debops.dovecot default variables¶

Sections

General Dovecot configuration
User database/mailbox configuration
Virtual Mail
DSync Settings
SQL Authentication Settings
PKI / TLS configuration
Diffie-Hellman parameters
Dovecot custom configuration
Firewall configuration
LDAP
Configuration for other Ansible roles

General Dovecot configuration ¶

dovecot__features¶

List of features which should be installed and enabled. See dovecot__features for details.

dovecot__features: [ 'imap', 'imaps', 'lmtp', 'sieve', 'quota' ]

dovecot__auth_mechanisms¶

List of enabled authentication mechanisms. Currently plain and login are supported.

dovecot__auth_mechanisms: [ 'plain', 'login' ]

dovecot__version¶

Variable which specifies what Dovecot version is installed on the host. It is defined via Ansible local facts and can be used in conditions to modify the configuration as needed.

dovecot__version: '{{ ansible_local.dovecot.version|d("0.0.0") }}'

User database/mailbox configuration ¶

dovecot__user_accounts¶

User account lookup mechanisms, see dovecot__user_accounts for details.

dovecot__user_accounts: '{{ [ "deny", "ldap" ]
                            if dovecot__ldap_enabled|bool
                            else [ "deny", "system" ] }}'

dovecot__deny_users¶

List of users for which mail access is disabled.

dovecot__deny_users: [ 'root' ]

dovecot__mail_location¶

Mailbox location. For mbox set something like mbox:~/mail:INBOX=/var/mail/%u. For more information about the supported format, see the Dovecot Mail Location documentation.

dovecot__mail_location: 'maildir:~/Maildir'

dovecot__auth_default_realm¶

The default domain (realm) to add to the usernames that don't include one. Required to correctly point the clients to their mailbox directories.

dovecot__auth_default_realm: '{{ ansible_domain }}'

Virtual Mail ¶

These settings makes it possible to host multiple (virtual) domains and to manage mail for users which do not need to have a local system account.

dovecot__vmail_enabled¶

Whether the virtual mail support should be enabled.

dovecot__vmail_enabled: '{{ True if (dovecot__user_accounts |
                                     intersect(["mysql", "pgsql", "sqlite",
                                                "ldap", "passwdfile" ]))
                            else False }}'

dovecot__vmail_posix_user¶

A separate user vmail (Virtual Mail), which owns the mailbox directories and is used by the various mail daemons to store and access the stored email, can be used. On the one hand this prevents mail daemons components from accessing sensitive system directories, on the other hand it protects the mailboxes from external access. Only the vmail user (and root) are allowed to access the mailboxes.

dovecot__vmail_posix_user: '{{ ansible_local.postldap.vmail_posix_user
                               | d("vmail") }}'

dovecot__vmail_posix_group¶

Virtual Mail POSIX group.

dovecot__vmail_posix_group: '{{ ansible_local.postldap.vmail_posix_group
                                | d("vmail") }}'

dovecot__vmail_base¶

The base directory where user mail directories are located, which also serves as the home directory for the dovecot__vmail_posix_user. This directory is used as the base for the virtual mail home directory paths and is used e.g. as a prefix for the mailHomeDirectory LDAP attribute if it's found in the LDAP lookups.

dovecot__vmail_base: '/var/vmail'

dovecot__vmail_home¶

The vmail home directory is a per-user directory where Dovecot can save user-specific files. Dovecot's home directories have nothing to do with system users' home directories. For more information, see Home Directories for Virtual Users.

dovecot__vmail_home: '{{ dovecot__vmail_base ~ "/%d/%n" }}'

DSync Settings ¶

Dovecot supports master/master replication using dsync. For more information, see DSync Replication.

dovecot__dsync_port¶

Port to use for dsync, defaults to 12345.

dovecot__dsync_port: '12345'

dovecot__dsync_host¶

Remote host to sync with, required.

dovecot__dsync_host: ''

dovecot__dsync_replica¶

Remote host to sync with, specified in the form tcp[s]:host[:port].

dovecot__dsync_replica: '{{ ("tcps" if dovecot__pki|d(True) else "tcp") ~ ":" ~
                            dovecot__dsync_host ~ ":" ~
                            dovecot__dsync_port }}'

dovecot__dsync_password_path¶

Directory on the Ansible Host where the dsync password will be stored. By default it's stored relative to the secret/ directory in the DebOps project directory. See the debops.secret role for more details.

dovecot__dsync_password_path: '{{ "dovecot/credentials/dsync.password" }}'

dovecot__dsync_password¶

Password to use for the dsync protocol. Must be the same on both hosts of a replica pair.

dovecot__dsync_password: '{{ lookup("password", secret + "/"
                                    + dovecot__dsync_password_path
                                    + " length=32") }}'

SQL Authentication Settings ¶

dovecot__sql_connect¶

Database-driver specific database connection string. See SQL User Databases for more details.

dovecot__sql_connect: ''

dovecot__sql_default_pass_scheme¶

Default password scheme for passwords, stored in a SQL database. For more information about the supported schemes, check Authentication / PasswordSchemes.

dovecot__sql_default_pass_scheme: 'SSHA512'

dovecot__sql_password_query¶

SQL query string to get the password. This function should return the values username, domain and password.

dovecot__sql_password_query: "SELECT userid AS username, domain, password FROM users WHERE userid = '%n' AND domain = '%d'"

dovecot__sql_user_query¶

SQL query string to get the userdb. This function should return the values home, uid and gid.

Optionally the mail_location can be defined with the option mail, see MailLocation.

dovecot__sql_user_query: "SELECT home, uid, gid FROM users WHERE userid = '%n' AND domain = '%d'"

dovecot__sql_iterate_query¶

SQL query string to get a list of users. This function should return all valid users (user or username and domain).

For more information about the iterate query , see the Dovecot SQL documentation.

dovecot__sql_iterate_query: "SELECT userid AS username, domain FROM users"

dovecot__passwdfile_scheme¶

Encryption scheme to use with password authentication.

dovecot__passwdfile_scheme: 'sha512-crypt'

dovecot__passwdfile_path¶

Path to the dovecot password file.

dovecot__passwdfile_path: '/etc/dovecot/private/'

dovecot__passwdfile_name¶

Name of the dovecot password file.

dovecot__passwdfile_name: 'passwd'

dovecot__checkpassword_passdb_command¶

Command to fetch the password database in checkpassword auth mode.

dovecot__checkpassword_passdb_command: '/usr/bin/checkpassword'

dovecot__checkpassword_userdb_command¶

Command to fetch the user database in checkpassword auth mode.

dovecot__checkpassword_userdb_command: '/usr/bin/checkpassword'

PKI / TLS configuration ¶

dovecot__pki¶

Enable or disable support for TLS/SSL using debops.pki.

dovecot__pki: '{{ ansible_local.pki.enabled|d() | bool }}'

dovecot__pki_path¶

Base PKI directory.

dovecot__pki_path: '{{ ansible_local.pki.path|d("/etc/pki/realms") }}'

dovecot__pki_realm¶

Default PKI realm.

dovecot__pki_realm: '{{ ansible_local.pki.realm|d("domain") }}'

dovecot__pki_ca¶

Name of the Root Certificate Authority certificate file, relative to the PKI realm directory.

dovecot__pki_ca: '{{ ansible_local.pki.ca|d("CA.crt") }}'

dovecot__pki_crt¶

Default certificate, relative to the dovecot__pki_realm variable.

dovecot__pki_crt: '{{ ansible_local.pki.crt|d("default.crt") }}'

dovecot__pki_key¶

Default private key, relative to the dovecot__pki_realm variable.

dovecot__pki_key: '{{ ansible_local.pki.key|d("default.key") }}'

dovecot__tls_ca_cert_dir¶

Directory containing X509 Certification Authority certificates.

dovecot__tls_ca_cert_dir: '/etc/ssl/certs/'

dovecot__ssl_required¶

Requires SSL/TLS also for non-plaintext authentication. For more information check ssl_required in the Dovecot SSL Configuration.

dovecot__ssl_required: True

dovecot__ssl_min_protocol¶

SSL ciphers to use.

dovecot__ssl_min_protocol: '{{ "!SSLv2 !SSLv3"
                              if (ansible_distribution_release in
                                [ "jessie", "precise", "trusty" ])
                              else "TLSv1.2" }}'

dovecot__ssl_dh_parameters_length¶

Diffie-Hellman parameters length.

dovecot__ssl_dh_parameters_length: 4096

dovecot__ssl_cipher_list¶

SSL ciphers to use.

dovecot__ssl_cipher_list: '{{ dovecot__ssl_cipher_list_default }}'

dovecot__ssl_cipher_list_default¶

Default SSL ciphers.

dovecot__ssl_cipher_list_default: 'ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH'

dovecot__ssl_cipher_list_better_crypto¶

See the bettercrypto.org guide.

dovecot__ssl_cipher_list_better_crypto: 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA'

dovecot__ssl_cipher_list_ncsc_nl¶

The 'good' cipher suite from the NCSC-NL TLS Guidelines v2.1.

dovecot__ssl_cipher_list_ncsc_nl: 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256'

dovecot__pki_hook_name¶

Name of the debops.pki hook script.

dovecot__pki_hook_name: 'dovecot'

dovecot__pki_hook_path¶

Directory for the debops.pki hooks.

dovecot__pki_hook_path: '{{ ansible_local.pki.hooks|d("/etc/pki/hooks") }}'

dovecot__pki_hook_action¶

Specify how changes in PKI should affect dovecot, either 'reload' or 'restart'.

dovecot__pki_hook_action: 'reload'

Diffie-Hellman parameters ¶

dovecot__dhparam¶

Enable or disable support for custom Diffie-Hellman parameters managed by the debops.dhparam Ansible role.

dovecot__dhparam: '{{ ansible_local.dhparam.enabled
                      if (ansible_local|d() and ansible_local.dhparam|d() and
                          ansible_local.dhparam.enabled is defined)
                      else False }}'

dovecot__dhparam_set¶

Name of the Diffie-Hellman parameter set to use. See the debops.dhparam Ansible role for more details.

dovecot__dhparam_set: 'default'

dovecot__ssl_dh_file¶

Absolute path to the Diffie-Hellman parameters file which should be used.

dovecot__ssl_dh_file: '{{ ansible_local.dhparam[dovecot__dhparam_set]
                          if (ansible_local|d() and ansible_local.dhparam|d() and
                            ansible_local.dhparam[dovecot__dhparam_set]|d())
                          else "" }}'

Dovecot custom configuration ¶

These variables define the contents of the /etc/dovecot/dovecot.conf configuration file.

dovecot__default_configuration¶

The default dovecot configuration options defined by the role. See Syntax for details.

dovecot__default_configuration:

  - section: 'main'
    title: 'Main Configuration'
    options:

      - name: 'protocols'
        comment: 'Currently active protocols'
        value: "{{ dovecot__features |
                   intersect(['imap', 'imaps', 'pop3',
                              'pop3s', 'sieve', 'lmtp']) |
                   map('regex_replace', '^(imap|pop3)s$', '\\1') |
                   list | unique | join(' ') }}"

  - section: 'authentication'
    title: 'Client Configuration'
    options:

      - name: 'auth_mechanisms'
        value: '{{ dovecot__auth_mechanisms | join(" ") }}'

      - name: 'disable_plaintext_auth'
        value: 'yes'

      - name: 'auth_default_realm'
        value: '{{ dovecot__auth_default_realm }}'

      - name: 'mail_uid'
        value: '{{ dovecot__vmail_posix_user }}'
        state: '{{ "present" if dovecot__vmail_enabled|d(False) else "absent" }}'

      - name: 'mail_gid'
        value: '{{ dovecot__vmail_posix_group }}'
        state: '{{ "present" if dovecot__vmail_enabled|d(False) else "absent" }}'

      - name: 'mail_privileged_group'
        value: '{{ dovecot__vmail_posix_user }}'
        state: '{{ "present" if dovecot__vmail_enabled|d(False) else "absent" }}'

      - name: 'passdb_deny'
        option: 'passdb'
        state: '{{ "present" if "deny" in dovecot__user_accounts else "absent" }}'
        options:

          - name: 'driver'
            value: 'passwd-file'

          - name: 'deny'
            value: 'yes'

          - name: 'args'
            value: '/etc/dovecot/dovecot.deny'

      - name: 'passdb_system'
        option: 'passdb'
        state: '{{ "present" if "system" in dovecot__user_accounts else "absent" }}'
        options:

          - name: 'driver'
            value: 'pam'

          - name: 'args'
            value: 'session=yes dovecot'

      - name: 'userdb_system'
        option: 'userdb'
        state: '{{ "present" if "system" in dovecot__user_accounts else "absent" }}'
        options:

          - name: 'driver'
            value: 'passwd'

          - name: 'args'
            value: 'blocking=no'

      - name: 'passdb_sql'
        option: 'passdb'
        state: '{{ "present" if (dovecot__user_accounts | d([]) |
                     intersect(["mysql", "pgsql", "sqlite"])) else "absent" }}'
        options:

          - name: 'driver'
            value: 'sql'

          - name: 'args'
            value: '/etc/dovecot/dovecot-sql.conf.ext'

      - name: 'userdb_sql'
        option: 'userdb'
        state: '{{ "present" if (dovecot__user_accounts | d([]) |
                     intersect(["mysql", "pgsql", "sqlite"])) else "absent" }}'
        options:

          - name: 'driver'
            value: 'sql'

          - name: 'args'
            value: '/etc/dovecot/dovecot-sql.conf.ext'

      - name: 'passdb_ldap'
        option: 'passdb'
        state: '{{ "present" if "ldap" in dovecot__user_accounts else "absent" }}'
        options:

          - name: 'driver'
            value: 'ldap'

          - name: 'args'
            value: '/etc/dovecot/dovecot-ldap-passdb.conf'

      - name: 'userdb_ldap'
        option: 'userdb'
        state: '{{ "present" if "ldap" in dovecot__user_accounts else "absent" }}'
        options:

          - name: 'driver'
            value: 'ldap'

          - name: 'args'
            value: '/etc/dovecot/dovecot-ldap-userdb.conf'

      - name: 'passdb_passwd'
        option: 'passdb'
        state: '{{ "present" if "passwdfile" in dovecot__user_accounts else "absent" }}'
        options:

          - name: 'driver'
            value: 'passwd-file'

          - name: 'args'
            value: 'scheme={{ dovecot__passwdfile_scheme }} {{ dovecot__passwdfile_path }}/{{ dovecot__passwdfile_name }}'

      - name: 'userdb_passwd'
        option: 'userdb'
        state: '{{ "present" if "passwdfile" in dovecot__user_accounts else "absent" }}'
        options:

          - name: 'driver'
            value: 'static'

          - name: 'args'
            value: 'uid={{ dovecot__vmail_posix_user }} gid={{ dovecot__vmail_posix_group }} home={{ dovecot__vmail_home }}'

          - name: 'default_fields'
            value: 'quota_rule=*:storage=1G'
            comment: 'Default fields that can be overridden by passwd-file'
            state: 'comment'

          - name: 'override_fields'
            value: 'home=/home/virtual/%u'
            comment: 'Override fields from passwd-file'
            state: 'comment'

      - name: 'passdb_checkpassword'
        option: 'passdb'
        state: '{{ "present" if ("checkpassword" in dovecot__user_accounts and
                     dovecot__checkpassword_passdb_command|d()) else "absent" }}'
        options:

          - name: 'driver'
            value: 'checkpassword'

          - name: 'args'
            value: '{{ dovecot__checkpassword_passdb_command }}'

      - name: 'userdb_checkpassword_pre'
        option: 'userdb'
        state: '{{ "present" if ("checkpassword" in dovecot__user_accounts and
                     dovecot__checkpassword_userdb_command|d()) else "absent" }}'
        options:

          - name: 'driver'
            value: 'prefetch'

      - name: 'userdb_checkpassword_main'
        option: 'userdb'
        state: '{{ "present" if ("checkpassword" in dovecot__user_accounts and
                     dovecot__checkpassword_userdb_command|d()) else "absent" }}'
        options:

          - name: 'driver'
            value: 'checkpassword'

          - name: 'args'
            value: '{{ dovecot__checkpassword_userdb_command }}'

  - section: 'tls'
    title: 'TLS Configuration'
    state: '{{ "present" if dovecot__pki is defined and dovecot__pki else "absent" }}'
    options:

      - name: 'ssl'
        value: '{{ "required" if dovecot__ssl_required else "yes" }}'

      - name: 'ssl_prefer_server_ciphers'
        value: 'yes'
        comment: 'Prefer the server''s order of ciphers over the client''s. (dovecot >= 2.2.6)'

      - name: 'ssl_cert'
        value: '<{{ dovecot__pki_path ~ "/" ~ dovecot__pki_realm ~ "/" ~ dovecot__pki_crt }}'

      - name: 'ssl_key'
        value: '<{{ dovecot__pki_path ~ "/" ~ dovecot__pki_realm ~ "/" ~ dovecot__pki_key }}'

      - name: 'ssl_protocols'
        value: '{{ dovecot__ssl_min_protocol }}'
        state: '{{ "present" if dovecot__version is version("2.3.0", "<") else "absent" }}'

      - name: 'ssl_dh_parameters_length'
        value: '{{ dovecot__ssl_dh_parameters_length }}'
        state: '{{ "present" if dovecot__version is version("2.3.0", "<") else "absent" }}'
        comment: 'Diffie-Hellman parameters length (default 1024, dovecot >= 2.2.7, optional in dovecot >= 2.3.3)'

      - name: 'ssl_min_protocol'
        value: '{{ dovecot__ssl_min_protocol }}'
        state: '{{ "present" if dovecot__version is version("2.3.0", ">=") else "absent" }}'

      - name: 'ssl_dh'
        value: '{{ "" if (dovecot__ssl_dh_file == "") else ("<" + dovecot__ssl_dh_file) }}'
        state: '{{ "present" if dovecot__version is version("2.3.0", ">=") else "absent" }}'

      - name: 'ssl_cipher_list'
        value: '{{ dovecot__ssl_cipher_list }}'

      - name: 'ssl_client_ca_dir'
        value: '/etc/ssl/certs'
        state: '{{ "present" if "dsync" in dovecot__features else "absent" }}'

  - section: 'no_tls'
    title: 'TLS Non-Configuration'
    state: '{{ "absent" if dovecot__pki is defined and dovecot__pki else "present" }}'
    options:

      - name: 'ssl'
        value: 'no'

  - section: 'services'
    title: 'Dovecot services'
    options:

      - name: 'service imap-login'
        state: '{{ "present" if ("imap" in dovecot__features or "imaps" in dovecot__features) else "absent" }}'
        options:

          - name: 'inet_listener imap'
            options:

              - name: 'address'
                value: '127.0.0.1, [::1]'
                comment: 'Only localhost if no PKI is configured'
                state: '{{ "present" if not dovecot__pki|d(True) else "comment" }}'

              - name: 'port'
                value: '{{ 143 if "imap" in dovecot__features else 0 }}'

          - name: 'inet_listener imaps'
            options:

              - name: 'port'
                value: '{{ 993 if ("imaps" in dovecot__features and dovecot__pki|d(True)) else 0 }}'
                comment: 'Disabled if no PKI is configured'

      - name: 'service pop3-login'
        state: '{{ "present" if ("pop3" in dovecot__features or "pop3s" in dovecot__features) else "absent" }}'
        options:

          - name: 'inet_listener pop3'
            options:

              - name: 'address'
                value: '127.0.0.1, [::1]'
                comment: 'Only localhost if no PKI is configured'
                state: '{{ "present" if not dovecot__pki|d(True) else "comment" }}'

              - name: 'port'
                value: '{{ 110 if "pop3" in dovecot__features else 0 }}'

          - name: 'inet_listener pop3s'
            options:

              - name: 'port'
                value: '{{ 995 if ("pop3s" in dovecot__features and dovecot__pki|d(True)) else 0 }}'
                comment: 'Disabled if no PKI is configured'

      - name: 'service lmtp'
        state: '{{ "present" if "lmtp" in dovecot__features else "absent" }}'
        options:

          - name: 'user'
            value: '{{ dovecot__vmail_posix_user }}'
            state: '{{ "present" if dovecot__vmail_enabled|d(False) else "absent" }}'

          - name: 'unix_listener /var/spool/postfix/private/dovecot-lmtp'
            options:

              - name: 'mode'
                value: '0660'

              - name: 'group'
                value: 'postfix'

              - name: 'user'
                value: 'postfix'

      - name: 'service managesieve-login'
        state: '{{ "present" if "sieve" in dovecot__features else "absent" }}'
        options:

          - name: 'inet_listener sieve'
            options:

              - name: 'port'
                value: '4190'

      - name: 'service replicator'
        state: '{{ "present" if "dsync" in dovecot__features else "absent" }}'
        options:

          - name: 'process_min_avail'
            value: '1'

          - name: 'unix_listener replicator-doveadm'
            options:

              - name: 'mode'
                value: '0600'

              - name: 'user'
                value: 'vmail'

      - name: 'service aggregator'
        state: '{{ "present" if "dsync" in dovecot__features else "absent" }}'
        options:

          - name: 'fifo_listener replication-notify-fifo'
            options:

              - name: 'user'
                value: 'vmail'

          - name: 'unix_listener replication-notify'
            options:

              - name: 'user'
                value: 'vmail'

      - name: 'service doveadm'
        state: '{{ "present" if "dsync" in dovecot__features else "absent" }}'
        options:

          - name: 'inet_listener doveadm'
            options:

              - name: 'port'
                value: '{{ dovecot__dsync_port }}'

              - name: 'ssl'
                value: 'yes'
                state: '{{ "present" if (dovecot__pki|d(True)) else "absent" }}'

      - name: 'replication_max_conns'
        value: '10'
        state: '{{ "present" if "dsync" in dovecot__features else "absent" }}'

      - name: 'doveadm_port'
        value: '{{ dovecot__dsync_port }}'
        state: '{{ "present" if "dsync" in dovecot__features else "absent" }}'

      - name: 'doveadm_password'
        value: '{{ dovecot__dsync_password }}'
        state: '{{ "present" if "dsync" in dovecot__features else "absent" }}'

      - name: 'service auth'
        options:

          - name: 'unix_listener /var/spool/postfix/private/auth'
            options:

              - name: 'mode'
                value: '0660'

              - name: 'group'
                value: 'postfix'

              - name: 'user'
                value: 'postfix'

          - name: 'unix_listener auth-userdb'
            state: '{{ "present" if (dovecot__vmail_enabled|d(False) and
                         "lmtp" in dovecot__features) else "absent" }}'
            options:

              - name: 'mode'
                value: '0660'

              - name: 'group'
                value: '{{ dovecot__vmail_posix_group }}'

              - name: 'user'
                value: '{{ dovecot__vmail_posix_user }}'

  - section: 'protocols'
    title: 'Protocol settings'
    options:

      - name: 'protocol imap'
        state: '{{ "present" if ("imap" in dovecot__features or "imaps" in dovecot__features) else "absent" }}'
        options:

          - name: 'mail_plugins'
            value: '{{ dovecot__mail_plugins_imap | flatten | join(" ") }}'

          - name: 'mail_max_userip_connections'
            value: '20'
            state: 'comment'

          - name: 'imap_idle_notify_interval'
            value: '29 mins'
            state: 'comment'

      - name: 'protocol pop3'
        state: '{{ "present" if ("pop3" in dovecot__features or "pop3s" in dovecot__features) else "absent" }}'
        options:

          - name: 'mail_plugins'
            value: '{{ dovecot__mail_plugins_pop3 | flatten | join(" ") }}'

          - name: 'mail_max_userip_connections'
            value: '10'
            state: 'comment'

      - name: 'protocol lda'
        state: '{{ "present" if "lmtp" not in dovecot__features else "absent" }}'
        options:

          - name: 'mail_plugins'
            value: '{{ dovecot__mail_plugins_lda | flatten | join(" ") }}'

          - name: 'postmaster_address'
            value: 'postmaster@{{ ansible_domain }}'

      - name: 'protocol lmtp'
        state: '{{ "present" if "lmtp" in dovecot__features else "absent" }}'
        options:

          - name: 'mail_plugins'
            value: '{{ dovecot__mail_plugins_lmtp | flatten | join(" ") }}'

          - name: 'postmaster_address'
            value: 'postmaster@{{ ansible_domain }}'

  - section: 'mailbox_locations'
    title: 'Mailbox Locations'
    options:

      - name: 'mail_home'
        value: '{{ dovecot__vmail_home }}'
        state: '{{ "present" if dovecot__vmail_enabled else "absent" }}'

      - name: 'mail_location'
        value: '{{ dovecot__mail_location }}'
        state: '{{ "present" if dovecot__mail_location|d() else "comment" }}'

  - section: 'mailbox_namespaces'
    title: 'Mailbox Namespaces'
    options:

      - name: 'namespace inbox'
        options:

          - name: 'inbox'
            value: 'yes'
            comment: 'There can be only one INBOX, and this setting defines which namespace has it.'

          - name: 'mailbox Drafts'
            options:
              - name: 'special_use'
                value: '\Drafts'

          - name: 'mailbox Junk'
            options:
              - name: 'special_use'
                value: '\Junk'

          - name: 'mailbox Trash'
            comment: |
              If you change the name of this mailbox and use LDAP,
              dovecot__ldap_trash_field also needs to be updated.
            options:

              - name: 'special_use'
                value: '\Trash'

          - name: 'mailbox Sent'
            comment: |
              For \Sent mailboxes there are two widely used names. We'll mark both of
              them as \Sent. User typically deletes one of them if duplicates are created.
            options:

              - name: 'special_use'
                value: '\Sent'

          - name: 'mailbox "Sent Messages"'
            options:

              - name: 'special_use'
                value: '\Sent'

          - name: 'mailbox virtual/All'
            comment: 'If you have a virtual "All Messages" mailbox:'
            state: 'comment'
            options:

              - name: 'special_use'
                value: '\All'

              - name: 'comment'
                value: 'All my messages'

          - name: 'mailbox virtual/Flagged'
            comment: 'If you have a virtual "Flagged" mailbox:'
            state: 'comment'
            options:

              - name: 'special_use'
                value: '\Flagged'

              - name: 'comment'
                value: 'All my flagged messages'

          - name: 'mailbox virtual/Important'
            comment: 'If you have a virtual "Important" mailbox:'
            state: 'comment'
            options:

              - name: 'special_use'
                value: '\Important'

              - name: 'comment'
                value: 'All my important messages'

  - section: 'plugins'
    title: 'Mail Plugins'
    options:

      - name: 'plugin'
        options:

          - name: 'sieve'
            value: '{{ dovecot__sieve_dir }}'
            state: '{{ "present" if "sieve" in dovecot__features else "absent" }}'

          - name: 'quota'
            value: 'maildir:User quota'
            state: '{{ "present" if "quota" in dovecot__features else "absent" }}'

          - name: 'mail_replica'
            value: '{{ dovecot__dsync_replica }}'
            state: '{{ "present" if "dsync" in dovecot__features else "absent" }}'

dovecot__configuration¶

The dovecot configuration options defined for all hosts in the Ansible inventory.

dovecot__configuration: []

dovecot__group_configuration¶

The dovecot configuration options defined for hosts in a specific Ansible inventory group.

dovecot__group_configuration: []

dovecot__host_configuration¶

The dovecot configuration options defined for a specific host in the Ansible inventory.

dovecot__host_configuration: []

dovecot__combined_configuration¶

The variable that combines other dovecot configuration options for use in the /etc/dovecot/dovecot.conf template.

dovecot__combined_configuration: '{{ dovecot__default_configuration
                                      + dovecot__configuration
                                      + dovecot__group_configuration
                                      + dovecot__host_configuration }}'

dovecot__mail_plugins¶

Default mail plugins for all protocols.

dovecot__mail_plugins:
  - '$mail_plugins'
  - '{{ "notify" if "dsync" in dovecot__features else [] }}'
  - '{{ "replication" if "dsync" in dovecot__features else [] }}'
  - '{{ "quota" if "quota" in dovecot__features else [] }}'

dovecot__mail_plugins_imap¶

Enabled mail plugins for the IMAP protocol.

dovecot__mail_plugins_imap:
  - '{{ dovecot__mail_plugins }}'
  - '{{ "imap_sieve" if "sieve" in dovecot__features else [] }}'
  - '{{ "imap_quota" if "quota" in dovecot__features else [] }}'

dovecot__mail_plugins_pop3¶

Enabled mail plugins for the POP3 protocol.

dovecot__mail_plugins_pop3:
  - '{{ dovecot__mail_plugins }}'

dovecot__mail_plugins_lda¶

Enabled mail plugins for the LDA protocol.

dovecot__mail_plugins_lda:
  - '{{ dovecot__mail_plugins }}'
  - '{{ "sieve" if "sieve" in dovecot__features else [] }}'

dovecot__mail_plugins_ltmp¶

Enabled mail plugins for the LMTP protocol.

dovecot__mail_plugins_lmtp:
  - '{{ dovecot__mail_plugins }}'
  - '{{ "sieve" if "sieve" in dovecot__features else [] }}'

dovecot__sieve_dir¶

Storage directory for sieve scripts.

dovecot__sieve_dir: 'file:~/sieve;active=~/.dovecot.sieve'

Firewall configuration ¶

dovecot__accept_any¶

The default firewall policy for dovecot services.

If True, any host can connect to the dovecot daemon unless allow restrictions are defined using the variables below.

If False, no hosts can connect to the dovecot daemon by default. You need to specify IP addresses or subnets that can access the services using the variables below.

dovecot__accept_any: True

dovecot__allow_imap¶

List of hosts/networks that can access the imap port (143).

dovecot__allow_imap: []

dovecot__allow_imaps¶

List of hosts/networks that can access the imaps port (993).

dovecot__allow_imaps: []

dovecot__allow_pop3¶

List of hosts/networks that can access the pop3 port (110).

dovecot__allow_pop3: []

dovecot__allow_pop3s¶

List of hosts/networks that can access the pop3s port (995).

dovecot__allow_pop3s: []

dovecot__allow_doveadm¶

List of hosts/networks that can access the doveadm port (12345, used for dsync).

dovecot__allow_doveadm:
  - '{{ dovecot__dsync_host }}'

dovecot__allow_sieve¶

List of hosts/networks that can access the ManageSieve Protocol port (4190).

dovecot__allow_sieve: []

LDAP ¶

dovecot__ldap_enabled¶

When enabled, dovecot will authenticate users against LDAP and authorize access to the user's mailbox.

dovecot__ldap_enabled: '{{ True
                           if (ansible_local|d() and ansible_local.ldap|d() and
                              (ansible_local.ldap.enabled|d())|bool)
                           else False }}'

dovecot__ldap_base_dn¶

The base Distinguished Name which should be used to create Distinguished Names of the LDAP directory objects.

dovecot__ldap_base_dn: '{{ ansible_local.ldap.base_dn|d([]) }}'

dovecot__ldap_device_dn¶

The Distinguished Name of the current host LDAP object. It will be used as a base for the Virtual Mail service account LDAP object. If empty, the role will not create the account LDAP object automatically.

dovecot__ldap_device_dn: '{{ ansible_local.ldap.device_dn|d([]) }}'

dovecot__ldap_self_rdn¶

The Relative Distinguished Name of the account LDAP object used by the dovecot service to access the LDAP directory.

dovecot__ldap_self_rdn: 'uid=dovecot'

dovecot__ldap_self_object_classes¶

List of the LDAP object classes which will be used to create the LDAP object used by the dovecot service to access the LDAP directory.

dovecot__ldap_self_object_classes: [ 'account', 'simpleSecurityObject' ]

dovecot__ldap_self_attributes¶

YAML dictionary that defines the attributes of the LDAP object used by the dovecot service to access the LDAP directory.

dovecot__ldap_self_attributes:
  uid: '{{ dovecot__ldap_self_rdn.split("=")[1] }}'
  userPassword: '{{ dovecot__ldap_bindpw }}'
  host: '{{ [ ansible_fqdn, ansible_hostname ] | unique }}'
  description: 'Account used by the "Dovecot" service to access the LDAP directory'

dovecot__ldap_binddn¶

The Distinguished Name used to bind to the LDAP directory.

dovecot__ldap_binddn: '{{ ([ dovecot__ldap_self_rdn ]
                             + dovecot__ldap_device_dn) | join(",") }}'

dovecot__ldap_bindpw¶

The password used to bind to the LDAP directory.

dovecot__ldap_bindpw: '{{ (lookup("password", secret + "/ldap/credentials/"
                           + dovecot__ldap_binddn | to_uuid + ".password length=32 "
                           + "chars=ascii_letters,digits,!@_$%^&*"))
                          if dovecot__ldap_enabled|bool
                          else "" }}'

dovecot__ldap_people_rdn¶

The Relative Distinguished Name of the LDAP object which contains the user accounts in LDAP.

dovecot__ldap_people_rdn: '{{ ansible_local.ldap.people_rdn|d("ou=People") }}'

dovecot__ldap_people_dn¶

The Distinguished Name of the LDAP object which contains the user accounts.

dovecot__ldap_people_dn: '{{ [ dovecot__ldap_people_rdn ]
                               + dovecot__ldap_base_dn }}'

dovecot__ldap_uri¶

List of LDAP URIs that point to the directory servers which should be used.

dovecot__ldap_uri: '{{ ansible_local.ldap.uri|d([""]) }}'

dovecot__ldap_start_tls¶

If True, STARTTLS will be used to connect to the LDAP server.

dovecot__ldap_start_tls: '{{ ansible_local.ldap.start_tls|d(True)|bool }}'

dovecot__ldap_user_filter¶

The LDAP filter used to look up user accounts in the directory. See LDAP tasks and administrative operations for more information.

dovecot__ldap_user_filter: '(&
                              (objectClass=mailRecipient)
                              (|
                                (uid=%n)
                                (mail=%u)
                              )
                              (|
                                (authorizedService=all)
                                (authorizedService=mail:access)
                              )
                            )'

dovecot__ldap_quota_attribute¶

The LDAP attribute storing the user quota.

dovecot__ldap_quota_attribute: 'mailQuota'

dovecot__ldap_quota_default¶

Default LDAP quota.

dovecot__ldap_quota_default: '10 GB'

dovecot__ldap_trash_field¶

The dovecot internal field name which corresponds to the trash mailbox, used to control the automatic expunction of mails via the mailExpungeTrash LDAP attribute.

dovecot__ldap_trash_field: 'namespace/inbox/mailbox/Trash/autoexpunge'

Configuration for other Ansible roles ¶

dovecot__postfix_lmtp_transport¶

Postfix mail transport target if LMTP is enabled.

dovecot__postfix_lmtp_transport: 'lmtp:unix:private/dovecot-lmtp'

dovecot__ldap__dependent_tasks¶

Configuration for the debops.ldap role.

dovecot__ldap__dependent_tasks:
  - name: 'Create Postfix account for {{ dovecot__ldap_device_dn | join(",") }}'
    dn: '{{ dovecot__ldap_binddn }}'
    objectClass: '{{ dovecot__ldap_self_object_classes }}'
    attributes: '{{ dovecot__ldap_self_attributes }}'
    no_log: '{{ debops__no_log | d(True) }}'
    state: '{{ "present"
                if (dovecot__ldap_enabled|bool and
                    dovecot__ldap_device_dn|d())
                else "ignore" }}'

dovecot__postfix__dependent_maincf¶

The main.cf configuration for the debops.postfix role.

dovecot__postfix__dependent_maincf:

  # The default TLS security level set by the 'postfix' role is "may", however
  # when the mail is delivered over local UNIX socket, this results in
  # a warning in the mail logs: "warning: smtp_connect_local: opportunistic TLS
  # encryption is not appropriate for unix-domain destinations". Therefore if
  # we know that Dovecot is installed locally and we deliver over an UNIX
  # socket, we can disable the opportunistic TLS encryption for the LMTP
  # protocol.
  - name: 'lmtp_tls_security_level'
    comment: |
      Security level overridden via local Dovecot installation
    value: '{{ "none"
               if dovecot__postfix_lmtp_transport.startswith("lmtp:unix:")
               else "may" }}'
    state: '{{ "present" if "lmtp" in dovecot__features else "ignore" }}'

  # We don't care about the STARTTLS offer when we talk to Dovecot over an UNIX
  # socket.
  - name: 'lmtp_tls_note_starttls_offer'
    value: '{{ False
               if dovecot__postfix_lmtp_transport.startswith("lmtp:unix:")
               else True }}'
    state: '{{ "present" if "lmtp" in dovecot__features else "ignore" }}'

  - name: 'virtual_transport'
    value: '{{ dovecot__postfix_lmtp_transport }}'
    state: '{{ "present"
               if ("lmtp" in dovecot__features and
                   dovecot__ldap_enabled|bool)
               else "ignore" }}'

  - name: 'mailbox_transport'
    value: '{{ dovecot__postfix_lmtp_transport }}'
    state: '{{ "present"
               if ("lmtp" in dovecot__features and
                   not dovecot__ldap_enabled|bool)
               else "ignore" }}'

dovecot__postfix__dependent_mastercf¶

The master.cf configuration for the debops.postfix role.

dovecot__postfix__dependent_mastercf: []

dovecot__etc_services__dependent_list¶

Configuration for the debops.etc_services role.

dovecot__etc_services__dependent_list:

  - name: 'doveadm'
    port: '{{ dovecot__dsync_port }}'
    protocols: [ 'tcp' ]
    comment: 'Added by debops.dovecot Ansible role.'

dovecot__ferm__dependent_rules¶

Configuration for the debops.ferm role.

dovecot__ferm__dependent_rules:

  - name: 'dovecot_imap'
    type: 'accept'
    by_role: 'debops.dovecot'
    dport: [ 'imap2' ]
    saddr: '{{ dovecot__allow_imap }}'
    accept_any: '{{ dovecot__accept_any }}'
    rule_state: '{{ "present"
                    if ("imap" in dovecot__features|d([]))
                    else "absent" }}'

  - name: 'dovecot_imaps'
    type: 'accept'
    by_role: 'debops.dovecot'
    dport: [ 'imaps' ]
    saddr: '{{ dovecot__allow_imaps }}'
    accept_any: '{{ dovecot__accept_any }}'
    rule_state: '{{ "present"
                    if ("imaps" in dovecot__features|d([])
                         and dovecot__pki|d(True))
                    else "absent" }}'

  - name: 'dovecot_pop3'
    type: 'accept'
    by_role: 'debops.dovecot'
    dport: [ 'pop3' ]
    saddr: '{{ dovecot__allow_pop3 }}'
    accept_any: '{{ dovecot__accept_any }}'
    rule_state: '{{ "present"
                    if ("pop3" in dovecot__features|d([]))
                    else "absent" }}'

  - name: 'dovecot_pop3s'
    type: 'accept'
    by_role: 'debops.dovecot'
    dport: [ 'pop3s' ]
    saddr: '{{ dovecot__allow_pop3s }}'
    accept_any: '{{ dovecot__accept_any }}'
    rule_state: '{{ "present"
                    if ("pop3s" in dovecot__features|d([])
                         and dovecot__pki|d(True))
                    else "absent" }}'

  - name: 'dovecot_doveadm'
    type: 'accept'
    by_role: 'debops.dovecot'
    dport: [ 'doveadm' ]
    saddr: '{{ dovecot__allow_doveadm }}'
    accept_any: '{{ dovecot__accept_any }}'
    rule_state: '{{ "present"
                    if ("dsync" in dovecot__features|d([]))
                    else "absent" }}'

  - name: 'dovecot_sieve'
    type: 'accept'
    by_role: 'debops.dovecot'
    dport: [ 'sieve' ]
    saddr: '{{ dovecot__allow_sieve }}'
    accept_any: '{{ dovecot__accept_any }}'
    rule_state: '{{ "present"
                    if ("sieve" in dovecot__features|d([])
                         and dovecot__pki|d(True))
                    else "absent" }}'