This repository has no description
mailserver: add dovecot shared namespace with ACL for bot IMAP access
author
lassulus
date
(Mar 7, 2026, 12:50 AM CET)
commit
63ae3da8
63ae3da8a3c04fa76fcbe1708b5533240ef9591f
parent
fba0d76b
fba0d76b2230551fd468c86971634d1b9cf39bec
+57
-3
+53
-2
2configs/mailserver.nix
+53
-2
2configs/mailserver.nix
···
87
87
clan.core.vars.generators.mailserver-bot = {
88
88
files."bot-mail-password" = { };
89
89
files."bot-mail-password-hash" = { };
90
+
files."mail.env" = { };
90
91
runtimeInputs = with pkgs; [
91
92
coreutils
92
93
mkpasswd
···
95
96
script = ''
96
97
pwgen -s 32 1 > "$out/bot-mail-password"
97
98
mkpasswd -sm bcrypt < "$out/bot-mail-password" > "$out/bot-mail-password-hash"
99
+
cat > "$out/mail.env" << EOF
100
+
IMAP_USER=bot@lassul.us
101
+
IMAP_PASSWORD=$(cat "$out/bot-mail-password")
102
+
IMAP_HOST=localhost
103
+
EOF
98
104
'';
99
105
};
100
106
···
168
174
'';
169
175
};
170
176
171
-
# Dovecot virtual mailbox: "Unread" shows all unseen messages across all folders
172
-
services.dovecot2.mailPlugins.globally.enable = [ "virtual" ];
177
+
# Dovecot virtual mailbox + ACL-restricted shared namespace for bot
178
+
services.dovecot2.mailPlugins.globally.enable = [
179
+
"virtual"
180
+
"acl"
181
+
];
173
182
services.dovecot2.extraConfig =
174
183
let
175
184
virtualDir = pkgs.linkFarm "dovecot-virtual" [
···
180
189
];
181
190
in
182
191
''
192
+
plugin {
193
+
acl = vfile
194
+
acl_shared_dict = file:/var/vmail/shared-mailboxes.db
195
+
}
196
+
197
+
namespace shared {
198
+
type = shared
199
+
separator = .
200
+
prefix = shared.%%n.
201
+
location = maildir:/var/vmail/lassul.us/%%n/mail:LAYOUT=Maildir++
202
+
subscriptions = no
203
+
list = children
204
+
}
205
+
183
206
namespace virtual {
184
207
prefix = virtual.
185
208
separator = .
···
190
213
}
191
214
}
192
215
'';
216
+
217
+
# Write dovecot-acl files to grant bot read-only + flag access to lass's mail
218
+
systemd.services.dovecot-acl-sync = {
219
+
description = "Sync dovecot ACL files for bot shared access";
220
+
after = [ "dovecot.service" ];
221
+
serviceConfig = {
222
+
Type = "oneshot";
223
+
User = "virtualMail";
224
+
Group = "virtualMail";
225
+
};
226
+
# l=lookup, r=read, w=write-flags, s=write-seen (no insert/delete/expunge)
227
+
script = ''
228
+
acl_line="user=bot@lassul.us lrws"
229
+
find /var/vmail/lassul.us/lass/mail -type d | while IFS= read -r dir; do
230
+
acl_file="$dir/dovecot-acl"
231
+
if [ ! -f "$acl_file" ] || [ "$(cat "$acl_file")" != "$acl_line" ]; then
232
+
echo "$acl_line" > "$acl_file"
233
+
fi
234
+
done
235
+
'';
236
+
};
237
+
systemd.timers.dovecot-acl-sync = {
238
+
wantedBy = [ "timers.target" ];
239
+
timerConfig = {
240
+
OnBootSec = "1min";
241
+
OnUnitActiveSec = "1h";
242
+
};
243
+
};
193
244
194
245
# notmuch + muchsync + msmtp for CLI mail access
195
246
environment.systemPackages = [
+4
-1
2configs/opencrow.nix
+4
-1
2configs/opencrow.nix
···
78
78
};
79
79
80
80
serviceConfig = {
81
-
EnvironmentFile = config.clan.core.vars.generators.opencrow.files."opencrow.env".path;
81
+
EnvironmentFile = [
82
+
config.clan.core.vars.generators.opencrow.files."opencrow.env".path
83
+
config.clan.core.vars.generators.mailserver-bot.files."mail.env".path
84
+
];
82
85
ExecStart = "${opencrow}/bin/opencrow";
83
86
Restart = "on-failure";
84
87
RestartSec = 10;