From 451903f663fa307a3e9c1b71ba8049fc68e11220 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Sat, 15 Aug 2026 17:29:41 -0600 Subject: [PATCH] Enable Sieve and ManageSieve for Dovecot Enables both sieve and managesieved, and adds a global rule that moves detected spam to a user's Junk folder automatically --- nodes | 2 +- .../kosmos_email/files/default/after.sieve | 6 +++ .../kosmos_email/recipes/dovecot.rb | 40 ++++++++++++++++++- .../kosmos_email/recipes/firewall.rb | 6 +++ .../templates/dovecot_10-master.conf.erb | 12 ++++++ .../templates/dovecot_20-lmtp.conf.erb | 9 +++++ .../templates/dovecot_90-sieve.conf.erb | 15 +++++++ 7 files changed, 87 insertions(+), 3 deletions(-) create mode 100644 site-cookbooks/kosmos_email/files/default/after.sieve create mode 100644 site-cookbooks/kosmos_email/templates/dovecot_20-lmtp.conf.erb create mode 100644 site-cookbooks/kosmos_email/templates/dovecot_90-sieve.conf.erb diff --git a/nodes b/nodes index be7d719..5fd2e23 160000 --- a/nodes +++ b/nodes @@ -1 +1 @@ -Subproject commit be7d719a1f2a9d5b0606e55f1094bd7f68d3ce97 +Subproject commit 5fd2e23a0174b64751548d362055d714440253d5 diff --git a/site-cookbooks/kosmos_email/files/default/after.sieve b/site-cookbooks/kosmos_email/files/default/after.sieve new file mode 100644 index 0000000..5a0b3b2 --- /dev/null +++ b/site-cookbooks/kosmos_email/files/default/after.sieve @@ -0,0 +1,6 @@ +require ["fileinto", "mailbox"]; + +if header :contains "X-Spam-Flag" "YES" { + fileinto :create "Junk"; + stop; +} diff --git a/site-cookbooks/kosmos_email/recipes/dovecot.rb b/site-cookbooks/kosmos_email/recipes/dovecot.rb index 0a6f1f7..fc76090 100644 --- a/site-cookbooks/kosmos_email/recipes/dovecot.rb +++ b/site-cookbooks/kosmos_email/recipes/dovecot.rb @@ -9,6 +9,8 @@ dovecot-ldap dovecot-lmtpd dovecot-pop3d + dovecot-sieve + dovecot-managesieved ].each do |pkg| apt_package pkg end @@ -26,8 +28,8 @@ credentials = Chef::EncryptedDataBagItem.load('credentials', 'email') template "/etc/dovecot/dovecot.conf" do source "dovecot.conf.erb" mode 0644 - # TODO variables protocols: "imap pop3 lmtp" - variables protocols: "imap lmtp", + # TODO variables protocols: "imap pop3 lmtp sieve" + variables protocols: "imap lmtp sieve", # TODO find by email_proxy role haproxy_trusted_networks: "10.1.1.167/32" notifies :restart, "service[dovecot]", :delayed @@ -85,6 +87,40 @@ template "/etc/dovecot/conf.d/15-mailboxes.conf" do notifies :restart, "service[dovecot]", :delayed end +template "/etc/dovecot/conf.d/20-lmtp.conf" do + source "dovecot_20-lmtp.conf.erb" + mode 0644 + notifies :restart, "service[dovecot]", :delayed +end + +template "/etc/dovecot/conf.d/90-sieve.conf" do + source "dovecot_90-sieve.conf.erb" + mode 0644 + notifies :restart, "service[dovecot]", :delayed +end + +# Directory for global Sieve scripts (applied after user scripts) +directory "/var/lib/dovecot/sieve" do + owner "dovecot" + group "dovecot" + mode 0755 +end + +# Global Sieve script run after every user script (sieve_after). +# Files spam flagged by SpamAssassin (X-Spam-Flag: YES) into the Junk folder. +cookbook_file "/var/lib/dovecot/sieve/after.sieve" do + source "after.sieve" + owner "dovecot" + group "dovecot" + mode 0644 + notifies :run, "execute[compile after.sieve]", :immediately +end + +execute "compile after.sieve" do + command "sievec /var/lib/dovecot/sieve/after.sieve" + action :nothing +end + service "dovecot" do action [:enable, :start] end diff --git a/site-cookbooks/kosmos_email/recipes/firewall.rb b/site-cookbooks/kosmos_email/recipes/firewall.rb index d4a76c0..7dc54c2 100644 --- a/site-cookbooks/kosmos_email/recipes/firewall.rb +++ b/site-cookbooks/kosmos_email/recipes/firewall.rb @@ -32,3 +32,9 @@ firewall_rule "IMAPS" do port 993 protocol :tcp end + +firewall_rule "ManageSieve" do + command :allow + port 4190 + protocol :tcp +end diff --git a/site-cookbooks/kosmos_email/templates/dovecot_10-master.conf.erb b/site-cookbooks/kosmos_email/templates/dovecot_10-master.conf.erb index a55a9a6..c241d1c 100644 --- a/site-cookbooks/kosmos_email/templates/dovecot_10-master.conf.erb +++ b/site-cookbooks/kosmos_email/templates/dovecot_10-master.conf.erb @@ -60,6 +60,18 @@ service submission-login { } } +service managesieve-login { + inet_listener sieve { + port = 4190 + ssl = yes + } + inet_listener sieve_haproxy { + port = 14190 + ssl = yes + haproxy = yes + } +} + service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0600 diff --git a/site-cookbooks/kosmos_email/templates/dovecot_20-lmtp.conf.erb b/site-cookbooks/kosmos_email/templates/dovecot_20-lmtp.conf.erb new file mode 100644 index 0000000..a8081f2 --- /dev/null +++ b/site-cookbooks/kosmos_email/templates/dovecot_20-lmtp.conf.erb @@ -0,0 +1,9 @@ +## +## LMTP specific settings +## + +# Enable the Sieve plugin for LMTP delivery so that Sieve scripts are +# executed for incoming mail handed over by Postfix. +protocol lmtp { + mail_plugins = $mail_plugins sieve +} diff --git a/site-cookbooks/kosmos_email/templates/dovecot_90-sieve.conf.erb b/site-cookbooks/kosmos_email/templates/dovecot_90-sieve.conf.erb new file mode 100644 index 0000000..da6b7d1 --- /dev/null +++ b/site-cookbooks/kosmos_email/templates/dovecot_90-sieve.conf.erb @@ -0,0 +1,15 @@ +## +## Plugin settings (Sieve) +## + +plugin { + # Per-user Sieve script storage. The "~" expands to mail_home + # (/var/vmail/%d/%n) set in 10-mail.conf, so scripts for LDAP virtual + # users are stored under ~/sieve/ with the active script symlinked at + # ~/.dovecot.sieve. + sieve = file:~/sieve;active=~/.dovecot.sieve + + # Global Sieve script executed AFTER user scripts. Used to enforce + # server-side spam filing regardless of per-user rules. + sieve_after = /var/lib/dovecot/sieve/after.sieve +}