bundles/dovecot/files/dovecot-sql.conf

@@ -0,0 +1,17 @@
+connect = host=${host} dbname=${name} user=${user} password=${password}
+driver = pgsql
+default_pass_scheme = ARGON2ID
+
+user_query = SELECT '/var/vmail/%u' AS home, 'vmail' AS uid, 'vmail' AS gid
+
+iterate_query = SELECT CONCAT(users.name, '@', domains.name) AS user \
+  FROM users \
+  LEFT JOIN domains ON users.domain_id = domains.id \
+  WHERE redirect IS NULL
+
+password_query = SELECT CONCAT(users.name, '@', domains.name) AS user, password \
+  FROM users \
+  LEFT JOIN domains ON users.domain_id = domains.id \
+  WHERE redirect IS NULL \
+  AND users.name = SPLIT_PART('%u', '@', 1) \
+  AND domains.name = SPLIT_PART('%u', '@', 2)

bundles/dovecot/files/dovecot.conf

@@ -1,18 +1,13 @@
-dovecot_config_version = ${config_version}
-dovecot_storage_version = ${storage_version}
-
 protocols = imap lmtp sieve
 auth_mechanisms = plain login
 mail_privileged_group = mail
 ssl = required
-ssl_server_cert_file = /var/lib/dehydrated/certs/${hostname}/fullchain.pem
-ssl_server_key_file = /var/lib/dehydrated/certs/${hostname}/privkey.pem
-ssl_server_dh_file = /etc/dovecot/dhparam.pem
+ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
+ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
+ssl_dh = </etc/dovecot/dhparam.pem
 ssl_client_ca_dir = /etc/ssl/certs
-mail_driver     = maildir
-mail_path       = ${maildir}/%{user}
-mail_index_path = ${maildir}/index/%{user}
-mail_plugins = fts fts_flatcurve
+mail_location = maildir:${node.metadata.get('mailserver/maildir')}/%u:INDEX=${node.metadata.get('mailserver/maildir')}/index/%u
+mail_plugins = fts fts_xapian
 
 namespace inbox {
   inbox = yes
@@ -35,46 +30,14 @@ namespace inbox {
   }
 }
 
-# postgres passdb userdb
-
-sql_driver = pgsql
-
-pgsql main {
-  parameters {
-    host     = ${db_host}
-    dbname   = ${db_name}
-    user     = ${db_user}
-    password = ${db_password}
-  }
+passdb {
+  driver = sql
+  args = /etc/dovecot/dovecot-sql.conf
 }
-
-passdb sql {
-  passdb_default_password_scheme = ARGON2ID
-
-  query = SELECT \
-            CONCAT(users.name, '@', domains.name) AS "user", \
-            password \
-          FROM users \
-          LEFT JOIN domains ON users.domain_id = domains.id \
-          WHERE redirect IS NULL \
-            AND users.name   = SPLIT_PART('%{user}', '@', 1) \
-            AND domains.name = SPLIT_PART('%{user}', '@', 2)
-}
-
-mail_uid = vmail
-mail_gid = vmail
-
-userdb sql {
-  query = SELECT \
-            '/var/vmail/%{user}' AS home, \
-            'vmail'              AS uid, \
-            'vmail'              AS gid
-
-  iterate_query = SELECT \
-                    CONCAT(users.name, '@', domains.name) AS username \
-                  FROM users \
-                  LEFT JOIN domains ON users.domain_id = domains.id \
-                  WHERE redirect IS NULL
+# use sql for userdb too, to enable iterate_query
+userdb {
+  driver = sql
+  args = /etc/dovecot/dovecot-sql.conf
 }
 
 service auth {
@@ -104,9 +67,10 @@ service stats {
   }
 }
 service managesieve-login {
-  #inet_listener sieve {}
-  process_min_avail = 1
-  process_limit = 1
+  inet_listener sieve {
+  }
+  process_min_avail = 0
+  service_count = 1
   vsz_limit = 64 M
 }
 service managesieve {
@@ -121,35 +85,22 @@ protocol imap {
 protocol lmtp {
    mail_plugins = $mail_plugins sieve
 }
-
-# Persönliches Skript (deine alte Datei /var/vmail/sieve/%u.sieve)
-sieve_script personal {
-  driver      = file
-  # Verzeichnis mit (evtl. mehreren) Sieve-Skripten des Users
-  path        = /var/vmail/sieve/%{user}/
-  # Aktives Skript (entspricht früher "sieve = /var/vmail/sieve/%u.sieve")
-  active_path = /var/vmail/sieve/%{user}.sieve
-}
-
-# Globales After-Skript (dein früheres "sieve_after = …")
-sieve_script after {
-  type   = after
-  driver = file
-  path   = /var/vmail/sieve/global/spam-to-folder.sieve
+protocol sieve {
+  plugin {
+    sieve = /var/vmail/sieve/%u.sieve
+    sieve_storage = /var/vmail/sieve/%u/
+  }
 }
 
 # fulltext search
-fts flatcurve {
-  # substring_search = yes     # RFC-konform = yes, braucht aber deutlich mehr Platz
-  # rotate_count     = 5000   # DB-Rotation nach X Mails
-  # rotate_time      = 5s     # oder zeitbasiert rotieren
-  # optimize_limit   = 10
-  # min_term_size    = 3
+plugin {
+    fts = xapian
+    fts_xapian = partial=3 full=20 verbose=0
+    fts_autoindex = yes
+    fts_enforced = yes
+    # Index attachements
+    fts_decoder = decode2text
 }
-fts_autoindex = yes
-fts_decoder_driver = script
-fts_decoder_script_socket_path = decode2text
-
 service indexer-worker {
     vsz_limit = ${indexer_ram}
 }
@@ -161,39 +112,24 @@ service decode2text {
     }
 }
 
-mailbox Junk {
-  sieve_script learn_spam {
-    driver = file
-    type   = before
-    cause  = copy
-    path   = /var/vmail/sieve/global/learn-spam.sieve
-  }
-}
+# spam filter
+plugin {
+  sieve_plugins = sieve_imapsieve sieve_extprograms
+  sieve_dir = /var/vmail/sieve/%u/
+  sieve = /var/vmail/sieve/%u.sieve
+  sieve_pipe_bin_dir = /var/vmail/sieve/bin
+  sieve_extensions = +vnd.dovecot.pipe
 
-imapsieve_from Junk {
-  sieve_script learn_ham {
-    driver = file
-    type   = before
-    cause  = copy
-    path   = /var/vmail/sieve/global/learn-ham.sieve
-  }
-}
+  sieve_after = /var/vmail/sieve/global/spam-to-folder.sieve
 
-# Extprograms-Plugin einschalten
-sieve_plugins {
-  sieve_extprograms = yes
-}
+  # From elsewhere to Spam folder
+  imapsieve_mailbox1_name = Junk
+  imapsieve_mailbox1_causes = COPY
+  imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve
 
-# Welche Sieve-Erweiterungen dürfen genutzt werden?
-# Empfehlung: nur global erlauben (nicht in User-Skripten):
-sieve_global_extensions {
-  vnd.dovecot.pipe = yes
-  # vnd.dovecot.filter = yes      # nur falls gebraucht
-  # vnd.dovecot.execute = yes     # nur falls gebraucht
+  # From Spam folder to elsewhere
+  imapsieve_mailbox2_name = *
+  imapsieve_mailbox2_from = Junk
+  imapsieve_mailbox2_causes = COPY
+  imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve
 }
-
-# Verzeichnis mit deinen Skripten/Binaries für :pipe
-sieve_pipe_bin_dir = /var/vmail/sieve/bin
-# (optional, analog für :filter / :execute)
-# sieve_filter_bin_dir  = /var/vmail/sieve/filter
-# sieve_execute_bin_dir = /var/vmail/sieve/execute

bundles/dovecot/items.py

@@ -44,14 +44,6 @@ files = {
         'context': {
             'admin_email': node.metadata.get('mailserver/admin_email'),
             'indexer_ram': node.metadata.get('dovecot/indexer_ram'),
-            'config_version': node.metadata.get('dovecot/config_version'),
-            'storage_version': node.metadata.get('dovecot/storage_version'),
-            'maildir': node.metadata.get('mailserver/maildir'),
-            'hostname': node.metadata.get('mailserver/hostname'),
-            'db_host': node.metadata.get('mailserver/database/host'),
-            'db_name': node.metadata.get('mailserver/database/name'),
-            'db_user': node.metadata.get('mailserver/database/user'),
-            'db_password': node.metadata.get('mailserver/database/password'),
         },
         'needs': {
             'pkg_apt:'
@@ -60,9 +52,29 @@ files = {
             'svc_systemd:dovecot:restart',
         },
     },
+    '/etc/dovecot/dovecot-sql.conf': {
+        'content_type': 'mako',
+        'context': node.metadata.get('mailserver/database'),
+        'needs': {
+            'pkg_apt:'
+        },
+        'triggers': {
+            'svc_systemd:dovecot:restart',
+        },
+    },
     '/etc/dovecot/dhparam.pem': {
         'content_type': 'any',
     },
+    '/etc/dovecot/dovecot-sql.conf': {
+        'content_type': 'mako',
+        'context': node.metadata.get('mailserver/database'),
+        'needs': {
+            'pkg_apt:'
+        },
+        'triggers': {
+            'svc_systemd:dovecot:restart',
+        },
+    },
     '/var/vmail/sieve/global/spam-to-folder.sieve': {
         'owner': 'vmail',
         'group': 'vmail',
@@ -119,6 +131,7 @@ svc_systemd = {
             'action:letsencrypt_update_certificates',
             'action:dovecot_generate_dhparam',
             'file:/etc/dovecot/dovecot.conf',
+            'file:/etc/dovecot/dovecot-sql.conf',
         },
     },
 }

bundles/redis/items.py

@@ -9,7 +9,6 @@ directories = {
     },
     '/var/lib/redis': {
         'owner': 'redis',
-        'group': 'redis',
         'mode': '0750',
         'needs': [
             'pkg_apt:redis-server',

nodes/htz.mails.py

@@ -2,7 +2,7 @@
     'hostname': '49.12.184.229',
     'groups': [
         'backup',
-        'debian-13',
+        'debian-12',
         'hetzner-cloud',
         'mailserver',
         'monitored',
@@ -108,10 +108,6 @@
                 'elimu-kwanza.de',
             },
         },
-        'dovecot': {
-            'config_version': '2.4.1',
-            'storage_version': '2.4.1',
-        },
         'rspamd': {
             'hostname': 'rspamd.sublimity.de',
         },