cronekorkn/bundlewrap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

wip

Browse source
This commit is contained in:
CroneKorkN 2025-08-10 11:09:37 +02:00
parent 1f2273d2ab
commit cc8d975188
Signed by: cronekorkn
SSH key fingerprint: SHA256:v0410ZKfuO1QHdgKBsdQNF64xmTxOF8osF1LIqwTcVw
5 changed files with 89 additions and 80 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
bundles/dovecot/files/dovecot-sql.conf
View file

@ -1,17 +0,0 @@
connect = host=${host} dbname=${name} user=${user} password=${password}
driver = pgsql
default_pass_scheme = ARGON2ID
user_query = SELECT '/var/vmail/%u' AS home, 'vmail' AS uid, 'vmail' AS gid
iterate_query = SELECT CONCAT(users.name, '@', domains.name) AS user \
FROM users \
LEFT JOIN domains ON users.domain_id = domains.id \
WHERE redirect IS NULL
password_query = SELECT CONCAT(users.name, '@', domains.name) AS user, password \
FROM users \
LEFT JOIN domains ON users.domain_id = domains.id \
WHERE redirect IS NULL \
AND users.name = SPLIT_PART('%u', '@', 1) \
AND domains.name = SPLIT_PART('%u', '@', 2)

112
bundles/dovecot/files/dovecot.conf
View file

@ -1,12 +1,17 @@
dovecot_config_version = ${config_version}
dovecot_storage_version = ${storage_version}
protocols = imap lmtp sieve protocols = imap lmtp sieve
auth_mechanisms = plain login auth_mechanisms = plain login
mail_privileged_group = mail mail_privileged_group = mail
ssl = required ssl = required
ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem ssl_server_cert_file = /var/lib/dehydrated/certs/${hostname}/fullchain.pem
ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem ssl_server_key_file = /var/lib/dehydrated/certs/${hostname}/privkey.pem
ssl_dh = </etc/dovecot/dhparam.pem ssl_server_dh_file = /etc/dovecot/dhparam.pem
ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_dir = /etc/ssl/certs
mail_location = maildir:${node.metadata.get('mailserver/maildir')}/%u:INDEX=${node.metadata.get('mailserver/maildir')}/index/%u mail_driver = maildir
mail_path = ${maildir}/%{user}
mail_index_path = ${maildir}/index/%{user}
mail_plugins = fts fts_xapian mail_plugins = fts fts_xapian
namespace inbox { namespace inbox {
@ -30,14 +35,47 @@ namespace inbox {
} }
} }
passdb {
driver = sql sql_driver = pgsql
args = /etc/dovecot/dovecot-sql.conf
pgsql main {
parameters {
host = ${db_host}
dbname = ${db_name}
user = ${db_user}
password = ${db_password}
}
} }
# use sql for userdb too, to enable iterate_query
userdb { # postgres passdb userdb
driver = sql
args = /etc/dovecot/dovecot-sql.conf passdb sql {
passdb_default_password_scheme = ARGON2ID
query = SELECT \
CONCAT(users.name, '@', domains.name) AS "user", \
password \
FROM users \
LEFT JOIN domains ON users.domain_id = domains.id \
WHERE redirect IS NULL \
AND users.name = SPLIT_PART('%{user}', '@', 1) \
AND domains.name = SPLIT_PART('%{user}', '@', 2)
}
mail_uid = vmail
mail_gid = vmail
userdb sql {
query = SELECT \
'/var/vmail/%{user}' AS home, \
'vmail' AS uid, \
'vmail' AS gid
iterate_query = SELECT \
CONCAT(users.name, '@', domains.name) AS username \
FROM users \
LEFT JOIN domains ON users.domain_id = domains.id \
WHERE redirect IS NULL
} }
service auth { service auth {
@ -70,7 +108,8 @@ service managesieve-login {
inet_listener sieve { inet_listener sieve {
} }
process_min_avail = 0 process_min_avail = 0
service_count = 1 process_min_avail = 1
process_limit = 1
vsz_limit = 64 M vsz_limit = 64 M
} }
service managesieve { service managesieve {
@ -86,21 +125,18 @@ protocol lmtp {
mail_plugins = $mail_plugins sieve mail_plugins = $mail_plugins sieve
} }
protocol sieve { protocol sieve {
plugin {
sieve = /var/vmail/sieve/%u.sieve sieve = /var/vmail/sieve/%u.sieve
sieve_storage = /var/vmail/sieve/%u/ sieve_storage = /var/vmail/sieve/%u/
}
} }
# fulltext search # fulltext search
plugin { fts = xapian
fts = xapian fts_xapian = partial=3 full=20 verbose=0
fts_xapian = partial=3 full=20 verbose=0 fts_autoindex = yes
fts_autoindex = yes fts_enforced = yes
fts_enforced = yes # Index attachements
# Index attachements fts_decoder = decode2text
fts_decoder = decode2text
}
service indexer-worker { service indexer-worker {
vsz_limit = ${indexer_ram} vsz_limit = ${indexer_ram}
} }
@ -113,23 +149,21 @@ service decode2text {
} }
# spam filter # spam filter
plugin { sieve_plugins = sieve_imapsieve sieve_extprograms
sieve_plugins = sieve_imapsieve sieve_extprograms sieve_dir = /var/vmail/sieve/%u/
sieve_dir = /var/vmail/sieve/%u/ sieve = /var/vmail/sieve/%u.sieve
sieve = /var/vmail/sieve/%u.sieve sieve_pipe_bin_dir = /var/vmail/sieve/bin
sieve_pipe_bin_dir = /var/vmail/sieve/bin sieve_extensions = +vnd.dovecot.pipe
sieve_extensions = +vnd.dovecot.pipe
sieve_after = /var/vmail/sieve/global/spam-to-folder.sieve sieve_after = /var/vmail/sieve/global/spam-to-folder.sieve
# From elsewhere to Spam folder # From elsewhere to Spam folder
imapsieve_mailbox1_name = Junk imapsieve_mailbox1_name = Junk
imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_causes = COPY
imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve
# From Spam folder to elsewhere # From Spam folder to elsewhere
imapsieve_mailbox2_name = * imapsieve_mailbox2_name = *
imapsieve_mailbox2_from = Junk imapsieve_mailbox2_from = Junk
imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_causes = COPY
imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve
}

29
bundles/dovecot/items.py
View file

@ -44,6 +44,14 @@ files = {
'context': { 'context': {
'admin_email': node.metadata.get('mailserver/admin_email'), 'admin_email': node.metadata.get('mailserver/admin_email'),
'indexer_ram': node.metadata.get('dovecot/indexer_ram'), 'indexer_ram': node.metadata.get('dovecot/indexer_ram'),
'config_version': node.metadata.get('dovecot/config_version'),
'storage_version': node.metadata.get('dovecot/storage_version'),
'maildir': node.metadata.get('mailserver/maildir'),
'hostname': node.metadata.get('mailserver/hostname'),
'db_host': node.metadata.get('mailserver/database/host'),
'db_name': node.metadata.get('mailserver/database/name'),
'db_user': node.metadata.get('mailserver/database/user'),
'db_password': node.metadata.get('mailserver/database/password'),
}, },
'needs': { 'needs': {
'pkg_apt:' 'pkg_apt:'
@ -52,29 +60,9 @@ files = {
'svc_systemd:dovecot:restart', 'svc_systemd:dovecot:restart',
}, },
}, },
'/etc/dovecot/dovecot-sql.conf': {
'content_type': 'mako',
'context': node.metadata.get('mailserver/database'),
'needs': {
'pkg_apt:'
},
'triggers': {
'svc_systemd:dovecot:restart',
},
},
'/etc/dovecot/dhparam.pem': { '/etc/dovecot/dhparam.pem': {
'content_type': 'any', 'content_type': 'any',
}, },
'/etc/dovecot/dovecot-sql.conf': {
'content_type': 'mako',
'context': node.metadata.get('mailserver/database'),
'needs': {
'pkg_apt:'
},
'triggers': {
'svc_systemd:dovecot:restart',
},
},
'/var/vmail/sieve/global/spam-to-folder.sieve': { '/var/vmail/sieve/global/spam-to-folder.sieve': {
'owner': 'vmail', 'owner': 'vmail',
'group': 'vmail', 'group': 'vmail',
@ -131,7 +119,6 @@ svc_systemd = {
'action:letsencrypt_update_certificates', 'action:letsencrypt_update_certificates',
'action:dovecot_generate_dhparam', 'action:dovecot_generate_dhparam',
'file:/etc/dovecot/dovecot.conf', 'file:/etc/dovecot/dovecot.conf',
'file:/etc/dovecot/dovecot-sql.conf',
}, },
}, },
} }

1
bundles/redis/items.py
View file

@ -9,6 +9,7 @@ directories = {
}, },
'/var/lib/redis': { '/var/lib/redis': {
'owner': 'redis', 'owner': 'redis',
'group': 'redis',
'mode': '0750', 'mode': '0750',
'needs': [ 'needs': [
'pkg_apt:redis-server', 'pkg_apt:redis-server',

6
nodes/htz.mails.py
View file

@ -2,7 +2,7 @@
'hostname': '49.12.184.229', 'hostname': '49.12.184.229',
'groups': [ 'groups': [
'backup', 'backup',
'debian-12', 'debian-13',
'hetzner-cloud', 'hetzner-cloud',
'mailserver', 'mailserver',
'monitored', 'monitored',
@ -108,6 +108,10 @@
'elimu-kwanza.de', 'elimu-kwanza.de',
}, },
}, },
'dovecot': {
'config_version': '2.4.1',
'storage_version': '2.4.1',
},
'rspamd': { 'rspamd': {
'hostname': 'rspamd.sublimity.de', 'hostname': 'rspamd.sublimity.de',
}, },