Enable Sieve and ManageSieve for Dovecot

Enables both sieve and managesieved, and adds a global rule that moves
detected spam to a user's Junk folder automatically

site-cookbooks/kosmos_email/files/default/after.sieve

@@ -0,0 +1,6 @@
+require ["fileinto", "mailbox"];
+
+if header :contains "X-Spam-Flag" "YES" {
+  fileinto :create "Junk";
+  stop;
+}

site-cookbooks/kosmos_email/recipes/dovecot.rb

@@ -9,6 +9,8 @@
   dovecot-ldap
   dovecot-lmtpd
   dovecot-pop3d
+  dovecot-sieve
+  dovecot-managesieved
 ].each do |pkg|
   apt_package pkg
 end
@@ -26,8 +28,8 @@ credentials = Chef::EncryptedDataBagItem.load('credentials', 'email')
 template "/etc/dovecot/dovecot.conf" do
   source    "dovecot.conf.erb"
   mode      0644
-  # TODO variables protocols: "imap pop3 lmtp"
+  # TODO variables protocols: "imap pop3 lmtp sieve"
-  variables protocols: "imap lmtp",
+  variables protocols: "imap lmtp sieve",
             # TODO find by email_proxy role
             haproxy_trusted_networks: "10.1.1.167/32"
   notifies :restart, "service[dovecot]", :delayed
@@ -85,6 +87,40 @@ template "/etc/dovecot/conf.d/15-mailboxes.conf" do
   notifies :restart, "service[dovecot]", :delayed
 end
 
+template "/etc/dovecot/conf.d/20-lmtp.conf" do
+  source    "dovecot_20-lmtp.conf.erb"
+  mode      0644
+  notifies :restart, "service[dovecot]", :delayed
+end
+
+template "/etc/dovecot/conf.d/90-sieve.conf" do
+  source    "dovecot_90-sieve.conf.erb"
+  mode      0644
+  notifies :restart, "service[dovecot]", :delayed
+end
+
+# Directory for global Sieve scripts (applied after user scripts)
+directory "/var/lib/dovecot/sieve" do
+  owner "dovecot"
+  group "dovecot"
+  mode  0755
+end
+
+# Global Sieve script run after every user script (sieve_after).
+# Files spam flagged by SpamAssassin (X-Spam-Flag: YES) into the Junk folder.
+cookbook_file "/var/lib/dovecot/sieve/after.sieve" do
+  source "after.sieve"
+  owner  "dovecot"
+  group  "dovecot"
+  mode   0644
+  notifies :run, "execute[compile after.sieve]", :immediately
+end
+
+execute "compile after.sieve" do
+  command "sievec /var/lib/dovecot/sieve/after.sieve"
+  action :nothing
+end
+
 service "dovecot" do
   action [:enable, :start]
 end

site-cookbooks/kosmos_email/recipes/firewall.rb

@@ -32,3 +32,9 @@ firewall_rule "IMAPS" do
   port     993
   protocol :tcp
 end
+
+firewall_rule "ManageSieve" do
+  command  :allow
+  port     4190
+  protocol :tcp
+end

site-cookbooks/kosmos_email/templates/dovecot_10-master.conf.erb

@@ -60,6 +60,18 @@ service submission-login {
   }
 }
 
+service managesieve-login {
+  inet_listener sieve {
+    port = 4190
+    ssl = yes
+  }
+  inet_listener sieve_haproxy {
+    port = 14190
+    ssl = yes
+    haproxy = yes
+  }
+}
+
 service lmtp {
   unix_listener /var/spool/postfix/private/dovecot-lmtp {
     mode = 0600

site-cookbooks/kosmos_email/templates/dovecot_20-lmtp.conf.erb

@@ -0,0 +1,9 @@
+##
+## LMTP specific settings
+##
+
+# Enable the Sieve plugin for LMTP delivery so that Sieve scripts are
+# executed for incoming mail handed over by Postfix.
+protocol lmtp {
+  mail_plugins = $mail_plugins sieve
+}

site-cookbooks/kosmos_email/templates/dovecot_90-sieve.conf.erb

@@ -0,0 +1,15 @@
+##
+## Plugin settings (Sieve)
+##
+
+plugin {
+  # Per-user Sieve script storage. The "~" expands to mail_home
+  # (/var/vmail/%d/%n) set in 10-mail.conf, so scripts for LDAP virtual
+  # users are stored under ~/sieve/ with the active script symlinked at
+  # ~/.dovecot.sieve.
+  sieve = file:~/sieve;active=~/.dovecot.sieve
+
+  # Global Sieve script executed AFTER user scripts. Used to enforce
+  # server-side spam filing regardless of per-user rules.
+  sieve_after = /var/lib/dovecot/sieve/after.sieve
+}