From f7c8011b39044a69daa091ef2c0f7a7aefacb663 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 14 May 2015 23:14:25 +0200
Subject: Upgrade Dovecot config to Jessie.

---
 roles/IMAP/files/etc/dovecot/conf.d/10-auth.conf   |   3 +-
 roles/IMAP/files/etc/dovecot/conf.d/10-mail.conf   |  35 ++++---
 roles/IMAP/files/etc/dovecot/conf.d/10-master.conf |  14 ++-
 roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf    |  16 ++-
 roles/IMAP/files/etc/dovecot/conf.d/20-imap.conf   | 109 +++++++++++----------
 roles/IMAP/files/etc/dovecot/conf.d/20-lmtp.conf   |   3 +
 roles/IMAP/files/etc/dovecot/conf.d/90-sieve.conf  |  25 ++---
 .../files/etc/dovecot/conf.d/auth-ldap.conf.ext    |   2 +-
 roles/IMAP/files/etc/dovecot/dovecot-ldap.conf.ext |   5 +-
 9 files changed, 119 insertions(+), 93 deletions(-)

(limited to 'roles/IMAP/files')

diff --git a/roles/IMAP/files/etc/dovecot/conf.d/10-auth.conf b/roles/IMAP/files/etc/dovecot/conf.d/10-auth.conf
index cf0189e..d4f323d 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/10-auth.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/10-auth.conf
@@ -6,7 +6,8 @@
 # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
 # matches the local IP (ie. you're connecting from the same computer), the
 # connection is considered secure and plaintext authentication is allowed.
-disable_plaintext_auth = yes
+# See also ssl=required setting.
+#disable_plaintext_auth = yes
 
 # Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
 # bsdauth, PAM and vpopmail require cache_key to be set for caching to be used.
diff --git a/roles/IMAP/files/etc/dovecot/conf.d/10-mail.conf b/roles/IMAP/files/etc/dovecot/conf.d/10-mail.conf
index dcc1d9c..c98d3f6 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/10-mail.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/10-mail.conf
@@ -107,7 +107,7 @@ namespace virtual {
   #list = children
 #}
 # Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"?
-#mail_shared_explicit_inbox = yes
+#mail_shared_explicit_inbox = no
 
 # System user and group used to access mails. If you use multiple, userdb
 # can override these by returning uid or gid fields. You can use either numbers
@@ -133,6 +133,10 @@ mail_gid = vmail
 # or ~user/.
 #mail_full_filesystem_access = no
 
+# Dictionary for key=value mailbox attributes. Currently used by URLAUTH, but
+# soon intended to be used by METADATA as well.
+#mail_attribute_dict =
+
 ##
 ## Mail processes
 ##
@@ -151,13 +155,6 @@ mail_gid = vmail
 #   never: Never use it (best performance, but crashes can lose data)
 #mail_fsync = optimized
 
-# Mail storage exists in NFS. Set this to yes to make Dovecot flush NFS caches
-# whenever needed. If you're using only a single mail server this isn't needed.
-#mail_nfs_storage = no
-# Mail index files also exist in NFS. Setting this to yes requires
-# mmap_disable=yes and fsync_disable=no.
-#mail_nfs_index = no
-
 # Locking method for index files. Alternatives are fcntl, flock and dotlock.
 # Dotlocking uses some tricks which may create more disk I/O than other locking
 # methods. NFS users: flock doesn't work, remember to change mmap_disable.
@@ -170,14 +167,14 @@ mail_gid = vmail
 # to make sure that users can't log in as daemons or other system users.
 # Note that denying root logins is hardcoded to dovecot binary and can't
 # be done even if first_valid_uid is set to 0.
-first_valid_uid = 1
+#first_valid_uid = 500
 #last_valid_uid = 0
 
 # Valid GID range for users, defaults to non-root/wheel. Users having
 # non-valid GID as primary group ID aren't allowed to log in. If user
 # belongs to supplementary groups with non-valid GIDs, those groups are
 # not set.
-first_valid_gid = 1
+#first_valid_gid = 1
 #last_valid_gid = 0
 
 # Maximum allowed length for mail keyword name. It's only forced when trying
@@ -216,6 +213,10 @@ mail_plugins = virtual zlib
 ## Mailbox handling optimizations
 ##
 
+# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are
+# also required for IMAP NOTIFY extension to be enabled.
+mailbox_list_index = yes
+
 # The minimum number of mails in a mailbox before updates are done to cache
 # file. This allows optimizing Dovecot's behavior to do less disk writes at
 # the cost of more disk reads.
@@ -267,6 +268,10 @@ mail_plugins = virtual zlib
 # broken size. The performance hit for enabling this is very small.
 #maildir_broken_filename_sizes = no
 
+# Always move mails from new/ directory to cur/, even when the \Recent flags
+# aren't being reset.
+#maildir_empty_new = no
+
 ##
 ## mbox-specific settings
 ##
@@ -285,8 +290,14 @@ mail_plugins = virtual zlib
 # in is important to avoid deadlocks if other MTAs/MUAs are using multiple
 # locking methods as well. Some operating systems don't allow using some of
 # them simultaneously.
+#
+# The Debian value for mbox_write_locks differs from upstream Dovecot. It is
+# changed to be compliant with Debian Policy (section 11.6) for NFS safety.
+#       Dovecot: mbox_write_locks = dotlock fcntl
+#       Debian:  mbox_write_locks = fcntl dotlock
+#
 #mbox_read_locks = fcntl
-#mbox_write_locks = dotlock fcntl
+#mbox_write_locks = fcntl dotlock
 
 # Maximum time to wait for lock (all of them) before aborting.
 #mbox_lock_timeout = 5 mins
@@ -350,8 +361,6 @@ mail_plugins = virtual zlib
 # also allows single instance storage for them. Other backends don't support
 # this for now.
 
-# WARNING: This feature hasn't been tested much yet. Use at your own risk.
-
 # Directory root where to store mail attachments. Disabled, if empty.
 #mail_attachment_dir =
 
diff --git a/roles/IMAP/files/etc/dovecot/conf.d/10-master.conf b/roles/IMAP/files/etc/dovecot/conf.d/10-master.conf
index 30e9fb6..189e96e 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/10-master.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/10-master.conf
@@ -8,25 +8,25 @@
 
 # Login user is internally used by login processes. This is the most untrusted
 # user in Dovecot system. It shouldn't have access to anything at all.
-default_login_user = dovenull
+#default_login_user = dovenull
 
 # Internal user is used by unprivileged processes. It should be separate from
 # login user, so that login processes can't disturb other processes.
-default_internal_user = dovecot
+#default_internal_user = dovecot
 
 service imap-login {
   inet_listener imap {
     port = 0
   }
   inet_listener imaps {
-    port = 993
-    ssl = yes
+    #port = 993
+    #ssl = yes
   }
 
   # Number of connections to handle before starting a new process. Typically
   # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
   # is faster. <doc/wiki/LoginProcess.txt>
-  service_count = 1
+  #service_count = 1
 
   # Max. number of IMAP processes (logins)
   process_limit = 256
@@ -46,8 +46,6 @@ service pop3-login {
     #port = 995
     #ssl = yes
   }
-
-  service_count = 1
 }
 
 service lmtp {
@@ -112,7 +110,7 @@ service auth {
   }
 
   # Auth process is run as this user.
-  user = $default_internal_user
+  #user = $default_internal_user
 }
 
 service auth-worker {
diff --git a/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf b/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
index 526da9c..90843b2 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
@@ -26,6 +26,13 @@ ssl_key = </etc/dovecot/ssl/imap.fripost.org.key
 # Require that CRL check succeeds for client certificates.
 #ssl_require_crl = yes
 
+# Directory and/or file for trusted SSL CA certificates. These are used only
+# when Dovecot needs to act as an SSL client (e.g. imapc backend). The
+# directory is usually /etc/ssl/certs in Debian-based systems and the file is
+# /etc/pki/tls/cert.pem in RedHat-based systems.
+#ssl_client_ca_dir =
+#ssl_client_ca_file =
+
 # Request client to send a certificate. If you also want to require it, set
 # auth_ssl_require_client_cert=yes in auth section.
 #ssl_verify_client_cert = no
@@ -35,10 +42,8 @@ ssl_key = </etc/dovecot/ssl/imap.fripost.org.key
 # auth_ssl_username_from_cert=yes.
 #ssl_cert_username_field = commonName
 
-# How often to regenerate the SSL parameters file. Generation is quite CPU
-# intensive operation. The value is in hours, 0 disables regeneration
-# entirely.
-#ssl_parameters_regenerate = 168
+# DH parameters length to use.
+#ssl_dh_parameters_length = 1024
 
 # SSL protocols to use
 ssl_protocols = !SSLv2
@@ -46,5 +51,8 @@ ssl_protocols = !SSLv2
 # SSL ciphers to use
 ssl_cipher_list = HIGH:!SSLv2:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH
 
+# Prefer the server's order of ciphers over client's.
+#ssl_prefer_server_ciphers = no
+
 # SSL crypto device to use, for valid values run "openssl engine"
 #ssl_crypto_device =
diff --git a/roles/IMAP/files/etc/dovecot/conf.d/20-imap.conf b/roles/IMAP/files/etc/dovecot/conf.d/20-imap.conf
index 2557b78..1807e05 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/20-imap.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/20-imap.conf
@@ -2,67 +2,70 @@
 ## IMAP specific settings
 ##
 
-protocol imap {
-  # Maximum IMAP command line length. Some clients generate very long command
-  # lines with huge mailboxes, so you may need to raise this if you get
-  # "Too long argument" or "IMAP command line too large" errors often.
-  #imap_max_line_length = 64k
+# Maximum IMAP command line length. Some clients generate very long command
+# lines with huge mailboxes, so you may need to raise this if you get
+# "Too long argument" or "IMAP command line too large" errors often.
+#imap_max_line_length = 64k
 
-  # Maximum number of IMAP connections allowed for a user from each IP address.
-  # NOTE: The username is compared case-sensitively.
-  mail_max_userip_connections = 16
+# IMAP logout format string:
+#  %i - total number of bytes read from client
+#  %o - total number of bytes sent to client
+#imap_logout_format = in=%i out=%o
 
-  # Space separated list of plugins to load (default is global mail_plugins).
-  #mail_plugins = $mail_plugins antispam
+# Override the IMAP CAPABILITY response. If the value begins with '+',
+# add the given capabilities on top of the defaults (e.g. +XFOO XBAR).
+#imap_capability = 
 
-  # IMAP logout format string:
-  #  %i - total number of bytes read from client
-  #  %o - total number of bytes sent to client
-  #imap_logout_format = bytes=%i/%o
+# How long to wait between "OK Still here" notifications when client is
+# IDLEing.
+#imap_idle_notify_interval = 2 mins
 
-  # Override the IMAP CAPABILITY response. If the value begins with '+',
-  # add the given capabilities on top of the defaults (e.g. +XFOO XBAR).
-  #imap_capability = 
+# ID field names and values to send to clients. Using * as the value makes
+# Dovecot use the default value. The following fields have default values
+# currently: name, version, os, os-version, support-url, support-email.
+#imap_id_send = 
 
-  # How long to wait between "OK Still here" notifications when client is
-  # IDLEing.
-  #imap_idle_notify_interval = 2 mins
+# ID fields sent by client to log. * means everything.
+#imap_id_log =
 
-  # ID field names and values to send to clients. Using * as the value makes
-  # Dovecot use the default value. The following fields have default values
-  # currently: name, version, os, os-version, support-url, support-email.
-  #imap_id_send = 
+# Workarounds for various client bugs:
+#   delay-newmail:
+#     Send EXISTS/RECENT new mail notifications only when replying to NOOP
+#     and CHECK commands. Some clients ignore them otherwise, for example OSX
+#     Mail (<v2.1). Outlook Express breaks more badly though, without this it
+#     may show user "Message no longer in server" errors. Note that OE6 still
+#     breaks even with this workaround if synchronization is set to
+#     "Headers Only".
+#   tb-extra-mailbox-sep:
+#     Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
+#     adds extra '/' suffixes to mailbox names. This option causes Dovecot to
+#     ignore the extra '/' instead of treating it as invalid mailbox name.
+#   tb-lsub-flags:
+#     Show \Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
+#     This makes Thunderbird realize they aren't selectable and show them
+#     greyed out, instead of only later giving "not selectable" popup error.
+#
+# The list is space-separated.
+#imap_client_workarounds = 
 
-  # ID fields sent by client to log. * means everything.
-  #imap_id_log =
+# Host allowed in URLAUTH URLs sent by client. "*" allows all.
+#imap_urlauth_host =
 
-  # Workarounds for various client bugs:
-  #   delay-newmail:
-  #     Send EXISTS/RECENT new mail notifications only when replying to NOOP
-  #     and CHECK commands. Some clients ignore them otherwise, for example OSX
-  #     Mail (<v2.1). Outlook Express breaks more badly though, without this it
-  #     may show user "Message no longer in server" errors. Note that OE6 still
-  #     breaks even with this workaround if synchronization is set to
-  #     "Headers Only".
-  #   tb-extra-mailbox-sep:
-  #     Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
-  #     adds extra '/' suffixes to mailbox names. This option causes Dovecot to
-  #     ignore the extra '/' instead of treating it as invalid mailbox name.
-  #   tb-lsub-flags:
-  #     Show \Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
-  #     This makes Thunderbird realize they aren't selectable and show them
-  #     greyed out, instead of only later giving "not selectable" popup error.
-  #
-  # The list is space-separated.
-  #imap_client_workarounds = 
+protocol imap {
+  # Space separated list of plugins to load (default is global mail_plugins).
+  #mail_plugins = $mail_plugins
 
-  # Load the 'antispam' plugin for people using the content filter.
-  # (Otherwise fallback to the static userdb.)
-  userdb {
-    driver = ldap
-    args = /etc/dovecot/dovecot-ldap-userdb.conf.ext
+  # Maximum number of IMAP connections allowed for a user from each IP address.
+  # NOTE: The username is compared case-sensitively.
+  mail_max_userip_connections = 16
 
-    # Default fields can be used to specify defaults that LDAP may override
-    default_fields = home=/home/mail/virtual/%d/%n
-  }
+#  # TODO Load the 'antispam' plugin for people using the content filter.
+#  # (Otherwise fallback to the static userdb.)
+#  userdb {
+#    driver = ldap
+#    args = /etc/dovecot/dovecot-ldap-userdb.conf.ext
+#
+#    # Default fields can be used to specify defaults that LDAP may override
+#    default_fields = home=/home/mail/virtual/%d/%n
+#  }
 }
diff --git a/roles/IMAP/files/etc/dovecot/conf.d/20-lmtp.conf b/roles/IMAP/files/etc/dovecot/conf.d/20-lmtp.conf
index b0be573..cd48ab8 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/20-lmtp.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/20-lmtp.conf
@@ -10,6 +10,9 @@
 # lda_mailbox_autocreate settings.
 #lmtp_save_to_detail_mailbox = no
 
+# Verify quota before replying to RCPT TO. This adds a small overhead.
+#lmtp_rcpt_check_quota = no
+
 protocol lmtp {
   postmaster_address = postmaster@fripost.org
   # Space separated list of plugins to load (default is global mail_plugins).
diff --git a/roles/IMAP/files/etc/dovecot/conf.d/90-sieve.conf b/roles/IMAP/files/etc/dovecot/conf.d/90-sieve.conf
index 4d0420a..8308adc 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/90-sieve.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/90-sieve.conf
@@ -1,6 +1,6 @@
 ##
 ## Settings for the Sieve interpreter
-## 
+##
 
 # Do not forget to enable the Sieve plugin in 15-lda.conf and 20-lmtp.conf
 # by adding it to the respective mail_plugins= settings.
@@ -22,7 +22,7 @@ plugin {
   # is also where the ManageSieve service stores the user's scripts.
   sieve_dir = ~/sieve
 
-  # Directory for :global include scripts for the include extension. 
+  # Directory for :global include scripts for the include extension.
   #sieve_global_dir =
 
   # Path to a script file or a directory containing script files that need to be
@@ -39,17 +39,17 @@ plugin {
   # user's script (only when keep is still in effect!). Multiple script file or
   # directory paths can be specified by appending an increasing number.
   #sieve_after =
-  #sieve_after2 = 
+  #sieve_after2 =
   #sieve_after2 = (etc...)
 
-  # Which Sieve language extensions are available to users. By default, all 
+  # Which Sieve language extensions are available to users. By default, all
   # supported extensions are available, except for deprecated extensions or
   # those that are still under development. Some system administrators may want
   # to disable certain Sieve extensions or enable those that are not available
   # by default. This setting can use '+' and '-' to specify differences relative
   # to the default. For example `sieve_extensions = +imapflags' will enable the
 	# deprecated imapflags extension in addition to all extensions were already
-  # enabled by default. 
+  # enabled by default.
   #sieve_extensions = +notify +imapflags
 
   # Which Sieve language extensions are ONLY available in global scripts. This
@@ -57,7 +57,7 @@ plugin {
   # control, for instance when these extensions can cause security concerns.
   # This setting has higher precedence than the `sieve_extensions' setting
   # (above), meaning that the extensions enabled with this setting are never
-  # available to the user's personal script no matter what is specified for the 
+  # available to the user's personal script no matter what is specified for the
   # `sieve_extensions' setting. The syntax of this setting is similar to the
   # `sieve_extensions' setting, with the difference that extensions are
   # enabled or disabled for exclusive use in global scripts. Currently, no
@@ -68,13 +68,14 @@ plugin {
   # setting, the used plugins can be specified. Check the Dovecot wiki
   # (wiki2.dovecot.org) or the pigeonhole website
   # (http://pigeonhole.dovecot.org) for available plugins.
+	# The sieve_extprograms plugin is included in this release.
   #sieve_plugins =
 
-  # The separator that is expected between the :user and :detail 
-  # address parts introduced by the subaddress extension. This may 
-  # also be a sequence of characters (e.g. '--'). The current 
-  # implementation looks for the separator from the left of the 
-  # localpart and uses the first one encountered. The :user part is 
+  # The separator that is expected between the :user and :detail
+  # address parts introduced by the subaddress extension. This may
+  # also be a sequence of characters (e.g. '--'). The current
+  # implementation looks for the separator from the left of the
+  # localpart and uses the first one encountered. The :user part is
   # left of the separator and the :detail part is right. This setting
   # is also used by Dovecot's LMTP service.
   recipient_delimiter = +
@@ -99,6 +100,6 @@ plugin {
 
   # The maximum amount of disk storage a single user's scripts may occupy. If
   # set to 0, no limit on the used amount of disk storage is enforced.
-  # (Currently only relevant for ManageSieve) 
+  # (Currently only relevant for ManageSieve)
   #sieve_quota_max_storage = 0
 }
diff --git a/roles/IMAP/files/etc/dovecot/conf.d/auth-ldap.conf.ext b/roles/IMAP/files/etc/dovecot/conf.d/auth-ldap.conf.ext
index 5237fc2..360727e 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/auth-ldap.conf.ext
+++ b/roles/IMAP/files/etc/dovecot/conf.d/auth-ldap.conf.ext
@@ -1,4 +1,4 @@
-# Authentication for LDAP users. Included from auth.conf.
+# Authentication for LDAP users. Included from 10-auth.conf.
 #
 # <doc/wiki/AuthDatabase.LDAP.txt>
 
diff --git a/roles/IMAP/files/etc/dovecot/dovecot-ldap.conf.ext b/roles/IMAP/files/etc/dovecot/dovecot-ldap.conf.ext
index 1ffa73d..72f4604 100644
--- a/roles/IMAP/files/etc/dovecot/dovecot-ldap.conf.ext
+++ b/roles/IMAP/files/etc/dovecot/dovecot-ldap.conf.ext
@@ -1,3 +1,6 @@
+# This file is commonly accessed via passdb {} or userdb {} section in
+# conf.d/auth-ldap.conf.ext
+
 # This file is opened as root, so it should be owned by root and mode 0600.
 #
 # http://wiki2.dovecot.org/AuthDatabase/LDAP
@@ -90,7 +93,7 @@ ldap_version = 3
 base = fvl=%n,fvd=%d,ou=virtual,dc=fripost,dc=org
 
 # Dereference: never, searching, finding, always
-deref = never
+#deref = never
 
 # Search scope: base, onelevel, subtree
 scope = base
-- 
cgit v1.2.3