Enable Sieve and ManageSieve for Dovecot

Enables both sieve and managesieved, and adds a global rule that moves
detected spam to a user's Junk folder automatically

site-cookbooks/kosmos_email/recipes/dovecot.rb

@@ -9,6 +9,8 @@
   dovecot-ldap
   dovecot-lmtpd
   dovecot-pop3d
+  dovecot-sieve
+  dovecot-managesieved
 ].each do |pkg|
   apt_package pkg
 end
@@ -26,8 +28,8 @@ credentials = Chef::EncryptedDataBagItem.load('credentials', 'email')
 template "/etc/dovecot/dovecot.conf" do
   source    "dovecot.conf.erb"
   mode      0644
-  # TODO variables protocols: "imap pop3 lmtp"
-  variables protocols: "imap lmtp",
+  # TODO variables protocols: "imap pop3 lmtp sieve"
+  variables protocols: "imap lmtp sieve",
             # TODO find by email_proxy role
             haproxy_trusted_networks: "10.1.1.167/32"
   notifies :restart, "service[dovecot]", :delayed
@@ -85,6 +87,40 @@ template "/etc/dovecot/conf.d/15-mailboxes.conf" do
   notifies :restart, "service[dovecot]", :delayed
 end
 
+template "/etc/dovecot/conf.d/20-lmtp.conf" do
+  source    "dovecot_20-lmtp.conf.erb"
+  mode      0644
+  notifies :restart, "service[dovecot]", :delayed
+end
+
+template "/etc/dovecot/conf.d/90-sieve.conf" do
+  source    "dovecot_90-sieve.conf.erb"
+  mode      0644
+  notifies :restart, "service[dovecot]", :delayed
+end
+
+# Directory for global Sieve scripts (applied after user scripts)
+directory "/var/lib/dovecot/sieve" do
+  owner "dovecot"
+  group "dovecot"
+  mode  0755
+end
+
+# Global Sieve script run after every user script (sieve_after).
+# Files spam flagged by SpamAssassin (X-Spam-Flag: YES) into the Junk folder.
+cookbook_file "/var/lib/dovecot/sieve/after.sieve" do
+  source "after.sieve"
+  owner  "dovecot"
+  group  "dovecot"
+  mode   0644
+  notifies :run, "execute[compile after.sieve]", :immediately
+end
+
+execute "compile after.sieve" do
+  command "sievec /var/lib/dovecot/sieve/after.sieve"
+  action :nothing
+end
+
 service "dovecot" do
   action [:enable, :start]
 end

site-cookbooks/kosmos_email/recipes/firewall.rb

@@ -32,3 +32,9 @@ firewall_rule "IMAPS" do
   port     993
   protocol :tcp
 end
+
+firewall_rule "ManageSieve" do
+  command  :allow
+  port     4190
+  protocol :tcp
+end