diff --git a/ansible/group_vars/all b/ansible/group_vars/all index d912abc..e5e2f95 100644 --- a/ansible/group_vars/all +++ b/ansible/group_vars/all @@ -2,9 +2,16 @@ # Set this to true to create a john@example.org account with password 'summersun' ispmail_populate_test_data: true +# Set the host name that will be used in the URL for webmail. +# Make sure its properly set in your DNS zone. +ispmail_fqdn: yoda.workaround.org + # MySQL password for read-only user ispmail_mysql_mailserver_password: ChangeMeServer +# MySQL password for read-write user +ispmail_mysql_mailadmin_password: ChangeMeAdmin + # MySQL password for administrative root user ispmail_mysql_root_password: ChangeMeRoot diff --git a/ansible/hosts b/ansible/hosts index 05614f6..e932d40 100644 --- a/ansible/hosts +++ b/ansible/hosts @@ -1 +1,2 @@ -localhost ansible_connection=local \ No newline at end of file +localhost ansible_connection=local +yoda.workaround.org diff --git a/ansible/ispmail.yml b/ansible/ispmail.yml index f89da8d..de3cd86 100644 --- a/ansible/ispmail.yml +++ b/ansible/ispmail.yml @@ -4,20 +4,27 @@ - hosts: all tasks: - - name: "Checking operating system version" - assert: - that: ansible_distribution_release == 'buster' - fail_msg: 'This Ansible playbook is only supported on Debian Buster.' - success_msg: 'Debian Buster found - that makes me happy.' + - name: "Checking operating system version" + assert: + that: ansible_distribution_release == 'buster' + fail_msg: "This Ansible playbook is only supported on Debian Buster." + success_msg: "Debian Buster found - that makes me happy." - hosts: all roles: - #- dumpvars - - ispmail-packages - - ispmail-certificate - - ispmail-database - - ispmail-postfix - - ispmail-dovecot -# - ispmail-webmail - - ispmail-webmail-apache-horde - - ispmail-tests + #- dumpvars + - role: ispmail-packages + tags: packages + - role: ispmail-certificate + tags: certificate + - role: ispmail-database + tags: database + - role: ispmail-postfix + tags: postfix + - role: ispmail-dovecot + tags: dovecot + - role: ispmail-webmail-apache-roundcube + tags: roundcube + # - ispmail-webmail-apache-horde + #- ispmail-tests + diff --git a/ansible/roles/ispmail-certificate/tasks/main.yml b/ansible/roles/ispmail-certificate/tasks/main.yml index 0ee1fb6..10dc8c5 100644 --- a/ansible/roles/ispmail-certificate/tasks/main.yml +++ b/ansible/roles/ispmail-certificate/tasks/main.yml @@ -12,4 +12,3 @@ creates: /etc/ssl/certs/mailserver.pem - name: Restrict access permissions of the private key file: path=/etc/ssl/private/mailserver.pem mode=0640 - diff --git a/ansible/roles/ispmail-database/files/schema.sql b/ansible/roles/ispmail-database/files/schema.sql index 7ba785c..a7cadc1 100644 --- a/ansible/roles/ispmail-database/files/schema.sql +++ b/ansible/roles/ispmail-database/files/schema.sql @@ -9,6 +9,7 @@ CREATE TABLE IF NOT EXISTS `virtual_users` ( `domain_id` int(11) NOT NULL, `password` varchar(150) NOT NULL, `email` varchar(100) NOT NULL, + `quota` int(11) NOT NULL DEFAULT 0, PRIMARY KEY (`id`), UNIQUE KEY `email` (`email`), FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE diff --git a/ansible/roles/ispmail-database/files/test.sql b/ansible/roles/ispmail-database/files/test.sql index f997d58..3ddc641 100644 --- a/ansible/roles/ispmail-database/files/test.sql +++ b/ansible/roles/ispmail-database/files/test.sql @@ -12,7 +12,7 @@ REPLACE INTO `mailserver`.`virtual_users` ( `email` ) VALUES ( - '1', '1', CONCAT('{PLAIN-MD5}', MD5( 'summersun' )) , 'john@example.org' + '1', '1', '{BLF-CRYPT}$2y$05$m.GdQNMyUFNG0vPsaXxSB.0ZQqZhe1e9Un841oBcWi6U6HRF2Kmky', 'john@example.org' ); REPLACE INTO `mailserver`.`virtual_aliases` ( `id`, diff --git a/ansible/roles/ispmail-database/tasks/main.yml b/ansible/roles/ispmail-database/tasks/main.yml index 626a231..71743f2 100644 --- a/ansible/roles/ispmail-database/tasks/main.yml +++ b/ansible/roles/ispmail-database/tasks/main.yml @@ -1,62 +1,64 @@ --- - name: Installing required Python mysqldb module for Ansible to manage databases -# apt: name=python-mysqldb + # apt: name=python-mysqldb apt: name=python-pymysql -- name: Set a new root password - mysql_user: - check_implicit_admin: yes - user: root - password: "{{ ispmail_mysql_root_password }}" - login_unix_socket: /var/run/mysqld/mysqld.sock - host: "{{ item }}" - with_items: - - localhost - - 127.0.0.1 +# - name: Create .my.cnf +# template: +# src: "root-my-cnf.j2" +# dest: "/root/.my.cnf" +# owner: root +# group: root +# mode: 0600 -- name: Create .my.cnf - template: - src: "root-my-cnf.j2" - dest: "/root/.my.cnf" - owner: root - group: root - mode: 0600 +# - name: Set a new root password +# mysql_user: +# check_implicit_admin: yes +# user: root +# password: "{{ ispmail_mysql_root_password }}" +# login_unix_socket: /var/run/mysqld/mysqld.sock +# host: "{{ item }}" +# with_items: +# - localhost +# - 127.0.0.1 - name: creating mailserver MySQL database - #become: true mysql_db: + login_unix_socket: /var/run/mysqld/mysqld.sock name: mailserver - -# - name: creating Roundcube MySQL database -# mysql_db: -# name: roundcube - name: copying MySQL database schema to server - copy: - src: schema.sql + copy: + src: schema.sql dest: /tmp - name: setting up SQL schema of mailserver database - mysql_db: - name: mailserver - state: import + mysql_db: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: mailserver + state: import target: /tmp/schema.sql -- name: creating MySQL user to read the mailserver database - mysql_user: - name: mailuser - password: "{{ispmail_mysql_mailuser_password}}" +- name: creating MySQL user mailadmin + mysql_user: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: mailadmin + password: "{{ispmail_mysql_mailadmin_password}}" priv: mailserver.*:SELECT,INSERT,UPDATE,DELETE -# - name: creating MySQL user for roundcube -# mysql_user: -# name: roundcube -# password: "{{ispmail_mysql_roundcube_password}}" -# priv: roundcube.*:ALL + host: localhost +- name: creating MySQL user to read the mailserver database + mysql_user: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: mailserver + password: "{{ispmail_mysql_mailserver_password}}" + priv: mailserver.*:SELECT + host: 127.0.0.1 - name: copying MySQL test data to server - copy: + copy: src: test.sql dest: /tmp when: ispmail_populate_test_data == true - name: populating the database with test data - mysql_db: - name: mailserver - state: import + mysql_db: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: mailserver + state: import target: /tmp/test.sql when: ispmail_populate_test_data == true diff --git a/ansible/roles/ispmail-dovecot/files/10-auth.conf b/ansible/roles/ispmail-dovecot/files/10-auth.conf new file mode 100644 index 0000000..9757224 --- /dev/null +++ b/ansible/roles/ispmail-dovecot/files/10-auth.conf @@ -0,0 +1,128 @@ +## +## Authentication processes +## + +# Disable LOGIN command and all other plaintext authentications unless +# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP +# matches the local IP (ie. you're connecting from the same computer), the +# connection is considered secure and plaintext authentication is allowed. +# See also ssl=required setting. +#disable_plaintext_auth = yes + +# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that +# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used. +#auth_cache_size = 0 +# Time to live for cached data. After TTL expires the cached record is no +# longer used, *except* if the main database lookup returns internal failure. +# We also try to handle password changes automatically: If user's previous +# authentication was successful, but this one wasn't, the cache isn't used. +# For now this works only with plaintext authentication. +#auth_cache_ttl = 1 hour +# TTL for negative hits (user not found, password mismatch). +# 0 disables caching them completely. +#auth_cache_negative_ttl = 1 hour + +# Space separated list of realms for SASL authentication mechanisms that need +# them. You can leave it empty if you don't want to support multiple realms. +# Many clients simply use the first one listed here, so keep the default realm +# first. +#auth_realms = + +# Default realm/domain to use if none was specified. This is used for both +# SASL realms and appending @domain to username in plaintext logins. +#auth_default_realm = + +# List of allowed characters in username. If the user-given username contains +# a character not listed in here, the login automatically fails. This is just +# an extra check to make sure user can't exploit any potential quote escaping +# vulnerabilities with SQL/LDAP databases. If you want to allow all characters, +# set this value to empty. +#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ + +# Username character translations before it's looked up from databases. The +# value contains series of from -> to characters. For example "#@/@" means +# that '#' and '/' characters are translated to '@'. +#auth_username_translation = + +# Username formatting before it's looked up from databases. You can use +# the standard variables here, eg. %Lu would lowercase the username, %n would +# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into +# "-AT-". This translation is done after auth_username_translation changes. +#auth_username_format = %Lu + +# If you want to allow master users to log in by specifying the master +# username within the normal username string (ie. not using SASL mechanism's +# support for it), you can specify the separator character here. The format +# is then . UW-IMAP uses "*" as the +# separator, so that could be a good choice. +#auth_master_user_separator = + +# Username to use for users logging in with ANONYMOUS SASL mechanism +#auth_anonymous_username = anonymous + +# Maximum number of dovecot-auth worker processes. They're used to execute +# blocking passdb and userdb queries (eg. MySQL and PAM). They're +# automatically created and destroyed as needed. +#auth_worker_max_count = 30 + +# Host name to use in GSSAPI principal names. The default is to use the +# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab +# entries. +#auth_gssapi_hostname = + +# Kerberos keytab to use for the GSSAPI mechanism. Will use the system +# default (usually /etc/krb5.keytab) if not specified. You may need to change +# the auth service to run as root to be able to read this file. +#auth_krb5_keytab = + +# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and +# ntlm_auth helper. +#auth_use_winbind = no + +# Path for Samba's ntlm_auth helper binary. +#auth_winbind_helper_path = /usr/bin/ntlm_auth + +# Time to delay before replying to failed authentications. +#auth_failure_delay = 2 secs + +# Require a valid SSL client certificate or the authentication fails. +#auth_ssl_require_client_cert = no + +# Take the username from client's SSL certificate, using +# X509_NAME_get_text_by_NID() which returns the subject's DN's +# CommonName. +#auth_ssl_username_from_cert = no + +# Space separated list of wanted authentication mechanisms: +# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey +# gss-spnego +# NOTE: See also disable_plaintext_auth setting. +auth_mechanisms = plain login + +## +## Password and user databases +## + +# +# Password database is used to verify user's password (and nothing more). +# You can have multiple passdbs and userdbs. This is useful if you want to +# allow both system users (/etc/passwd) and virtual users to login without +# duplicating the system users into virtual database. +# +# +# +# User database specifies where mails are located and what user/group IDs +# own them. For single-UID configuration use "static" userdb. +# +# + +#!include auth-deny.conf.ext +#!include auth-master.conf.ext + +#!include auth-system.conf.ext +!include auth-sql.conf.ext +#!include auth-ldap.conf.ext +#!include auth-passwdfile.conf.ext +#!include auth-checkpassword.conf.ext +#!include auth-vpopmail.conf.ext +#!include auth-static.conf.ext diff --git a/ansible/roles/ispmail-dovecot/files/10-mail.conf b/ansible/roles/ispmail-dovecot/files/10-mail.conf index 3ef99fc..382ac69 100644 --- a/ansible/roles/ispmail-dovecot/files/10-mail.conf +++ b/ansible/roles/ispmail-dovecot/files/10-mail.conf @@ -28,7 +28,7 @@ # # #mail_location = mbox:~/mail:INBOX=/var/mail/%u -mail_location = maildir:/var/vmail/%d/%n/Maildir +mail_location = maildir:~/Maildir # If you need to set multiple mailbox locations or want to change default # namespace settings, you can do it by defining namespace sections. @@ -47,12 +47,11 @@ namespace inbox { # Hierarchy separator to use. You should use the same separator for all # namespaces or some clients get confused. '/' is usually a good one. # The default however depends on the underlying mail storage format. - #separator = separator = . # Prefix required to access this namespace. This needs to be different for # all namespaces. For example "Public/". - #prefix = + #prefix = # Physical location of the mailbox. This is in same format as # mail_location, which is also the default for it. @@ -78,14 +77,7 @@ namespace inbox { # namespace handles them (empty prefix should always have this as "yes") #subscriptions = yes -# mailbox INBOX.Junk { -# auto = subscribe # autocreate and autosubscribe the Junk mailbox -# special_use = \Junk -# } -# mailbox INBOX.Trash { -# auto = subscribe # autocreate and autosubscribe the Trash mailbox -# special_use = \Trash -# } + # See 15-mailboxes.conf for definitions of special mailboxes. } # Example shared namespace configuration @@ -120,7 +112,7 @@ namespace inbox { # Group to enable temporarily for privileged operations. Currently this is # used only with INBOX when either its initial creation or dotlocking fails. # Typically this is set to "mail" to give access to /var/mail. -#mail_privileged_group = +mail_privileged_group = mail # Grant access to these supplementary groups for mail processes. Typically # these are used to set up access to shared mailboxes. Note that it may be @@ -135,10 +127,22 @@ namespace inbox { # or ~user/. #mail_full_filesystem_access = no -# Dictionary for key=value mailbox attributes. Currently used by URLAUTH, but -# soon intended to be used by METADATA as well. +# Dictionary for key=value mailbox attributes. This is used for example by +# URLAUTH and METADATA extensions. #mail_attribute_dict = +# A comment or note that is associated with the server. This value is +# accessible for authenticated users through the IMAP METADATA server +# entry "/shared/comment". +#mail_server_comment = "" + +# Indicates a method for contacting the server administrator. According to +# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that +# is currently not enforced. Use for example mailto:admin@example.com. This +# value is accessible for authenticated users through the IMAP METADATA server +# entry "/shared/admin". +#mail_server_admin = + ## ## Mail processes ## @@ -162,7 +166,10 @@ namespace inbox { # methods. NFS users: flock doesn't work, remember to change mmap_disable. #lock_method = fcntl -# Directory in which LDA/LMTP temporarily stores incoming mails >128 kB. +# Directory where mails can be temporarily stored. Usually it's used only for +# mails larger than >= 128 kB. It's used by various parts of Dovecot, for +# example LDA/LMTP while delivering large mails or zlib plugin for keeping +# uncompressed mails. #mail_temp_dir = /tmp # Valid UID range for users, defaults to 500 and above. This is mostly @@ -190,7 +197,7 @@ namespace inbox { # WARNING: Never add directories here which local users can modify, that # may lead to root exploit. Usually this should be done only if you don't # allow shell access for users. -#valid_chroot_dirs = +#valid_chroot_dirs = # Default chroot directory for mail processes. This can be overridden for # specific users in user database by giving /./ in user's home directory @@ -198,7 +205,7 @@ namespace inbox { # need to do chrooting, Dovecot doesn't allow users to access files outside # their mail directory anyway. If your home directories are prefixed with # the chroot directory, append "/." to mail_chroot. -#mail_chroot = +#mail_chroot = # UNIX socket path to master authentication server to find users. # This is used by imap (for shared users) and lda. @@ -209,7 +216,7 @@ namespace inbox { # Space separated list of plugins to load for all services. Plugins specific to # IMAP, LDA, etc. are added to this list in their own .conf files. -#mail_plugins = +mail_plugins = quota ## ## Mailbox handling optimizations @@ -217,7 +224,16 @@ namespace inbox { # Mailbox list indexes can be used to optimize IMAP STATUS commands. They are # also required for IMAP NOTIFY extension to be enabled. -#mailbox_list_index = no +#mailbox_list_index = yes + +# Trust mailbox list index to be up-to-date. This reduces disk I/O at the cost +# of potentially returning out-of-date results after e.g. server crashes. +# The results will be automatically fixed once the folders are opened. +#mailbox_list_index_very_dirty_syncs = yes + +# Should INBOX be kept up-to-date in the mailbox list index? By default it's +# not, because most of the mailbox accesses will open INBOX anyway. +#mailbox_list_index_include_inbox = no # The minimum number of mails in a mailbox before updates are done to cache # file. This allows optimizing Dovecot's behavior to do less disk writes at @@ -226,7 +242,7 @@ namespace inbox { # When IDLE command is running, mailbox is checked once in a while to see if # there are any new mails or other changes. This setting defines the minimum -# time to wait between those checks. Dovecot can also use dnotify, inotify and +# time to wait between those checks. Dovecot can also use inotify and # kqueue to find out immediately when changes occur. #mailbox_idle_check_interval = 30 secs @@ -245,6 +261,19 @@ namespace inbox { # These should exist only after Dovecot dies in the middle of saving mails. #mail_temp_scan_interval = 1w +# How many slow mail accesses sorting can perform before it returns failure. +# With IMAP the reply is: NO [LIMIT] Requested sort would have taken too long. +# The untagged SORT reply is still returned, but it's likely not correct. +#mail_sort_max_read_count = 0 + +protocol !indexer-worker { + # If folder vsize calculation requires opening more than this many mails from + # disk (i.e. mail sizes aren't in cache already), return failure and finish + # the calculation via indexer process. Disabled by default. This setting must + # be 0 for indexer-worker processes. + #mail_vsize_bg_after_count = 0 +} + ## ## Maildir-specific settings ## @@ -315,7 +344,7 @@ namespace inbox { # fallbacks to re-reading the whole mbox file whenever something in mbox isn't # how it's expected to be. The only real downside to this setting is that if # some other MUA changes message flags, Dovecot doesn't notice it immediately. -# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK +# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK # commands. #mbox_dirty_syncs = yes @@ -344,7 +373,7 @@ namespace inbox { ## # Maximum dbox file size until it's rotated. -#mdbox_rotate_size = 2M +#mdbox_rotate_size = 10M # Maximum dbox file age until it's rotated. Typically in days. Day begins # from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. @@ -380,3 +409,13 @@ namespace inbox { # variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. # Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits #mail_attachment_hash = %{sha1} + +# Settings to control adding $HasAttachment or $HasNoAttachment keywords. +# By default, all MIME parts with Content-Disposition=attachment, or inlines +# with filename parameter are consired attachments. +# add-flags-on-save - Add the keywords when saving new mails. +# content-type=type or !type - Include/exclude content type. Excluding will +# never consider the matched MIME part as attachment. Including will only +# negate an exclusion (e.g. content-type=!foo/* content-type=foo/bar). +# exclude-inlined - Exclude any Content-Disposition=inline MIME part. +#mail_attachment_detection_options = diff --git a/ansible/roles/ispmail-dovecot/files/10-master.conf b/ansible/roles/ispmail-dovecot/files/10-master.conf index ff5d9f8..c3122a3 100644 --- a/ansible/roles/ispmail-dovecot/files/10-master.conf +++ b/ansible/roles/ispmail-dovecot/files/10-master.conf @@ -45,6 +45,12 @@ service pop3-login { } } +service submission-login { + inet_listener submission { + #port = 587 + } +} + service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix @@ -56,7 +62,7 @@ service lmtp { #inet_listener lmtp { # Avoid making LMTP visible for the entire internet #address = - #port = + #port = #} } @@ -74,6 +80,11 @@ service pop3 { #process_limit = 1024 } +service submission { + # Max. number of SMTP Submission processes (connections) + #process_limit = 1024 +} + service auth { # auth_socket_path points to this userdb socket by default. It's typically # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have @@ -88,19 +99,17 @@ service auth { # To give the caller full permissions to lookup all users, set the mode to # something else than 0666 and Dovecot lets the kernel enforce the # permissions (e.g. 0777 allows everyone full permissions). - unix_listener auth-userdb { - #mode = 0666 - #user = - #group = - } - - # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { - mode = 0666 + mode = 0660 user = postfix group = postfix } + # Postfix smtp-auth + #unix_listener /var/spool/postfix/private/auth { + # mode = 0666 + #} + # Auth process is run as this user. #user = $default_internal_user } @@ -117,7 +126,7 @@ service dict { # For example: mode=0660, group=vmail and global mail_access_groups=vmail unix_listener dict { #mode = 0600 - #user = - #group = + #user = + #group = } } diff --git a/ansible/roles/ispmail-dovecot/files/15-mailboxes.conf b/ansible/roles/ispmail-dovecot/files/15-mailboxes.conf deleted file mode 100644 index 243ce55..0000000 --- a/ansible/roles/ispmail-dovecot/files/15-mailboxes.conf +++ /dev/null @@ -1,50 +0,0 @@ -## -## Mailbox definitions -## - -# NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf. -namespace inbox { - - #mailbox name { - # auto=create will automatically create this mailbox. - # auto=subscribe will both create and subscribe to the mailbox. - #auto = no - - # Space separated list of IMAP SPECIAL-USE attributes as specified by - # RFC 6154: \All \Archive \Drafts \Flagged \Junk \Sent \Trash - #special_use = - #} - - # These mailboxes are widely used and could perhaps be created automatically: - #mailbox Drafts { - # special_use = \Drafts - #} - mailbox INBOX.Junk { - auto = subscribe - special_use = \Junk - } - mailbox INBOX.Trash { - auto = subscribe - special_use = \Trash - } - - - # For \Sent mailboxes there are two widely used names. We'll mark both of - # them as \Sent. User typically deletes one of them if duplicates are created. - mailbox INBOX.Sent { - special_use = \Sent - } - #mailbox "Sent Messages" { - # special_use = \Sent - #} - - # If you have a virtual "All messages" mailbox: - #mailbox virtual/All { - # special_use = \All - #} - - # If you have a virtual "Flagged" mailbox: - #mailbox virtual/Flagged { - # special_use = \Flagged - #} -} diff --git a/ansible/roles/ispmail-dovecot/files/20-lmtp.conf b/ansible/roles/ispmail-dovecot/files/20-lmtp.conf index cd3caaf..6a691ec 100644 --- a/ansible/roles/ispmail-dovecot/files/20-lmtp.conf +++ b/ansible/roles/ispmail-dovecot/files/20-lmtp.conf @@ -13,8 +13,14 @@ # Verify quota before replying to RCPT TO. This adds a small overhead. #lmtp_rcpt_check_quota = no +# Which recipient address to use for Delivered-To: header and Received: +# header. The default is "final", which is the same as the one given to +# RCPT TO command. "original" uses the address given in RCPT TO's ORCPT +# parameter, "none" uses nothing. Note that "none" is currently always used +# when a mail has multiple recipients. +#lmtp_hdr_delivery_address = final + protocol lmtp { # Space separated list of plugins to load (default is global mail_plugins). - #mail_plugins = $mail_plugins mail_plugins = $mail_plugins sieve } diff --git a/ansible/roles/ispmail-dovecot/files/90-quota.conf b/ansible/roles/ispmail-dovecot/files/90-quota.conf new file mode 100644 index 0000000..6604fc8 --- /dev/null +++ b/ansible/roles/ispmail-dovecot/files/90-quota.conf @@ -0,0 +1,101 @@ +## +## Quota configuration. +## + +# Note that you also have to enable quota plugin in mail_plugins setting. +# + +## +## Quota limits +## + +# Quota limits are set using "quota_rule" parameters. To get per-user quota +# limits, you can set/override them by returning "quota_rule" extra field +# from userdb. It's also possible to give mailbox-specific limits, for example +# to give additional 100 MB when saving to Trash: + +plugin { + #quota_rule = *:storage=1G + #quota_rule2 = Trash:storage=+100M + + # LDA/LMTP allows saving the last mail to bring user from under quota to + # over quota, if the quota doesn't grow too high. Default is to allow as + # long as quota will stay under 10% above the limit. Also allowed e.g. 10M. + #quota_grace = 10%% + + # Quota plugin can also limit the maximum accepted mail size. + #quota_max_mail_size = 100M +} + +## +## Quota warnings +## + +# You can execute a given command when user exceeds a specified quota limit. +# Each quota root has separate limits. Only the command for the first +# exceeded limit is executed, so put the highest limit first. +# The commands are executed via script service by connecting to the named +# UNIX socket (quota-warning below). +# Note that % needs to be escaped as %%, otherwise "% " expands to empty. + +plugin { + #quota_warning = storage=95%% quota-warning 95 %u + #quota_warning2 = storage=80%% quota-warning 80 %u +} + +# Example quota-warning service. The unix listener's permissions should be +# set in a way that mail processes can connect to it. Below example assumes +# that mail processes run as vmail user. If you use mode=0666, all system users +# can generate quota warnings to anyone. +service quota-status { + executable = /usr/lib/dovecot/quota-status -p postfix + unix_listener /var/spool/postfix/private/quota-status { + user = postfix + } +} + +plugin { + quota_status_success = DUNNO + quota_status_nouser = DUNNO + quota_status_overquota = "552 5.2.2 Mailbox is over quota / Mailbox ist voll" +} + +## +## Quota backends +## + +# Multiple backends are supported: +# dirsize: Find and sum all the files found from mail directory. +# Extremely SLOW with Maildir. It'll eat your CPU and disk I/O. +# dict: Keep quota stored in dictionary (eg. SQL) +# maildir: Maildir++ quota +# fs: Read-only support for filesystem quota + +plugin { + #quota = dirsize:User quota + quota = maildir:User quota + #quota_rule = *:bytes=1000 + #quota = dict:User quota::proxy::quota + #quota = fs:User quota +} + +# Multiple quota roots are also possible, for example this gives each user +# their own 100MB quota and one shared 1GB quota within the domain: +plugin { + #quota = dict:user::proxy::quota + #quota2 = dict:domain:%d:proxy::quota_domain + #quota_rule = *:storage=102400 + #quota2_rule = *:storage=1048576 +} + +plugin { + quota_warning = storage=95%% quota-warning 95 %u + quota_warning2 = storage=80%% quota-warning 80 %u +} +service quota-warning { + executable = script /usr/local/bin/quota-warning.sh + unix_listener quota-warning { + group = dovecot + mode = 0660 + } +} diff --git a/ansible/roles/ispmail-dovecot/files/90-sieve.conf b/ansible/roles/ispmail-dovecot/files/90-sieve.conf index 566f53e..6a2be9e 100644 --- a/ansible/roles/ispmail-dovecot/files/90-sieve.conf +++ b/ansible/roles/ispmail-dovecot/files/90-sieve.conf @@ -5,39 +5,81 @@ # Do not forget to enable the Sieve plugin in 15-lda.conf and 20-lmtp.conf # by adding it to the respective mail_plugins= settings. +# The Sieve interpreter can retrieve Sieve scripts from several types of +# locations. The default `file' location type is a local filesystem path +# pointing to a Sieve script file or a directory containing multiple Sieve +# script files. More complex setups can use other location types such as +# `ldap' or `dict' to fetch Sieve scripts from remote databases. +# +# All settings that specify the location of one ore more Sieve scripts accept +# the following syntax: +# +# location = [:]path[;