This repository has no description
mailserver: fix muchsync permissions with POSIX ACLs
- Enable posixacl on zroot ZFS pool for /var/vmail
- Set POSIX ACL default granting lass rwX on mail dir (new files inherit)
- Fix /var/vmail permissions after dovecot pre-start resets to 0700
- Fix dovecot-acl-sync to skip cur/new/tmp/.notmuch subdirs
- Change recursive tmpfiles rule to non-recursive to avoid setgid on files
author
lassulus
date
(Mar 7, 2026, 1:26 AM CET)
commit
efd67bd6
efd67bd64ddb82a09d2ca0dc65bd562e0949dda9
parent
0a97a972
0a97a972c407b63e533dfeb69e987772333d20e6
+17
-3
+15
-3
2configs/mailserver.nix
+15
-3
2configs/mailserver.nix
···
69
69
stateVersion = 3;
70
70
};
71
71
72
+
# dovecot pre-start creates /var/vmail with 0700; widen for lass (virtualMail group)
73
+
# POSIX ACL default ensures new files inherit lass access (needed for muchsync hardlinks)
74
+
systemd.services.dovecot.serviceConfig.ExecStartPost = [
75
+
"+${pkgs.coreutils}/bin/chmod 2770 /var/vmail"
76
+
"+${pkgs.acl}/bin/setfacl -R -m u:lass:rwX /var/vmail/lassul.us/lass/mail"
77
+
"+${pkgs.acl}/bin/setfacl -R -d -m u:lass:rwX /var/vmail/lassul.us/lass/mail"
78
+
];
79
+
72
80
# Password generation for mail accounts
73
81
clan.core.vars.generators.mailserver-lass = {
74
82
files."lass-mail-password" = { };
···
137
145
users.groups.virtualMail.members = [ "lass" ];
138
146
systemd.tmpfiles.rules = [
139
147
"L+ /home/lass/Maildir - - - - /var/vmail/lassul.us/lass/mail"
140
-
# dovecot pre-start sets /var/vmail to 02770 already; just fix subdirs
141
148
"z /var/vmail/lassul.us 2770 virtualMail virtualMail -"
142
149
"z /var/vmail/lassul.us/lass 2770 virtualMail virtualMail -"
143
-
"Z /var/vmail/lassul.us/lass/mail 2770 virtualMail virtualMail -"
150
+
"d /var/vmail/lassul.us/lass/mail 2770 virtualMail virtualMail -"
144
151
];
145
152
146
153
# Thunderbird autoconfig
···
226
233
# l=lookup, r=read, w=write-flags, s=write-seen (no insert/delete/expunge)
227
234
script = ''
228
235
acl_line="user=bot@lassul.us lrws"
229
-
find /var/vmail/lassul.us/lass/mail -type d | while IFS= read -r dir; do
236
+
# Only write ACL in mailbox root dirs, skip cur/new/tmp/notmuch subdirs
237
+
find /var/vmail/lassul.us/lass/mail -type d \
238
+
-not -name cur -not -name new -not -name tmp \
239
+
-not -path '*/.notmuch/*' -not -name .notmuch \
240
+
-not -path '*/fts-flatcurve/*' -not -name fts-flatcurve \
241
+
| while IFS= read -r dir; do
230
242
acl_file="$dir/dovecot-acl"
231
243
if [ ! -f "$acl_file" ] || [ "$(cat "$acl_file")" != "$acl_line" ]; then
232
244
echo "$acl_line" > "$acl_file"