }
+}
+
+service submission-login {
+  inet_listener submission {
+    port = 0
+  }
+}
+
 service lmtp {
   user = vmail
 
@@ -88,6 +101,8 @@ service imap {
 
 service imap-hibernate {
   unix_listener imap-hibernate {
+    # Match user running imap processes, cf.
+    # https://dovecot.org/pipermail/dovecot/2015-August/101783.html
     user = vmail
     mode = 0600
   }
@@ -98,6 +113,11 @@ service pop3 {
   #process_limit = 1024
 }
 
+service submission {
+  # Max. number of SMTP Submission processes (connections)
+  #process_limit = 1024
+}
+
 service auth {
   # auth_socket_path points to this userdb socket by default. It's typically
   # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
@@ -120,6 +140,7 @@ service auth {
   # Postfix smtp-auth
   unix_listener /var/spool/postfix-{{ postfix_instance.MSA.name }}/private/dovecot-auth {
     user = postfix
+    group = postfix
     mode = 0600
   }
 
@@ -143,10 +164,3 @@ service dict {
     #group = 
   }
 }
-
-service stats {
-  fifo_listener stats-mail {
-    user = vmail
-    mode = 0600
-  }
-}