Skip to content

Draft: Implement mail_crypt plugin for dovecot

Omer Naveed requested to merge omernaveedxyz/nixos-mailserver:master into master

The mail_crypt plugin provides the ability to encrypt the emails stored locally on the machine running Dovecot with the individual users' passwords. This merge request implements the plugin with per-user encrypted keys, but with some large caveats.

The goal of this draft is to see if there is interest in having this implemented (taking into account the caveats), and finalizing configuration details.

In no particular order, here are a list of issues needing to be tackled:

  • Requires SQL based userdb & passdb drivers (passwd-file does not work)
    • Logic needs to be moved to separate file (i.e. mysql.nix).
    • Structure of 'virtual_users' table needs to be decided. (+other tables?)
    • DB connection should use separate 'mailserver' user instead of root (I am unable to get another user to access the database correctly using NixOS MySQL authentication with Unix sockets for the dovecot2 systemd service.)
    • Dovecot package in Nixpkgs needs to be compiled with the additional flags for enabling SQL drivers. dovecot = super.dovecot.override { withMySQL = true; };
  • Option to enable/disable the plugin needs to be added.
  • Account for configurations options that I do not use and therefore have not tested.
  • Requires user to manually doveadm -o plugin/mail_crypt_private_password=<some_password> mailbox cryptokey generate -u <username> -U where <some_password> is the plaintext password for the user. (Not sure what the security implications of this is. Was unable to find where/if this is stored by dovecot.

Reference: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/

Edited by Omer Naveed

Merge request reports