From eaf4831451f1264e8775b43d232ecab3d4d34600 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Fri, 14 Aug 2026 16:57:21 +0100 Subject: [PATCH 01/23] Filter the mail that arrives from outside Mail that comes in through the tunnel is now scanned by rspamd before it reaches a mailbox. Only the tunnel service is miltered, so what the owner sends and what the web mail submits are left alone. Postfix is told to believe the address redirect announces, otherwise every sender looks like loopback and reputation, spf and the rest of the checks all judge the same host. What scores high enough is refused during the smtp conversation, so the sender is told rather than the message disappearing into a folder nobody reads. What only looks suspicious is tagged and sieve files it into Junk, which needs pigeonhole, so dovecot now builds it and Junk is created up front. Redis is what rspamd keeps its statistics and counters in. --- .drone.jsonnet | 37 ++++++++++- bin/service.redis.sh | 5 ++ bin/service.rspamd.sh | 15 +++++ cli/cmd/smtp/main.go | 16 ++++- cli/cmd/smtp/session.go | 14 ++++- cli/installer/installer.go | 8 +++ cli/installer/sieve.go | 36 +++++++++++ cli/installer/sieve_test.go | 38 ++++++++++++ config/dovecot/conf.d/15-lda.conf | 3 +- config/dovecot/conf.d/15-mailboxes.conf | 1 + config/dovecot/conf.d/90-sieve.conf | 3 + config/postfix/master.cf | 3 +- config/redis/redis.conf | 12 ++++ config/rspamd/local.d/actions.conf | 3 + config/rspamd/local.d/classifier-bayes.conf | 2 + config/rspamd/local.d/logging.inc | 3 + config/rspamd/local.d/milter_headers.conf | 8 +++ config/rspamd/local.d/redis.conf | 1 + config/rspamd/local.d/worker-controller.inc | 1 + config/rspamd/local.d/worker-normal.inc | 1 + config/rspamd/local.d/worker-proxy.inc | 7 +++ config/rspamd/rspamd.conf | 1 + config/sieve/spam.sieve | 6 ++ dovecot/build.sh | 20 ++++++ dovecot/sievec.sh | 7 +++ meta/snap.yaml | 19 ++++++ redis/bin/redis-cli.sh | 4 ++ redis/bin/redis.sh | 4 ++ redis/build.sh | 31 ++++++++++ redis/test.sh | 7 +++ rspamd/bin/rspamadm.sh | 4 ++ rspamd/bin/rspamc.sh | 4 ++ rspamd/bin/rspamd.sh | 4 ++ rspamd/build.sh | 38 ++++++++++++ rspamd/test.sh | 9 +++ test/test.py | 68 ++++++++++++++++++++- 36 files changed, 436 insertions(+), 7 deletions(-) create mode 100755 bin/service.redis.sh create mode 100755 bin/service.rspamd.sh create mode 100644 cli/installer/sieve.go create mode 100644 cli/installer/sieve_test.go create mode 100644 config/dovecot/conf.d/90-sieve.conf create mode 100644 config/redis/redis.conf create mode 100644 config/rspamd/local.d/actions.conf create mode 100644 config/rspamd/local.d/classifier-bayes.conf create mode 100644 config/rspamd/local.d/logging.inc create mode 100644 config/rspamd/local.d/milter_headers.conf create mode 100644 config/rspamd/local.d/redis.conf create mode 100644 config/rspamd/local.d/worker-controller.inc create mode 100644 config/rspamd/local.d/worker-normal.inc create mode 100644 config/rspamd/local.d/worker-proxy.inc create mode 100644 config/rspamd/rspamd.conf create mode 100644 config/sieve/spam.sieve create mode 100755 dovecot/sievec.sh create mode 100755 redis/bin/redis-cli.sh create mode 100755 redis/bin/redis.sh create mode 100755 redis/build.sh create mode 100755 redis/test.sh create mode 100755 rspamd/bin/rspamadm.sh create mode 100755 rspamd/bin/rspamc.sh create mode 100755 rspamd/bin/rspamd.sh create mode 100755 rspamd/build.sh create mode 100755 rspamd/test.sh diff --git a/.drone.jsonnet b/.drone.jsonnet index b011f9c..6611c93 100644 --- a/.drone.jsonnet +++ b/.drone.jsonnet @@ -1,6 +1,7 @@ local name = 'mail'; local roundcube = '1.6.15'; local dovecot = '2.3.21'; +local pigeonhole = '0.5.21'; local nginx = '1.30.4'; local postfix = '3.11.5'; local python = '3.12-slim-bookworm'; @@ -47,7 +48,7 @@ local build(arch, test_ui) = [{ name: 'dovecot', image: 'debian:' + debian, commands: [ - './dovecot/build.sh ' + dovecot, + './dovecot/build.sh ' + dovecot + ' ' + pigeonhole, ], }, ] + [ @@ -127,6 +128,40 @@ local build(arch, test_ui) = [{ ], } for distro in distros + ] + [ + { + name: 'redis', + image: 'debian:' + debian, + commands: [ + './redis/build.sh', + ], + }, + ] + [ + { + name: 'redis test ' + distro, + image: platform_image(distro, arch), + commands: [ + './redis/test.sh', + ], + } + for distro in distros + ] + [ + { + name: 'rspamd', + image: 'debian:' + debian, + commands: [ + './rspamd/build.sh', + ], + }, + ] + [ + { + name: 'rspamd test ' + distro, + image: platform_image(distro, arch), + commands: [ + './rspamd/test.sh', + ], + } + for distro in distros ] + [ { name: 'download', diff --git a/bin/service.redis.sh b/bin/service.redis.sh new file mode 100755 index 0000000..5c24e09 --- /dev/null +++ b/bin/service.redis.sh @@ -0,0 +1,5 @@ +#!/bin/bash -e + +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) + +exec ${DIR}/redis/bin/redis.sh ${SNAP_DATA}/config/redis/redis.conf diff --git a/bin/service.rspamd.sh b/bin/service.rspamd.sh new file mode 100755 index 0000000..de7d33d --- /dev/null +++ b/bin/service.rspamd.sh @@ -0,0 +1,15 @@ +#!/bin/bash -e + +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) + +exec ${DIR}/rspamd/bin/rspamd.sh -f -c ${SNAP_DATA}/config/rspamd/rspamd.conf \ + --var=CONFDIR=${DIR}/rspamd/etc \ + --var=LOCAL_CONFDIR=${SNAP_DATA}/config/rspamd \ + --var=RUNDIR=${SNAP_DATA}/rspamd \ + --var=DBDIR=${SNAP_DATA}/rspamd \ + --var=LOGDIR=${SNAP_DATA}/log \ + --var=SHAREDIR=${DIR}/rspamd/share \ + --var=PLUGINSDIR=${DIR}/rspamd/share/plugins \ + --var=RULESDIR=${DIR}/rspamd/share/rules \ + --var=LUALIBDIR=${DIR}/rspamd/share/lualib \ + --var=WWWDIR=${DIR}/rspamd/share/www diff --git a/cli/cmd/smtp/main.go b/cli/cmd/smtp/main.go index 4f52bab..1560137 100644 --- a/cli/cmd/smtp/main.go +++ b/cli/cmd/smtp/main.go @@ -14,6 +14,12 @@ func main() { subject := flag.String("subject", "", "subject, delivery is skipped when empty") body := flag.String("body", "", "message body") repeat := flag.Int("repeat", 1, "how many lines the body is repeated to") + xclient := flag.String("xclient", "", "xclient attributes announced before the transaction") + var headers []string + flag.Func("header", "extra header line, repeatable", func(value string) error { + headers = append(headers, value) + return nil + }) flag.Parse() if *socket == "" || *from == "" || *recipient == "" { @@ -33,7 +39,15 @@ func main() { text = strings.TrimSuffix(strings.Repeat(*body+"\n", *repeat), "\n") } - deliverErr := session.Deliver(*from, *recipient, *subject, text) + if *xclient != "" { + if err := session.Xclient(*xclient); err != nil { + fmt.Print(session.Transcript()) + fmt.Fprintf(os.Stderr, "xclient failed: %v\n", err) + os.Exit(1) + } + } + + deliverErr := session.Deliver(*from, *recipient, *subject, text, headers) fmt.Print(session.Transcript()) if deliverErr != nil { fmt.Fprintf(os.Stderr, "conversation failed: %v\n", deliverErr) diff --git a/cli/cmd/smtp/session.go b/cli/cmd/smtp/session.go index 2634f0c..ac06bda 100644 --- a/cli/cmd/smtp/session.go +++ b/cli/cmd/smtp/session.go @@ -71,7 +71,14 @@ func (s *Session) reply() error { } } -func (s *Session) Deliver(from string, recipient string, subject string, body string) error { +func (s *Session) Xclient(attributes string) error { + if err := s.Send("EHLO smtp.test"); err != nil { + return err + } + return s.Send(fmt.Sprintf("XCLIENT %s", attributes)) +} + +func (s *Session) Deliver(from string, recipient string, subject string, body string, headers []string) error { if err := s.Send("EHLO smtp.test"); err != nil { return err } @@ -94,6 +101,11 @@ func (s *Session) Deliver(from string, recipient string, subject string, body st if err := s.Write(fmt.Sprintf("To: %s", recipient)); err != nil { return err } + for _, header := range headers { + if err := s.Write(header); err != nil { + return err + } + } if err := s.Write(""); err != nil { return err } diff --git a/cli/installer/installer.go b/cli/installer/installer.go index 8dada1a..9107e5b 100644 --- a/cli/installer/installer.go +++ b/cli/installer/installer.go @@ -54,6 +54,7 @@ type Installer struct { platformClient *platform.Client database *Database relay *Relay + sieve *Sieve mailInbound *MailInbound executor *Executor logger *zap.Logger @@ -78,6 +79,7 @@ func New(logger *zap.Logger) *Installer { platformClient: platformClient, database: NewDatabase(appDir, dataDir, configPath, DbName, DbUser, DbPass, PsqlPort, executor, logger), relay: NewRelay(appDir, configPath, executor, logger), + sieve: NewSieve(appDir, configPath, executor, logger), mailInbound: NewMailInbound(dataDir, platformClient, logger), executor: executor, logger: logger, @@ -138,6 +140,10 @@ func (i *Installer) RegenerateConfigs() error { return err } + if err := i.sieve.Compile(); err != nil { + return err + } + return linux.Chown(i.configPath, UserName) } @@ -203,6 +209,8 @@ func (i *Installer) InitConfig() error { path.Join(i.dataDir, "dovecot"), path.Join(i.dataDir, "dovecot", "private"), path.Join(i.dataDir, "data"), + path.Join(i.dataDir, "redis"), + path.Join(i.dataDir, "rspamd"), boxDataDir, i.opendkimDir, i.opendkimKeysDir, diff --git a/cli/installer/sieve.go b/cli/installer/sieve.go new file mode 100644 index 0000000..2ed0b9c --- /dev/null +++ b/cli/installer/sieve.go @@ -0,0 +1,36 @@ +package installer + +import ( + "path" + + "go.uber.org/zap" +) + +const SpamScript = "sieve/spam.sieve" + +type Runner interface { + RunDir(dir, app string, args ...string) (string, error) +} + +type Sieve struct { + appDir string + configPath string + executor Runner + logger *zap.Logger +} + +func NewSieve(appDir string, configPath string, executor Runner, logger *zap.Logger) *Sieve { + return &Sieve{appDir: appDir, configPath: configPath, executor: executor, logger: logger} +} + +func (s *Sieve) ScriptPath() string { + return path.Join(s.configPath, SpamScript) +} + +func (s *Sieve) Compile() error { + script := s.ScriptPath() + s.logger.Info("compiling the spam filing script", zap.String("script", script)) + sievec := path.Join(s.appDir, "dovecot", "bin", "sievec.sh") + _, err := s.executor.RunDir("", sievec, script) + return err +} diff --git a/cli/installer/sieve_test.go b/cli/installer/sieve_test.go new file mode 100644 index 0000000..6c06767 --- /dev/null +++ b/cli/installer/sieve_test.go @@ -0,0 +1,38 @@ +package installer + +import ( + "fmt" + "testing" + + "github.com/stretchr/testify/assert" + "go.uber.org/zap" +) + +type fakeRunner struct { + err error + app string + args []string +} + +func (f *fakeRunner) RunDir(_ string, app string, args ...string) (string, error) { + f.app = app + f.args = args + return "", f.err +} + +func TestSieve_CompilesTheSpamScript(t *testing.T) { + runner := &fakeRunner{} + sieve := NewSieve("/snap/mail/current", "/var/snap/mail/current/config", runner, zap.NewNop()) + + assert.NoError(t, sieve.Compile()) + + assert.Equal(t, "/snap/mail/current/dovecot/bin/sievec.sh", runner.app) + assert.Equal(t, []string{"/var/snap/mail/current/config/sieve/spam.sieve"}, runner.args) +} + +func TestSieve_ReportsCompilationFailure(t *testing.T) { + runner := &fakeRunner{err: fmt.Errorf("sievec: line 3: error")} + sieve := NewSieve("/snap/mail/current", "/var/snap/mail/current/config", runner, zap.NewNop()) + + assert.Error(t, sieve.Compile()) +} diff --git a/config/dovecot/conf.d/15-lda.conf b/config/dovecot/conf.d/15-lda.conf index 8341cac..0d7e8ef 100644 --- a/config/dovecot/conf.d/15-lda.conf +++ b/config/dovecot/conf.d/15-lda.conf @@ -40,8 +40,7 @@ #lda_mailbox_autosubscribe = no protocol lda { - # Space separated list of plugins to load (default is global mail_plugins). - #mail_plugins = $mail_plugins + mail_plugins = $mail_plugins sieve #log_path = {{ .DataDir }}/log/dovecot-lda.error.log #info_log_path = {{ .DataDir }}/log/dovecot-lda.info.log auth_socket_path = {{ .DataDir }}/dovecot/auth-userdb diff --git a/config/dovecot/conf.d/15-mailboxes.conf b/config/dovecot/conf.d/15-mailboxes.conf index 910c7c0..398f462 100644 --- a/config/dovecot/conf.d/15-mailboxes.conf +++ b/config/dovecot/conf.d/15-mailboxes.conf @@ -49,6 +49,7 @@ namespace inbox { special_use = \Drafts } mailbox Junk { + auto = subscribe special_use = \Junk } mailbox Trash { diff --git a/config/dovecot/conf.d/90-sieve.conf b/config/dovecot/conf.d/90-sieve.conf new file mode 100644 index 0000000..051e27f --- /dev/null +++ b/config/dovecot/conf.d/90-sieve.conf @@ -0,0 +1,3 @@ +plugin { + sieve_before = {{ .DataDir }}/config/sieve/spam.sieve +} diff --git a/config/postfix/master.cf b/config/postfix/master.cf index 2fb4279..fc17353 100644 --- a/config/postfix/master.cf +++ b/config/postfix/master.cf @@ -21,7 +21,8 @@ tunnel unix n - n - - smtpd -o smtpd_recipient_restrictions= -o smtpd_sasl_auth_enable=no -o smtpd_tls_security_level=none - -o smtpd_milters= + -o smtpd_authorized_xclient_hosts=static:all + -o smtpd_milters=unix:{{ .DataDir }}/rspamd/milter.sock -o non_smtpd_milters= submission inet n - n - - smtpd diff --git a/config/redis/redis.conf b/config/redis/redis.conf new file mode 100644 index 0000000..abc33df --- /dev/null +++ b/config/redis/redis.conf @@ -0,0 +1,12 @@ +unixsocket {{ .DataDir }}/redis/redis.sock +unixsocketperm 770 +port 0 +daemonize no +pidfile {{ .DataDir }}/redis/redis.pid +dir {{ .DataDir }}/redis +dbfilename dump.rdb +logfile {{ .DataDir }}/log/redis.log +save 900 1 +appendonly no +maxmemory 64mb +maxmemory-policy volatile-lru diff --git a/config/rspamd/local.d/actions.conf b/config/rspamd/local.d/actions.conf new file mode 100644 index 0000000..a45893c --- /dev/null +++ b/config/rspamd/local.d/actions.conf @@ -0,0 +1,3 @@ +reject = 15; +add_header = 6; +greylist = null; diff --git a/config/rspamd/local.d/classifier-bayes.conf b/config/rspamd/local.d/classifier-bayes.conf new file mode 100644 index 0000000..ad85f2e --- /dev/null +++ b/config/rspamd/local.d/classifier-bayes.conf @@ -0,0 +1,2 @@ +backend = "redis"; +autolearn = true; diff --git a/config/rspamd/local.d/logging.inc b/config/rspamd/local.d/logging.inc new file mode 100644 index 0000000..e32c875 --- /dev/null +++ b/config/rspamd/local.d/logging.inc @@ -0,0 +1,3 @@ +type = "file"; +filename = "{{ .DataDir }}/log/rspamd.log"; +level = "warning"; diff --git a/config/rspamd/local.d/milter_headers.conf b/config/rspamd/local.d/milter_headers.conf new file mode 100644 index 0000000..f48f832 --- /dev/null +++ b/config/rspamd/local.d/milter_headers.conf @@ -0,0 +1,8 @@ +use = ["spam-header", "x-spam-level", "x-spamd-bar", "authentication-results"]; +routines { + spam-header { + header = "X-Spam"; + value = "Yes"; + remove = 1; + } +} diff --git a/config/rspamd/local.d/redis.conf b/config/rspamd/local.d/redis.conf new file mode 100644 index 0000000..3c0f812 --- /dev/null +++ b/config/rspamd/local.d/redis.conf @@ -0,0 +1 @@ +servers = "{{ .DataDir }}/redis/redis.sock"; diff --git a/config/rspamd/local.d/worker-controller.inc b/config/rspamd/local.d/worker-controller.inc new file mode 100644 index 0000000..1f3456a --- /dev/null +++ b/config/rspamd/local.d/worker-controller.inc @@ -0,0 +1 @@ +bind_socket = "{{ .DataDir }}/rspamd/controller.sock mode=0660"; diff --git a/config/rspamd/local.d/worker-normal.inc b/config/rspamd/local.d/worker-normal.inc new file mode 100644 index 0000000..25af1ca --- /dev/null +++ b/config/rspamd/local.d/worker-normal.inc @@ -0,0 +1 @@ +bind_socket = "{{ .DataDir }}/rspamd/normal.sock mode=0660"; diff --git a/config/rspamd/local.d/worker-proxy.inc b/config/rspamd/local.d/worker-proxy.inc new file mode 100644 index 0000000..a580394 --- /dev/null +++ b/config/rspamd/local.d/worker-proxy.inc @@ -0,0 +1,7 @@ +bind_socket = "{{ .DataDir }}/rspamd/milter.sock mode=0666"; +milter = yes; +timeout = 120s; +upstream "local" { + default = yes; + self_scan = yes; +} diff --git a/config/rspamd/rspamd.conf b/config/rspamd/rspamd.conf new file mode 100644 index 0000000..0d05727 --- /dev/null +++ b/config/rspamd/rspamd.conf @@ -0,0 +1 @@ +.include "$CONFDIR/rspamd.conf" diff --git a/config/sieve/spam.sieve b/config/sieve/spam.sieve new file mode 100644 index 0000000..2f2105c --- /dev/null +++ b/config/sieve/spam.sieve @@ -0,0 +1,6 @@ +require ["fileinto", "mailbox"]; + +if header :contains "X-Spam" "Yes" { + fileinto :create "Junk"; + stop; +} diff --git a/dovecot/build.sh b/dovecot/build.sh index 6ec8d42..8a033e9 100755 --- a/dovecot/build.sh +++ b/dovecot/build.sh @@ -7,6 +7,7 @@ export TMPDIR=/tmp export TMP=/tmp NAME=dovecot VERSION=$1 +PIGEONHOLE=$2 PREFIX=/snap/mail/current/${NAME} OUTPUT=${DIR}/../build/snap/${NAME} @@ -32,6 +33,18 @@ cd ${NAME}-${VERSION} make -j4 make install +cd ${DIR}/work +wget http://www.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-${PIGEONHOLE}.tar.gz --progress dot:giga +tar xzf dovecot-2.3-pigeonhole-${PIGEONHOLE}.tar.gz +cd dovecot-2.3-pigeonhole-${PIGEONHOLE} + +./configure --prefix=${PREFIX} \ + --with-dovecot=${PREFIX}/lib/dovecot \ + --disable-rpath + +make -j4 +make install + echo "original libs" ldd ${PREFIX}/sbin/dovecot @@ -62,6 +75,7 @@ ldd ${PREFIX}/libexec/dovecot/auth cp ${DIR}/dovecot.sh ${PREFIX}/bin cp ${DIR}/lda.sh ${PREFIX}/bin cp ${DIR}/doveadm.sh ${PREFIX}/bin +cp ${DIR}/sievec.sh ${PREFIX}/bin cp ${DIR}/auth.sh ${PREFIX}/libexec/dovecot apt-get -y install patchelf @@ -106,6 +120,12 @@ patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/submission-login patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/xml2text +for binary in ${PREFIX}/bin/sieve* ${PREFIX}/libexec/dovecot/managesieve*; do + if [ -f "${binary}" ]; then + patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${binary} + fi +done + rm -rf ${OUTPUT} mkdir -p ${DIR}/../build/snap cp -r ${PREFIX} ${OUTPUT} diff --git a/dovecot/sievec.sh b/dovecot/sievec.sh new file mode 100755 index 0000000..f0aa001 --- /dev/null +++ b/dovecot/sievec.sh @@ -0,0 +1,7 @@ +#!/bin/bash -e + +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) + +LD_LIBRARY_PATH=$(find ${DIR}/lib -type d | tr '\n' ':') +export LD_LIBRARY_PATH=${LD_LIBRARY_PATH%:} +exec ${DIR}/lib/ld.so --library-path ${LD_LIBRARY_PATH} ${DIR}/bin/sievec "$@" diff --git a/meta/snap.yaml b/meta/snap.yaml index 5d34aa7..7b60d05 100644 --- a/meta/snap.yaml +++ b/meta/snap.yaml @@ -52,6 +52,25 @@ apps: - network - network-bind restart-condition: always + redis: + user: mail + command: bin/service.redis.sh + daemon: simple + plugs: + - network + - network-bind + restart-condition: always + before: [rspamd] + rspamd: + user: mail + command: bin/service.rspamd.sh + daemon: simple + plugs: + - network + - network-bind + restart-condition: always + after: [redis] + before: [postfix] storage-change: command: bin/cli storage-change diff --git a/redis/bin/redis-cli.sh b/redis/bin/redis-cli.sh new file mode 100755 index 0000000..4e34168 --- /dev/null +++ b/redis/bin/redis-cli.sh @@ -0,0 +1,4 @@ +#!/bin/bash -e +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) +export LD_LIBRARY_PATH=${DIR}/lib +exec ${DIR}/lib/ld.so --library-path ${DIR}/lib ${DIR}/sbin/redis-cli "$@" diff --git a/redis/bin/redis.sh b/redis/bin/redis.sh new file mode 100755 index 0000000..f139e93 --- /dev/null +++ b/redis/bin/redis.sh @@ -0,0 +1,4 @@ +#!/bin/bash -e +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) +export LD_LIBRARY_PATH=${DIR}/lib +exec ${DIR}/lib/ld.so --library-path ${DIR}/lib ${DIR}/sbin/redis-server "$@" diff --git a/redis/build.sh b/redis/build.sh new file mode 100755 index 0000000..89ed128 --- /dev/null +++ b/redis/build.sh @@ -0,0 +1,31 @@ +#!/bin/bash -xe + +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) +cd ${DIR} + +export TMPDIR=/tmp +export TMP=/tmp +NAME=redis +PREFIX=${DIR}/../build/snap/${NAME} + +rm -rf ${PREFIX} +mkdir -p ${PREFIX}/bin ${PREFIX}/sbin ${PREFIX}/lib + +apt-get update +apt-get -y install redis-server + +cp /usr/bin/redis-server ${PREFIX}/sbin +cp /usr/bin/redis-cli ${PREFIX}/sbin + +for binary in ${PREFIX}/sbin/*; do + ldd ${binary} | awk '/=> \//{print $3}' | while read lib; do + cp -L --remove-destination ${lib} ${PREFIX}/lib + done +done + +cp $(readlink -f /lib*/ld-linux-*.so*) ${PREFIX}/lib/ld.so + +cp ${DIR}/bin/*.sh ${PREFIX}/bin + +export LD_LIBRARY_PATH=${PREFIX}/lib +ldd ${PREFIX}/sbin/redis-server diff --git a/redis/test.sh b/redis/test.sh new file mode 100755 index 0000000..18b8a9b --- /dev/null +++ b/redis/test.sh @@ -0,0 +1,7 @@ +#!/bin/bash -xe + +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) +REDIS=${DIR}/../build/snap/redis + +${REDIS}/bin/redis.sh --version +${REDIS}/bin/redis-cli.sh --version diff --git a/rspamd/bin/rspamadm.sh b/rspamd/bin/rspamadm.sh new file mode 100755 index 0000000..c8c661f --- /dev/null +++ b/rspamd/bin/rspamadm.sh @@ -0,0 +1,4 @@ +#!/bin/bash -e +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) +export LD_LIBRARY_PATH=${DIR}/lib +exec ${DIR}/lib/ld.so --library-path ${DIR}/lib ${DIR}/sbin/rspamadm "$@" diff --git a/rspamd/bin/rspamc.sh b/rspamd/bin/rspamc.sh new file mode 100755 index 0000000..fcbe5a6 --- /dev/null +++ b/rspamd/bin/rspamc.sh @@ -0,0 +1,4 @@ +#!/bin/bash -e +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) +export LD_LIBRARY_PATH=${DIR}/lib +exec ${DIR}/lib/ld.so --library-path ${DIR}/lib ${DIR}/sbin/rspamc "$@" diff --git a/rspamd/bin/rspamd.sh b/rspamd/bin/rspamd.sh new file mode 100755 index 0000000..42cb174 --- /dev/null +++ b/rspamd/bin/rspamd.sh @@ -0,0 +1,4 @@ +#!/bin/bash -e +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) +export LD_LIBRARY_PATH=${DIR}/lib +exec ${DIR}/lib/ld.so --library-path ${DIR}/lib ${DIR}/sbin/rspamd "$@" diff --git a/rspamd/build.sh b/rspamd/build.sh new file mode 100755 index 0000000..5bcc4c7 --- /dev/null +++ b/rspamd/build.sh @@ -0,0 +1,38 @@ +#!/bin/bash -xe + +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) +cd ${DIR} + +export TMPDIR=/tmp +export TMP=/tmp +NAME=rspamd +PREFIX=${DIR}/../build/snap/${NAME} + +rm -rf ${PREFIX} +mkdir -p ${PREFIX}/bin ${PREFIX}/sbin ${PREFIX}/lib ${PREFIX}/etc ${PREFIX}/share + +apt-get update +apt-get -y install rspamd + +cp /usr/bin/rspamd ${PREFIX}/sbin +cp /usr/bin/rspamc ${PREFIX}/sbin +cp /usr/bin/rspamadm ${PREFIX}/sbin + +for binary in ${PREFIX}/sbin/*; do + ldd ${binary} | awk '/=> \//{print $3}' | while read lib; do + cp -L --remove-destination ${lib} ${PREFIX}/lib + done +done + +cp $(readlink -f /lib*/ld-linux-*.so*) ${PREFIX}/lib/ld.so + +cp -r /etc/rspamd/. ${PREFIX}/etc +cp -r /usr/share/rspamd/. ${PREFIX}/share + +rm -rf ${PREFIX}/etc/local.d ${PREFIX}/etc/override.d +mkdir -p ${PREFIX}/etc/local.d ${PREFIX}/etc/override.d + +cp ${DIR}/bin/*.sh ${PREFIX}/bin + +export LD_LIBRARY_PATH=${PREFIX}/lib +ldd ${PREFIX}/sbin/rspamd diff --git a/rspamd/test.sh b/rspamd/test.sh new file mode 100755 index 0000000..d1347da --- /dev/null +++ b/rspamd/test.sh @@ -0,0 +1,9 @@ +#!/bin/bash -xe + +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) +RSPAMD=${DIR}/../build/snap/rspamd + +${RSPAMD}/bin/rspamd.sh --version +${RSPAMD}/bin/rspamadm.sh --version +test -f ${RSPAMD}/etc/rspamd.conf +test -d ${RSPAMD}/share/lua diff --git a/test/test.py b/test/test.py index 2c0fc3c..ab2a64b 100644 --- a/test/test.py +++ b/test/test.py @@ -296,11 +296,15 @@ def smtp(device, device_host): return SMTP_TOOL -def tunnel_smtp(device, sender, recipient, subject='', body=''): +def tunnel_smtp(device, sender, recipient, subject='', body='', xclient='', headers=()): command = "{0} -socket {1} -from '{2}' -rcpt '{3}'".format( SMTP_TOOL, TUNNEL_SOCKET, sender, recipient) if subject: command += " -subject '{0}' -body '{1}'".format(subject, body) + if xclient: + command += " -xclient '{0}'".format(xclient) + for header in headers: + command += " -header '{0}'".format(header) return device.run_ssh(command, throw=False) @@ -352,3 +356,65 @@ def test_tunnel_does_not_sign_incoming_mail(app_domain, domain, device_user, dev message = latest_message(app_domain, device_user, device_password) signed_by_us = 'd={0}'.format(domain) assert signed_by_us not in message, message[:2000] + + +GTUBE = 'XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X' + + +def test_rspamd_and_redis_listen_on_sockets(device, data_dir): + milter = device.run_ssh("ls -l {0}/rspamd/milter.sock".format(data_dir), throw=False) + assert 'srw' in milter, milter + + redis = device.run_ssh("ls -l {0}/redis/redis.sock".format(data_dir), throw=False) + assert 'srw' in redis, redis + + +def test_tunnel_takes_the_announced_client_address(smtp, device, domain, device_user): + out = tunnel_smtp(device, 'outside@example.com', '{0}@{1}'.format(device_user, domain), + subject='xclient-announced', body='announced', + xclient='ADDR=192.0.2.77 NAME=announced.example.com') + assert 'queued' in out, out + + logged = device.run_ssh( + "grep -h postfix/tunnel /var/log/mail.log /var/log/syslog 2>/dev/null | tail -20; " + "journalctl --since '5 min ago' --no-pager 2>/dev/null | grep postfix/tunnel | tail -20", + throw=False) + assert '192.0.2.77' in logged, logged + + +def test_spam_is_rejected_before_the_mailbox(smtp, device, domain, device_user): + out = tunnel_smtp(device, 'spammer@example.com', '{0}@{1}'.format(device_user, domain), + subject='gtube-probe', body=GTUBE) + assert 'queued' not in out, out + assert '554' in out or '550' in out, out + + +def test_tagged_mail_is_filed_into_junk(app_domain, domain, device_user, device_password): + subject = 'junk-filing' + message = MIMEText('tagged as spam') + message['Subject'] = subject + message['From'] = 'outside@example.com' + message['To'] = '{0}@{1}'.format(device_user, domain) + message['X-Spam'] = 'Yes' + server = smtplib.SMTP(app_domain, timeout=10) + server.send_message(message) + server.quit() + + retry_func(lambda: assert_in_junk(app_domain, device_user, device_password, subject), + message='junk filing', retries=20, sleep=3) + + +def assert_in_junk(app_domain, device_user, device_password, subject): + server = imaplib.IMAP4_SSL(app_domain, ssl_context=(SSLContext(ssl.PROTOCOL_TLS))) + server.login(device_user, device_password) + try: + server.select('Junk') + _, data = server.search(None, 'SUBJECT', '"{0}"'.format(subject)) + junk = data[0].split() + server.select('inbox') + _, data = server.search(None, 'SUBJECT', '"{0}"'.format(subject)) + inbox = data[0].split() + finally: + server.logout() + assert junk, 'the tagged message is not in Junk' + assert not inbox, 'the tagged message also reached the inbox' From a4854db667ad3c63459cec41b0733132545bb032 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Fri, 14 Aug 2026 17:24:58 +0100 Subject: [PATCH 02/23] Fetch pigeonhole from where it is published The sieve releases live on their own host, not next to the dovecot ones, so the build asked for a file that was never there and stopped at a 404. --- dovecot/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dovecot/build.sh b/dovecot/build.sh index 8a033e9..84bb653 100755 --- a/dovecot/build.sh +++ b/dovecot/build.sh @@ -34,7 +34,7 @@ make -j4 make install cd ${DIR}/work -wget http://www.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-${PIGEONHOLE}.tar.gz --progress dot:giga +wget https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-${PIGEONHOLE}.tar.gz --progress dot:giga tar xzf dovecot-2.3-pigeonhole-${PIGEONHOLE}.tar.gz cd dovecot-2.3-pigeonhole-${PIGEONHOLE} From 21bbf8f008ac16fafbad85ba651ca3d15f380f2d Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Fri, 14 Aug 2026 17:58:34 +0100 Subject: [PATCH 03/23] Patch only the binaries, not the wrapper beside them The sieve wrapper sits in the same directory and matched the pattern, and patchelf has nothing to say about a shell script, so it is put in place once the real binaries have been dealt with. --- dovecot/build.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dovecot/build.sh b/dovecot/build.sh index 84bb653..997de01 100755 --- a/dovecot/build.sh +++ b/dovecot/build.sh @@ -75,7 +75,6 @@ ldd ${PREFIX}/libexec/dovecot/auth cp ${DIR}/dovecot.sh ${PREFIX}/bin cp ${DIR}/lda.sh ${PREFIX}/bin cp ${DIR}/doveadm.sh ${PREFIX}/bin -cp ${DIR}/sievec.sh ${PREFIX}/bin cp ${DIR}/auth.sh ${PREFIX}/libexec/dovecot apt-get -y install patchelf @@ -126,6 +125,8 @@ for binary in ${PREFIX}/bin/sieve* ${PREFIX}/libexec/dovecot/managesieve*; do fi done +cp ${DIR}/sievec.sh ${PREFIX}/bin + rm -rf ${OUTPUT} mkdir -p ${DIR}/../build/snap cp -r ${PREFIX} ${OUTPUT} From 33afb4ed61085cddbabb2d4cd2b8767820ec5f73 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Fri, 14 Aug 2026 18:14:24 +0100 Subject: [PATCH 04/23] Scan what arrives on the open port too Only mail coming through the tunnel was being looked at, so a device that takes its own mail rather than going through the relay was left with nothing between the internet and the mailbox. The owner sends through the same port, so opendkim keeps signing there and what an authenticated sender submits is left unscored, otherwise the box would start refusing its own mail. --- config/postfix/master.cf | 1 + config/rspamd/local.d/settings.conf | 10 ++++++++++ test/test.py | 22 ++++++++++++++++++++++ 3 files changed, 33 insertions(+) create mode 100644 config/rspamd/local.d/settings.conf diff --git a/config/postfix/master.cf b/config/postfix/master.cf index fc17353..e1209ed 100644 --- a/config/postfix/master.cf +++ b/config/postfix/master.cf @@ -10,6 +10,7 @@ # (yes) (yes) (yes) (never) (100) # ========================================================================== smtp inet n - n - - smtpd + -o smtpd_milters=unix:{{ .DataDir }}/opendkim.socket,unix:{{ .DataDir }}/rspamd/milter.sock #smtp inet n - n - 1 postscreen #smtpd pass - - n - - smtpd #dnsblog unix - - n - 0 dnsblog diff --git a/config/rspamd/local.d/settings.conf b/config/rspamd/local.d/settings.conf new file mode 100644 index 0000000..7e07eac --- /dev/null +++ b/config/rspamd/local.d/settings.conf @@ -0,0 +1,10 @@ +authenticated { + authenticated = yes; + apply { + actions { + reject = null; + add_header = null; + greylist = null; + } + } +} diff --git a/test/test.py b/test/test.py index ab2a64b..57fb938 100644 --- a/test/test.py +++ b/test/test.py @@ -418,3 +418,25 @@ def assert_in_junk(app_domain, device_user, device_password, subject): server.logout() assert junk, 'the tagged message is not in Junk' assert not inbox, 'the tagged message also reached the inbox' + + +def test_spam_arriving_directly_is_also_rejected(app_domain, domain, device_user): + message = MIMEText(GTUBE) + message['Subject'] = 'gtube-direct' + message['From'] = 'spammer@example.com' + message['To'] = '{0}@{1}'.format(device_user, domain) + server = smtplib.SMTP(app_domain, timeout=10) + with pytest.raises(smtplib.SMTPDataError) as rejected: + server.send_message(message) + assert rejected.value.smtp_code in (550, 554), rejected.value + + +def test_owner_mail_is_not_filtered(app_domain, domain, device_user, device_password): + message = MIMEText(GTUBE) + message['Subject'] = 'gtube-authenticated' + message['From'] = '{0}@{1}'.format(device_user, domain) + message['To'] = '{0}@{1}'.format(device_user, domain) + server = smtplib.SMTP(app_domain, timeout=10) + server.login(device_user, device_password) + server.send_message(message) + server.quit() From 14bc75c6188dd907f020adeb8300974e38baea07 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Fri, 14 Aug 2026 20:03:20 +0100 Subject: [PATCH 05/23] Check for the directories rspamd actually ships The lua code is spread across lualib, rules and plugins rather than sitting in one directory, and those are the paths the service points the daemon at, so they are what the check looks for. --- rspamd/test.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/rspamd/test.sh b/rspamd/test.sh index d1347da..56492b1 100755 --- a/rspamd/test.sh +++ b/rspamd/test.sh @@ -5,5 +5,10 @@ RSPAMD=${DIR}/../build/snap/rspamd ${RSPAMD}/bin/rspamd.sh --version ${RSPAMD}/bin/rspamadm.sh --version +${RSPAMD}/bin/rspamc.sh --version + test -f ${RSPAMD}/etc/rspamd.conf -test -d ${RSPAMD}/share/lua +test -d ${RSPAMD}/share/lualib +test -d ${RSPAMD}/share/rules +test -d ${RSPAMD}/share/plugins +test -d ${RSPAMD}/share/www From bbeaa05a39990aa01e84799b5a1c50d373e330eb Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Fri, 14 Aug 2026 21:45:14 +0100 Subject: [PATCH 06/23] Do not ask rspamc for a version it does not report It rejects the option and stops the build, so the check is that the client is there and runnable, which is all the other two already prove about the libraries. --- rspamd/test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rspamd/test.sh b/rspamd/test.sh index 56492b1..82a30d8 100755 --- a/rspamd/test.sh +++ b/rspamd/test.sh @@ -5,8 +5,8 @@ RSPAMD=${DIR}/../build/snap/rspamd ${RSPAMD}/bin/rspamd.sh --version ${RSPAMD}/bin/rspamadm.sh --version -${RSPAMD}/bin/rspamc.sh --version +test -x ${RSPAMD}/sbin/rspamc test -f ${RSPAMD}/etc/rspamd.conf test -d ${RSPAMD}/share/lualib test -d ${RSPAMD}/share/rules From 5391be5f17bb76e9c0b08b548405d406957895e3 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sat, 15 Aug 2026 10:07:05 +0100 Subject: [PATCH 07/23] Tell sievec where the configuration lives It looks for a dovecot config next to the binary, and ours is generated into the data directory, so the compile stopped the install before it started. --- cli/installer/sieve.go | 3 ++- cli/installer/sieve_test.go | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/cli/installer/sieve.go b/cli/installer/sieve.go index 2ed0b9c..fc377a7 100644 --- a/cli/installer/sieve.go +++ b/cli/installer/sieve.go @@ -31,6 +31,7 @@ func (s *Sieve) Compile() error { script := s.ScriptPath() s.logger.Info("compiling the spam filing script", zap.String("script", script)) sievec := path.Join(s.appDir, "dovecot", "bin", "sievec.sh") - _, err := s.executor.RunDir("", sievec, script) + config := path.Join(s.configPath, "dovecot", "dovecot.conf") + _, err := s.executor.RunDir("", sievec, "-c", config, script) return err } diff --git a/cli/installer/sieve_test.go b/cli/installer/sieve_test.go index 6c06767..3d3045e 100644 --- a/cli/installer/sieve_test.go +++ b/cli/installer/sieve_test.go @@ -27,7 +27,10 @@ func TestSieve_CompilesTheSpamScript(t *testing.T) { assert.NoError(t, sieve.Compile()) assert.Equal(t, "/snap/mail/current/dovecot/bin/sievec.sh", runner.app) - assert.Equal(t, []string{"/var/snap/mail/current/config/sieve/spam.sieve"}, runner.args) + assert.Equal(t, []string{ + "-c", "/var/snap/mail/current/config/dovecot/dovecot.conf", + "/var/snap/mail/current/config/sieve/spam.sieve", + }, runner.args) } func TestSieve_ReportsCompilationFailure(t *testing.T) { From 88a8fbd9aa7b20cbec20f77b296cffccc0e45b9f Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sat, 15 Aug 2026 12:47:59 +0100 Subject: [PATCH 08/23] Speak a milter protocol rspamd will answer Postfix was pinned to a version from before the one rspamd talks, so the handshake was aborted on every message and the default action let everything through unscanned, which is why spam still arrived. Language detection was also reading from where the distribution puts it rather than from the snap, so it silently had no data to work with. --- config/postfix/main.cf | 2 +- config/rspamd/rspamd.conf | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/config/postfix/main.cf b/config/postfix/main.cf index 1f69429..a740422 100644 --- a/config/postfix/main.cf +++ b/config/postfix/main.cf @@ -706,7 +706,7 @@ smtpd_tls_auth_only = no smtp_tls_security_level = may -milter_protocol = 2 +milter_protocol = 6 milter_default_action = accept smtpd_milters = unix:{{ .DataDir }}/opendkim.socket non_smtpd_milters = unix:{{ .DataDir }}/opendkim.socket diff --git a/config/rspamd/rspamd.conf b/config/rspamd/rspamd.conf index 0d05727..b18a701 100644 --- a/config/rspamd/rspamd.conf +++ b/config/rspamd/rspamd.conf @@ -1 +1,5 @@ .include "$CONFDIR/rspamd.conf" + +lang_detection { + languages = "{{ .AppDir }}/rspamd/share/languages"; +} From 0475d98c3c0716c004c492091ab1e10966d7dae0 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sat, 15 Aug 2026 15:08:59 +0100 Subject: [PATCH 09/23] Stop holding mail back for a later attempt Turning the action off left the module itself running, and once it had somewhere to keep its records it started deferring the first message from every sender. Waiting minutes for mail that was going to arrive anyway is not what this is meant to do. --- config/rspamd/local.d/greylist.conf | 1 + 1 file changed, 1 insertion(+) create mode 100644 config/rspamd/local.d/greylist.conf diff --git a/config/rspamd/local.d/greylist.conf b/config/rspamd/local.d/greylist.conf new file mode 100644 index 0000000..a6ee831 --- /dev/null +++ b/config/rspamd/local.d/greylist.conf @@ -0,0 +1 @@ +enabled = false; From 3cd7e68f3ddc1e478c03b7af4396d168cbbab26b Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sat, 15 Aug 2026 16:26:53 +0100 Subject: [PATCH 10/23] Leave the owner's mail alone entirely Silencing the actions was not enough because some checks decide on their own and never consult them, so mail from someone who has signed in is now left out of the filtering rather than filtered and then forgiven. --- config/rspamd/local.d/settings.conf | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/config/rspamd/local.d/settings.conf b/config/rspamd/local.d/settings.conf index 7e07eac..19d1bf0 100644 --- a/config/rspamd/local.d/settings.conf +++ b/config/rspamd/local.d/settings.conf @@ -1,10 +1,6 @@ authenticated { authenticated = yes; apply { - actions { - reject = null; - add_header = null; - greylist = null; - } + want_spam = yes; } } From 267fdfea51a918b8148ee4f4b34c86fb233e3391 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sat, 15 Aug 2026 17:57:06 +0100 Subject: [PATCH 11/23] Check the owner's mail arrives rather than poke a tripwire The pattern used here is meant to fire whatever the circumstances, so it can never show that a sender was left out of the filtering. What matters is that mail from the owner lands in the inbox and is not put aside as junk, so that is what is checked. --- test/test.py | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/test/test.py b/test/test.py index 57fb938..3db8172 100644 --- a/test/test.py +++ b/test/test.py @@ -432,11 +432,31 @@ def test_spam_arriving_directly_is_also_rejected(app_domain, domain, device_user def test_owner_mail_is_not_filtered(app_domain, domain, device_user, device_password): - message = MIMEText(GTUBE) - message['Subject'] = 'gtube-authenticated' + subject = 'owner-submission' + message = MIMEText('sent by the owner') + message['Subject'] = subject message['From'] = '{0}@{1}'.format(device_user, domain) message['To'] = '{0}@{1}'.format(device_user, domain) server = smtplib.SMTP(app_domain, timeout=10) server.login(device_user, device_password) server.send_message(message) server.quit() + + retry_func(lambda: assert_in_inbox(app_domain, device_user, device_password, subject), + message='owner submission', retries=20, sleep=3) + + +def assert_in_inbox(app_domain, device_user, device_password, subject): + server = imaplib.IMAP4_SSL(app_domain, ssl_context=(SSLContext(ssl.PROTOCOL_TLS))) + server.login(device_user, device_password) + try: + server.select('inbox') + _, data = server.search(None, 'SUBJECT', '"{0}"'.format(subject)) + inbox = data[0].split() + server.select('Junk') + _, data = server.search(None, 'SUBJECT', '"{0}"'.format(subject)) + junk = data[0].split() + finally: + server.logout() + assert inbox, 'the owner submission never reached the inbox' + assert not junk, 'the owner submission was filed as junk' From 4d1d9610a1a196d9781e4602c2dc02a5eb810f2c Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 01:22:28 +0100 Subject: [PATCH 12/23] Move to the current dovecot and sieve The settings this was written against are gone in the new version, so the configuration is written out once in the shape it expects rather than carried over: storage says what it is and where it lives, the directory lookup is stated inline instead of in a file of its own, certificates sit with the rest of the server settings, and the script that files junk is declared as a script that runs before the user's own. The sieve releases now carry the same version as dovecot, which is what made the earlier pairing easy to get wrong. Binaries are patched by looking at what they are, since the set of them changes between versions, and the login processes get the account the new version expects. The one time move of state out of the common directory goes as well, having already happened everywhere it needed to. --- .drone.jsonnet | 4 +- cli/installer/installer.go | 38 +-- config/dovecot/conf.d/10-auth.conf | 128 -------- config/dovecot/conf.d/10-logging.conf | 85 ----- config/dovecot/conf.d/10-mail.conf | 385 ----------------------- config/dovecot/conf.d/10-master.conf | 120 ------- config/dovecot/conf.d/10-ssl.conf | 43 --- config/dovecot/conf.d/15-lda.conf | 49 --- config/dovecot/conf.d/15-mailboxes.conf | 79 ----- config/dovecot/conf.d/90-sieve.conf | 3 - config/dovecot/conf.d/auth-ldap.conf.ext | 33 -- config/dovecot/dovecot-ldap.conf.ext | 143 --------- config/dovecot/dovecot.conf | 206 ++++++------ dovecot/build.sh | 54 +--- 14 files changed, 124 insertions(+), 1246 deletions(-) delete mode 100644 config/dovecot/conf.d/10-auth.conf delete mode 100644 config/dovecot/conf.d/10-logging.conf delete mode 100644 config/dovecot/conf.d/10-mail.conf delete mode 100644 config/dovecot/conf.d/10-master.conf delete mode 100644 config/dovecot/conf.d/10-ssl.conf delete mode 100644 config/dovecot/conf.d/15-lda.conf delete mode 100644 config/dovecot/conf.d/15-mailboxes.conf delete mode 100644 config/dovecot/conf.d/90-sieve.conf delete mode 100644 config/dovecot/conf.d/auth-ldap.conf.ext delete mode 100644 config/dovecot/dovecot-ldap.conf.ext diff --git a/.drone.jsonnet b/.drone.jsonnet index 6611c93..21c657e 100644 --- a/.drone.jsonnet +++ b/.drone.jsonnet @@ -1,7 +1,7 @@ local name = 'mail'; local roundcube = '1.6.15'; -local dovecot = '2.3.21'; -local pigeonhole = '0.5.21'; +local dovecot = '2.4.4'; +local pigeonhole = '2.4.4'; local nginx = '1.30.4'; local postfix = '3.11.5'; local python = '3.12-slim-bookworm'; diff --git a/cli/installer/installer.go b/cli/installer/installer.go index 9107e5b..f4fcce9 100644 --- a/cli/installer/installer.go +++ b/cli/installer/installer.go @@ -147,48 +147,16 @@ func (i *Installer) RegenerateConfigs() error { return linux.Chown(i.configPath, UserName) } -func (i *Installer) MigrateCommonToData() error { - marker := path.Join(i.dataDir, ".migrated_from_common") - if _, err := os.Stat(marker); err == nil { - return nil - } - if err := linux.CreateMissingDirs(i.dataDir); err != nil { - return err - } - entries, err := os.ReadDir(i.commonDir) - if err != nil { - if os.IsNotExist(err) { - return os.WriteFile(marker, []byte{}, 0644) - } - return err - } - for _, entry := range entries { - name := entry.Name() - if name == "web.socket" || strings.HasSuffix(name, ".socket") { - continue - } - dst := path.Join(i.dataDir, name) - if _, err := os.Stat(dst); err == nil { - continue - } - i.logger.Info("migrating to data", zap.String("name", name)) - if err := os.Rename(path.Join(i.commonDir, name), dst); err != nil { - return err - } - } - return os.WriteFile(marker, []byte{}, 0644) -} - func (i *Installer) InitConfig() error { - if err := i.MigrateCommonToData(); err != nil { - return err - } if err := linux.CreateUser("maildrop"); err != nil { return err } if err := linux.CreateUser("dovecot"); err != nil { return err } + if err := linux.CreateUser("dovenull"); err != nil { + return err + } if err := linux.CreateUser(UserName); err != nil { return err } diff --git a/config/dovecot/conf.d/10-auth.conf b/config/dovecot/conf.d/10-auth.conf deleted file mode 100644 index 3e7e8e6..0000000 --- a/config/dovecot/conf.d/10-auth.conf +++ /dev/null @@ -1,128 +0,0 @@ -## -## Authentication processes -## - -# Disable LOGIN command and all other plaintext authentications unless -# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP -# matches the local IP (ie. you're connecting from the same computer), the -# connection is considered secure and plaintext authentication is allowed. -# See also ssl=required setting. -#disable_plaintext_auth = yes - -# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that -# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used. -#auth_cache_size = 0 -# Time to live for cached data. After TTL expires the cached record is no -# longer used, *except* if the main database lookup returns internal failure. -# We also try to handle password changes automatically: If user's previous -# authentication was successful, but this one wasn't, the cache isn't used. -# For now this works only with plaintext authentication. -#auth_cache_ttl = 1 hour -# TTL for negative hits (user not found, password mismatch). -# 0 disables caching them completely. -#auth_cache_negative_ttl = 1 hour - -# Space separated list of realms for SASL authentication mechanisms that need -# them. You can leave it empty if you don't want to support multiple realms. -# Many clients simply use the first one listed here, so keep the default realm -# first. -#auth_realms = - -# Default realm/domain to use if none was specified. This is used for both -# SASL realms and appending @domain to username in plaintext logins. -#auth_default_realm = - -# List of allowed characters in username. If the user-given username contains -# a character not listed in here, the login automatically fails. This is just -# an extra check to make sure user can't exploit any potential quote escaping -# vulnerabilities with SQL/LDAP databases. If you want to allow all characters, -# set this value to empty. -#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ - -# Username character translations before it's looked up from databases. The -# value contains series of from -> to characters. For example "#@/@" means -# that '#' and '/' characters are translated to '@'. -#auth_username_translation = - -# Username formatting before it's looked up from databases. You can use -# the standard variables here, eg. %Lu would lowercase the username, %n would -# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into -# "-AT-". This translation is done after auth_username_translation changes. -#auth_username_format = %Lu - -# If you want to allow master users to log in by specifying the master -# username within the normal username string (ie. not using SASL mechanism's -# support for it), you can specify the separator character here. The format -# is then . UW-IMAP uses "*" as the -# separator, so that could be a good choice. -#auth_master_user_separator = - -# Username to use for users logging in with ANONYMOUS SASL mechanism -#auth_anonymous_username = anonymous - -# Maximum number of dovecot-auth worker processes. They're used to execute -# blocking passdb and userdb queries (eg. MySQL and PAM). They're -# automatically created and destroyed as needed. -#auth_worker_max_count = 30 - -# Host name to use in GSSAPI principal names. The default is to use the -# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab -# entries. -#auth_gssapi_hostname = - -# Kerberos keytab to use for the GSSAPI mechanism. Will use the system -# default (usually /etc/krb5.keytab) if not specified. You may need to change -# the auth service to run as root to be able to read this file. -#auth_krb5_keytab = - -# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and -# ntlm_auth helper. -#auth_use_winbind = no - -# Path for Samba's ntlm_auth helper binary. -#auth_winbind_helper_path = /usr/bin/ntlm_auth - -# Time to delay before replying to failed authentications. -#auth_failure_delay = 2 secs - -# Require a valid SSL client certificate or the authentication fails. -#auth_ssl_require_client_cert = no - -# Take the username from client's SSL certificate, using -# X509_NAME_get_text_by_NID() which returns the subject's DN's -# CommonName. -#auth_ssl_username_from_cert = no - -# Space separated list of wanted authentication mechanisms: -# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey -# gss-spnego -# NOTE: See also disable_plaintext_auth setting. -auth_mechanisms = plain login - -## -## Password and user databases -## - -# -# Password database is used to verify user's password (and nothing more). -# You can have multiple passdbs and userdbs. This is useful if you want to -# allow both system users (/etc/passwd) and virtual users to login without -# duplicating the system users into virtual database. -# -# -# -# User database specifies where mails are located and what user/group IDs -# own them. For single-UID configuration use "static" userdb. -# -# - -#!include auth-deny.conf.ext -#!include auth-master.conf.ext - -#!include auth-system.conf.ext -#!include auth-sql.conf.ext -!include auth-ldap.conf.ext -#!include auth-passwdfile.conf.ext -#!include auth-checkpassword.conf.ext -#!include auth-vpopmail.conf.ext -#!include auth-static.conf.ext diff --git a/config/dovecot/conf.d/10-logging.conf b/config/dovecot/conf.d/10-logging.conf deleted file mode 100644 index 6b79239..0000000 --- a/config/dovecot/conf.d/10-logging.conf +++ /dev/null @@ -1,85 +0,0 @@ -## -## Log destination. -## - -# Log file to use for error messages. "syslog" logs to syslog, -# /dev/stderr logs to stderr. -log_path = syslog - -# Log file to use for informational messages. Defaults to log_path. -#info_log_path = {{ .DataDir }}/log/dovecot.info.log -# Log file to use for debug messages. Defaults to info_log_path. -#debug_log_path = - -# Syslog facility to use if you're logging to syslog. Usually if you don't -# want to use "mail", you'll use local0..local7. Also other standard -# facilities are supported. -#syslog_facility = mail - -## -## Logging verbosity and debugging. -## - -# Log unsuccessful authentication attempts and the reasons why they failed. -auth_verbose = no - -# In case of password mismatches, log the attempted password. Valid values are -# no, plain and sha1. sha1 can be useful for detecting brute force password -# attempts vs. user simply trying the same password over and over again. -#auth_verbose_passwords = no - -# Even more verbose logging for debugging purposes. Shows for example SQL -# queries. -auth_debug = no - -# In case of password mismatches, log the passwords and used scheme so the -# problem can be debugged. Enabling this also enables auth_debug. -#auth_debug_passwords = no - -# Enable mail process debugging. This can help you figure out why Dovecot -# isn't finding your mails. -#mail_debug = no - -# Show protocol level SSL errors. -verbose_ssl = no - -# mail_log plugin provides more event logging for mail processes. -plugin { - # Events to log. Also available: flag_change append - mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename - # Group events within a transaction to one line. - #mail_log_group_events = no - # Available fields: uid, box, msgid, from, subject, size, vsize, flags - # size and vsize are available only for expunge and copy events. - #mail_log_fields = uid box msgid size -} - -## -## Log formatting. -## - -# Prefix for each line written to log file. % codes are in strftime(3) -# format. -#log_timestamp = "%b %d %H:%M:%S " - -# Space-separated list of elements we want to log. The elements which have -# a non-empty variable value are joined together to form a comma-separated -# string. -#login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c - -# Login log format. %$ contains login_log_format_elements string, %s contains -# the data we want to log. -#login_log_format = %$: %s - -# Log prefix for mail processes. See doc/wiki/Variables.txt for list of -# possible variables you can use. -#mail_log_prefix = "%s(%u): " - -# Format to use for logging mail deliveries. You can use variables: -# %$ - Delivery status message (e.g. "saved to INBOX") -# %m - Message-ID -# %s - Subject -# %f - From address -# %p - Physical size -# %w - Virtual size -#deliver_log_format = msgid=%m: %$ diff --git a/config/dovecot/conf.d/10-mail.conf b/config/dovecot/conf.d/10-mail.conf deleted file mode 100644 index 01bd7fc..0000000 --- a/config/dovecot/conf.d/10-mail.conf +++ /dev/null @@ -1,385 +0,0 @@ -## -## Mailbox locations and namespaces -## - -# Location for users' mailboxes. The default is empty, which means that Dovecot -# tries to find the mailboxes automatically. This won't work if the user -# doesn't yet have any mail, so you should explicitly tell Dovecot the full -# location. -# -# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u) -# isn't enough. You'll also need to tell Dovecot where the other mailboxes are -# kept. This is called the "root mail directory", and it must be the first -# path given in the mail_location setting. -# -# There are a few special variables you can use, eg.: -# -# %u - username -# %n - user part in user@domain, same as %u if there's no domain -# %d - domain part in user@domain, empty if there's no domain -# %h - home directory -# -# See doc/wiki/Variables.txt for full list. Some examples: -# -# mail_location = maildir:~/Maildir -# mail_location = mbox:~/mail:INBOX=/var/mail/%u -# mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n -# -# -# -#mail_location = -mail_location = maildir:{{ .DataDir }}/box/%u - -# If you need to set multiple mailbox locations or want to change default -# namespace settings, you can do it by defining namespace sections. -# -# You can have private, shared and public namespaces. Private namespaces -# are for user's personal mails. Shared namespaces are for accessing other -# users' mailboxes that have been shared. Public namespaces are for shared -# mailboxes that are managed by sysadmin. If you create any shared or public -# namespaces you'll typically want to enable ACL plugin also, otherwise all -# users can access all the shared mailboxes, assuming they have permissions -# on filesystem level to do so. -namespace inbox { - # Namespace type: private, shared or public - #type = private - - # Hierarchy separator to use. You should use the same separator for all - # namespaces or some clients get confused. '/' is usually a good one. - # The default however depends on the underlying mail storage format. - #separator = - - # Prefix required to access this namespace. This needs to be different for - # all namespaces. For example "Public/". - #prefix = - - # Physical location of the mailbox. This is in same format as - # mail_location, which is also the default for it. - #location = - - # There can be only one INBOX, and this setting defines which namespace - # has it. - inbox = yes - - # If namespace is hidden, it's not advertised to clients via NAMESPACE - # extension. You'll most likely also want to set list=no. This is mostly - # useful when converting from another server with different namespaces which - # you want to deprecate but still keep working. For example you can create - # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/". - #hidden = no - - # Show the mailboxes under this namespace with LIST command. This makes the - # namespace visible for clients that don't support NAMESPACE extension. - # "children" value lists child mailboxes, but hides the namespace prefix. - #list = yes - - # Namespace handles its own subscriptions. If set to "no", the parent - # namespace handles them (empty prefix should always have this as "yes") - #subscriptions = yes - - # See 15-mailboxes.conf for definitions of special mailboxes. -} - -# Example shared namespace configuration -#namespace { - #type = shared - #separator = / - - # Mailboxes are visible under "shared/user@domain/" - # %%n, %%d and %%u are expanded to the destination user. - #prefix = shared/%%u/ - - # Mail location for other users' mailboxes. Note that %variables and ~/ - # expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the - # destination user's data. - #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u - - # Use the default namespace for saving subscriptions. - #subscriptions = no - - # List the shared/ namespace only if there are visible shared mailboxes. - #list = children -#} -# Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"? -#mail_shared_explicit_inbox = no - -# System user and group used to access mails. If you use multiple, userdb -# can override these by returning uid or gid fields. You can use either numbers -# or names. -#mail_uid = -#mail_gid = - -# Group to enable temporarily for privileged operations. Currently this is -# used only with INBOX when either its initial creation or dotlocking fails. -# Typically this is set to "mail" to give access to /var/mail. -#mail_privileged_group = -mail_privileged_group = mail - -# Grant access to these supplementary groups for mail processes. Typically -# these are used to set up access to shared mailboxes. Note that it may be -# dangerous to set these if users can create symlinks (e.g. if "mail" group is -# set here, ln -s /var/mail ~/mail/var could allow a user to delete others' -# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it). -#mail_access_groups = - -# Allow full filesystem access to clients. There's no access checks other than -# what the operating system does for the active UID/GID. It works with both -# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/ -# or ~user/. -#mail_full_filesystem_access = no - -# Dictionary for key=value mailbox attributes. This is used for example by -# URLAUTH and METADATA extensions. -#mail_attribute_dict = - -# A comment or note that is associated with the server. This value is -# accessible for authenticated users through the IMAP METADATA server -# entry "/shared/comment". -#mail_server_comment = "" - -# Indicates a method for contacting the server administrator. According to -# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that -# is currently not enforced. Use for example mailto:admin@example.com. This -# value is accessible for authenticated users through the IMAP METADATA server -# entry "/shared/admin". -#mail_server_admin = - -## -## Mail processes -## - -# Don't use mmap() at all. This is required if you store indexes to shared -# filesystems (NFS or clustered filesystem). -#mmap_disable = no - -# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL -# since version 3, so this should be safe to use nowadays by default. -#dotlock_use_excl = yes - -# When to use fsync() or fdatasync() calls: -# optimized (default): Whenever necessary to avoid losing important data -# always: Useful with e.g. NFS when write()s are delayed -# never: Never use it (best performance, but crashes can lose data) -#mail_fsync = optimized - -# Locking method for index files. Alternatives are fcntl, flock and dotlock. -# Dotlocking uses some tricks which may create more disk I/O than other locking -# methods. NFS users: flock doesn't work, remember to change mmap_disable. -#lock_method = fcntl - -# Directory in which LDA/LMTP temporarily stores incoming mails >128 kB. -#mail_temp_dir = /tmp - -# Valid UID range for users, defaults to 500 and above. This is mostly -# to make sure that users can't log in as daemons or other system users. -# Note that denying root logins is hardcoded to dovecot binary and can't -# be done even if first_valid_uid is set to 0. -#first_valid_uid = 500 -#last_valid_uid = 0 - -first_valid_uid = 1 -last_valid_uid = 10000 - - -# Valid GID range for users, defaults to non-root/wheel. Users having -# non-valid GID as primary group ID aren't allowed to log in. If user -# belongs to supplementary groups with non-valid GIDs, those groups are -# not set. -#first_valid_gid = 1 -#last_valid_gid = 0 - -# Maximum allowed length for mail keyword name. It's only forced when trying -# to create new keywords. -#mail_max_keyword_length = 50 - -# ':' separated list of directories under which chrooting is allowed for mail -# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too). -# This setting doesn't affect login_chroot, mail_chroot or auth chroot -# settings. If this setting is empty, "/./" in home dirs are ignored. -# WARNING: Never add directories here which local users can modify, that -# may lead to root exploit. Usually this should be done only if you don't -# allow shell access for users. -#valid_chroot_dirs = - -# Default chroot directory for mail processes. This can be overridden for -# specific users in user database by giving /./ in user's home directory -# (eg. /home/./user chroots into /home). Note that usually there is no real -# need to do chrooting, Dovecot doesn't allow users to access files outside -# their mail directory anyway. If your home directories are prefixed with -# the chroot directory, append "/." to mail_chroot. -#mail_chroot = - -# UNIX socket path to master authentication server to find users. -# This is used by imap (for shared users) and lda. -#auth_socket_path = /var/run/dovecot/auth-userdb - -# Directory where to look up mail plugins. -#mail_plugin_dir = /usr/lib/dovecot - -# Space separated list of plugins to load for all services. Plugins specific to -# IMAP, LDA, etc. are added to this list in their own .conf files. -#mail_plugins = - -## -## Mailbox handling optimizations -## - -# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are -# also required for IMAP NOTIFY extension to be enabled. -#mailbox_list_index = no - -# The minimum number of mails in a mailbox before updates are done to cache -# file. This allows optimizing Dovecot's behavior to do less disk writes at -# the cost of more disk reads. -#mail_cache_min_mail_count = 0 - -# When IDLE command is running, mailbox is checked once in a while to see if -# there are any new mails or other changes. This setting defines the minimum -# time to wait between those checks. Dovecot can also use inotify and -# kqueue to find out immediately when changes occur. -#mailbox_idle_check_interval = 30 secs - -# Save mails with CR+LF instead of plain LF. This makes sending those mails -# take less CPU, especially with sendfile() syscall with Linux and FreeBSD. -# But it also creates a bit more disk I/O which may just make it slower. -# Also note that if other software reads the mboxes/maildirs, they may handle -# the extra CRs wrong and cause problems. -#mail_save_crlf = no - -# Max number of mails to keep open and prefetch to memory. This only works with -# some mailbox formats and/or operating systems. -#mail_prefetch_count = 0 - -# How often to scan for stale temporary files and delete them (0 = never). -# These should exist only after Dovecot dies in the middle of saving mails. -#mail_temp_scan_interval = 1w - -## -## Maildir-specific settings -## - -# By default LIST command returns all entries in maildir beginning with a dot. -# Enabling this option makes Dovecot return only entries which are directories. -# This is done by stat()ing each entry, so it causes more disk I/O. -# (For systems setting struct dirent->d_type, this check is free and it's -# done always regardless of this setting) -#maildir_stat_dirs = no - -# When copying a message, do it with hard links whenever possible. This makes -# the performance much better, and it's unlikely to have any side effects. -#maildir_copy_with_hardlinks = yes - -# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only -# when its mtime changes unexpectedly or when we can't find the mail otherwise. -#maildir_very_dirty_syncs = no - -# If enabled, Dovecot doesn't use the S= in the Maildir filenames for -# getting the mail's physical size, except when recalculating Maildir++ quota. -# This can be useful in systems where a lot of the Maildir filenames have a -# broken size. The performance hit for enabling this is very small. -#maildir_broken_filename_sizes = no - -# Always move mails from new/ directory to cur/, even when the \Recent flags -# aren't being reset. -#maildir_empty_new = no - -## -## mbox-specific settings -## - -# Which locking methods to use for locking mbox. There are four available: -# dotlock: Create .lock file. This is the oldest and most NFS-safe -# solution. If you want to use /var/mail/ like directory, the users -# will need write access to that directory. -# dotlock_try: Same as dotlock, but if it fails because of permissions or -# because there isn't enough disk space, just skip it. -# fcntl : Use this if possible. Works with NFS too if lockd is used. -# flock : May not exist in all systems. Doesn't work with NFS. -# lockf : May not exist in all systems. Doesn't work with NFS. -# -# You can use multiple locking methods; if you do the order they're declared -# in is important to avoid deadlocks if other MTAs/MUAs are using multiple -# locking methods as well. Some operating systems don't allow using some of -# them simultaneously. -#mbox_read_locks = fcntl -#mbox_write_locks = dotlock fcntl - -# Maximum time to wait for lock (all of them) before aborting. -#mbox_lock_timeout = 5 mins - -# If dotlock exists but the mailbox isn't modified in any way, override the -# lock file after this much time. -#mbox_dotlock_change_timeout = 2 mins - -# When mbox changes unexpectedly we have to fully read it to find out what -# changed. If the mbox is large this can take a long time. Since the change -# is usually just a newly appended mail, it'd be faster to simply read the -# new mails. If this setting is enabled, Dovecot does this but still safely -# fallbacks to re-reading the whole mbox file whenever something in mbox isn't -# how it's expected to be. The only real downside to this setting is that if -# some other MUA changes message flags, Dovecot doesn't notice it immediately. -# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK -# commands. -#mbox_dirty_syncs = yes - -# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE, -# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored. -#mbox_very_dirty_syncs = no - -# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK -# commands and when closing the mailbox). This is especially useful for POP3 -# where clients often delete all mails. The downside is that our changes -# aren't immediately visible to other MUAs. -#mbox_lazy_writes = yes - -# If mbox size is smaller than this (e.g. 100k), don't write index files. -# If an index file already exists it's still read, just not updated. -#mbox_min_index_size = 0 - -# Mail header selection algorithm to use for MD5 POP3 UIDLs when -# pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired -# algorithm, but it fails if the first Received: header isn't unique in all -# mails. An alternative algorithm is "all" that selects all headers. -#mbox_md5 = apop3d - -## -## mdbox-specific settings -## - -# Maximum dbox file size until it's rotated. -#mdbox_rotate_size = 2M - -# Maximum dbox file age until it's rotated. Typically in days. Day begins -# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. -#mdbox_rotate_interval = 0 - -# When creating new mdbox files, immediately preallocate their size to -# mdbox_rotate_size. This setting currently works only in Linux with some -# filesystems (ext4, xfs). -#mdbox_preallocate_space = no - -## -## Mail attachments -## - -# sdbox and mdbox support saving mail attachments to external files, which -# also allows single instance storage for them. Other backends don't support -# this for now. - -# Directory root where to store mail attachments. Disabled, if empty. -#mail_attachment_dir = - -# Attachments smaller than this aren't saved externally. It's also possible to -# write a plugin to disable saving specific attachments externally. -#mail_attachment_min_size = 128k - -# Filesystem backend to use for saving attachments: -# posix : No SiS done by Dovecot (but this might help FS's own deduplication) -# sis posix : SiS with immediate byte-by-byte comparison during saving -# sis-queue posix : SiS with delayed comparison and deduplication -#mail_attachment_fs = sis posix - -# Hash format to use in attachment filenames. You can add any text and -# variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. -# Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits -#mail_attachment_hash = %{sha1} diff --git a/config/dovecot/conf.d/10-master.conf b/config/dovecot/conf.d/10-master.conf deleted file mode 100644 index 7cf722e..0000000 --- a/config/dovecot/conf.d/10-master.conf +++ /dev/null @@ -1,120 +0,0 @@ -#default_process_limit = 100 -#default_client_limit = 1000 - -# Default VSZ (virtual memory size) limit for service processes. This is mainly -# intended to catch and kill processes that leak memory before they eat up -# everything. -#default_vsz_limit = 256M - -# Login user is internally used by login processes. This is the most untrusted -# user in Dovecot system. It shouldn't have access to anything at all. -#default_login_user = dovenull - -# Internal user is used by unprivileged processes. It should be separate from -# login user, so that login processes can't disturb other processes. -#default_internal_user = dovecot - -service imap-login { - inet_listener imap { - #port = 143 - } - inet_listener imaps { - #port = 993 - #ssl = yes - } - - # Number of connections to handle before starting a new process. Typically - # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0 - # is faster. - #service_count = 1 - - # Number of processes to always keep waiting for more connections. - #process_min_avail = 0 - - # If you set service_count=0, you probably need to grow this. - #vsz_limit = $default_vsz_limit -} - -service pop3-login { - inet_listener pop3 { - #port = 110 - } - inet_listener pop3s { - #port = 995 - #ssl = yes - } -} - -service lmtp { - unix_listener private/dovecot-lmtp { - mode = 0600 - } - # Create inet listener only if you can't use the above UNIX socket - #inet_listener lmtp { - # Avoid making LMTP visible for the entire internet - #address = - #port = - #} -} - -service imap { - # Most of the memory goes to mmap()ing files. You may need to increase this - # limit if you have huge mailboxes. - #vsz_limit = $default_vsz_limit - - # Max. number of IMAP processes (connections) - #process_limit = 1024 -} - -service pop3 { - # Max. number of POP3 processes (connections) - #process_limit = 1024 -} - -service auth { - # auth_socket_path points to this userdb socket by default. It's typically - # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have - # full permissions to this socket are able to get a list of all usernames and - # get the results of everyone's userdb lookups. - # - # The default 0666 mode allows anyone to connect to the socket, but the - # userdb lookups will succeed only if the userdb returns an "uid" field that - # matches the caller process's UID. Also if caller's uid or gid matches the - # socket's uid or gid the lookup succeeds. Anything else causes a failure. - # - # To give the caller full permissions to lookup all users, set the mode to - # something else than 0666 and Dovecot lets the kernel enforce the - # permissions (e.g. 0777 allows everyone full permissions). - unix_listener auth-userdb { - mode = 0777 - user = dovecot - group = dovecot - } - - # Postfix smtp-auth - unix_listener private/auth { - mode = 0777 - user = dovecot - group = dovecot - } - - # Auth process is run as this user. - #user = $default_internal_user -} - -service auth-worker { - # Auth worker process is run as root by default, so that it can access - # /etc/shadow. If this isn't necessary, the user should be changed to - # $default_internal_user. - #user = root -} - -service dict { - # If dict proxy is used, mail processes should have access to its socket. - # For example: mode=0660, group=vmail and global mail_access_groups=vmail - unix_listener dict { - #mode = 0600 - #user = - #group = - } -} diff --git a/config/dovecot/conf.d/10-ssl.conf b/config/dovecot/conf.d/10-ssl.conf deleted file mode 100644 index f4ac291..0000000 --- a/config/dovecot/conf.d/10-ssl.conf +++ /dev/null @@ -1,43 +0,0 @@ -## -## SSL settings -## - -# SSL/TLS support: yes, no, required. -ssl = yes - -# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before -# dropping root privileges, so keep the key file unreadable by anyone but -# root. Included doc/mkcert.sh can be used to easily generate self-signed -# certificate, just make sure to update the domains in dovecot-openssl.cnf -ssl_cert = . -#postmaster_address = - -# Hostname to use in various parts of sent mails, eg. in Message-Id. -# Default is the system's real hostname. -#hostname = - -# If user is over quota, return with temporary failure instead of -# bouncing the mail. -#quota_full_tempfail = no - -# Binary to use for sending mails. -#sendmail_path = /usr/sbin/sendmail - -# Subject: header to use for rejection mails. You can use the same variables -# as for rejection_reason below. -#rejection_subject = Rejected: %s - -# Human readable error message for rejection mails. You can use variables: -# %n = CRLF, %r = reason, %s = original subject, %t = recipient -#rejection_reason = Your message to <%t> was automatically rejected:%n%r - -# Delimiter character between local-part and detail in email address. -#recipient_delimiter = + - -# Header where the original recipient address (SMTP's RCPT TO: address) is taken -# from if not available elsewhere. With dovecot-lda -a parameter overrides this. -# A commonly used header for this is X-Original-To. -#lda_original_recipient_header = - -# Should saving a mail to a nonexistent mailbox automatically create it? -#lda_mailbox_autocreate = no - -# Should automatically created mailboxes be also automatically subscribed? -#lda_mailbox_autosubscribe = no - -protocol lda { - mail_plugins = $mail_plugins sieve - #log_path = {{ .DataDir }}/log/dovecot-lda.error.log - #info_log_path = {{ .DataDir }}/log/dovecot-lda.info.log - auth_socket_path = {{ .DataDir }}/dovecot/auth-userdb -} - -#auth_socket_path = {{ .DataDir }}/dovecot/auth-userdb diff --git a/config/dovecot/conf.d/15-mailboxes.conf b/config/dovecot/conf.d/15-mailboxes.conf deleted file mode 100644 index 398f462..0000000 --- a/config/dovecot/conf.d/15-mailboxes.conf +++ /dev/null @@ -1,79 +0,0 @@ -## -## Mailbox definitions -## - -# Each mailbox is specified in a separate mailbox section. The section name -# specifies the mailbox name. If it has spaces, you can put the name -# "in quotes". These sections can contain the following mailbox settings: -# -# auto: -# Indicates whether the mailbox with this name is automatically created -# implicitly when it is first accessed. The user can also be automatically -# subscribed to the mailbox after creation. The following values are -# defined for this setting: -# -# no - Never created automatically. -# create - Automatically created, but no automatic subscription. -# subscribe - Automatically created and subscribed. -# -# special_use: -# A space-separated list of SPECIAL-USE flags (RFC 6154) to use for the -# mailbox. There are no validity checks, so you could specify anything -# you want in here, but it's not a good idea to use flags other than the -# standard ones specified in the RFC: -# -# \All - This (virtual) mailbox presents all messages in the -# user's message store. -# \Archive - This mailbox is used to archive messages. -# \Drafts - This mailbox is used to hold draft messages. -# \Flagged - This (virtual) mailbox presents all messages in the -# user's message store marked with the IMAP \Flagged flag. -# \Junk - This mailbox is where messages deemed to be junk mail -# are held. -# \Sent - This mailbox is used to hold copies of messages that -# have been sent. -# \Trash - This mailbox is used to hold messages that have been -# deleted. -# -# comment: -# Defines a default comment or note associated with the mailbox. This -# value is accessible through the IMAP METADATA mailbox entries -# "/shared/comment" and "/private/comment". Users with sufficient -# privileges can override the default value for entries with a custom -# value. - -# NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf. -namespace inbox { - # These mailboxes are widely used and could perhaps be created automatically: - mailbox Drafts { - special_use = \Drafts - } - mailbox Junk { - auto = subscribe - special_use = \Junk - } - mailbox Trash { - special_use = \Trash - } - - # For \Sent mailboxes there are two widely used names. We'll mark both of - # them as \Sent. User typically deletes one of them if duplicates are created. - mailbox Sent { - special_use = \Sent - } - mailbox "Sent Messages" { - special_use = \Sent - } - - # If you have a virtual "All messages" mailbox: - #mailbox virtual/All { - # special_use = \All - # comment = All my messages - #} - - # If you have a virtual "Flagged" mailbox: - #mailbox virtual/Flagged { - # special_use = \Flagged - # comment = All my flagged messages - #} -} diff --git a/config/dovecot/conf.d/90-sieve.conf b/config/dovecot/conf.d/90-sieve.conf deleted file mode 100644 index 051e27f..0000000 --- a/config/dovecot/conf.d/90-sieve.conf +++ /dev/null @@ -1,3 +0,0 @@ -plugin { - sieve_before = {{ .DataDir }}/config/sieve/spam.sieve -} diff --git a/config/dovecot/conf.d/auth-ldap.conf.ext b/config/dovecot/conf.d/auth-ldap.conf.ext deleted file mode 100644 index 641c399..0000000 --- a/config/dovecot/conf.d/auth-ldap.conf.ext +++ /dev/null @@ -1,33 +0,0 @@ -# Authentication for LDAP users. Included from 10-auth.conf. -# -# - -passdb { - driver = ldap - - # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext - args = {{ .DataDir }}/config/dovecot/dovecot-ldap.conf.ext -} - -# "prefetch" user database means that the passdb already provided the -# needed information and there's no need to do a separate userdb lookup. -# -#userdb { -# driver = prefetch -#} - -#userdb { -# driver = ldap -# args = {{ .DataDir }}/config/dovecot/dovecot-ldap.conf.ext - - # Default fields can be used to specify defaults that LDAP may override - #default_fields = home=/home/virtual/%u -#} - -# If you don't have any user-specific settings, you can avoid the userdb LDAP -# lookup by using userdb static instead of userdb ldap, for example: -# -userdb { - driver = static - args = uid=dovecot gid=dovecot home={{ .DataDir }}/box/%u -} diff --git a/config/dovecot/dovecot-ldap.conf.ext b/config/dovecot/dovecot-ldap.conf.ext deleted file mode 100644 index 3589583..0000000 --- a/config/dovecot/dovecot-ldap.conf.ext +++ /dev/null @@ -1,143 +0,0 @@ -# This file is commonly accessed via passdb {} or userdb {} section in -# conf.d/auth-ldap.conf.ext - -# This file is opened as root, so it should be owned by root and mode 0600. -# -# http://wiki2.dovecot.org/AuthDatabase/LDAP -# -# NOTE: If you're not using authentication binds, you'll need to give -# dovecot-auth read access to userPassword field in the LDAP server. -# With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should -# already be something like this: - -# access to attribute=userPassword -# by dn="" read # add this -# by anonymous auth -# by self write -# by * none - -# Space separated list of LDAP hosts to use. host:port is allowed too. -hosts = localhost - -# LDAP URIs to use. You can use this instead of hosts list. Note that this -# setting isn't supported by all LDAP libraries. -#uris = - -# Distinguished Name - the username used to login to the LDAP server. -# Leave it commented out to bind anonymously (useful with auth_bind=yes). -dn = dc=syncloud,dc=org - -# Password for LDAP server, if dn is specified. -dnpass = syncloud - -# Use SASL binding instead of the simple binding. Note that this changes -# ldap_version automatically to be 3 if it's lower. Also note that SASL binds -# and auth_bind=yes don't work together. -#sasl_bind = no -# SASL mechanism name to use. -#sasl_mech = -# SASL realm to use. -#sasl_realm = -# SASL authorization ID, ie. the dnpass is for this "master user", but the -# dn is still the logged in user. Normally you want to keep this empty. -#sasl_authz_id = - -# Use TLS to connect to the LDAP server. -#tls = no -# TLS options, currently supported only with OpenLDAP: -#tls_ca_cert_file = -#tls_ca_cert_dir = -#tls_cipher_suite = -# TLS cert/key is used only if LDAP server requires a client certificate. -#tls_cert_file = -#tls_key_file = -# Valid values: never, hard, demand, allow, try -#tls_require_cert = - -# Use the given ldaprc path. -#ldaprc_path = - -# LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. -# -1 = everything. You may need to recompile OpenLDAP with debugging enabled -# to get enough output. -debug_level = 0 - -# Use authentication binding for verifying password's validity. This works by -# logging into LDAP server using the username and password given by client. -# The pass_filter is used to find the DN for the user. Note that the pass_attrs -# is still used, only the password field is ignored in it. Before doing any -# search, the binding is switched back to the default DN. -auth_bind = yes - -# If authentication binding is used, you can save one LDAP request per login -# if users' DN can be specified with a common template. The template can use -# the standard %variables (see user_filter). Note that you can't -# use any pass_attrs if you use this setting. -# -# If you use this setting, it's a good idea to use a different -# dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as -# the filename is different in userdb's args). That way one connection is used -# only for LDAP binds and another connection is used for user lookups. -# Otherwise the binding is changed to the default DN before each user lookup. -# -# For example: -# auth_bind_userdn = cn=%u,ou=people,o=org -# -auth_bind_userdn = cn=%u,ou=users,dc=syncloud,dc=org - -# LDAP protocol version to use. Likely 2 or 3. -ldap_version = 3 - -# LDAP base. %variables can be used here. -# For example: dc=mail, dc=example, dc=org -base = ou=users,dc=syncloud,dc=org - -# Dereference: never, searching, finding, always -#deref = never - -# Search scope: base, onelevel, subtree -scope = subtree - -# User attributes are given in LDAP-name=dovecot-internal-name list. The -# internal names are: -# uid - System UID -# gid - System GID -# home - Home directory -# mail - Mail location -# -# There are also other special fields which can be returned, see -# http://wiki2.dovecot.org/UserDatabase/ExtraFields -#user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid - -# Filter for user lookup. Some variables can be used (see -# http://wiki2.dovecot.org/Variables for full list): -# %u - username -# %n - user part in user@domain, same as %u if there's no domain -# %d - domain part in user@domain, empty if user there's no domain -user_filter = (&(objectClass=inetOrgPerson)(cn=%u)) - -# Password checking attributes: -# user: Virtual user name (user@domain), if you wish to change the -# user-given username to something else -# password: Password, may optionally start with {type}, eg. {crypt} -# There are also other special fields which can be returned, see -# http://wiki2.dovecot.org/PasswordDatabase/ExtraFields -#pass_attrs = uid=user,userPassword=password - -# If you wish to avoid two LDAP lookups (passdb + userdb), you can use -# userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll -# also have to include user_attrs in pass_attrs field prefixed with "userdb_" -# string. For example: -pass_attrs = cn=user,userPassword=password,\ - homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid - -# Filter for password lookups -pass_filter = (&(objectClass=inetOrgPerson)(cn=%u)) - -# Attributes and filter to get a list of all users -#iterate_attrs = uid=user -iterate_filter = (objectClass=inetOrgPerson) - -# Default password scheme. "{scheme}" before password overrides this. -# List of supported schemes is in: http://wiki2.dovecot.org/Authentication -#default_pass_scheme = CRYPT diff --git a/config/dovecot/dovecot.conf b/config/dovecot/dovecot.conf index 3c2c9ba..3cd5e1c 100644 --- a/config/dovecot/dovecot.conf +++ b/config/dovecot/dovecot.conf @@ -1,110 +1,128 @@ -## Dovecot configuration file +dovecot_config_version = 2.4.4 +dovecot_storage_version = 2.4.4 -# If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration +base_dir = {{ .DataDir }}/dovecot/ +import_environment = TZ CORE_OUTOFMEM CORE_ERROR PATH LD_LIBRARY_PATH -default_login_user = mail -default_internal_user = maildrop -# "doveconf -n" command gives a clean output of the changed settings. Use it -# instead of copy&pasting files when posting to the Dovecot mailing list. +protocols { + imap = yes + pop3 = yes + lmtp = yes +} -# '#' character and everything after it is treated as comments. Extra spaces -# and tabs are ignored. If you want to use either of these explicitly, put the -# value inside quotes, eg.: key = "# char and trailing whitespace " +mail_driver = maildir +mail_path = {{ .DataDir }}/box/%{user} +mail_uid = dovecot +mail_gid = dovecot + +postmaster_address = postmaster@{{ .DeviceDomainName }} + +namespace inbox { + inbox = yes + + mailbox Drafts { + special_use = \Drafts + } + mailbox Junk { + auto = subscribe + special_use = \Junk + } + mailbox Trash { + special_use = \Trash + } + mailbox Sent { + special_use = \Sent + } + mailbox "Sent Messages" { + special_use = \Sent + } +} -# Most (but not all) settings can be overridden by different protocols and/or -# source/destination IPs by placing the settings inside sections, for example: -# protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { } +auth_mechanisms { + plain = yes + login = yes +} -# Default values are shown for each setting, it's not required to uncomment -# those. These are exceptions to this though: No sections (e.g. namespace {}) -# or plugin settings are added by default, they're listed only as examples. -# Paths are also just examples with the real defaults being based on configure -# options. The paths listed here are for configure --prefix=/usr -# --sysconfdir=/etc --localstatedir=/var +passdb ldap { + ldap_uris = ldap://localhost + ldap_auth_dn = dc=syncloud,dc=org + ldap_auth_dn_password = syncloud + ldap_version = 3 + ldap_base = ou=users,dc=syncloud,dc=org + ldap_scope = subtree + passdb_ldap_bind = yes + passdb_ldap_bind_userdn = cn=%{user},ou=users,dc=syncloud,dc=org + passdb_ldap_filter = (&(objectClass=inetOrgPerson)(cn=%{user})) +} -# Protocols we want to be serving. -#protocols = imap pop3 lmtp +userdb static { + fields { + uid = dovecot + gid = dovecot + home = {{ .DataDir }}/box/%{user} + } +} -# A comma separated list of IPs or hosts where to listen in for connections. -# "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. -# If you want to specify non-default ports or anything more complex, -# edit conf.d/master.conf. -#listen = *, :: +ssl = yes +ssl_min_protocol = TLSv1.2 -# Base directory where to store runtime data. -base_dir = {{ .DataDir }}/dovecot/ +ssl_server { + cert_file = /var/snap/platform/current/syncloud.crt + key_file = /var/snap/platform/current/syncloud.key +} -libexec_dir = {{ .AppDir }}/dovecot/libexec/dovecot/ - -state_dir = {{ .DataDir }}/var - -# Name of this instance. In multi-instance setup doveadm and other commands -# can use -i to select which instance is used (an alternative -# to -c ). The instance name is also added to Dovecot processes -# in ps output. -#instance_name = dovecot - -# Greeting message for clients. -#login_greeting = Dovecot ready. - -# Space separated list of trusted network ranges. Connections from these -# IPs are allowed to override their IP addresses and ports (for logging and -# for authentication checks). disable_plaintext_auth is also ignored for -# these networks. Typically you'd specify your IMAP proxy servers here. -#login_trusted_networks = - -# Space separated list of login access check sockets (e.g. tcpwrap) -#login_access_sockets = - -# With proxy_maybe=yes if proxy destination matches any of these IPs, don't do -# proxying. This isn't necessary normally, but may be useful if the destination -# IP is e.g. a load balancer's IP. -#auth_proxy_self = - -# Show more verbose process titles (in ps). Currently shows user name and -# IP address. Useful for seeing who are actually using the IMAP processes -# (eg. shared mailboxes or if same uid is used for multiple accounts). -#verbose_proctitle = no - -# Should all processes be killed when Dovecot master process shuts down. -# Setting this to "no" means that Dovecot can be upgraded without -# forcing existing client connections to close (although that could also be -# a problem if the upgrade is e.g. because of a security fix). -#shutdown_clients = yes - -# If non-zero, run mail commands via this many connections to doveadm server, -# instead of running them directly in the same process. -#doveadm_worker_count = 0 -# UNIX socket or host:port used for connecting to doveadm server -#doveadm_socket_path = doveadm-server - -# Space separated list of environment variables that are preserved on Dovecot -# startup and passed down to all of its child processes. You can also give -# key=value pairs to always set specific settings. -import_environment = TZ CORE_OUTOFMEM CORE_ERROR PATH LD_LIBRARY_PATH +service imap-login { + user = mail + inet_listener imap { + } + inet_listener imaps { + } +} + +service pop3-login { + user = mail + inet_listener pop3 { + } + inet_listener pop3s { + } +} + +service lmtp { + unix_listener private/dovecot-lmtp { + mode = 0600 + } +} -## -## Dictionary server settings -## +service imap { +} -# Dictionary can be used to store key=value lists. This is used by several -# plugins. The dictionary can be accessed either directly or though a -# dictionary server. The following dict block maps dictionary names to URIs -# when the server is used. These can then be referenced using URIs in format -# "proxy::". +service pop3 { +} -dict { - #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext - #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext +service auth { + unix_listener auth-userdb { + mode = 0777 + user = dovecot + group = dovecot + } + unix_listener private/auth { + mode = 0777 + user = dovecot + group = dovecot + } } -# Most of the actual configuration gets included below. The filenames are -# first sorted by their ASCII value and parsed in that order. The 00-prefixes -# in filenames are intended to make it easier to understand the ordering. -!include {{ .DataDir }}/config/dovecot/conf.d/*.conf +service auth-worker { +} -# A config file can also tried to be included without giving an error if -# it's not found: -#!include_try local.conf +protocol lda { + mail_plugins { + sieve = yes + } +} -postmaster_address = postmaster@{{ .DeviceDomainName }} \ No newline at end of file +sieve_script spam { + sieve_script_type = before + sieve_script_driver = file + sieve_script_file_path = {{ .DataDir }}/config/sieve/spam.sieve +} diff --git a/dovecot/build.sh b/dovecot/build.sh index 997de01..70f3dd2 100755 --- a/dovecot/build.sh +++ b/dovecot/build.sh @@ -21,12 +21,11 @@ rm -rf ${DIR}/work mkdir -p ${DIR}/work cd ${DIR}/work -wget http://www.dovecot.org/releases/2.3/${NAME}-${VERSION}.tar.gz --progress dot:giga +wget https://dovecot.org/releases/2.4/${NAME}-${VERSION}.tar.gz --progress dot:giga tar xzf ${NAME}-${VERSION}.tar.gz cd ${NAME}-${VERSION} ./configure --prefix=${PREFIX} \ - --with-rawlog \ --with-ldap \ --disable-rpath @@ -34,9 +33,9 @@ make -j4 make install cd ${DIR}/work -wget https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-${PIGEONHOLE}.tar.gz --progress dot:giga -tar xzf dovecot-2.3-pigeonhole-${PIGEONHOLE}.tar.gz -cd dovecot-2.3-pigeonhole-${PIGEONHOLE} +wget https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-${PIGEONHOLE}.tar.gz --progress dot:giga +tar xzf dovecot-pigeonhole-${PIGEONHOLE}.tar.gz +cd dovecot-pigeonhole-${PIGEONHOLE} ./configure --prefix=${PREFIX} \ --with-dovecot=${PREFIX}/lib/dovecot \ @@ -80,48 +79,9 @@ cp ${DIR}/auth.sh ${PREFIX}/libexec/dovecot apt-get -y install patchelf INTERP=/snap/mail/current/dovecot/lib/ld.so RPATH=/snap/mail/current/dovecot/lib:/snap/mail/current/dovecot/lib/dovecot -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/sbin/dovecot -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/bin/doveadm -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/bin/doveconf -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/aggregator -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/anvil -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/auth -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/checkpassword-reply -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/config -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/dict -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/director -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/dns-client -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/doveadm-server -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/dovecot-lda -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/gdbhelper -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/imap -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/imap-hibernate -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/imap-login -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/imap-urlauth -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/imap-urlauth-login -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/imap-urlauth-worker -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/indexer -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/indexer-worker -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/ipc -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/lmtp -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/log -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/maildirlock -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/old-stats -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/pop3 -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/pop3-login -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/quota-status -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/rawlog -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/replicator -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/script -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/script-login -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/stats -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/submission -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/submission-login -patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${PREFIX}/libexec/dovecot/xml2text - -for binary in ${PREFIX}/bin/sieve* ${PREFIX}/libexec/dovecot/managesieve*; do - if [ -f "${binary}" ]; then - patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath ${binary} +for binary in ${PREFIX}/sbin/* ${PREFIX}/bin/* ${PREFIX}/libexec/dovecot/*; do + if [ -f "${binary}" ] && head -c 4 "${binary}" | grep -qa ELF; then + patchelf --set-interpreter "$INTERP" --set-rpath "$RPATH" --force-rpath "${binary}" fi done From ca21d7d48ff05a30c70dea21cc18513095464da4 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 03:57:53 +0100 Subject: [PATCH 13/23] Give dovecot the compression library it now insists on The new version will not configure without zlib, where the old one did not ask for it at all. --- dovecot/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dovecot/build.sh b/dovecot/build.sh index 70f3dd2..536ce86 100755 --- a/dovecot/build.sh +++ b/dovecot/build.sh @@ -12,7 +12,7 @@ PREFIX=/snap/mail/current/${NAME} OUTPUT=${DIR}/../build/snap/${NAME} apt-get update -apt-get -y install build-essential libncurses5-dev libldap2-dev libsasl2-dev libssl-dev libldb-dev wget +apt-get -y install build-essential libncurses5-dev libldap2-dev libsasl2-dev libssl-dev libldb-dev zlib1g-dev pkg-config wget rm -rf ${PREFIX} mkdir -p ${PREFIX} From 0715a93ead019c4014b58ca35a58d9637e7dd94a Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 04:26:13 +0100 Subject: [PATCH 14/23] Give sieve the interpreter it builds a header with Part of the sieve source is generated during the build by a script, so without it the compile stops after everything else has already been made. --- dovecot/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dovecot/build.sh b/dovecot/build.sh index 536ce86..1a333fb 100755 --- a/dovecot/build.sh +++ b/dovecot/build.sh @@ -12,7 +12,7 @@ PREFIX=/snap/mail/current/${NAME} OUTPUT=${DIR}/../build/snap/${NAME} apt-get update -apt-get -y install build-essential libncurses5-dev libldap2-dev libsasl2-dev libssl-dev libldb-dev zlib1g-dev pkg-config wget +apt-get -y install build-essential libncurses5-dev libldap2-dev libsasl2-dev libssl-dev libldb-dev zlib1g-dev pkg-config python3 wget rm -rf ${PREFIX} mkdir -p ${PREFIX} From ed74841d12097cbb79acabca084495c2345b9169 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 05:49:00 +0100 Subject: [PATCH 15/23] Check the dovecot configuration as soon as it is built The configuration is only read when the app is installed on a device, which is most of an hour into the run, so a rendered copy is parsed right after the build instead and the same mistake is caught in minutes. Two settings are written the way the new version wants them: the passed environment is left at its default now that every binary carries its own library path, and the mailbox roles are a list rather than a single value. --- config/dovecot/dovecot.conf | 21 +++++++++++++++------ dovecot/build.sh | 1 + dovecot/doveconf.sh | 7 +++++++ dovecot/test.sh | 10 ++++++++++ 4 files changed, 33 insertions(+), 6 deletions(-) create mode 100755 dovecot/doveconf.sh diff --git a/config/dovecot/dovecot.conf b/config/dovecot/dovecot.conf index 3cd5e1c..a6b66b2 100644 --- a/config/dovecot/dovecot.conf +++ b/config/dovecot/dovecot.conf @@ -2,7 +2,6 @@ dovecot_config_version = 2.4.4 dovecot_storage_version = 2.4.4 base_dir = {{ .DataDir }}/dovecot/ -import_environment = TZ CORE_OUTOFMEM CORE_ERROR PATH LD_LIBRARY_PATH protocols { imap = yes @@ -21,20 +20,30 @@ namespace inbox { inbox = yes mailbox Drafts { - special_use = \Drafts + special_use { + \Drafts = yes + } } mailbox Junk { auto = subscribe - special_use = \Junk + special_use { + \Junk = yes + } } mailbox Trash { - special_use = \Trash + special_use { + \Trash = yes + } } mailbox Sent { - special_use = \Sent + special_use { + \Sent = yes + } } mailbox "Sent Messages" { - special_use = \Sent + special_use { + \Sent = yes + } } } diff --git a/dovecot/build.sh b/dovecot/build.sh index 1a333fb..065658d 100755 --- a/dovecot/build.sh +++ b/dovecot/build.sh @@ -74,6 +74,7 @@ ldd ${PREFIX}/libexec/dovecot/auth cp ${DIR}/dovecot.sh ${PREFIX}/bin cp ${DIR}/lda.sh ${PREFIX}/bin cp ${DIR}/doveadm.sh ${PREFIX}/bin +cp ${DIR}/doveconf.sh ${PREFIX}/bin cp ${DIR}/auth.sh ${PREFIX}/libexec/dovecot apt-get -y install patchelf diff --git a/dovecot/doveconf.sh b/dovecot/doveconf.sh new file mode 100755 index 0000000..a9dac2f --- /dev/null +++ b/dovecot/doveconf.sh @@ -0,0 +1,7 @@ +#!/bin/bash -e + +DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && cd .. && pwd ) + +LD_LIBRARY_PATH=$(find ${DIR}/lib -type d | tr '\n' ':') +export LD_LIBRARY_PATH=${LD_LIBRARY_PATH%:} +exec ${DIR}/lib/ld.so --library-path ${LD_LIBRARY_PATH} ${DIR}/bin/doveconf "$@" diff --git a/dovecot/test.sh b/dovecot/test.sh index dc211aa..6bd50fd 100755 --- a/dovecot/test.sh +++ b/dovecot/test.sh @@ -4,3 +4,13 @@ DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) DOVECOT=${DIR}/../build/snap/dovecot ${DOVECOT}/bin/dovecot.sh --version +${DOVECOT}/bin/sievec.sh --version + +CHECK=$(mktemp -d) +sed -e "s|{{ .DataDir }}|${CHECK}|g" \ + -e "s|{{ .AppDir }}|${DIR}/..|g" \ + -e "s|{{ .DeviceDomainName }}|example.com|g" \ + ${DIR}/../config/dovecot/dovecot.conf > ${CHECK}/dovecot.conf + +mkdir -p ${CHECK}/dovecot +${DOVECOT}/bin/doveconf.sh -c ${CHECK}/dovecot.conf > /dev/null From de31ffcd8eef5fdf009bc52af15dc75631c44a03 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 06:19:51 +0100 Subject: [PATCH 16/23] Do not ask sievec for a version either It prints usage and fails, so the check is that it is there, the same as the other tools that report nothing useful about themselves. --- dovecot/test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dovecot/test.sh b/dovecot/test.sh index 6bd50fd..2bbdae6 100755 --- a/dovecot/test.sh +++ b/dovecot/test.sh @@ -4,7 +4,7 @@ DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) DOVECOT=${DIR}/../build/snap/dovecot ${DOVECOT}/bin/dovecot.sh --version -${DOVECOT}/bin/sievec.sh --version +test -x ${DOVECOT}/bin/sievec CHECK=$(mktemp -d) sed -e "s|{{ .DataDir }}|${CHECK}|g" \ From 1bf731d0fe5fca1409a16f8d374a1f299f1b23c8 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 06:49:39 +0100 Subject: [PATCH 17/23] Check the configuration where the tools expect to be installed Sieve adds its own settings to the ones the config reader knows about, and it looks for them under the path built into the binaries, so the check now puts the build there. Without it the reader has never heard of a sieve script and rejects a file that is fine on a device. --- dovecot/test.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dovecot/test.sh b/dovecot/test.sh index 2bbdae6..0feead2 100755 --- a/dovecot/test.sh +++ b/dovecot/test.sh @@ -6,6 +6,10 @@ DOVECOT=${DIR}/../build/snap/dovecot ${DOVECOT}/bin/dovecot.sh --version test -x ${DOVECOT}/bin/sievec +rm -rf /snap/mail/current +mkdir -p /snap/mail +ln -sfn ${DIR}/../build/snap /snap/mail/current + CHECK=$(mktemp -d) sed -e "s|{{ .DataDir }}|${CHECK}|g" \ -e "s|{{ .AppDir }}|${DIR}/..|g" \ From 8b291fbe0fde8d9f88f6b151788445e624ee14e5 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 07:19:07 +0100 Subject: [PATCH 18/23] Point the sieve script at its path by the name in use The file storage calls it a path, and the longer name belongs to something else, so the reader rejected it. --- config/dovecot/dovecot.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/dovecot/dovecot.conf b/config/dovecot/dovecot.conf index a6b66b2..5c2e413 100644 --- a/config/dovecot/dovecot.conf +++ b/config/dovecot/dovecot.conf @@ -133,5 +133,5 @@ protocol lda { sieve_script spam { sieve_script_type = before sieve_script_driver = file - sieve_script_file_path = {{ .DataDir }}/config/sieve/spam.sieve + sieve_script_path = {{ .DataDir }}/config/sieve/spam.sieve } From ff17ad920d55b7fbd0401b2729c3626ead3723f6 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 08:36:33 +0100 Subject: [PATCH 19/23] Say which ports mail clients connect on Naming a listener used to be enough to get the usual port for it, and now it is not, so nothing was listening for pop3 or imap. --- config/dovecot/dovecot.conf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/dovecot/dovecot.conf b/config/dovecot/dovecot.conf index 5c2e413..1ae2a44 100644 --- a/config/dovecot/dovecot.conf +++ b/config/dovecot/dovecot.conf @@ -83,16 +83,22 @@ ssl_server { service imap-login { user = mail inet_listener imap { + port = 143 } inet_listener imaps { + port = 993 + ssl = yes } } service pop3-login { user = mail inet_listener pop3 { + port = 110 } inet_listener pop3s { + port = 995 + ssl = yes } } From a8dbb5ffe0c95c5552d32599be2a379305ea2116 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 09:55:32 +0100 Subject: [PATCH 20/23] Keep dovecot's own state where it can write It wants a place to remember things across restarts and defaults to one inside the installed copy, which cannot be written to, so it refused to start and nothing was listening for mail clients. --- config/dovecot/dovecot.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/dovecot/dovecot.conf b/config/dovecot/dovecot.conf index 1ae2a44..46a3e03 100644 --- a/config/dovecot/dovecot.conf +++ b/config/dovecot/dovecot.conf @@ -2,6 +2,7 @@ dovecot_config_version = 2.4.4 dovecot_storage_version = 2.4.4 base_dir = {{ .DataDir }}/dovecot/ +state_dir = {{ .DataDir }}/var protocols { imap = yes From 76bffcab46b77358d723237ad1a54b93aa2c7a2b Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 13:59:58 +0100 Subject: [PATCH 21/23] Give rspamd a password of its own It shipped with the one from the example configuration, which is the same on every device and written in plain, so one is made at install and kept, and only its hashed form reaches the configuration. The platform images are published for every architecture under one name, so asking for a particular one adds nothing. --- .drone.jsonnet | 22 +++---- cli/installer/installer.go | 8 +++ cli/installer/rspamd.go | 70 +++++++++++++++++++++ cli/installer/rspamd_test.go | 55 ++++++++++++++++ cli/installer/sieve_test.go | 3 +- config/rspamd/local.d/worker-controller.inc | 1 + 6 files changed, 147 insertions(+), 12 deletions(-) create mode 100644 cli/installer/rspamd.go create mode 100644 cli/installer/rspamd_test.go diff --git a/.drone.jsonnet b/.drone.jsonnet index 21c657e..0799045 100644 --- a/.drone.jsonnet +++ b/.drone.jsonnet @@ -15,8 +15,8 @@ local playwright = 'mcr.microsoft.com/playwright:v1.48.2-jammy'; local store_publisher = 'stable-346'; local distros = ['bookworm', 'buster']; -local platform_image(distro, arch) = - 'syncloud/platform-' + distro + ':' + platform + '-' + arch; +local platform_image(distro) = + 'syncloud/platform-' + distro + ':' + platform; local build(arch, test_ui) = [{ kind: 'pipeline', @@ -37,7 +37,7 @@ local build(arch, test_ui) = [{ ] + [ { name: 'nginx test ' + distro, - image: platform_image(distro, arch), + image: platform_image(distro), commands: [ './nginx/test.sh', ], @@ -54,7 +54,7 @@ local build(arch, test_ui) = [{ ] + [ { name: 'dovecot test ' + distro, - image: platform_image(distro, arch), + image: platform_image(distro), commands: [ './dovecot/test.sh', ], @@ -71,7 +71,7 @@ local build(arch, test_ui) = [{ ] + [ { name: 'opendkim test ' + distro, - image: platform_image(distro, arch), + image: platform_image(distro), commands: [ './opendkim/test.sh', ], @@ -88,7 +88,7 @@ local build(arch, test_ui) = [{ ] + [ { name: 'php test ' + distro, - image: platform_image(distro, arch), + image: platform_image(distro), commands: [ './php/test.sh', ], @@ -105,7 +105,7 @@ local build(arch, test_ui) = [{ ] + [ { name: 'postgresql test ' + distro, - image: platform_image(distro, arch), + image: platform_image(distro), commands: [ './postgresql/test.sh', ], @@ -122,7 +122,7 @@ local build(arch, test_ui) = [{ ] + [ { name: 'postfix test ' + distro, - image: platform_image(distro, arch), + image: platform_image(distro), commands: [ './postfix/test.sh', ], @@ -139,7 +139,7 @@ local build(arch, test_ui) = [{ ] + [ { name: 'redis test ' + distro, - image: platform_image(distro, arch), + image: platform_image(distro), commands: [ './redis/test.sh', ], @@ -156,7 +156,7 @@ local build(arch, test_ui) = [{ ] + [ { name: 'rspamd test ' + distro, - image: platform_image(distro, arch), + image: platform_image(distro), commands: [ './rspamd/test.sh', ], @@ -281,7 +281,7 @@ local build(arch, test_ui) = [{ services: [ { name: name + '.' + distro + '.com', - image: platform_image(distro, arch), + image: platform_image(distro), privileged: true, entrypoint: ['/bin/sh', '-c', "mkdir -p /etc/systemd/system/snapd.service.d && printf '[Service]\\nExecStartPost=/bin/sh -c \"/usr/bin/snap set system refresh.hold=2099-01-01T00:00:00Z\"\\n' > /etc/systemd/system/snapd.service.d/disable-refresh.conf && exec /sbin/init"], volumes: [ diff --git a/cli/installer/installer.go b/cli/installer/installer.go index f4fcce9..ddc53d7 100644 --- a/cli/installer/installer.go +++ b/cli/installer/installer.go @@ -40,6 +40,7 @@ type Variables struct { DeviceDomainName string AppDomainName string Timezone string + RspamdPassword string } type Installer struct { @@ -55,6 +56,7 @@ type Installer struct { database *Database relay *Relay sieve *Sieve + rspamd *Rspamd mailInbound *MailInbound executor *Executor logger *zap.Logger @@ -80,6 +82,7 @@ func New(logger *zap.Logger) *Installer { database: NewDatabase(appDir, dataDir, configPath, DbName, DbUser, DbPass, PsqlPort, executor, logger), relay: NewRelay(appDir, configPath, executor, logger), sieve: NewSieve(appDir, configPath, executor, logger), + rspamd: NewRspamd(appDir, dataDir, executor, logger), mailInbound: NewMailInbound(dataDir, platformClient, logger), executor: executor, logger: logger, @@ -115,6 +118,10 @@ func (i *Installer) RegenerateConfigs() error { if err != nil { return err } + rspamdPassword, err := i.rspamd.HashedPassword() + if err != nil { + return err + } variables := Variables{ AppDir: i.appDir, @@ -129,6 +136,7 @@ func (i *Installer) RegenerateConfigs() error { DeviceDomainName: deviceDomainName, AppDomainName: appDomainName, Timezone: tz, + RspamdPassword: rspamdPassword, } templatesPath := path.Join(i.appDir, "config") diff --git a/cli/installer/rspamd.go b/cli/installer/rspamd.go new file mode 100644 index 0000000..4d67b20 --- /dev/null +++ b/cli/installer/rspamd.go @@ -0,0 +1,70 @@ +package installer + +import ( + "crypto/rand" + "encoding/hex" + "os" + "path" + "strings" + + "go.uber.org/zap" +) + +const ( + PasswordFile = "rspamd/password" + PasswordLength = 24 +) + +type Rspamd struct { + appDir string + dataDir string + executor Runner + logger *zap.Logger +} + +func NewRspamd(appDir string, dataDir string, executor Runner, logger *zap.Logger) *Rspamd { + return &Rspamd{appDir: appDir, dataDir: dataDir, executor: executor, logger: logger} +} + +func (r *Rspamd) PasswordPath() string { + return path.Join(r.dataDir, PasswordFile) +} + +func (r *Rspamd) Password() (string, error) { + file := r.PasswordPath() + existing, err := os.ReadFile(file) + if err == nil { + return strings.TrimSpace(string(existing)), nil + } + if !os.IsNotExist(err) { + return "", err + } + r.logger.Info("generating the rspamd controller password") + secret := make([]byte, PasswordLength) + if _, err := rand.Read(secret); err != nil { + return "", err + } + password := hex.EncodeToString(secret) + if err := os.WriteFile(file, []byte(password), 0600); err != nil { + return "", err + } + return password, nil +} + +func (r *Rspamd) HashedPassword() (string, error) { + password, err := r.Password() + if err != nil { + return "", err + } + rspamadm := path.Join(r.appDir, "rspamd", "bin", "rspamadm.sh") + out, err := r.executor.RunDir("", rspamadm, "pw", "-p", password) + if err != nil { + return "", err + } + return lastLine(out), nil +} + +func lastLine(out string) string { + lines := strings.Split(strings.TrimSpace(out), "\n") + return strings.TrimSpace(lines[len(lines)-1]) +} diff --git a/cli/installer/rspamd_test.go b/cli/installer/rspamd_test.go new file mode 100644 index 0000000..715323c --- /dev/null +++ b/cli/installer/rspamd_test.go @@ -0,0 +1,55 @@ +package installer + +import ( + "os" + "path" + "testing" + + "github.com/stretchr/testify/assert" + "go.uber.org/zap" +) + +func rspamdIn(t *testing.T) (*Rspamd, *fakeRunner, string) { + dataDir := t.TempDir() + assert.NoError(t, os.Mkdir(path.Join(dataDir, "rspamd"), 0755)) + runner := &fakeRunner{out: "$2$hashed"} + return NewRspamd("/snap/mail/current", dataDir, runner, zap.NewNop()), runner, dataDir +} + +func TestRspamd_GeneratesAPasswordAndKeepsIt(t *testing.T) { + rspamd, _, dataDir := rspamdIn(t) + + first, err := rspamd.Password() + assert.NoError(t, err) + assert.Len(t, first, PasswordLength*2) + + stored, err := os.ReadFile(path.Join(dataDir, PasswordFile)) + assert.NoError(t, err) + assert.Equal(t, first, string(stored)) + + again, err := rspamd.Password() + assert.NoError(t, err) + assert.Equal(t, first, again) +} + +func TestRspamd_HashesTheGeneratedPassword(t *testing.T) { + rspamd, runner, _ := rspamdIn(t) + + hashed, err := rspamd.HashedPassword() + assert.NoError(t, err) + + assert.Equal(t, "$2$hashed", hashed) + assert.Equal(t, "/snap/mail/current/rspamd/bin/rspamadm.sh", runner.app) + assert.Equal(t, "pw", runner.args[0]) + assert.Equal(t, "-p", runner.args[1]) +} + +func TestRspamd_TakesTheHashFromTheLastLine(t *testing.T) { + rspamd, runner, _ := rspamdIn(t) + runner.out = "some notice\n$2$hashed\n" + + hashed, err := rspamd.HashedPassword() + assert.NoError(t, err) + + assert.Equal(t, "$2$hashed", hashed) +} diff --git a/cli/installer/sieve_test.go b/cli/installer/sieve_test.go index 3d3045e..29b9172 100644 --- a/cli/installer/sieve_test.go +++ b/cli/installer/sieve_test.go @@ -10,6 +10,7 @@ import ( type fakeRunner struct { err error + out string app string args []string } @@ -17,7 +18,7 @@ type fakeRunner struct { func (f *fakeRunner) RunDir(_ string, app string, args ...string) (string, error) { f.app = app f.args = args - return "", f.err + return f.out, f.err } func TestSieve_CompilesTheSpamScript(t *testing.T) { diff --git a/config/rspamd/local.d/worker-controller.inc b/config/rspamd/local.d/worker-controller.inc index 1f3456a..e063144 100644 --- a/config/rspamd/local.d/worker-controller.inc +++ b/config/rspamd/local.d/worker-controller.inc @@ -1 +1,2 @@ bind_socket = "{{ .DataDir }}/rspamd/controller.sock mode=0660"; +password = "{{ .RspamdPassword }}"; From c99d8bdea28e33f624e743bfc97f2b0b434ff48a Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 14:13:38 +0100 Subject: [PATCH 22/23] Drop the python image nothing builds Nothing calls it, it copies a file that is not in the tree and installs from a list that is not there either, so it could not have run for a long time. --- Dockerfile.python | 4 ---- build-python.sh | 21 --------------------- 2 files changed, 25 deletions(-) delete mode 100644 Dockerfile.python delete mode 100755 build-python.sh diff --git a/Dockerfile.python b/Dockerfile.python deleted file mode 100644 index 501247c..0000000 --- a/Dockerfile.python +++ /dev/null @@ -1,4 +0,0 @@ -FROM python:3.8-buster -COPY requirements.txt / -RUN pip install -r /requirements.txt -RUN rm -rf /var/lib/apt/lists/* \ No newline at end of file diff --git a/build-python.sh b/build-python.sh deleted file mode 100755 index 571c572..0000000 --- a/build-python.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -ex - -DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) -cd ${DIR} -apt update -apt install -y libltdl7 libnss3 - -BUILD_DIR=${DIR}/build/mail/python -docker ps -a -q --filter ancestor=python:syncloud --format="{{.ID}}" | xargs docker stop | xargs docker rm || true -docker rmi python:syncloud || true -docker build -t python:syncloud -f Dockerfile.python . -docker run python:syncloud python --help -docker create --name=python python:syncloud -mkdir -p ${BUILD_DIR} -cd ${BUILD_DIR} -docker export python -o python.tar -tar xf python.tar -rm -rf python.tar -cp ${DIR}/bin/python ${BUILD_DIR}/bin/ -ls -la ${BUILD_DIR}/bin -rm -rf ${BUILD_DIR}/usr/src From 0dd9b9bb2f080dd9342713bcb1895ff14a4c7181 Mon Sep 17 00:00:00 2001 From: Boris Rybalkin Date: Sun, 16 Aug 2026 16:01:36 +0100 Subject: [PATCH 23/23] Keep writing files the previous version can still read This says how far back the files written here have to remain readable, and it was set to the version being installed, so anything written would have been beyond what the version before it understands. A refresh that has to be undone would then leave a mailbox the older dovecot cannot open. --- config/dovecot/dovecot.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/dovecot/dovecot.conf b/config/dovecot/dovecot.conf index 46a3e03..118c8cd 100644 --- a/config/dovecot/dovecot.conf +++ b/config/dovecot/dovecot.conf @@ -1,5 +1,5 @@ dovecot_config_version = 2.4.4 -dovecot_storage_version = 2.4.4 +dovecot_storage_version = 2.3.21 base_dir = {{ .DataDir }}/dovecot/ state_dir = {{ .DataDir }}/var