movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-19 08:31:01 +03:00
Code Activity

Revert "nixos/dovecot: improve and harden systemd unit" (#422817)

Browse source 
Users reported issues with this changeset in https://github.com/NixOS/nixpkgs/pull/418722.
This commit is contained in:
Martin Weinelt 2025-07-06 02:14:08 +02:00 • committed by GitHub
commit 17b5150fcb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

52
nixos/modules/services/mail/dovecot.nix
View file

@ -692,67 +692,23 @@ in
environment.etc."dovecot/dovecot.conf".source = cfg.configFile;
systemd.services.dovecot = {
aliases = [ "dovecot2.service" ];
systemd.services.dovecot2 = {
description = "Dovecot IMAP/POP3 server";
documentation = [
"man:dovecot(1)"
"https://doc.dovecot.org"
];
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
restartTriggers = [ cfg.configFile ];
restartTriggers = [
cfg.configFile
];
startLimitIntervalSec = 60; # 1 min
serviceConfig = {
Type = "notify";
ExecStart = "${dovecotPkg}/sbin/dovecot -F";
ExecReload = "${dovecotPkg}/sbin/doveadm reload";
CapabilityBoundingSet = [
"CAP_CHOWN"
"CAP_DAC_OVERRIDE"
"CAP_FOWNER"
"CAP_NET_BIND_SERVICE"
"CAP_SETGID"
"CAP_SETUID"
"CAP_SYS_CHROOT"
"CAP_SYS_RESOURCE"
];
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
OOMPolicy = "continue";
PrivateTmp = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = lib.mkDefault false;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
PrivateDevices = true;
Restart = "on-failure";
RestartSec = "1s";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = false; # sets sgid on maildirs
RuntimeDirectory = [ "dovecot2" ];
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service @resources"
"~@privileged"
"@chown @setuid capset chroot"
];
};
# When copying sieve scripts preserve the original time stamp

4
nixos/tests/dovecot.nix
View file

@ -84,13 +84,11 @@
testScript = ''
machine.wait_for_unit("postfix.service")
machine.wait_for_unit("dovecot.service")
machine.wait_for_unit("dovecot2.service")
machine.succeed("send-testmail")
machine.succeed("send-lda")
machine.wait_until_fails('[ "$(postqueue -p)" != "Mail queue is empty" ]')
machine.succeed("test-imap")
machine.succeed("test-pop")
machine.log(machine.succeed("systemd-analyze security dovecot.service | grep -v ✓"))
'';
}