Added rspamd redis db backup

Fix Grammar

README.rst

@@ -3,11 +3,11 @@
 
 |workflow| |codecov|
 
-An installer which deploy a complete mail server based on Modoboa.
+An installer which deploys a complete mail server based on Modoboa.
 
 .. warning::
 
-   This tool is still in beta stage, it has been tested on:
+   This tool is still in beta, it has been tested on:
 
    * Debian 12 and upper
    * Ubuntu Focal Fossa (20.04) and upper
@@ -44,7 +44,6 @@ The following components are installed by the installer:
 * Postfix
 * Dovecot
 * Amavis (with SpamAssassin and ClamAV) or Rspamd
-* automx (autoconfiguration service)
 * OpenDKIM
 * Radicale (CalDAV and CardDAV server)
 

modoboa_installer/config_dict_template.py

@@ -222,35 +222,6 @@ ConfigDictTemplate = [
             },
         ]
     },
-    {
-        "name": "automx",
-        "values": [
-            {
-                "option": "enabled",
-                "default": "true",
-            },
-            {
-                "option": "user",
-                "default": "automx",
-            },
-            {
-                "option": "config_dir",
-                "default": "/etc",
-            },
-            {
-                "option": "home_dir",
-                "default": "/srv/automx",
-            },
-            {
-                "option": "venv_path",
-                "default": "%(home_dir)s/env",
-            },
-            {
-                "option": "instance_path",
-                "default": "%(home_dir)s/instance",
-            },
-        ]
-    },
     {
         "name": "rspamd",
         "if": ["antispam.enabled=true", "antispam.type=rspamd"],

modoboa_installer/database.py

@@ -3,19 +3,19 @@
 import os
 import pwd
 import stat
+from typing import Optional
 
 from . import package
 from . import system
 from . import utils
 
 
-class Database(object):
-
+class Database:
     """Common database backend."""
 
-    default_port = None
-    packages = None
-    service = None
+    default_port: Optional[int] = None
+    packages: Optional[dict[str, list[str]]] = None
+    service: Optional[str] = None
 
     def __init__(self, config):
         """Install if necessary."""
@@ -36,7 +36,6 @@ class Database(object):
 
 
 class PostgreSQL(Database):
-
     """Postgres."""
 
     default_port = 5432
@@ -157,7 +156,6 @@ class PostgreSQL(Database):
 
 
 class MySQL(Database):
-
     """MySQL backend."""
 
     default_port = 3306
@@ -178,7 +176,7 @@ class MySQL(Database):
         if name.startswith("debian"):
             if version.startswith("8"):
                 self.packages["deb"].append("libmysqlclient-dev")
-            elif version.startswith("11") or version.startswith("12"):
+            elif int(version[:2]) >= 11:
                 self.packages["deb"].append("libmariadb-dev")
             else:
                 self.packages["deb"].append("libmariadbclient-dev")
@@ -188,7 +186,7 @@ class MySQL(Database):
                 self.packages["deb"].append("libmariadb-dev")
             else:
                 self.packages["deb"].append("libmysqlclient-dev")
-        super(MySQL, self).install_package()
+        super().install_package()
         queries = []
         if name.startswith("debian"):
             if version.startswith("8"):
@@ -200,7 +198,7 @@ class MySQL(Database):
                     self.dbpassword)
                 return
         if (
-            (name.startswith("debian") and (version.startswith("11") or version.startswith("12"))) or
+            (name.startswith("debian") and int(version[:2]) >= 11) or
             (name.startswith("ubuntu") and int(version[:2]) >= 22)
         ):
             queries = [

modoboa_installer/scripts/__init__.py

@@ -9,8 +9,7 @@ from .. import utils
 def load_app_script(appname):
     """Load module corresponding to the given appname."""
     try:
-        script = importlib.import_module(
-            "modoboa_installer.scripts.{}".format(appname))
+        script = importlib.import_module("modoboa_installer.scripts.{}".format(appname))
     except ImportError:
         print("Unknown application {}".format(appname))
         sys.exit(1)
@@ -19,8 +18,9 @@ def load_app_script(appname):
 
 def install(appname: str, config, upgrade: bool, archive_path: str):
     """Install an application."""
-    if (config.has_option(appname, "enabled") and
-            not config.getboolean(appname, "enabled")):
+    if config.has_option(appname, "enabled") and not config.getboolean(
+        appname, "enabled"
+    ):
         return
 
     utils.printcolor("Installing {}".format(appname), utils.MAGENTA)
@@ -34,8 +34,9 @@ def install(appname: str, config, upgrade: bool, archive_path: str):
 
 def backup(appname, config, path):
     """Backup an application."""
-    if (config.has_option(appname, "enabled") and
-            not config.getboolean(appname, "enabled")):
+    if config.has_option(appname, "enabled") and not config.getboolean(
+        appname, "enabled"
+    ):
         return
 
     utils.printcolor("Backing up {}".format(appname), utils.MAGENTA)
@@ -49,6 +50,5 @@ def backup(appname, config, path):
 
 def restore_prep(restore):
     """Restore instance"""
-    script = importlib.import_module(
-        "modoboa_installer.scripts.restore")
+    script = importlib.import_module("modoboa_installer.scripts.restore")
     getattr(script, "Restore")(restore)

modoboa_installer/scripts/amavis.py

@@ -10,18 +10,29 @@ from . import backup, install
 
 
 class Amavis(base.Installer):
-
     """Amavis installer."""
 
     appname = "amavis"
     packages = {
         "deb": [
-            "libdbi-perl", "amavisd-new", "arc", "arj", "cabextract",
-            "liblz4-tool", "lrzip", "lzop", "p7zip-full", "rpm2cpio",
+            "libdbi-perl",
+            "amavisd-new",
+            "arc",
+            "arj",
+            "cabextract",
+            "liblz4-tool",
+            "lrzip",
+            "lzop",
+            "p7zip-full",
+            "rpm2cpio",
             "unrar-free",
         ],
         "rpm": [
-            "amavisd-new", "arj", "lz4", "lzop", "p7zip",
+            "amavisd-new",
+            "arj",
+            "lz4",
+            "lzop",
+            "p7zip",
         ],
     }
     with_db = True
@@ -43,8 +54,10 @@ class Amavis(base.Installer):
         """Return appropriate config files."""
         if package.backend.FORMAT == "deb":
             return [
-                "conf.d/05-node_id", "conf.d/15-content_filter_mode",
-                "conf.d/50-user"]
+                "conf.d/05-node_id",
+                "conf.d/15-content_filter_mode",
+                "conf.d/50-user",
+            ]
         return ["amavisd.conf"]
 
     def get_packages(self):
@@ -52,7 +65,17 @@ class Amavis(base.Installer):
         packages = super(Amavis, self).get_packages()
         if package.backend.FORMAT == "deb":
             db_driver = "pg" if self.db_driver == "pgsql" else self.db_driver
-            return packages + ["libdbd-{}-perl".format(db_driver)]
+            packages += ["libdbd-{}-perl".format(db_driver)]
+
+            name, version = utils.dist_info()
+            try:
+                major_version = int(version.split(".")[0])
+            except ValueError:
+                major_version = 0
+            if major_version >= 13:
+                packages = [p if p != "liblz4-tool" else "lz4" for p in packages]
+            return packages
+
         if self.db_driver == "pgsql":
             db_driver = "Pg"
         elif self.db_driver == "mysql":
@@ -61,9 +84,9 @@ class Amavis(base.Installer):
             raise NotImplementedError("DB driver not supported")
         packages += ["perl-DBD-{}".format(db_driver)]
         name, version = utils.dist_info()
-        if version.startswith('7'):
+        if version.startswith("7"):
             packages += ["cabextract", "lrzip", "unar", "unzoo"]
-        elif version.startswith('8'):
+        elif version.startswith("8"):
             packages += ["perl-IO-stringy"]
         return packages
 
@@ -75,12 +98,10 @@ class Amavis(base.Installer):
             version = package.backend.get_installed_version("amavis")
             if version is None:
                 raise utils.FatalError("Amavis is not installed")
-        path = self.get_file_path(
-            "amavis_{}_{}.sql".format(self.dbengine, version))
+        path = self.get_file_path("amavis_{}_{}.sql".format(self.dbengine, version))
         if not os.path.exists(path):
             version = ".".join(version.split(".")[:-1]) + ".X"
-            path = self.get_file_path(
-                "amavis_{}_{}.sql".format(self.dbengine, version))
+            path = self.get_file_path("amavis_{}_{}.sql".format(self.dbengine, version))
             if not os.path.exists(path):
                 raise utils.FatalError("Failed to find amavis database schema")
         return path
@@ -97,20 +118,21 @@ class Amavis(base.Installer):
 
     def custom_backup(self, path):
         """Backup custom configuration if any."""
-        if package.backend.FORMAT == "deb":
-            amavis_custom = f"{self.config_dir}/conf.d/99-custom"
-            if os.path.isfile(amavis_custom):
-                utils.copy_file(amavis_custom, path)
-                utils.success("Amavis custom configuration saved!")
-        backup("spamassassin", self.config, os.path.dirname(path))
+        amavis_custom = f"{self.config_dir}/conf.d/99-custom"
+        if os.path.isfile(amavis_custom):
+            utils.copy_file(amavis_custom, path)
+            utils.success("Amavis custom configuration saved!")
+        backup("spamassassin", self.config, self.base_backup_path)
 
     def restore(self):
         """Restore custom config files."""
         if package.backend.FORMAT != "deb":
             return
         amavis_custom_configuration = os.path.join(
-            self.archive_path, "custom/99-custom")
+            self.archive_path, "custom/amavis/99-custom"
+        )
         if os.path.isfile(amavis_custom_configuration):
-            utils.copy_file(amavis_custom_configuration, os.path.join(
-                self.config_dir, "conf.d"))
+            utils.copy_file(
+                amavis_custom_configuration, os.path.join(self.config_dir, "conf.d")
+            )
             utils.success("Custom amavis configuration restored.")

modoboa_installer/scripts/automx.py

@@ -1,101 +0,0 @@
-"""Automx related tasks."""
-
-import os
-import pwd
-import shutil
-import stat
-
-from .. import python
-from .. import system
-from .. import utils
-
-from . import base
-
-
-class Automx(base.Installer):
-    """Automx installation."""
-
-    appname = "automx"
-    config_files = ["automx.conf"]
-    no_daemon = True
-    packages = {
-        "deb": ["memcached", "unzip"],
-        "rpm": ["memcached", "unzip"]
-    }
-    with_user = True
-
-    def __init__(self, *args, **kwargs):
-        """Get configuration."""
-        super(Automx, self).__init__(*args, **kwargs)
-        self.venv_path = self.config.get("automx", "venv_path")
-        self.instance_path = self.config.get("automx", "instance_path")
-
-    def get_template_context(self):
-        """Additional variables."""
-        context = super(Automx, self).get_template_context()
-        sql_dsn = "{}://{}:{}@{}:{}/{}".format(
-            "postgresql" if self.dbengine == "postgres" else self.dbengine,
-            self.config.get("modoboa", "dbuser"),
-            self.config.get("modoboa", "dbpassword"),
-            self.dbhost,
-            self.dbport,
-            self.config.get("modoboa", "dbname"))
-        if self.db_driver == "pgsql":
-            sql_query = (
-                "SELECT first_name || ' ' || last_name AS display_name, email"
-                ", SPLIT_PART(email, '@', 2) AS domain "
-                "FROM core_user WHERE email='%s' AND is_active;")
-        else:
-            sql_query = (
-                "SELECT concat(first_name, ' ', last_name) AS display_name, "
-                "email, SUBSTRING_INDEX(email, '@', -1) AS domain "
-                "FROM core_user WHERE email='%s' AND is_active=1;"
-            )
-        context.update({"sql_dsn": sql_dsn, "sql_query": sql_query})
-        return context
-
-    def _setup_venv(self):
-        """Prepare a python virtualenv."""
-        python.setup_virtualenv(self.venv_path, sudo_user=self.user)
-        packages = [
-            "future", "lxml", "ipaddress", "sqlalchemy < 2.0", "python-memcached",
-            "python-dateutil", "configparser"
-        ]
-        if self.dbengine == "postgres":
-            packages.append("psycopg2-binary")
-        else:
-            packages.append("mysqlclient")
-        python.install_packages(packages, self.venv_path, sudo_user=self.user)
-        target = "{}/master.zip".format(self.home_dir)
-        if os.path.exists(target):
-            os.unlink(target)
-        utils.exec_cmd(
-            "wget https://github.com/sys4/automx/archive/master.zip",
-            sudo_user=self.user, cwd=self.home_dir)
-        self.repo_dir = "{}/automx-master".format(self.home_dir)
-        if os.path.exists(self.repo_dir):
-            shutil.rmtree(self.repo_dir)
-        utils.exec_cmd(
-            "unzip master.zip", sudo_user=self.user, cwd=self.home_dir)
-        utils.exec_cmd(
-            "{} setup.py install".format(
-                python.get_path("python", self.venv_path)),
-            cwd=self.repo_dir)
-
-    def _deploy_instance(self):
-        """Copy files to instance dir."""
-        if not os.path.exists(self.instance_path):
-            pw = pwd.getpwnam(self.user)
-            mode = (
-                stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
-                stat.S_IROTH | stat.S_IXOTH)
-            utils.mkdir(self.instance_path, mode, pw[2], pw[3])
-        path = "{}/src/automx_wsgi.py".format(self.repo_dir)
-        utils.exec_cmd("cp {} {}".format(path, self.instance_path),
-                       sudo_user=self.user, cwd=self.home_dir)
-
-    def post_run(self):
-        """Additional tasks."""
-        self._setup_venv()
-        self._deploy_instance()
-        system.enable_and_start_service("memcached")

modoboa_installer/scripts/backup.py

@@ -1,226 +0,0 @@
-"""Backup script for pre-installed instance."""
-
-import os
-import pwd
-import shutil
-import stat
-import sys
-import datetime
-
-from .. import database
-from .. import utils
-from ..constants import DEFAULT_BACKUP_DIRECTORY
-
-
-class Backup:
-    """
-    Backup structure ( {optional} ):
-    {{backup_directory}}
-    ||
-    ||--> installer.cfg
-    ||--> custom
-        |--> { (copy of) /etc/amavis/conf.d/99-custom }
-        |--> { (copy of) /etc/postfix/custom_whitelist.cidr }
-        |--> { (copy of) dkim directory }
-            |--> {dkim.pem}...
-        |--> { (copy of) radicale home_dir }
-    ||--> databases
-        |--> modoboa.sql
-        |--> { amavis.sql }
-        |--> { spamassassin.sql }
-    ||--> mails
-        |--> vmails
-    """
-
-    def __init__(self, config, silent_backup, backup_path, nomail):
-        self.config = config
-        self.backup_path = backup_path
-        self.nomail = nomail
-        self.silent_backup = silent_backup
-
-    def validate_path(self, path):
-        """Check basic condition for backup directory."""
-
-        path_exists = os.path.exists(path)
-
-        if path_exists and os.path.isfile(path):
-            utils.error("Error, you provided a file instead of a directory!")
-            return False
-
-        if not path_exists:
-            if not self.silent_backup:
-                create_dir = input(
-                    f"\"{path}\" doesn't exist, would you like to create it? [Y/n]\n").lower()
-
-            if self.silent_backup or (not self.silent_backup and create_dir.startswith("y")):
-                pw = pwd.getpwnam("root")
-                utils.mkdir_safe(path, stat.S_IRWXU |
-                                 stat.S_IRWXG, pw[2], pw[3])
-            else:
-                utils.error("Error, backup directory not present.")
-                return False
-
-        if len(os.listdir(path)) != 0:
-            if not self.silent_backup:
-                delete_dir = input(
-                    "Warning: backup directory is not empty, it will be purged if you continue... [Y/n]\n").lower()
-
-            if self.silent_backup or (not self.silent_backup and delete_dir.startswith("y")):
-                try:
-                    os.remove(os.path.join(path, "installer.cfg"))
-                except FileNotFoundError:
-                    pass
-
-                shutil.rmtree(os.path.join(path, "custom"),
-                              ignore_errors=False)
-                shutil.rmtree(os.path.join(path, "mails"), ignore_errors=False)
-                shutil.rmtree(os.path.join(path, "databases"),
-                              ignore_errors=False)
-            else:
-                utils.error("Error: backup directory not clean.")
-                return False
-
-        self.backup_path = path
-
-        pw = pwd.getpwnam("root")
-        for dir in ["custom/", "databases/"]:
-            utils.mkdir_safe(os.path.join(self.backup_path, dir),
-                             stat.S_IRWXU | stat.S_IRWXG, pw[2], pw[3])
-        return True
-
-    def set_path(self):
-        """Setup backup directory."""
-        if self.silent_backup:
-            if self.backup_path is None:
-                if self.config.has_option("backup", "default_path"):
-                    path = self.config.get("backup", "default_path")
-                else:
-                    path = DEFAULT_BACKUP_DIRECTORY
-                date = datetime.datetime.now().strftime("%m_%d_%Y_%H_%M")
-                path = os.path.join(path, f"backup_{date}")
-                self.validate_path(path)
-            else:
-                if not self.validate_path(self.backup_path):
-                    utils.printcolor(
-                        f"Path provided: {self.backup_path}", utils.BLUE)
-                    sys.exit(1)
-        else:
-            user_value = None
-            while user_value == "" or user_value is None or not self.validate_path(user_value):
-                utils.printcolor(
-                    "Enter backup path (it must be an empty directory)", utils.MAGENTA)
-                utils.printcolor("CTRL+C to cancel", utils.MAGENTA)
-                user_value = utils.user_input("-> ")
-
-    def config_file_backup(self):
-        utils.copy_file("installer.cfg", self.backup_path)
-
-    def mail_backup(self):
-        if self.nomail:
-            utils.printcolor(
-                "Skipping mail backup, no-mail argument provided", utils.MAGENTA)
-            return
-
-        utils.printcolor("Backing up mails", utils.MAGENTA)
-
-        home_path = self.config.get("dovecot", "home_dir")
-
-        if not os.path.exists(home_path) or os.path.isfile(home_path):
-            utils.error("Error backing up Email, provided path "
-                        f" ({home_path}) seems not right...")
-
-        else:
-            dst = os.path.join(self.backup_path, "mails/")
-
-            if os.path.exists(dst):
-                shutil.rmtree(dst)
-
-            shutil.copytree(home_path, dst)
-            utils.printcolor("Mail backup complete!", utils.GREEN)
-
-    def custom_config_backup(self):
-        """
-        Custom config :
-        - DKIM keys: {{keys_storage_dir}}
-        - Radicale collection (calendars, contacts): {{home_dir}}
-        - Amavis : /etc/amavis/conf.d/99-custom
-        - Postwhite : /etc/postwhite.conf
-        Feel free to suggest to add others!
-        """
-        utils.printcolor(
-            "Backing up some custom configuration...", utils.MAGENTA)
-
-        custom_path = os.path.join(
-            self.backup_path, "custom")
-
-        # DKIM Key
-        if (self.config.has_option("opendkim", "enabled") and
-                self.config.getboolean("opendkim", "enabled")):
-            dkim_keys = self.config.get(
-                "opendkim", "keys_storage_dir", fallback="/var/lib/dkim")
-            if os.path.isdir(dkim_keys):
-                shutil.copytree(dkim_keys, os.path.join(custom_path, "dkim"))
-                utils.printcolor(
-                    "DKIM keys saved!", utils.GREEN)
-
-        # Radicale Collections
-        if (self.config.has_option("radicale", "enabled") and
-                self.config.getboolean("radicale", "enabled")):
-            radicale_backup = os.path.join(self.config.get(
-                "radicale", "home_dir", fallback="/srv/radicale"), "collections")
-            if os.path.isdir(radicale_backup):
-                shutil.copytree(radicale_backup, os.path.join(
-                    custom_path, "radicale"))
-                utils.printcolor("Radicale files saved", utils.GREEN)
-
-        # AMAVIS
-        if (self.config.has_option("amavis", "enabled") and
-                self.config.getboolean("amavis", "enabled")):
-            amavis_custom = "/etc/amavis/conf.d/99-custom"
-            if os.path.isfile(amavis_custom):
-                utils.copy_file(amavis_custom, custom_path)
-                utils.printcolor(
-                    "Amavis custom configuration saved!", utils.GREEN)
-
-        # POSTWHITE
-        if (self.config.has_option("postwhite", "enabled") and
-                self.config.getboolean("postwhite", "enabled")):
-            postswhite_custom = "/etc/postwhite.conf"
-            if os.path.isfile(postswhite_custom):
-                utils.copy_file(postswhite_custom, custom_path)
-                utils.printcolor(
-                    "Postwhite configuration saved!", utils.GREEN)
-
-    def database_backup(self):
-        """Backing up databases"""
-
-        utils.printcolor("Backing up databases...", utils.MAGENTA)
-
-        self.database_dump("modoboa")
-        self.database_dump("amavis")
-        self.database_dump("spamassassin")
-
-    def database_dump(self, app_name):
-
-        dump_path = os.path.join(self.backup_path, "databases")
-        backend = database.get_backend(self.config)
-
-        if app_name == "modoboa" or (self.config.has_option(app_name, "enabled") and
-                                     self.config.getboolean(app_name, "enabled")):
-            dbname = self.config.get(app_name, "dbname")
-            dbuser = self.config.get(app_name, "dbuser")
-            dbpasswd = self.config.get(app_name, "dbpassword")
-            backend.dump_database(dbname, dbuser, dbpasswd,
-                                  os.path.join(dump_path, f"{app_name}.sql"))
-
-    def backup_completed(self):
-        utils.printcolor("Backup process done, your backup is available here:"
-                         f"--> {self.backup_path}", utils.GREEN)
-
-    def run(self):
-        self.set_path()
-        self.config_file_backup()
-        self.mail_backup()
-        self.custom_config_backup()
-        self.database_backup()
-        self.backup_completed()

modoboa_installer/scripts/base.py

@@ -2,6 +2,7 @@
 
 import os
 import sys
+from typing import Optional
 
 from .. import database
 from .. import package
@@ -13,15 +14,15 @@ from .. import utils
 class Installer:
     """Simple installer for one application."""
 
-    appname = None
-    no_daemon = False
-    daemon_name = None
-    packages = {}
-    with_user = False
-    with_db = False
-    config_files = []
+    appname: str
+    no_daemon: bool = False
+    daemon_name: Optional[str] = None
+    packages: dict[str, list[str]] = {}
+    with_user: bool = False
+    with_db: bool = False
+    config_files: list[str] = []
 
-    def __init__(self, config, upgrade: bool, archive_path: str):
+    def __init__(self, config, upgrade: bool, archive_path: str) -> None:
         """Get configuration."""
         self.config = config
         self.upgrade = upgrade
@@ -30,12 +31,12 @@ class Installer:
             self.app_config = dict(self.config.items(self.appname))
         self.dbengine = self.config.get("database", "engine")
         # Used to install system packages
-        self.db_driver = (
-            "pgsql" if self.dbengine == "postgres" else self.dbengine)
+        self.db_driver = "pgsql" if self.dbengine == "postgres" else self.dbengine
         self.backend = database.get_backend(self.config)
         self.dbhost = self.config.get("database", "host")
         self.dbport = self.config.get(
-            "database", "port", fallback=self.backend.default_port)
+            "database", "port", fallback=self.backend.default_port
+        )
         self._config_dir = None
         if not self.with_db:
             return
@@ -44,24 +45,24 @@ class Installer:
         self.dbpasswd = self.config.get(self.appname, "dbpassword")
 
     @property
-    def modoboa_2_2_or_greater(self):
+    def modoboa_2_2_or_greater(self) -> bool:
         # Check if modoboa version > 2.2
         modoboa_version = python.get_package_version(
             "modoboa",
             self.config.get("modoboa", "venv_path"),
-            sudo_user=self.config.get("modoboa", "user")
-            )
+            sudo_user=self.config.get("modoboa", "user"),
+        )
         condition = (
-            (int(modoboa_version[0]) == 2 and int(modoboa_version[1]) >= 2) or
-            int(modoboa_version[0]) > 2
-            )
+            int(modoboa_version[0]) == 2 and int(modoboa_version[1]) >= 2
+        ) or int(modoboa_version[0]) > 2
         return condition
 
     @property
     def config_dir(self):
         """Return main configuration directory."""
         if self._config_dir is None and self.config.has_option(
-                self.appname, "config_dir"):
+            self.appname, "config_dir"
+        ):
             self._config_dir = self.config.get(self.appname, "config_dir")
         return self._config_dir
 
@@ -72,11 +73,11 @@ class Installer:
     def get_sql_schema_from_backup(self):
         """Retrieve a dump path from a previous backup."""
         utils.printcolor(
-            f"Trying to restore {self.appname} database from backup.",
-            utils.MAGENTA
+            f"Trying to restore {self.appname} database from backup.", utils.MAGENTA
         )
         database_backup_path = os.path.join(
-            self.archive_path, f"databases/{self.appname}.sql")
+            self.archive_path, f"databases/{self.appname}.sql"
+        )
         if os.path.isfile(database_backup_path):
             utils.success(f"SQL dump found in backup for {self.appname}!")
             return database_backup_path
@@ -85,8 +86,7 @@ class Installer:
     def get_file_path(self, fname):
         """Return the absolute path of this file."""
         return os.path.abspath(
-            os.path.join(
-                os.path.dirname(__file__), "files", self.appname, fname)
+            os.path.join(os.path.dirname(__file__), "files", self.appname, fname)
         )
 
     def setup_database(self):
@@ -101,8 +101,7 @@ class Installer:
         if not schema:
             schema = self.get_sql_schema_path()
         if schema:
-            self.backend.load_sql_file(
-                self.dbname, self.dbuser, self.dbpasswd, schema)
+            self.backend.load_sql_file(self.dbname, self.dbuser, self.dbpasswd, schema)
 
     def setup_user(self):
         """Setup a system user."""
@@ -118,8 +117,7 @@ class Installer:
     def get_template_context(self):
         """Return context used for template rendering."""
         context = {
-            "dbengine": (
-                "Pg" if self.dbengine == "postgres" else self.dbengine),
+            "dbengine": ("Pg" if self.dbengine == "postgres" else self.dbengine),
             "dbhost": self.dbhost,
             "dbport": self.dbport,
         }
@@ -171,9 +169,11 @@ class Installer:
             utils.copy_from_template(src, dst, context)
 
     def backup(self, path):
+        self.base_backup_path = path
         if self.with_db:
             self._dump_database(path)
-        custom_backup_path = os.path.join(path, "custom")
+        custom_backup_path = os.path.join(path, "custom", self.appname)
+        utils.mkdir_safe(custom_backup_path)
         self.custom_backup(custom_backup_path)
 
     def custom_backup(self, path):
@@ -212,8 +212,7 @@ class Installer:
         """Create a new database dump for this app."""
         target_dir = os.path.join(backup_path, "databases")
         target_file = os.path.join(target_dir, f"{self.appname}.sql")
-        self.backend.dump_database(
-            self.dbname, self.dbuser, self.dbpasswd, target_file)
+        self.backend.dump_database(self.dbname, self.dbuser, self.dbpasswd, target_file)
 
     def pre_run(self):
         """Tasks to execute before the installer starts."""

modoboa_installer/scripts/dovecot.py

@@ -5,7 +5,6 @@ import os
 import pwd
 import shutil
 import stat
-import uuid
 
 from .. import database
 from .. import package
@@ -16,52 +15,87 @@ from . import base
 
 
 class Dovecot(base.Installer):
-
     """Dovecot installer."""
 
     appname = "dovecot"
     packages = {
         "deb": [
-            "dovecot-imapd", "dovecot-lmtpd", "dovecot-managesieved",
-            "dovecot-sieve"],
-        "rpm": [
-            "dovecot", "dovecot-pigeonhole"]
+            "dovecot-imapd",
+            "dovecot-lmtpd",
+            "dovecot-managesieved",
+            "dovecot-sieve",
+        ],
+        "rpm": ["dovecot", "dovecot-pigeonhole"],
+    }
+    per_version_config_files = {
+        "2.3": [
+            "dovecot.conf",
+            "dovecot-dict-sql.conf.ext",
+            "conf.d/10-ssl.conf",
+            "conf.d/10-master.conf",
+            "conf.d/20-lmtp.conf",
+            "conf.d/10-ssl-keys.try",
+            "conf.d/dovecot-oauth2.conf.ext",
+        ],
+        "2.4": [
+            "dovecot.conf",
+            "conf.d/10-mail.conf",
+            "conf.d/10-master.conf",
+            "conf.d/10-ssl.conf",
+            "conf.d/10-ssl-keys.try",
+            "conf.d/20-lmtp.conf",
+            "conf.d/auth-oauth2.conf.ext",
+        ],
     }
-    config_files = [
-        "dovecot.conf",
-        "dovecot-dict-sql.conf.ext",
-        "conf.d/10-ssl.conf",
-        "conf.d/10-master.conf",
-        "conf.d/20-lmtp.conf",
-        "conf.d/10-ssl-keys.try",
-        "conf.d/dovecot-oauth2.conf.ext",
-    ]
     with_user = True
 
+    @property
+    def version(self) -> str:
+        if not hasattr(self, "_version"):
+            self._version = package.backend.get_installed_version("dovecot-core")[:3]
+        return self._version
+
     def setup_user(self):
         """Setup mailbox user."""
         super().setup_user()
         self.mailboxes_owner = self.app_config["mailboxes_owner"]
         system.create_user(self.mailboxes_owner, self.home_dir)
 
-    def get_config_files(self):
-        """Additional config files."""
-        _config_files = self.config_files
+    def _get_config_files_for_version(self, version: str) -> list[str]:
+        files = self.per_version_config_files[version]
+        if version == "2.4":
+            files += [
+                f"conf.d/auth-sql-{self.dbengine}.conf.ext=conf.d/auth-sql.conf.ext",
+                f"conf.d/auth-master-{self.dbengine}.conf.ext=conf.d/auth-master.conf.ext",
+                f"conf.d/30-dict-server-{self.dbengine}.conf=conf.d/30-dict-server.conf",
+            ]
+        else:
+            files += [
+                f"dovecot-sql-{self.dbengine}.conf.ext=dovecot-sql.conf.ext",
+                f"dovecot-sql-master-{self.dbengine}.conf.ext=dovecot-sql-master.conf.ext",
+            ]
+        result = []
+        for path in files:
+            if "=" not in path:
+                result.append(f"{version}/{path}={path}")
+            else:
+                src, dst = path.split("=")
+                result.append(f"{version}/{src}={dst}")
+        return result
 
+    def get_config_files(self) -> list[str]:
+        """Additional config files."""
+        _config_files = self._get_config_files_for_version(self.version)
+        _config_files.append(
+            f"postlogin-{self.dbengine}.sh=/usr/local/bin/postlogin.sh"
+        )
         if self.app_config["move_spam_to_junk"]:
             _config_files += [
-                "conf.d/custom_after_sieve/spam-to-junk.sieve",
-                "conf.d/90-sieve.conf",
+                "custom_after_sieve/spam-to-junk.sieve=conf.d/custom_after_sieve/spam-to-junk.sieve",
+                f"{self.version}/conf.d/90-sieve.conf=conf.d/90-sieve.conf",
             ]
 
-        return _config_files + [
-            "dovecot-sql-{}.conf.ext=dovecot-sql.conf.ext"
-            .format(self.dbengine),
-            "dovecot-sql-master-{}.conf.ext=dovecot-sql-master.conf.ext"
-            .format(self.dbengine),
-            "postlogin-{}.sh=/usr/local/bin/postlogin.sh"
-            .format(self.dbengine),
-        ]
+        return _config_files
 
     def get_packages(self):
         """Additional packages."""
@@ -72,7 +106,9 @@ class Dovecot(base.Installer):
         packages += super().get_packages()
         backports_codename = getattr(self, "backports_codename", None)
         if backports_codename:
-            packages = [f"{package}/{backports_codename}-backports" for package in packages]
+            packages = [
+                f"{package}/{backports_codename}-backports" for package in packages
+            ]
         return packages
 
     def install_packages(self):
@@ -83,7 +119,8 @@ class Dovecot(base.Installer):
             package.backend.enable_backports("bookworm")
             self.backports_codename = "bookworm"
         package.backend.preconfigure(
-            "dovecot-core", "create-ssl-cert", "boolean", "false")
+            "dovecot-core", "create-ssl-cert", "boolean", "false"
+        )
         super().install_packages()
 
     def get_template_context(self):
@@ -92,14 +129,20 @@ class Dovecot(base.Installer):
         pw_mailbox = pwd.getpwnam(self.mailboxes_owner)
         dovecot_package = {"deb": "dovecot-core", "rpm": "dovecot"}
         ssl_protocol_parameter = "ssl_protocols"
-        if package.backend.get_installed_version(dovecot_package[package.backend.FORMAT]) > "2.3":
+        if (
+            package.backend.get_installed_version(
+                dovecot_package[package.backend.FORMAT]
+            )
+            > "2.3"
+        ):
             ssl_protocol_parameter = "ssl_min_protocol"
         ssl_protocols = "!SSLv2 !SSLv3"
-        if package.backend.get_installed_version("openssl").startswith("1.1") \
-                or package.backend.get_installed_version("openssl").startswith("3"):
+        if package.backend.get_installed_version("openssl").startswith(
+            "1.1"
+        ) or package.backend.get_installed_version("openssl").startswith("3"):
             ssl_protocols = "!SSLv3"
         if ssl_protocol_parameter == "ssl_min_protocol":
-            ssl_protocols = "TLSv1"
+            ssl_protocols = "TLSv1.2"
         if "centos" in utils.dist_name():
             protocols = "protocols = imap lmtp sieve"
             extra_protocols = self.config.get("dovecot", "extra_protocols")
@@ -110,30 +153,38 @@ class Dovecot(base.Installer):
             protocols = ""
 
         oauth2_client_id, oauth2_client_secret = utils.create_oauth2_app(
-            "Dovecot", "dovecot", self.config)
+            "Dovecot", "dovecot", self.config
+        )
         hostname = self.config.get("general", "hostname")
         oauth2_introspection_url = (
             f"https://{oauth2_client_id}:{oauth2_client_secret}"
             f"@{hostname}/api/o/introspect/"
         )
 
-        context.update({
-            "db_driver": self.db_driver,
-            "mailboxes_owner_uid": pw_mailbox[2],
-            "mailboxes_owner_gid": pw_mailbox[3],
-            "mailbox_owner": self.mailboxes_owner,
-            "modoboa_user": self.config.get("modoboa", "user"),
-            "modoboa_dbname": self.config.get("modoboa", "dbname"),
-            "modoboa_dbuser": self.config.get("modoboa", "dbuser"),
-            "modoboa_dbpassword": self.config.get("modoboa", "dbpassword"),
-            "protocols": protocols,
-            "ssl_protocols": ssl_protocols,
-            "ssl_protocol_parameter": ssl_protocol_parameter,
-            "modoboa_2_2_or_greater": "" if self.modoboa_2_2_or_greater else "#",
-            "not_modoboa_2_2_or_greater": "" if not self.modoboa_2_2_or_greater else "#",
-            "do_move_spam_to_junk": "" if self.app_config["move_spam_to_junk"] else "#",
-            "oauth2_introspection_url": oauth2_introspection_url
-        })
+        context.update(
+            {
+                "db_driver": self.db_driver,
+                "mailboxes_owner_uid": pw_mailbox[2],
+                "mailboxes_owner_gid": pw_mailbox[3],
+                "mailbox_owner": self.mailboxes_owner,
+                "modoboa_user": self.config.get("modoboa", "user"),
+                "modoboa_dbname": self.config.get("modoboa", "dbname"),
+                "modoboa_dbuser": self.config.get("modoboa", "dbuser"),
+                "modoboa_dbpassword": self.config.get("modoboa", "dbpassword"),
+                "protocols": protocols,
+                "ssl_protocols": ssl_protocols,
+                "ssl_protocol_parameter": ssl_protocol_parameter,
+                "modoboa_2_2_or_greater": "" if self.modoboa_2_2_or_greater else "#",
+                "not_modoboa_2_2_or_greater": (
+                    "" if not self.modoboa_2_2_or_greater else "#"
+                ),
+                "do_move_spam_to_junk": (
+                    "" if self.app_config["move_spam_to_junk"] else "#"
+                ),
+                "oauth2_introspection_url": oauth2_introspection_url,
+                "radicale_user": self.config.get("radicale", "user"),
+            }
+        )
         return context
 
     def install_config_files(self):
@@ -141,28 +192,36 @@ class Dovecot(base.Installer):
         if self.app_config["move_spam_to_junk"]:
             utils.mkdir_safe(
                 f"{self.config_dir}/conf.d/custom_after_sieve",
-                stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
-                stat.S_IROTH | stat.S_IXOTH,
-                0, 0
-                )
+                stat.S_IRWXU
+                | stat.S_IRGRP
+                | stat.S_IXGRP
+                | stat.S_IROTH
+                | stat.S_IXOTH,
+                0,
+                0,
+            )
         super().install_config_files()
 
     def post_run(self):
         """Additional tasks."""
-        if self.dbengine == "postgres":
+        if self.version == "2.3" and self.dbengine == "postgres":
             dbname = self.config.get("modoboa", "dbname")
             dbuser = self.config.get("modoboa", "dbuser")
             dbpassword = self.config.get("modoboa", "dbpassword")
             backend = database.get_backend(self.config)
             backend.load_sql_file(
-                dbname, dbuser, dbpassword,
-                self.get_file_path("install_modoboa_postgres_trigger.sql")
+                dbname,
+                dbuser,
+                dbpassword,
+                self.get_file_path("install_modoboa_postgres_trigger.sql"),
             )
             backend.load_sql_file(
-                dbname, dbuser, dbpassword,
-                self.get_file_path("fix_modoboa_postgres_schema.sql")
+                dbname,
+                dbuser,
+                dbpassword,
+                self.get_file_path("fix_modoboa_postgres_schema.sql"),
             )
-        for f in glob.glob("{}/*".format(self.get_file_path("conf.d"))):
+        for f in glob.glob(f"{self.get_file_path(f'{self.version}/conf.d')}/*"):
             if os.path.isfile(f):
                 utils.copy_file(f, "{}/conf.d".format(self.config_dir))
         # Make postlogin script executable
@@ -174,9 +233,11 @@ class Dovecot(base.Installer):
         # See https://github.com/modoboa/modoboa/issues/2157.
         if self.app_config["move_spam_to_junk"]:
             # Compile sieve script
-            sieve_file = f"{self.config_dir}/conf.d/custom_after_sieve/spam-to-junk.sieve"
+            sieve_file = (
+                f"{self.config_dir}/conf.d/custom_after_sieve/spam-to-junk.sieve"
+            )
             utils.exec_cmd(f"/usr/bin/sievec {sieve_file}")
-        system.add_user_to_group(self.mailboxes_owner, 'dovecot')
+        system.add_user_to_group(self.mailboxes_owner, "dovecot")
 
     def restart_daemon(self):
         """Restart daemon process.
@@ -190,7 +251,8 @@ class Dovecot(base.Installer):
         action = "start" if code else "restart"
         utils.exec_cmd(
             "service {} {} > /dev/null 2>&1".format(self.appname, action),
-            capture_output=False)
+            capture_output=False,
+        )
         system.enable_service(self.get_daemon_name())
 
     def backup(self, path):
@@ -198,14 +260,16 @@ class Dovecot(base.Installer):
         home_dir = self.config.get("dovecot", "home_dir")
         utils.printcolor("Backing up mails", utils.MAGENTA)
         if not os.path.exists(home_dir) or os.path.isfile(home_dir):
-            utils.error("Error backing up emails, provided path "
-                        f" ({home_dir}) seems not right...")
+            utils.error(
+                "Error backing up emails, provided path "
+                f" ({home_dir}) seems not right..."
+            )
             return
 
         dst = os.path.join(path, "mails/")
         if os.path.exists(dst):
             shutil.rmtree(dst)
-        shutil.copytree(home_dir, dst)
+        shutil.copytree(home_dir, dst, dirs_exist_ok=True)
         utils.success("Mail backup complete!")
 
     def restore(self):
@@ -221,10 +285,13 @@ class Dovecot(base.Installer):
             for dirpath, dirnames, filenames in os.walk(home_dir):
                 shutil.chown(dirpath, self.mailboxes_owner, self.mailboxes_owner)
                 for filename in filenames:
-                    shutil.chown(os.path.join(dirpath, filename),
-                                 self.mailboxes_owner, self.mailboxes_owner)
+                    shutil.chown(
+                        os.path.join(dirpath, filename),
+                        self.mailboxes_owner,
+                        self.mailboxes_owner,
+                    )
         else:
             utils.printcolor(
                 "It seems that emails were not backed up, skipping restoration.",
-                utils.MAGENTA
+                utils.MAGENTA,
             )

modoboa_installer/scripts/files/automx/automx.conf.tpl

@@ -1,39 +0,0 @@
-[automx]
-provider = %domain
-domains = *
-
-#debug=yes
-#logfile = /srv/automx/automx.log
-
-# Protect against DoS
-memcache = 127.0.0.1:11211
-memcache_ttl = 600
-client_error_limit = 20
-rate_limit_exception_networks = 127.0.0.0/8, ::1/128
-
-[global]
-backend = sql
-action = settings
-account_type = email
-host = %sql_dsn
-query = %sql_query
-result_attrs = display_name, email
-
-display_name = ${display_name}
-
-smtp = yes
-smtp_server = %hostname
-smtp_port = 587
-smtp_encryption = starttls
-smtp_auth = plaintext
-smtp_auth_identity = ${email}
-smtp_refresh_ttl = 6
-smtp_default = yes
-
-imap = yes
-imap_server = %hostname
-imap_port = 143
-imap_encryption = starttls
-imap_auth = plaintext
-imap_auth_identity = ${email}
-imap_refresh_ttl = 6

modoboa_installer/scripts/files/dovecot/2.4/conf.d/10-auth.conf

@@ -0,0 +1,122 @@
+#log_debug=category=auth
+#auth_debug_passwords = yes
+##
+## Authentication processes
+##
+
+# Enable LOGIN command and all other plaintext authentications even if
+# SSL/TLS is not used (LOGINDISABLED capability). Note that if the remote IP
+# matches the local IP (ie. you're connecting from the same computer), the
+# connection is considered secure and plaintext authentication is allowed,
+# unless ssl = required.
+#auth_allow_cleartext = yes
+
+# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
+# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used.
+#auth_cache_size = 0
+# Time to live for cached data. After TTL expires the cached record is no
+# longer used, *except* if the main database lookup returns internal failure.
+# We also try to handle password changes automatically: If user's previous
+# authentication was successful, but this one wasn't, the cache isn't used.
+# For now this works only with plaintext authentication.
+#auth_cache_ttl = 1 hour
+# TTL for negative hits (user not found, password mismatch).
+# 0 disables caching them completely.
+#auth_cache_negative_ttl = 1 hour
+
+# Space separated list of realms for SASL authentication mechanisms that need
+# them. You can leave it empty if you don't want to support multiple realms.
+# Many clients simply use the first one listed here, so keep the default realm
+# first.
+#auth_realms =
+#
+# Default realm/domain to use if none was specified. This is used for both
+# SASL realms and appending @domain to username in plaintext logins.
+#auth_default_domain =
+
+# List of allowed characters in username. If the user-given username contains
+# a character not listed in here, the login automatically fails. This is just
+# an extra check to make sure user can't exploit any potential quote escaping
+# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
+# set this value to empty.
+#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
+
+# Username character translations before it's looked up from databases. The
+# value contains series of from -> to characters. For example "#@/@" means
+# that '#' and '/' characters are translated to '@'.
+#auth_username_translation =
+
+# Username formatting before it's looked up from databases.
+auth_username_format = %{user|lower}
+#auth_username_format = %{user|username|lower}
+
+# If you want to allow master users to log in by specifying the master
+# username within the normal username string (ie. not using SASL mechanism's
+# support for it), you can specify the separator character here. The format
+# is then <username><separator><master username>. UW-IMAP uses "*" as the
+# separator, so that could be a good choice.
+auth_master_user_separator = *
+
+# Username to use for users logging in with ANONYMOUS SASL mechanism
+#auth_anonymous_username = anonymous
+
+# Host name to use in GSSAPI principal names. The default is to use the
+# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab
+# entries.
+#auth_gssapi_hostname =
+
+# Kerberos keytab to use for the GSSAPI mechanism. Will use the system
+# default (usually /etc/krb5.keytab) if not specified. You may need to change
+# the auth service to run as root to be able to read this file.
+#auth_krb5_keytab = 
+
+# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
+# ntlm_auth helper. <https://doc.dovecot.org/latest/core/config/auth/mechanisms/winbind.html>
+#auth_use_winbind = no
+
+# Path for Samba's ntlm_auth helper binary.
+#auth_winbind_helper_path = /usr/bin/ntlm_auth
+
+# Time to delay before replying to failed authentications.
+#auth_failure_delay = 2 secs
+
+# Require a valid SSL client certificate or the authentication fails.
+#auth_ssl_require_client_cert = no
+
+# Take the username from client's SSL certificate, using 
+# X509_NAME_get_text_by_NID() which returns the subject's DN's
+# CommonName. 
+#auth_ssl_username_from_cert = no
+
+# Space separated list of wanted authentication mechanisms:
+#   plain login digest-md5 cram-md5 ntlm anonymous gssapi
+#   gss-spnego xoauth2 oauthbearer
+# NOTE: See also auth_allow_cleartext setting.
+auth_mechanisms = plain login oauthbearer xoauth2
+
+##
+## Password and user databases
+##
+
+#
+# Password database is used to verify user's password (and nothing more).
+# You can have multiple passdbs and userdbs. This is useful if you want to
+# allow both system users (/etc/passwd) and virtual users to login without
+# duplicating the system users into virtual database.
+#
+# <https://doc.dovecot.org/latest/core/config/auth/passdb.html>
+#
+# User database specifies where mails are located and what user/group IDs
+# own them. For single-UID configuration use "static" userdb.
+#
+# <https://doc.dovecot.org/latest/core/config/auth/userdb.html>
+
+#!include auth-deny.conf.ext
+!include auth-master.conf.ext
+!include auth-oauth2.conf.ext
+
+#!include auth-system.conf.ext
+!include auth-sql.conf.ext
+#!include auth-ldap.conf.ext
+#!include auth-passwdfile.conf.ext
+#!include auth-static.conf.ext

modoboa_installer/scripts/files/dovecot/2.4/conf.d/10-mail.conf.tpl

@@ -0,0 +1,417 @@
+##
+## Mailbox locations and namespaces
+##
+
+# Location for users' mailboxes. The default is empty, which means that Dovecot
+# tries to find the mailboxes automatically. This won't work if the user
+# doesn't yet have any mail, so you should explicitly tell Dovecot the full
+# location.
+#
+# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%%u)
+# isn't enough. You'll also need to tell Dovecot where the other mailboxes are
+# kept. This is called the "root mail directory", and it must be the first
+# path given in the mail_location setting.
+#
+# There are a few special variables you can use, eg.:
+#
+#   %%{user} - username
+#   %%{user|username} - user part in user@domain, same as %%u if there's no domain
+#   %%{user|domain} - domain part in user@domain, empty if there's no domain
+#   %%{home} - home directory
+#
+# See https://doc.dovecot.org/latest/core/settings/variables.html for full list
+# of variables.
+#
+# Example:
+#  mail_driver = maildir
+#  mail_path = ~/Maildir
+#  mail_inbox_path = ~/Maildir/.INBOX
+#
+
+# Debian defaults
+# Note that upstream considers mbox deprecated and strongly recommends
+# against its use in production environments. See further information
+# at
+# https://doc.dovecot.org/2.4.0/core/config/mailbox/formats/mbox.html
+# mail_driver = mbox
+# mail_home = /home/%%{user|username}
+# mail_path = %%{home}/mail
+# mail_inbox_path = /var/mail/%%{user}
+mail_driver = maildir
+mail_home = %{home_dir}/%%{user|domain}/%%{user|username}
+mail_path = %%{home}/Maildir
+
+# If you need to set multiple mailbox locations or want to change default
+# namespace settings, you can do it by defining namespace sections.
+#
+# You can have private, shared and public namespaces. Private namespaces
+# are for user's personal mails. Shared namespaces are for accessing other
+# users' mailboxes that have been shared. Public namespaces are for shared
+# mailboxes that are managed by sysadmin. If you create any shared or public
+# namespaces you'll typically want to enable ACL plugin also, otherwise all
+# users can access all the shared mailboxes, assuming they have permissions
+# on filesystem level to do so.
+namespace inbox {
+  # Namespace type: private, shared or public
+  #type = private
+
+  # Hierarchy separator to use. You should use the same separator for all
+  # namespaces or some clients get confused. '/' is usually a good one.
+  # The default however depends on the underlying mail storage format.
+  #separator = 
+
+  # Prefix required to access this namespace. This needs to be different for
+  # all namespaces. For example "Public/".
+  #prefix = 
+
+  # Physical location of the mailbox. This is in same format as
+  # mail location, which is also the default for it.
+  # mail_driver = 
+  # mail_path = 
+  #
+  # There can be only one INBOX, and this setting defines which namespace
+  # has it.
+  inbox = yes
+
+  # If namespace is hidden, it's not advertised to clients via NAMESPACE
+  # extension. You'll most likely also want to set list=no. This is mostly
+  # useful when converting from another server with different namespaces which
+  # you want to deprecate but still keep working. For example you can create
+  # hidden namespaces with prefixes "~/mail/", "~%%u/mail/" and "mail/".
+  #hidden = no
+
+  # Show the mailboxes under this namespace with LIST command. This makes the
+  # namespace visible for clients that don't support NAMESPACE extension.
+  # "children" value lists child mailboxes, but hides the namespace prefix.
+  #list = yes
+
+  # Namespace handles its own subscriptions. If set to "no", the parent
+  # namespace handles them (empty prefix should always have this as "yes")
+  #subscriptions = yes
+
+  # See 15-mailboxes.conf for definitions of special mailboxes.
+}
+
+# Example shared namespace configuration
+#namespace shared {
+  #type = shared
+  #separator = /
+
+  # Mailboxes are visible under "shared/user@domain/"
+  # $user, $domain and $username are expanded to the destination user.
+  #prefix = shared/$user/
+
+  # Mail location for other users' mailboxes. Note that %%{variables} and ~/
+  # expands to the logged in user's data. %%{owner_user} and %%{owner_home}
+  # destination user's data.
+  #mail_driver = maildir
+  #mail_path = %%{owner_home}/Maildir
+  #mail_index_path = ~/Maildir/shared/%%{owner_user}
+
+  # Use the default namespace for saving subscriptions.
+  #subscriptions = no
+
+  # List the shared/ namespace only if there are visible shared mailboxes.
+  #list = children
+#}
+# Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"?
+#mail_shared_explicit_inbox = no
+
+# System user and group used to access mails. If you use multiple, userdb
+# can override these by returning uid or gid fields. You can use either numbers
+# or names. <https://doc.dovecot.org/latest/core/config/system_users.html#uids>
+#mail_uid =
+#mail_gid =
+
+#  Group to enable temporarily for privileged operations. Currently this is
+# used only with INBOX when either its initial creation or dotlocking fails.
+# Typically this is set to "mail" to give access to /var/mail.
+mail_privileged_group = mail
+
+# Grant access to these supplementary groups for mail processes. Typically
+# these are used to set up access to shared mailboxes. Note that it may be
+# dangerous to set these if users can create symlinks (e.g. if "mail" group is
+# set here, ln -s /var/mail ~/mail/var could allow a user to delete others'
+# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it).
+#mail_access_groups =
+
+# Allow full filesystem access to clients. There's no access checks other than
+# what the operating system does for the active UID/GID. It works with both
+# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/
+# or ~user/.
+#mail_full_filesystem_access = no
+
+# Dictionary for key=value mailbox attributes. This is used for example by
+# URLAUTH and METADATA extensions.
+#mail_attribute {
+#  dict file {
+#    path = %%{home}/Maildir/dovecot-attributes
+#  }
+#}
+
+# A comment or note that is associated with the server. This value is
+# accessible for authenticated users through the IMAP METADATA server
+# entry "/shared/comment". 
+#mail_server_comment = ""
+
+# Indicates a method for contacting the server administrator. According to
+# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that
+# is currently not enforced. Use for example mailto:admin@example.com. This
+# value is accessible for authenticated users through the IMAP METADATA server
+# entry "/shared/admin".
+#mail_server_admin = 
+
+##
+## Mail processes
+##
+
+# Don't use mmap() at all. This is required if you store indexes to shared
+# filesystems (NFS or clustered filesystem).
+#mmap_disable = no
+
+# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL
+# since version 3, so this should be safe to use nowadays by default.
+#dotlock_use_excl = yes
+
+# When to use fsync() or fdatasync() calls:
+#   optimized (default): Whenever necessary to avoid losing important data
+#   always: Useful with e.g. NFS when write()s are delayed
+#   never: Never use it (best performance, but crashes can lose data)
+#mail_fsync = optimized
+
+# Locking method for index files. Alternatives are fcntl, flock and dotlock.
+# Dotlocking uses some tricks which may create more disk I/O than other locking
+# methods. NFS users: flock doesn't work, remember to change mmap_disable.
+#lock_method = fcntl
+
+# Directory where mails can be temporarily stored. Usually it's used only for
+# mails larger than >= 128 kB. It's used by various parts of Dovecot, for
+# example LDA/LMTP while delivering large mails or zlib plugin for keeping
+# uncompressed mails.
+#mail_temp_dir = /tmp
+
+# Valid UID range for users, defaults to 500 and above. This is mostly
+# to make sure that users can't log in as daemons or other system users.
+# Note that denying root logins is hardcoded to dovecot binary and can't
+# be done even if first_valid_uid is set to 0.
+#first_valid_uid = 500
+#last_valid_uid = 0
+
+# Valid GID range for users, defaults to non-root/wheel. Users having
+# non-valid GID as primary group ID aren't allowed to log in. If user
+# belongs to supplementary groups with non-valid GIDs, those groups are
+# not set.
+#first_valid_gid = 1
+#last_valid_gid = 0
+
+# Maximum allowed length for mail keyword name. It's only forced when trying
+# to create new keywords.
+#mail_max_keyword_length = 50
+
+# ':' separated list of directories under which chrooting is allowed for mail
+# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too).
+# This setting doesn't affect login_chroot, mail_chroot or auth chroot
+# settings. If this setting is empty, "/./" in home dirs are ignored.
+# WARNING: Never add directories here which local users can modify, that
+# may lead to root exploit. Usually this should be done only if you don't
+# allow shell access for users. <doc/wiki/Chrooting.txt>
+#valid_chroot_dirs = 
+
+# Default chroot directory for mail processes. This can be overridden for
+# specific users in user database by giving /./ in user's home directory
+# (eg. /home/./user chroots into /home). Note that usually there is no real
+# need to do chrooting, Dovecot doesn't allow users to access files outside
+# their mail directory anyway. If your home directories are prefixed with
+# the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt>
+#mail_chroot = 
+
+# UNIX socket path to master authentication server to find users.
+# This is used by imap (for shared users) and lda.
+#auth_socket_path = /var/run/dovecot/auth-userdb
+
+# Directory where to look up mail plugins.
+#mail_plugin_dir = /usr/lib/dovecot
+
+# Space separated list of plugins to load for all services. Plugins specific to
+# IMAP, LDA, etc. are added to this list in their own .conf files.
+#mail_plugins =
+#
+# To add plugins, use
+#mail_plugins {
+#  plugin = yes
+#}
+mail_plugins {
+  quota = yes
+  quota_clone = yes
+}
+
+##
+## Mailbox handling optimizations
+##
+
+# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are
+# also required for IMAP NOTIFY extension to be enabled.
+#mailbox_list_index = yes
+
+# Trust mailbox list index to be up-to-date. This reduces disk I/O at the cost
+# of potentially returning out-of-date results after e.g. server crashes.
+# The results will be automatically fixed once the folders are opened.
+#mailbox_list_index_very_dirty_syncs = yes
+
+# Should INBOX be kept up-to-date in the mailbox list index? By default it's
+# not, because most of the mailbox accesses will open INBOX anyway.
+#mailbox_list_index_include_inbox = no
+
+# The minimum number of mails in a mailbox before updates are done to cache
+# file. This allows optimizing Dovecot's behavior to do less disk writes at
+# the cost of more disk reads.
+#mail_cache_min_mail_count = 0
+
+# When IDLE command is running, mailbox is checked once in a while to see if
+# there are any new mails or other changes. This setting defines the minimum
+# time to wait between those checks. Dovecot can also use inotify and
+# kqueue to find out immediately when changes occur.
+#mailbox_idle_check_interval = 30 secs
+
+# Save mails with CR+LF instead of plain LF. This makes sending those mails
+# take less CPU, especially with sendfile() syscall with Linux and FreeBSD.
+# But it also creates a bit more disk I/O which may just make it slower.
+# Also note that if other software reads the mboxes/maildirs, they may handle
+# the extra CRs wrong and cause problems.
+#mail_save_crlf = no
+
+# Max number of mails to keep open and prefetch to memory. This only works with
+# some mailbox formats and/or operating systems.
+#mail_prefetch_count = 0
+
+# How often to scan for stale temporary files and delete them (0 = never).
+# These should exist only after Dovecot dies in the middle of saving mails.
+#mail_temp_scan_interval = 1w
+
+# How many slow mail accesses sorting can perform before it returns failure.
+# With IMAP the reply is: NO [LIMIT] Requested sort would have taken too long.
+# The untagged SORT reply is still returned, but it's likely not correct.
+#mail_sort_max_read_count = 0
+
+protocol !indexer-worker {
+  # If folder vsize calculation requires opening more than this many mails from
+  # disk (i.e. mail sizes aren't in cache already), return failure and finish
+  # the calculation via indexer process. Disabled by default. This setting must
+  # be 0 for indexer-worker processes.
+  #mail_vsize_bg_after_count = 0
+}
+
+##
+## Maildir-specific settings
+##
+
+# By default LIST command returns all entries in maildir beginning with a dot.
+# Enabling this option makes Dovecot return only entries which are directories.
+# This is done by stat()ing each entry, so it causes more disk I/O.
+# (For systems setting struct dirent->d_type, this check is free and it's
+# done always regardless of this setting)
+#maildir_stat_dirs = no
+
+# When copying a message, do it with hard links whenever possible. This makes
+# the performance much better, and it's unlikely to have any side effects.
+#maildir_copy_with_hardlinks = yes
+
+# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only
+# when its mtime changes unexpectedly or when we can't find the mail otherwise.
+#maildir_very_dirty_syncs = no
+
+# If enabled, Dovecot doesn't use the S=<size> in the Maildir filenames for
+# getting the mail's physical size, except when recalculating Maildir++ quota.
+# This can be useful in systems where a lot of the Maildir filenames have a
+# broken size. The performance hit for enabling this is very small.
+#maildir_broken_filename_sizes = no
+
+# Always move mails from new/ directory to cur/, even when the \Recent flags
+# aren't being reset.
+#maildir_empty_new = no
+
+##
+## mbox-specific settings
+##
+
+# Which locking methods to use for locking mbox. There are four available:
+#  dotlock: Create <mailbox>.lock file. This is the oldest and most NFS-safe
+#           solution. If you want to use /var/mail/ like directory, the users
+#           will need write access to that directory.
+#  dotlock_try: Same as dotlock, but if it fails because of permissions or
+#               because there isn't enough disk space, just skip it.
+#  fcntl  : Use this if possible. Works with NFS too if lockd is used.
+#  flock  : May not exist in all systems. Doesn't work with NFS.
+#  lockf  : May not exist in all systems. Doesn't work with NFS.
+#
+# You can use multiple locking methods; if you do the order they're declared
+# in is important to avoid deadlocks if other MTAs/MUAs are using multiple
+# locking methods as well. Some operating systems don't allow using some of
+# them simultaneously.
+#mbox_read_locks = fcntl
+#mbox_write_locks = dotlock fcntl
+
+# Maximum time to wait for lock (all of them) before aborting.
+#mbox_lock_timeout = 5 mins
+
+# If dotlock exists but the mailbox isn't modified in any way, override the
+# lock file after this much time.
+#mbox_dotlock_change_timeout = 2 mins
+
+# When mbox changes unexpectedly we have to fully read it to find out what
+# changed. If the mbox is large this can take a long time. Since the change
+# is usually just a newly appended mail, it'd be faster to simply read the
+# new mails. If this setting is enabled, Dovecot does this but still safely
+# fallbacks to re-reading the whole mbox file whenever something in mbox isn't
+# how it's expected to be. The only real downside to this setting is that if
+# some other MUA changes message flags, Dovecot doesn't notice it immediately.
+# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK 
+# commands.
+#mbox_dirty_syncs = yes
+
+# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE,
+# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored.
+#mbox_very_dirty_syncs = no
+
+# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK
+# commands and when closing the mailbox). This is especially useful for POP3
+# where clients often delete all mails. The downside is that our changes
+# aren't immediately visible to other MUAs.
+#mbox_lazy_writes = yes
+
+# If mbox size is smaller than this (e.g. 100k), don't write index files.
+# If an index file already exists it's still read, just not updated.
+#mbox_min_index_size = 0
+
+# Mail header selection algorithm to use for MD5 POP3 UIDLs when
+# pop3_uidl_format=%%m. For backwards compatibility we use apop3d inspired
+# algorithm, but it fails if the first Received: header isn't unique in all
+# mails. An alternative algorithm is "all" that selects all headers.
+#mbox_md5 = apop3d
+
+##
+## mdbox-specific settings
+##
+
+# Maximum dbox file size until it's rotated.
+#mdbox_rotate_size = 10M
+
+# Maximum dbox file age until it's rotated. Typically in days. Day begins
+# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled.
+#mdbox_rotate_interval = 0
+
+# When creating new mdbox files, immediately preallocate their size to
+# mdbox_rotate_size. This setting currently works only in Linux with some
+# filesystems (ext4, xfs).
+#mdbox_preallocate_space = no
+
+# Settings to control adding $HasAttachment or $HasNoAttachment keywords.
+# By default, all MIME parts with Content-Disposition=attachment, or inlines
+# with filename parameter are consired attachments.
+#   add-flags - Add the keywords when saving new mails or when fetching can
+#      do it efficiently.
+#   content-type=type or !type - Include/exclude content type. Excluding will
+#     never consider the matched MIME part as attachment. Including will only
+#     negate an exclusion (e.g. content-type=!foo/* content-type=foo/bar).
+#   exclude-inlined - Exclude any Content-Disposition=inline MIME part.
+#mail_attachment_detection_options =

modoboa_installer/scripts/files/dovecot/2.4/conf.d/10-master.conf.tpl

@@ -0,0 +1,174 @@
+#default_process_limit = 100
+#default_client_limit = 1000
+
+# Default VSZ (virtual memory size) limit for service processes. This is mainly
+# intended to catch and kill processes that leak memory before they eat up
+# everything.
+#default_vsz_limit = 256M
+
+# Login user is internally used by login processes. This is the most untrusted
+# user in Dovecot system. It shouldn't have access to anything at all.
+#default_login_user = dovenull
+
+# Internal user is used by unprivileged processes. It should be separate from
+# login user, so that login processes can't disturb other processes.
+#default_internal_user = dovecot
+
+service imap-login {
+  inet_listener imap {
+    #port = 143
+  }
+  inet_listener imaps {
+    #port = 993
+    #ssl = yes
+  }
+
+  # Number of connections to handle before starting a new process. Typically
+  # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
+  # is faster. <d>
+  #service_restart_request_count = 1
+
+  # Number of processes to always keep waiting for more connections.
+  #process_min_avail = 0
+
+  # If you set service_restart_request_count=0, you probably need to grow this.
+  #vsz_limit = 256M # default
+}
+
+service pop3-login {
+  inet_listener pop3 {
+    #port = 110
+  }
+  inet_listener pop3s {
+    #port = 995
+    #ssl = yes
+  }
+}
+
+service submission-login {
+  inet_listener submission {
+    #port = 587
+  }
+  inet_listener submissions {
+    #port = 465
+  }
+}
+
+service lmtp {
+  unix_listener lmtp {
+    #mode = 0666
+  }
+
+  # Create inet listener only if you can't use the above UNIX socket
+  #inet_listener lmtp {
+    # Avoid making LMTP visible for the entire internet
+    #listen = 127.0.0.1
+    #port = 24
+  #}
+
+  unix_listener /var/spool/postfix/private/dovecot-lmtp {
+    mode = 0600
+    user = postfix
+    group = postfix
+  }
+}
+
+service imap {
+  # Most of the memory goes to mmap()ing files. You may need to increase this
+  # limit if you have huge mailboxes.
+  #vsz_limit = 256M # default
+
+  # Max. number of IMAP processes (connections)
+  #process_limit = 1024
+
+  executable = imap postlogin
+}
+
+service pop3 {
+  # Max. number of POP3 processes (connections)
+  #process_limit = 1024
+  executable = imap postlogin
+}
+
+service submission {
+  # Max. number of SMTP Submission processes (connections)
+  #process_limit = 1024
+}
+
+service postlogin {
+  executable = script-login /usr/local/bin/postlogin.sh
+  user = %modoboa_user
+  unix_listener postlogin {
+  }
+}
+
+service stats {
+  # To allow modoboa to access available cipher list.
+  unix_listener stats-reader {
+    user = %{mailboxes_owner}
+    group = %{mailboxes_owner}
+    mode = 0660
+  }
+
+  unix_listener stats-writer {
+    user = %{mailboxes_owner}
+    group = %{mailboxes_owner}
+    mode = 0660
+  }
+}
+
+
+service auth {
+  # auth_socket_path points to this userdb socket by default. It's typically
+  # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
+  # full permissions to this socket are able to get a list of all usernames and
+  # get the results of everyone's userdb lookups.
+  #
+  # The default 0666 mode allows anyone to connect to the socket, but the
+  # userdb lookups will succeed only if the userdb returns an "uid" field that
+  # matches the caller process's UID. Also if caller's uid or gid matches the
+  # socket's uid or gid the lookup succeeds. Anything else causes a failure.
+  #
+  # To give the caller full permissions to lookup all users, set the mode to
+  # something else than 0666 and Dovecot lets the kernel enforce the
+  # permissions (e.g. 0777 allows everyone full permissions).
+  unix_listener auth-userdb {
+    #mode = 0666
+    user = %{mailboxes_owner}
+    #group = 
+  }
+
+  # Postfix smtp-auth
+  unix_listener /var/spool/postfix/private/auth {
+    mode = 0666
+    user = postfix
+    group = postfix
+  }
+
+  %{radicale_enabled}unix_listener auth-radicale {
+  %{radicale_enabled}  mode = 0666
+  %{radicale_enabled}  user = %{radicale_user}
+  %{radicale_enabled}  group = %{radicale_user}
+  %{radicale_enabled}  type = auth-legacy
+  %{radicale_enabled}}
+
+  # Auth process is run as this user.
+  #user = $SET:default_internal_user
+}
+
+service auth-worker {
+  # Auth worker process is run as root by default, so that it can access
+  # /etc/shadow. If this isn't necessary, the user should be changed to
+  # $SET:default_internal_user.
+  #user = root
+}
+
+service dict {
+  # If dict proxy is used, mail processes should have access to its socket.
+  # For example: mode=0660, group=vmail and global mail_access_groups=vmail
+  unix_listener dict {
+    mode = 0600
+    user = %{mailboxes_owner}
+    #group = 
+  }
+}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/10-ssl-keys.try.tpl

@@ -0,0 +1,6 @@
+# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
+# dropping root privileges, so keep the key file unreadable by anyone but
+# root. Included doc/mkcert.sh can be used to easily generate self-signed
+# certificate, just make sure to update the domains in dovecot-openssl.cnf
+ssl_server_cert_file = %tls_cert_file
+ssl_server_key_file = %tls_key_file

modoboa_installer/scripts/files/dovecot/2.4/conf.d/10-ssl.conf.tpl

@@ -0,0 +1,59 @@
+##
+## SSL settings
+##
+
+# SSL/TLS support: yes, no, required. <https://doc.dovecot.org/latest/core/config/ssl.html>
+ssl = yes
+
+# PEM encoded X.509 SSL/TLS certificate and private key.  By default, Debian
+# installs a self-signed certificate.  This is useful for testing, but you
+# should obtain a real certificate from a recognized certificate authority.
+#
+# These files are opened before dropping root privileges, so keep the key file
+# unreadable by anyone but root. Included /usr/share/dovecot/mkcert.sh can be
+# used to easily generate self-signed certificate, just make sure to update the
+# domains in dovecot-openssl.cnf
+# 
+# Preferred permissions: root:root 0444
+# ssl_server_cert_file = /etc/dovecot/private/dovecot.pem
+# Preferred permissions: root:root 0400
+# ssl_server_key_file = /etc/dovecot/private/dovecot.key
+!include_try /etc/dovecot/conf.d/10-ssl-keys.try
+
+# If key file is password protected, give the password here. Alternatively
+# give it when starting dovecot with -p parameter. Since this file is often
+# world-readable, you may want to place this setting instead to a different
+# root owned 0600 file by using ssl_key_password = <path.
+#ssl_server_key_password =
+
+# PEM encoded trusted certificate authority. Set this only if you intend to use
+# ssl_request_client_cert=yes. The file should contain the CA certificate(s)
+# followed by the matching CRL(s). (e.g. ssl_server_ca_file = /etc/ssl/certs/ca.pem)
+#ssl_server_ca_file = 
+
+# Require that CRL check succeeds for client certificates.
+#ssl_server_require_crl = yes
+
+# Request client to send a certificate. If you also want to require it, set
+# auth_ssl_require_client_cert=yes in auth section.
+#ssl_server_request_client_cert = no
+
+# Which field from certificate to use for username. commonName and
+# x500UniqueIdentifier are the usual choices. You'll also need to set
+# auth_ssl_username_from_cert=yes.
+#ssl_server_cert_username_field = commonName
+
+# SSL protocols to use.  Debian systems specify TLSv1.2 by default, which should
+# be reasonbly secure and compatible with existing clients.
+%ssl_protocol_parameter = %ssl_protocols
+
+# Diffie-Hellman parameters are no longer required and should be phased out.
+# They do not work with ECDH(E) and require DH(E) ciphers.
+#ssl_server_dh_file = /etc/dovecot/dh.pem
+
+# SSL ciphers to use
+#ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
+ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4
+
+# SSL crypto device to use, for valid values run "openssl engine"
+#ssl_crypto_device = /dev/crypto

modoboa_installer/scripts/files/dovecot/2.4/conf.d/20-imap.conf

@@ -0,0 +1,108 @@
+##
+## IMAP specific settings
+##
+
+# If nothing happens for this long while client is IDLEing, move the connection
+# to imap-hibernate process and close the old imap process. This saves memory,
+# because connections use very little memory in imap-hibernate process. The
+# downside is that recreating the imap process back uses some resources.
+#imap_hibernate_timeout = 0
+
+# Maximum IMAP command line length. Some clients generate very long command
+# lines with huge mailboxes, so you may need to raise this if you get
+# "Too long argument" or "IMAP command line too large" errors often.
+#imap_max_line_length = 64k
+
+# IMAP logout format string:
+#  %{input} - total number of bytes read from client
+#  %{output} - total number of bytes sent to client
+#  %{fetch_hdr_count} - Number of mails with mail header data sent to client
+#  %{fetch_hdr_bytes} - Number of bytes with mail header data sent to client
+#  %{fetch_body_count} - Number of mails with mail body data sent to client
+#  %{fetch_body_bytes} - Number of bytes with mail body data sent to client
+#  %{deleted} - Number of mails where client added \Deleted flag
+#  %{expunged} - Number of mails that client expunged, which does not
+#                include automatically expunged mails
+#  %{autoexpunged} - Number of mails that were automatically expunged after
+#                    client disconnected
+#  %{trashed} - Number of mails that client copied/moved to the
+#               special_use=\Trash mailbox.
+#  %{appended} - Number of mails saved during the session
+#imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} \
+#  trashed=%{trashed} hdr_count=%{fetch_hdr_count} \
+#  hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} \
+#  body_bytes=%{fetch_body_bytes}
+
+# Amend or override the IMAP capability response. To override, set the value
+# with imap_capability = 
+# 
+# To amend, you can use a boolean list to specify which capabilities to turn
+# on and off
+#imap_capability {
+#  SPECIAL-USE = yes
+#  "LITERAL+" = no
+#}
+
+# How long to wait between "OK Still here" notifications when client is
+# IDLEing.
+#imap_idle_notify_interval = 2 mins
+
+# ID field names and values to send to clients. Using * as the value makes
+# Dovecot use the default value. The following fields have default values
+# currently: name, version, os, os-version, support-url, support-email,
+# revision.
+#imap_id_send = 
+
+# Use imap_id_received event to log IMAP id
+
+# Workarounds for various client bugs:
+#   delay-newmail:
+#     Send EXISTS/RECENT new mail notifications only when replying to NOOP
+#     and CHECK commands. Some clients ignore them otherwise, for example OSX
+#     Mail (<v2.1). Outlook Express breaks more badly though, without this it
+#     may show user "Message no longer in server" errors. Note that OE6 still
+#     breaks even with this workaround if synchronization is set to
+#     "Headers Only".
+#   tb-extra-mailbox-sep:
+#     Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and
+#     adds extra '/' suffixes to mailbox names. This option causes Dovecot to
+#     ignore the extra '/' instead of treating it as invalid mailbox name.
+#   tb-lsub-flags:
+#     Show \Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox).
+#     This makes Thunderbird realize they aren't selectable and show them
+#     greyed out, instead of only later giving "not selectable" popup error.
+#
+# This is a boolean list
+#imap_client_workarounds {
+#  delay-newmail = yes
+#}
+
+# Host allowed in URLAUTH URLs sent by client. "*" allows all.
+#imap_urlauth_host =
+
+# Enable IMAP LITERAL- extension (replaces LITERAL+)
+#imap_literal_minus = no
+
+# What happens when FETCH fails due to some internal error:
+#   disconnect-immediately:
+#     The FETCH is aborted immediately and the IMAP client is disconnected.
+#   disconnect-after:
+#     The FETCH runs for all the requested mails returning as much data as
+#     possible. The client is finally disconnected without a tagged reply.
+#   no-after:
+#     Same as disconnect-after, but tagged NO reply is sent instead of
+#     disconnecting the client. If the client attempts to FETCH the same failed
+#     mail more than once, the client is disconnected. This is to avoid clients
+#     from going into infinite loops trying to FETCH a broken mail.
+#imap_fetch_failure = disconnect-immediately
+
+protocol imap {
+  # Space separated list of plugins to load (default is global mail_plugins).
+  mail_plugins {
+    quota = yes
+  }
+
+  # Maximum number of IMAP connections allowed for a user from each IP address.
+  # NOTE: The username is compared case-sensitively.
+  #mail_max_userip_connections = 10
+}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/20-lmtp.conf.tpl

@@ -0,0 +1,53 @@
+##
+#i
+## LMTP specific settings
+##
+
+# Support proxying to other LMTP/SMTP servers by performing passdb lookups.
+#lmtp_proxy = no
+
+# When recipient address includes the detail (e.g. user+detail), try to save
+# the mail to the detail mailbox. See also recipient_delimiter and
+# lda_mailbox_autocreate settings.
+#lmtp_save_to_detail_mailbox = no
+
+# Verify quota before replying to RCPT TO. This adds a small overhead.
+lmtp_rcpt_check_quota = yes
+
+# Add "Received:" header to mails delivered.
+#lmtp_add_received_header = yes
+
+# Which recipient address to use for Delivered-To: header and Received:
+# header. The default is "final", which is the same as the one given to
+# RCPT TO command. "original" uses the address given in RCPT TO's ORCPT
+# parameter, "none" uses nothing. Note that "none" is currently always used
+# when a mail has multiple recipients.
+#lmtp_hdr_delivery_address = final
+
+# Workarounds for various client bugs:
+#   whitespace-before-path:
+#     Allow one or more spaces or tabs between `MAIL FROM:' and path and between
+#     `RCPT TO:' and path.
+#   mailbox-for-path:
+#     Allow using bare Mailbox syntax (i.e., without <...>) instead of full path
+#     syntax.
+#
+#lmtp_client_workarounds {
+#  whitespace-before-path = yes
+#}
+
+protocol lmtp {
+  mail_plugins {
+    quota = yes
+    sieve = yes
+  }
+  postmaster_address = %postmaster_address
+
+  # This strips the domain name before delivery, since the default
+  # userdb in Debian is /etc/passwd, which doesn't include domain
+  # names in the user.  If you're using a different userdb backend
+  # that does include domain names, you may wish to remove this.  See
+  # https://doc.dovecot.org/2.4.0/howto/lmtp/exim.html and
+  # https://doc.dovecot.org/2.4.0/core/summaries/settings.html#auth_username_format
+  # auth_username_format = %%{user | username}
+}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/30-dict-server-mysql.conf.tpl

@@ -0,0 +1,45 @@
+##
+## Dictionary server settings
+##
+
+# Dictionary can be used to store key=value lists. This is used by several
+# plugins. The dictionary can be accessed either directly or though a
+# dictionary server. The following dict block maps dictionary names to URIs
+# when the server is used. These can then be referenced using URIs in format
+# "proxy::<name>".
+
+dict_server {
+  mysql %dbhost {
+    port = %dbport
+    dbname = %modoboa_dbname
+    user = %modoboa_dbuser
+    password = %modoboa_dbpassword
+  }
+  dict quota {
+    driver = sql
+    sql_driver = %db_driver
+    hostname = %dbhost
+
+    dict_map priv/quota/storage {
+      sql_table = admin_quota
+      username_field = username
+      value_field bytes {
+        type = uint
+      }
+    }
+
+    dict_map priv/quota/messages {
+      sql_table = admin_quota
+      username_field = username
+      value_field messages {
+        type = uint
+      }
+    }
+  }
+}
+
+quota_clone {
+  dict proxy {
+    name = quota
+  }
+}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/30-dict-server-postgres.conf.tpl

@@ -0,0 +1,47 @@
+##
+## Dictionary server settings
+##
+
+# Dictionary can be used to store key=value lists. This is used by several
+# plugins. The dictionary can be accessed either directly or though a
+# dictionary server. The following dict block maps dictionary names to URIs
+# when the server is used. These can then be referenced using URIs in format
+# "proxy::<name>".
+
+dict_server {
+  pgsql %dbhost {
+    parameters {
+      port = %dbport
+      dbname = %modoboa_dbname
+      user = %modoboa_dbuser
+      password = %modoboa_dbpassword
+    }
+  }
+  dict quota {
+    driver = sql
+    sql_driver = %db_driver
+    hostname = %dbhost
+
+    dict_map priv/quota/storage {
+      sql_table = admin_quota
+      username_field = username
+      value_field bytes {
+        type = uint
+      }
+    }
+
+    dict_map priv/quota/messages {
+      sql_table = admin_quota
+      username_field = username
+      value_field messages {
+        type = uint
+      }
+    }
+  }
+}
+
+quota_clone {
+  dict proxy {
+    name = quota
+  }
+}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/90-quota.conf

@@ -0,0 +1,79 @@
+##
+## Quota configuration.
+##
+
+# Note that you also have to enable quota plugin in mail_plugins setting.
+## <https://doc.dovecot.org/latest/core/plugins/quota.html>
+
+##
+## Quota limits
+##
+
+# Quota limits are set using "quota_rule" parameters. To get per-user quota
+# limits, you can set/override them by returning "quota_rule" extra field
+# from userdb. It's also possible to give mailbox-specific limits, for example
+# to give additional 100 MB when saving to Trash:
+
+#mail_plugins {
+#  quota = yes
+#}
+
+quota "User quota" {
+#   storage_size = 1G
+}
+#
+#namespace inbox {
+#   mailbox Trash {
+#     quota_storage_extra = 100M
+#   }
+#}
+
+##
+## Quota warnings
+##
+
+# You can execute a given command when user exceeds a specified quota limit.
+# Each quota root has separate limits. Only the command for the first
+# exceeded limit is excecuted, so put the highest limit first.
+# The commands are executed via script service by connecting to the named
+# UNIX socket (quota-warning below).
+# Note that % needs to be escaped as %%, otherwise "% " expands to empty.
+
+#quota "User quota" {
+#  warning warn-95 {
+#    quota_storage_percentage = 95
+#    execute quota-warning {
+#      args = 95 %{user}
+#    }
+#  }
+#  warning warn-80 {
+#    quota_storage_percentage = 80
+#    execute quota-warning {
+#      args = 80 %{user}
+#    }
+#  }
+#}
+
+# Example quota-warning service. The unix listener's permissions should be
+# set in a way that mail processes can connect to it. Below example assumes
+# that mail processes run as vmail user. If you use mode=0666, all system users
+# can generate quota warnings to anyone.
+#service quota-warning {
+#  executable = script /usr/local/bin/quota-warning.sh
+#  user = dovecot
+#  unix_listener quota-warning {
+#    user = vmail
+#  }
+#}
+
+##
+## Quota backends
+##
+
+# Multiple backends are supported:
+#   count: Default and recommended, quota driver tracks the quota internally within Dovecot's index files.
+#   maildir: Maildir++ quota
+#   fs: Read-only support for filesystem quota
+#quota "User quota" {
+#  driver = count
+#}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/90-sieve.conf.tpl

@@ -0,0 +1,118 @@
+##
+## Settings for the Sieve interpreter
+##
+
+# Do not forget to enable the Sieve plugin in 15-lda.conf and 20-lmtp.conf
+# by adding it to the respective mail_plugins { sieve = yes } settings.
+
+# See https://doc.dovecot.org/latest/core/plugins/sieve.html
+
+# Personal sieve script location
+#sieve_script personal {
+#  driver = file
+#  path = ~/sieve
+#  active_path = ~/.dovecot.sieve
+#}
+
+# Default sieve script location
+#sieve_script default {
+#  type = default
+#  name = default
+#  driver = file
+#  path = /etc/dovecot/sieve/default/
+#}
+
+%{do_move_spam_to_junk}sieve_script after {
+%{do_move_spam_to_junk}  type = after
+%{do_move_spam_to_junk}  path = /etc/dovecot/conf.d/custom_after_sieve
+%{do_move_spam_to_junk}}
+
+
+# Which Sieve language extensions are available to users. By default, all
+# supported extensions are available, except for deprecated extensions or
+# those that are still under development. Some system administrators may want
+# to disable certain Sieve extensions or enable those that are not available
+# by default. This setting can use 'yes' and 'no' to specify differences relative
+# to the default. For example `imapflags = yes' will enable the
+# deprecated imapflags extension in addition to all extensions were already
+# enabled by default.
+#sieve_extensions {
+#  mboxmetadata = yes
+#  vnd.dovecot.debug = yes
+#}
+
+# Which Sieve language extensions are ONLY available in global scripts. This
+# can be used to restrict the use of certain Sieve extensions to administrator
+# control, for instance when these extensions can cause security concerns.
+# This setting has higher precedence than the `sieve_extensions' setting
+# (above), meaning that the extensions enabled with this setting are never
+# available to the user's personal script no matter what is specified for the
+# `sieve_extensions' setting. The syntax of this setting is similar to the
+# `sieve_extensions' setting, with the difference that extensions are
+# enabled or disabled for exclusive use in global scripts. Currently, no
+# extensions are marked as such by default.
+#sieve_global_extensions =
+
+# The Pigeonhole Sieve interpreter can have plugins of its own. Using this
+# setting, the used plugins can be specified. Check the Dovecot documentation
+# https://doc.dovecot.org/latest/core/plugins/sieve.html
+
+#sieve_plugins = sieve_imapsieve sieve_extprograms
+#sieve_pipe_bin_dir    = /usr/share/dovecot-pigeonhole/sieve
+#sieve_execute_bin_dir = /usr/share/dovecot-pigeonhole/sieve
+#sieve_global_extensions {
+#  vnd.dovecot.pipe = yes
+#  vnd.dovecot.execute = yes
+#}
+#imapsieve_url = 
+
+# The separator that is expected between the :user and :detail
+# address parts introduced by the subaddress extension. This may
+# also be a sequence of characters (e.g. '--'). The current
+# implementation looks for the separator from the left of the
+# localpart and uses the first one encountered. The :user part is
+# left of the separator and the :detail part is right. This setting
+# is also used by Dovecot's LMTP service.
+#recipient_delimiter = +-_
+
+# The maximum size of a Sieve script. The compiler will refuse to compile any
+# script larger than this limit. If set to 0, no limit on the script size is
+# enforced.
+#sieve_max_script_size = 1M
+
+# The maximum number of actions that can be performed during a single script
+# execution. If set to 0, no limit on the total number of actions is enforced.
+#sieve_max_actions = 32
+
+# The maximum number of redirect actions that can be performed during a single
+# script execution. If set to 0, no redirect actions are allowed.
+#sieve_max_redirects = 4
+
+# The maximum number of personal Sieve scripts a single user can have. If set
+# to 0, no limit on the number of scripts is enforced.
+# (Currently only relevant for ManageSieve)
+#sieve_quota_script_count = 0
+
+# The maximum amount of disk storage a single user's scripts may occupy. If
+# set to 0, no limit on the used amount of disk storage is enforced.
+# (Currently only relevant for ManageSieve)
+#sieve_quota_storage_size = 0
+
+
+#mailbox Spam {
+## From elsewhere to Spam folder
+#  sieve_script report-spam {
+#    type = before
+#    cause = copy
+#    path = /etc/dovecot/report-spam.sieve
+#  }
+#}
+
+## From Spam folder to elsewhere
+#imapsieve_from Spam {
+#  sieve_script report-ham {
+#    type = before
+#    cause = copy
+#    path = /etc/dovecot/report-ham.sieve
+#  }
+#}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/auth-master-mysql.conf.ext.tpl

@@ -0,0 +1,28 @@
+# Authentication for master users. Included from auth.conf.
+
+# By adding master=yes setting inside a passdb you make the passdb a list
+# of "master users", who can log in as anyone else.
+# <https://doc.dovecot.org/latest/core/config/auth/master_users.html>
+
+# Example master user passdb using passwd-file. You can use any passdb though.
+#passdb master-passwd-file {
+#  driver = passwd-file
+#  master = yes
+#  passwd_file_path = /etc/dovecot/master-users
+#}
+
+sql_driver = %db_driver
+
+mysql %dbhost {
+  port = %dbport
+  dbname = %modoboa_dbname
+  user = %modoboa_dbuser
+  password = %modoboa_dbpassword
+}
+
+passdb db1 {
+  driver = sql
+  sql_query = SELECT email AS user, password FROM core_user WHERE email='%%{user}' and is_active=1 and master_user=1
+  master = yes
+  result_success = continue
+}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/auth-master-postgres.conf.ext.tpl

@@ -0,0 +1,30 @@
+# Authentication for master users. Included from auth.conf.
+
+# By adding master=yes setting inside a passdb you make the passdb a list
+# of "master users", who can log in as anyone else.
+# <https://doc.dovecot.org/latest/core/config/auth/master_users.html>
+
+# Example master user passdb using passwd-file. You can use any passdb though.
+#passdb master-passwd-file {
+#  driver = passwd-file
+#  master = yes
+#  passwd_file_path = /etc/dovecot/master-users
+#}
+
+sql_driver = %db_driver
+
+pgsql %dbhost {
+  parameters {
+    port = %dbport
+    dbname = %modoboa_dbname
+    user = %modoboa_dbuser
+    password = %modoboa_dbpassword
+  }
+}
+
+passdb db1 {
+  driver = sql
+  sql_query = SELECT email AS user, password FROM core_user WHERE email='%%{user}' and is_active and master_user
+  master = yes
+  result_success = continue
+}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/auth-oauth2.conf.ext.tpl

@@ -0,0 +1,24 @@
+auth_mechanisms {
+  xoauth2 = yes
+  oauthbearer = yes
+}
+
+oauth2 {
+  introspection_mode = post
+  introspection_url = %{oauth2_introspection_url}
+  #force_introspection = yes
+  username_attribute = username
+}
+
+# with local validation
+#oauth2 {
+#  introspection_mode = local
+#  username_attribute = email
+#  oauth2_local_validation {
+#    dict fs {
+#      fs posix {
+#        prefix = /etc/dovecot/oauth2-keys/
+#      }
+#    }
+#  }
+#}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/auth-sql-mysql.conf.ext.tpl

@@ -0,0 +1,195 @@
+# Authentication for SQL users. Included from auth.conf.
+#
+# <https://doc.dovecot.org/latest/core/config/auth/databases/sql.html>
+
+# For the sql passdb module, you'll need a database with a table that
+# contains fields for at least the username and password. If you want to
+# use the user@domain syntax, you might want to have a separate domain
+# field as well.
+#
+# If your users all have the same uig/gid, and have predictable home
+# directories, you can use the static userdb module to generate the home
+# dir based on the username and domain. In this case, you won't need fields
+# for home, uid, or gid in the database.
+#
+# If you prefer to use the sql userdb module, you'll want to add fields
+# for home, uid, and gid. Here is an example table:
+#
+# CREATE TABLE users (
+#     username VARCHAR(128) NOT NULL,
+#     domain VARCHAR(128) NOT NULL,
+#     password VARCHAR(64) NOT NULL,
+#     home VARCHAR(255) NOT NULL,
+#     uid INTEGER NOT NULL,
+#     gid INTEGER NOT NULL,
+#     active CHAR(1) DEFAULT 'Y' NOT NULL
+# );
+
+# Database driver: mysql, pgsql, sqlite
+sql_driver = %db_driver
+
+# Database connection string. This is driver-specific setting.
+#
+# HA / round-robin load-balancing is supported by giving multiple host
+# settings, like: host=sql1.host.org host=sql2.host.org
+#
+# pgsql:
+#   For available options, see the PostgreSQL documention for the
+#   PQconnectdb function of libpq.
+#   Use maxconns=n (default 5) to change how many connections Dovecot can
+#   create to pgsql.
+#
+# mysql:
+#   Basic options emulate PostgreSQL option names:
+#     host, port, user, password, dbname
+#
+#   But also adds some new settings:
+#     client_flags        - See MySQL manual
+#     ssl_ca, ssl_ca_path - Set either one or both to enable SSL
+#     ssl_cert, ssl_key   - For sending client-side certificates to server
+#     ssl_cipher          - Set minimum allowed cipher security (default: HIGH)
+#     option_file         - Read options from the given file instead of
+#                           the default my.cnf location
+#     option_group        - Read options from the given group (default: client)
+# 
+#   You can connect to UNIX sockets by using host: host=/var/run/mysql.sock
+#   Note that currently you can't use spaces in parameters.
+#
+# sqlite:
+#   The path to the database file.
+#
+# Examples:
+# mysql 192.168.1.1 {
+#   dbname = users
+# }
+# mysql sql.example.com {
+#   ssl = yes
+#   user = virtual
+#   password = blarg
+#   dbname = virtual
+# }
+# sqlite /etc/dovecot/authdb.sqlite {
+# }
+#
+#mysql /var/run/mysqld/mysqld.sock {
+#  user = dovecot
+#  password = dvmail
+#  dbname = dovecot
+#}
+#mysql localhost {
+# ...
+#}
+mysql %dbhost {
+  port = %dbport
+  dbname = %modoboa_dbname
+  user = %modoboa_dbuser
+  password = %modoboa_dbpassword
+}
+
+#passdb sql {
+#  default_password_scheme = SHA256
+
+# passdb query to retrieve the password. It can return fields:
+#   password - The user's password. This field must be returned.
+#   user - user@domain from the database. Needed with case-insensitive lookups.
+#   username and domain - An alternative way to represent the "user" field.
+#
+# The "user" field is often necessary with case-insensitive lookups to avoid
+# e.g. "name" and "nAme" logins creating two different mail directories. If
+# your user and domain names are in separate fields, you can return "username"
+# and "domain" fields instead of "user".
+#
+# The query can also return other fields which have a special meaning, see
+# https://doc.dovecot.org/latest/core/config/auth/passdb.html#extra-fields
+#
+# Commonly used available substitutions (see https://doc.dovecot.org/latest/core/settings/variables.html
+# for full list):
+#   %%{user} = entire user@domain
+#   %%{user|username} = user part of user@domain
+#   %%{user|domain} = domain part of user@domain
+# 
+# Note that these can be used only as input to SQL query. If the query outputs
+# any of these substitutions, they're not touched. Otherwise it would be
+# difficult to have eg. usernames containing '%%' characters.
+#
+# Example:
+#   query = SELECT userid AS user, pw AS password \
+#     FROM users WHERE userid = '%%u' AND active = 'Y'
+#
+#  query = \
+#    SELECT userid as username, domain, password \
+#    FROM users WHERE userid = '%%{user|username}' AND domain = '%%{user|domain}'
+#}
+
+passdb sql {
+  query = SELECT email AS user, password FROM core_user u INNER JOIN admin_mailbox mb ON u.id=mb.user_id INNER JOIN admin_domain dom ON mb.domain_id=dom.id WHERE (mb.is_send_only=0 OR '%%{protocol}' NOT IN ('imap', 'pop3')) AND u.email='%%{user}' AND u.is_active=1 AND dom.enabled=1
+}
+
+#userdb sql {
+# userdb query to retrieve the user information. It can return fields:
+#   uid - System UID (overrides mail_uid setting)
+#   gid - System GID (overrides mail_gid setting)
+#   home - Home directory
+#   mail_driver - Mail driver
+#   mail_path - Mail storage path
+#
+# None of these are strictly required. If you use a single UID and GID, and
+# home or mail directory fits to a template string, you could use userdb static
+# instead. For a list of all fields that can be returned, see
+# Examples:
+#   query = SELECT home, uid, gid FROM users WHERE userid = '%%{user}'
+#   query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%%{user}'
+#   query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%%{user}'
+#
+#  query = \
+#    SELECT home, uid, gid \
+#    FROM users WHERE userid = '%%{user|username}' AND domain = '%%{user|domain}'
+
+# Query to get a list of all usernames.
+#  iterate_query = SELECT username AS user,domain FROM users
+
+#  userdb_ldap {
+#    iterate_fields {
+#      home = /var/vmail/%%{home}
+#    }
+#  }
+#}
+
+userdb sql {
+  query = SELECT '%{home_dir}/%%{user|domain}/%%{user|username}' AS home, %mailboxes_owner_uid as uid, %mailboxes_owner_gid as gid, CONCAT(mb.quota, 'M') AS quota_storage_size FROM admin_mailbox mb INNER JOIN admin_domain dom ON mb.domain_id=dom.id INNER JOIN core_user u ON u.id=mb.user_id WHERE (mb.is_send_only=0 OR '%%{protocol}' NOT IN ('imap', 'pop3', 'lmtp')) AND mb.address='%%{user|username}' AND dom.name='%%{user|domain}'
+  iterate_query = SELECT email AS user FROM core_user
+}
+
+#passdb static {
+#  fields {
+#    user=%%{user|username|lower}
+#    noauthenticate=yes
+#  }
+## you can remove next line if you want to always normalize your usernames
+#  skip = authenticated
+#}
+
+# "prefetch" user database means that the passdb already provided the
+# needed information and there's no need to do a separate userdb lookup.
+# <https://doc.dovecot.org/latest/core/config/auth/databases/prefetch.html>
+#userdb prefetch {
+#}
+
+#userdb static {
+#  fields {
+#    user=%%{user|lower}
+#  }
+# you can remove next line if you want to always normalize your usernames
+#  skip = found
+#}
+
+# If you don't have any user-specific settings, you can avoid the user_query
+# by using userdb static instead of userdb sql, for example:
+# <https://doc.dovecot.org/latest/core/config/auth/databases/static.html>
+#userdb static {
+  #fields {
+  #  uid = vmail
+  #  gid = vmail
+  #  home = /var/vmail/%%{user}
+  #}
+#}

modoboa_installer/scripts/files/dovecot/2.4/conf.d/auth-sql-postgres.conf.ext.tpl

@@ -0,0 +1,195 @@
+# Authentication for SQL users. Included from auth.conf.
+#
+# <https://doc.dovecot.org/latest/core/config/auth/databases/sql.html>
+
+# For the sql passdb module, you'll need a database with a table that
+# contains fields for at least the username and password. If you want to
+# use the user@domain syntax, you might want to have a separate domain
+# field as well.
+#
+# If your users all have the same uig/gid, and have predictable home
+# directories, you can use the static userdb module to generate the home
+# dir based on the username and domain. In this case, you won't need fields
+# for home, uid, or gid in the database.
+#
+# If you prefer to use the sql userdb module, you'll want to add fields
+# for home, uid, and gid. Here is an example table:
+#
+# CREATE TABLE users (
+#     username VARCHAR(128) NOT NULL,
+#     domain VARCHAR(128) NOT NULL,
+#     password VARCHAR(64) NOT NULL,
+#     home VARCHAR(255) NOT NULL,
+#     uid INTEGER NOT NULL,
+#     gid INTEGER NOT NULL,
+#     active CHAR(1) DEFAULT 'Y' NOT NULL
+# );
+
+# Database driver: mysql, pgsql, sqlite
+sql_driver = %db_driver
+
+# Database connection string. This is driver-specific setting.
+#
+# HA / round-robin load-balancing is supported by giving multiple host
+# settings, like: host=sql1.host.org host=sql2.host.org
+#
+# pgsql:
+#   For available options, see the PostgreSQL documention for the
+#   PQconnectdb function of libpq.
+#   Use maxconns=n (default 5) to change how many connections Dovecot can
+#   create to pgsql.
+#
+# mysql:
+#   Basic options emulate PostgreSQL option names:
+#     host, port, user, password, dbname
+#
+#   But also adds some new settings:
+#     client_flags        - See MySQL manual
+#     ssl_ca, ssl_ca_path - Set either one or both to enable SSL
+#     ssl_cert, ssl_key   - For sending client-side certificates to server
+#     ssl_cipher          - Set minimum allowed cipher security (default: HIGH)
+#     option_file         - Read options from the given file instead of
+#                           the default my.cnf location
+#     option_group        - Read options from the given group (default: client)
+# 
+#   You can connect to UNIX sockets by using host: host=/var/run/mysql.sock
+#   Note that currently you can't use spaces in parameters.
+#
+# sqlite:
+#   The path to the database file.
+#
+# Examples:
+# mysql 192.168.1.1 {
+#   dbname = users
+# }
+# mysql sql.example.com {
+#   ssl = yes
+#   user = virtual
+#   password = blarg
+#   dbname = virtual
+# }
+# sqlite /etc/dovecot/authdb.sqlite {
+# }
+#
+#mysql /var/run/mysqld/mysqld.sock {
+#  user = dovecot
+#  password = dvmail
+#  dbname = dovecot
+#}
+#mysql localhost {
+# ...
+#}
+pgsql %dbhost {
+  parameters {
+    port = %dbport
+    dbname = %modoboa_dbname
+    user = %modoboa_dbuser
+    password = %modoboa_dbpassword
+  }
+}
+
+#passdb sql {
+#  default_password_scheme = SHA256
+
+# passdb query to retrieve the password. It can return fields:
+#   password - The user's password. This field must be returned.
+#   user - user@domain from the database. Needed with case-insensitive lookups.
+#   username and domain - An alternative way to represent the "user" field.
+#
+# The "user" field is often necessary with case-insensitive lookups to avoid
+# e.g. "name" and "nAme" logins creating two different mail directories. If
+# your user and domain names are in separate fields, you can return "username"
+# and "domain" fields instead of "user".
+#
+# The query can also return other fields which have a special meaning, see
+# https://doc.dovecot.org/latest/core/config/auth/passdb.html#extra-fields
+#
+# Commonly used available substitutions (see https://doc.dovecot.org/latest/core/settings/variables.html
+# for full list):
+#   %%{user} = entire user@domain
+#   %%{user|username} = user part of user@domain
+#   %%{user|domain} = domain part of user@domain
+# 
+# Note that these can be used only as input to SQL query. If the query outputs
+# any of these substitutions, they're not touched. Otherwise it would be
+# difficult to have eg. usernames containing '%%' characters.
+#
+# Example:
+#   query = SELECT userid AS user, pw AS password \
+#     FROM users WHERE userid = '%%u' AND active = 'Y'
+#
+#  query = \
+#    SELECT userid as username, domain, password \
+#    FROM users WHERE userid = '%%{user|username}' AND domain = '%%{user|domain}'
+#}
+passdb sql {
+  query = SELECT email AS user, password FROM core_user u INNER JOIN admin_mailbox mb ON u.id=mb.user_id INNER JOIN admin_domain dom ON mb.domain_id=dom.id WHERE (mb.is_send_only IS NOT TRUE OR '%%{protocol}' NOT IN ('imap', 'pop3')) AND email='%%{user}' AND is_active AND dom.enabled
+}
+
+#userdb sql {
+# userdb query to retrieve the user information. It can return fields:
+#   uid - System UID (overrides mail_uid setting)
+#   gid - System GID (overrides mail_gid setting)
+#   home - Home directory
+#   mail_driver - Mail driver
+#   mail_path - Mail storage path
+#
+# None of these are strictly required. If you use a single UID and GID, and
+# home or mail directory fits to a template string, you could use userdb static
+# instead. For a list of all fields that can be returned, see
+# Examples:
+#   query = SELECT home, uid, gid FROM users WHERE userid = '%%{user}'
+#   query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%%{user}'
+#   query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%%{user}'
+#
+#  query = \
+#    SELECT home, uid, gid \
+#    FROM users WHERE userid = '%%{user|username}' AND domain = '%%{user|domain}'
+
+# Query to get a list of all usernames.
+#  iterate_query = SELECT username AS user,domain FROM users
+
+#  userdb_ldap {
+#    iterate_fields {
+#      home = /var/vmail/%%{home}
+#    }
+#  }
+#}
+userdb sql {
+  query = SELECT '%{home_dir}/%%{user|domain}/%%{user|username}' AS home, %mailboxes_owner_uid as uid, %mailboxes_owner_gid as gid, mb.quota || 'M' AS quota_storage_size FROM admin_mailbox mb INNER JOIN admin_domain dom ON mb.domain_id=dom.id INNER JOIN core_user u ON u.id=mb.user_id WHERE (mb.is_send_only IS NOT TRUE OR '%%{protocol}' NOT IN ('imap', 'pop3', 'lmtp')) AND mb.address='%%{user|username}' AND dom.name='%%{user|domain}'
+  iterate_query = SELECT email AS user FROM core_user
+}
+
+#passdb static {
+#  fields {
+#    user=%%{user|username|lower}
+#    noauthenticate=yes
+#  }
+## you can remove next line if you want to always normalize your usernames
+#  skip = authenticated
+#}
+
+# "prefetch" user database means that the passdb already provided the
+# needed information and there's no need to do a separate userdb lookup.
+# <https://doc.dovecot.org/latest/core/config/auth/databases/prefetch.html>
+#userdb prefetch {
+#}
+
+#userdb static {
+#  fields {
+#    user=%%{user|lower}
+#  }
+# you can remove next line if you want to always normalize your usernames
+#  skip = found
+#}
+
+# If you don't have any user-specific settings, you can avoid the user_query
+# by using userdb static instead of userdb sql, for example:
+# <https://doc.dovecot.org/latest/core/config/auth/databases/static.html>
+#userdb static {
+  #fields {
+  #  uid = vmail
+  #  gid = vmail
+  #  home = /var/vmail/%%{user}
+  #}
+#}

modoboa_installer/scripts/files/dovecot/2.4/dovecot.conf.tpl

@@ -0,0 +1,87 @@
+## Dovecot configuration file
+
+# If you're in a hurry, see https://doc.dovecot.org/latest/core/config/guides/quick.html
+
+# "doveconf -n" command gives a clean output of the changed settings. Use it
+# instead of copy&pasting files when posting to the Dovecot mailing list.
+
+# '#' character and everything after it is treated as comments. Extra spaces
+# and tabs are ignored. If you want to use either of these explicitly, put the
+# value inside quotes, eg.: key = "# char and trailing whitespace  "
+
+# Default values are shown for each setting, it's not required to uncomment
+# those. These are exceptions to this though: No sections (e.g. namespace {})
+# or plugin settings are added by default, they're listed only as examples.
+# Paths are also just examples with the real defaults being based on configure
+# options. The paths listed here are for configure --prefix=/usr/local
+# --sysconfdir=/usr/local/etc --localstatedir=/var
+
+dovecot_config_version = 2.4.0
+dovecot_storage_version = 2.4.0
+
+# Protocols we want to be serving.
+%protocols
+!include_try /usr/share/dovecot/protocols.d/*.protocol
+
+# A comma separated list of IPs or hosts where to listen in for connections. 
+# "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces.
+# If you want to specify non-default ports or anything more complex,
+# edit conf.d/master.conf.
+#listen = *, ::
+
+# Base directory where to store runtime data.
+#base_dir = /var/run/dovecot/
+
+# Name of this instance. In multi-instance setup doveadm and other commands
+# can use -i <instance_name> to select which instance is used (an alternative
+# to -c <config_path>). The instance name is also added to Dovecot processes
+# in ps output.
+#instance_name = dovecot
+
+# Greeting message for clients.
+#login_greeting = Dovecot ready.
+
+# Space separated list of trusted network ranges. Connections from these
+# IPs are allowed to override their IP addresses and ports (for logging and
+# for authentication checks). disable_plaintext_auth is also ignored for
+# these networks, unless ssl=required.
+# Typically you'd specify your IMAP proxy servers here.
+#login_trusted_networks =
+
+# With proxy_maybe=yes if proxy destination matches any of these IPs, don't do
+# proxying. This isn't necessary normally, but may be useful if the destination
+# IP is e.g. a load balancer's IP.
+#auth_proxy_self =
+
+# Show more verbose process titles (in ps). Currently shows user name and
+# IP address. Useful for seeing who are actually using the IMAP processes
+# (eg. shared mailboxes or if same uid is used for multiple accounts).
+#verbose_proctitle = yes
+
+# Should all processes be killed when Dovecot master process shuts down.
+# Setting this to "no" means that Dovecot can be upgraded without
+# forcing existing client connections to close (although that could also be
+# a problem if the upgrade is e.g. because of a security fix).
+#shutdown_clients = yes
+
+# If non-zero, run mail commands via this many connections to doveadm server,
+# instead of running them directly in the same process.
+#doveadm_worker_count = 0
+# UNIX socket or host:port used for connecting to doveadm server
+#doveadm_socket_path = doveadm-server
+
+# Space separated list of environment variables that are preserved on Dovecot
+# startup and passed down to all of its child processes. You can also give
+# key=value pairs to always set specific settings.
+#import_environment {
+#  TZ=%%{env:TZ}
+#}
+
+# Most of the actual configuration gets included below. The filenames are
+# first sorted by their ASCII value and parsed in that order. The 00-prefixes
+# in filenames are intended to make it easier to understand the ordering.
+!include conf.d/*.conf
+
+# A config file can also tried to be included without giving an error if
+# it's not found:
+!include_try local.conf

modoboa_installer/scripts/files/nginx/autoconfig.conf.tpl

@@ -1,18 +1,14 @@
-upstream automx {
-    server unix:%uwsgi_socket_path fail_timeout=0;
-}
-
 server {
     listen 80;
     listen [::]:80;
     server_name %hostname;
-    root /srv/automx/instance;
+    root %app_instance_path;
 
     access_log /var/log/nginx/%{hostname}-access.log;
     error_log /var/log/nginx/%{hostname}-error.log;
 
-    location /mail/config-v1.1.xml {
+    location ~ ^/(mail/config-v1.1.xml|mobileconfig) {
         include uwsgi_params;
-        uwsgi_pass automx;
+        uwsgi_pass modoboa;
     }
 }

modoboa_installer/scripts/files/radicale/config.tpl

@@ -92,7 +92,7 @@ oauth2_introspection_endpoint = %{oauth2_introspection_url}
 
 # Rights backend
 # Value: none | authenticated | owner_only | owner_write | from_file
-type = from_file 
+type = from_file
 
 # File for rights management from_file
 file = %{config_dir}/rights
@@ -102,8 +102,6 @@ file = %{config_dir}/rights
 
 # Storage backend
 # Value: multifilesystem
-type = radicale_storage_by_index
-radicale_storage_by_index_fields = dtstart, dtend, uid, summary
 
 # Folder for storing local collections, created if not present
 filesystem_folder = %{home_dir}/collections
@@ -134,7 +132,7 @@ filesystem_folder = %{home_dir}/collections
 
 # Web interface backend
 # Value: none | internal
-type = none 
+type = none
 
 
 [logging]

modoboa_installer/scripts/files/uwsgi/automx.ini.tpl

@@ -1,14 +0,0 @@
-[uwsgi]
-uid = %app_user
-gid = %app_user
-plugins = %uwsgi_plugin
-home = %app_venv_path
-chdir = %app_instance_path
-module = automx_wsgi
-master = true
-vhost = true
-harakiri = 60
-processes = %nb_processes
-socket = %uwsgi_socket_path
-chmod-socket = 660
-vacuum = true

modoboa_installer/scripts/modoboa.py

@@ -27,7 +27,7 @@ class Modoboa(base.Installer):
             "build-essential", "python3-dev", "libxml2-dev", "libxslt-dev",
             "libjpeg-dev", "librrd-dev", "rrdtool", "libffi-dev", "cron",
             "libssl-dev", "redis-server", "supervisor", "pkg-config",
-            "libcairo2-dev"
+            "libcairo2-dev", "libmagic-dev"
         ],
         "rpm": [
             "gcc", "gcc-c++", "python3-devel", "libxml2-devel", "libxslt-devel",
@@ -50,6 +50,7 @@ class Modoboa(base.Installer):
         self.extensions = self.config.get("modoboa", "extensions").split()
         self.devmode = self.config.getboolean("modoboa", "devmode")
         self.amavis_enabled = self.config.getboolean("amavis", "enabled")
+        self.rspamd_enabled = self.config.getboolean("rspamd", "enabled")
         self.dovecot_enabled = self.config.getboolean("dovecot", "enabled")
         self.opendkim_enabled = self.config.getboolean("opendkim", "enabled")
         self.dkim_cron_enabled = False
@@ -70,7 +71,7 @@ class Modoboa(base.Installer):
     def _setup_venv(self):
         """Prepare a dedicated virtualenv."""
         python.setup_virtualenv(self.venv_path, sudo_user=self.user)
-        packages = ["rrdtool"]
+        packages = []
         version = self.config.get("modoboa", "version")
         extras = "postgresql"
         if self.dbengine != "postgres":
@@ -134,6 +135,10 @@ class Modoboa(base.Installer):
 
         prefix = ". {}; ".format(
             os.path.join(self.venv_path, "bin", "activate"))
+        if self.amavis_enabled:
+            self.extensions += ["modoboa.amavis"]
+        if self.rspamd_enabled:
+            self.extensions += ["modoboa.rspamd"]
         args = [
             "--collectstatic",
             "--timezone", self.config.get("modoboa", "timezone"),
@@ -235,7 +240,7 @@ class Modoboa(base.Installer):
             "dovecot_mailboxes_owner": (
                 self.config.get("dovecot", "mailboxes_owner")),
             "opendkim_user": self.config.get("opendkim", "user"),
-            "dkim_user": "_rspamd" if self.config.getboolean("rspamd", "enabled") else self.config.get("opendkim", "user"),
+            "dkim_user": "_rspamd" if self.rspamd_enabled else self.config.get("opendkim", "user"),
             "minutes": random.randint(1, 59),
             "hours": f"{random_hour},{random_hour+12}",
             "modoboa_2_2_or_greater": "" if self.modoboa_2_2_or_greater else "#",
@@ -257,9 +262,6 @@ class Modoboa(base.Installer):
                 "handle_mailboxes": True,
                 "account_auto_removal": True
             },
-            "modoboa_amavis": {
-                "am_pdp_mode": "inet",
-            },
             "maillog": {
                 "rrd_rootdir": rrd_root_dir,
             },
@@ -280,13 +282,17 @@ class Modoboa(base.Installer):
             settings["admin"]["dkim_keys_storage_dir"] = (
                 self.config.get("opendkim", "keys_storage_dir"))
 
-        if self.config.getboolean("rspamd", "enabled"):
+        if self.rspamd_enabled:
             settings["admin"]["dkim_keys_storage_dir"] = (
                 self.config.get("rspamd", "dkim_keys_storage_dir"))
-            settings["modoboa_rspamd"] = {
+            settings["rspamd"] = {
                 "key_map_path": self.config.get("rspamd", "key_map_path"),
                 "selector_map_path": self.config.get("rspamd", "selector_map_path")
             }
+        if self.config.getboolean("amavis", "enabled"):
+            settings["amavis"] = {
+                "am_pdp_mode": "inet",
+            }
 
         settings = json.dumps(settings)
         query = (

modoboa_installer/scripts/nginx.py

@@ -19,14 +19,15 @@ class Nginx(base.Installer):
         "rpm": ["nginx"]
     }
 
-    def get_template_context(self, app):
+    def get_template_context(self):
         """Additionnal variables."""
         context = super().get_template_context()
         context.update({
             "app_instance_path": (
-                self.config.get(app, "instance_path")),
+                self.config.get("modoboa", "instance_path")),
             "uwsgi_socket_path": (
-                Uwsgi(self.config, self.upgrade, self.restore).get_socket_path(app))
+                Uwsgi(self.config, self.upgrade, self.restore).get_socket_path("modoboa")
+            )
         })
         return context
 
@@ -34,9 +35,10 @@ class Nginx(base.Installer):
         """Custom app configuration."""
         if hostname is None:
             hostname = self.config.get("general", "hostname")
-        context = self.get_template_context(app)
+        context = self.get_template_context()
         context.update({"hostname": hostname, "extra_config": extra_config})
         src = self.get_file_path("{}.conf.tpl".format(app))
+        group = None
         if package.backend.FORMAT == "deb":
             dst = os.path.join(
                 self.config_dir, "sites-available", "{}.conf".format(hostname))
@@ -46,7 +48,8 @@ class Nginx(base.Installer):
             if os.path.exists(link):
                 return
             os.symlink(dst, link)
-            group = self.config.get(app, "user")
+            if self.config.has_section(app):
+                group = self.config.get(app, "user")
             user = "www-data"
         else:
             dst = os.path.join(
@@ -54,25 +57,17 @@ class Nginx(base.Installer):
             utils.copy_from_template(src, dst, context)
             group = "uwsgi"
             user = "nginx"
-        system.add_user_to_group(user, group)
+        if user and group:
+            system.add_user_to_group(user, group)
 
     def post_run(self):
         """Additionnal tasks."""
         extra_modoboa_config = ""
-        if self.config.getboolean("automx", "enabled"):
-            hostname = "autoconfig.{}".format(
-                self.config.get("general", "domain"))
-            self._setup_config("automx", hostname)
-            extra_modoboa_config = """
-    location ~* ^/autodiscover/autodiscover.xml {
-        include uwsgi_params;
-        uwsgi_pass automx;
-    }
-    location /mobileconfig {
-        include uwsgi_params;
-        uwsgi_pass automx;
-    }
-"""
+
+        hostname = "autoconfig.{}".format(
+            self.config.get("general", "domain"))
+        self._setup_config("autoconfig", hostname)
+
         if self.config.get("radicale", "enabled"):
             extra_modoboa_config += """
     location /radicale/ {

modoboa_installer/scripts/opendkim.py

@@ -16,10 +16,7 @@ class Opendkim(base.Installer):
     """OpenDKIM installer."""
 
     appname = "opendkim"
-    packages = {
-        "deb": ["opendkim"],
-        "rpm": ["opendkim"]
-    }
+    packages = {"deb": ["opendkim"], "rpm": ["opendkim"]}
     config_files = ["opendkim.conf", "opendkim.hosts"]
 
     def get_packages(self):
@@ -36,30 +33,34 @@ class Opendkim(base.Installer):
         """Make sure config directory exists."""
         user = self.config.get("opendkim", "user")
         pw = pwd.getpwnam(user)
-        targets = [
-            [self.app_config["keys_storage_dir"], pw[2], pw[3]]
-        ]
+        targets = [[self.app_config["keys_storage_dir"], pw[2], pw[3]]]
         for target in targets:
             if not os.path.exists(target[0]):
                 utils.mkdir(
                     target[0],
-                    stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
-                    stat.S_IROTH | stat.S_IXOTH,
-                    target[1], target[2]
+                    stat.S_IRWXU
+                    | stat.S_IRGRP
+                    | stat.S_IXGRP
+                    | stat.S_IROTH
+                    | stat.S_IXOTH,
+                    target[1],
+                    target[2],
                 )
         super().install_config_files()
 
     def get_template_context(self):
         """Additional variables."""
         context = super(Opendkim, self).get_template_context()
-        context.update({
-            "db_driver": self.db_driver,
-            "db_name": self.config.get("modoboa", "dbname"),
-            "db_user": self.app_config["dbuser"],
-            "db_password": self.app_config["dbpassword"],
-            "port": self.app_config["port"],
-            "user": self.app_config["user"]
-        })
+        context.update(
+            {
+                "db_driver": self.db_driver,
+                "db_name": self.config.get("modoboa", "dbname"),
+                "db_user": self.app_config["dbuser"],
+                "db_password": self.app_config["dbpassword"],
+                "port": self.app_config["port"],
+                "user": self.app_config["user"],
+            }
+        )
         return context
 
     def setup_database(self):
@@ -72,11 +73,14 @@ class Opendkim(base.Installer):
         dbuser = self.config.get("modoboa", "dbuser")
         dbpassword = self.config.get("modoboa", "dbpassword")
         self.backend.load_sql_file(
-            dbname, dbuser, dbpassword,
-            self.get_file_path("dkim_view_{}.sql".format(self.dbengine))
+            dbname,
+            dbuser,
+            dbpassword,
+            self.get_file_path("dkim_view_{}.sql".format(self.dbengine)),
         )
         self.backend.grant_right_on_table(
-            dbname, "dkim", self.app_config["dbuser"], "SELECT")
+            dbname, "dkim", self.app_config["dbuser"], "SELECT"
+        )
 
     def post_run(self):
         """Additional tasks.
@@ -90,31 +94,33 @@ class Opendkim(base.Installer):
         else:
             params_file = "/etc/opendkim.conf"
         pattern = r"s/^(SOCKET=.*)/#\1/"
-        utils.exec_cmd(
-            "perl -pi -e '{}' {}".format(pattern, params_file))
+        utils.exec_cmd("perl -pi -e '{}' {}".format(pattern, params_file))
         with open(params_file, "a") as f:
-            f.write('\n'.join([
-                "",
-                'SOCKET="inet:12345@localhost"',
-            ]))
+            f.write(
+                "\n".join(
+                    [
+                        "",
+                        'SOCKET="inet:12345@localhost"',
+                    ]
+                )
+            )
 
         # Make sure opendkim is started after postgresql and mysql,
         # respectively.
-        if (self.dbengine != "postgres" and package.backend.FORMAT == "deb"):
+        if self.dbengine != "postgres" and package.backend.FORMAT == "deb":
             dbservice = "mysql.service"
-        elif (self.dbengine != "postgres" and package.backend.FORMAT != "deb"):
+        elif self.dbengine != "postgres" and package.backend.FORMAT != "deb":
             dbservice = "mysqld.service"
         else:
             dbservice = "postgresql.service"
-        pattern = (
-            "s/^After=(.*)$/After=$1 {}/".format(dbservice))
+        pattern = "s/^After=(.*)$/After=$1 {}/".format(dbservice)
         utils.exec_cmd(
-            "perl -pi -e '{}' /lib/systemd/system/opendkim.service".format(pattern))
+            "perl -pi -e '{}' /lib/systemd/system/opendkim.service".format(pattern)
+        )
 
     def restore(self):
         """Restore keys."""
-        dkim_keys_backup = os.path.join(
-            self.archive_path, "custom/dkim")
+        dkim_keys_backup = os.path.join(self.archive_path, "custom/opendkim")
         keys_storage_dir = self.app_config["keys_storage_dir"]
         if os.path.isdir(dkim_keys_backup):
             for file in os.listdir(dkim_keys_backup):
@@ -129,6 +135,7 @@ class Opendkim(base.Installer):
     def custom_backup(self, path):
         """Backup DKIM keys."""
         if os.path.isdir(self.app_config["keys_storage_dir"]):
-            shutil.copytree(self.app_config["keys_storage_dir"], os.path.join(path, "dkim"))
-            utils.printcolor(
-                "DKIM keys saved!", utils.GREEN)
+            shutil.copytree(
+                self.app_config["keys_storage_dir"], path, dirs_exist_ok=True
+            )
+            utils.printcolor("DKIM keys saved!", utils.GREEN)

modoboa_installer/scripts/postwhite.py

@@ -19,10 +19,7 @@ class Postwhite(base.Installer):
         "crontab=/etc/cron.d/postwhite",
     ]
     no_daemon = True
-    packages = {
-        "deb": ["bind9-host"],
-        "rpm": ["bind-utils"]
-    }
+    packages = {"deb": ["bind9-host", "unzip"], "rpm": ["bind-utils", "unzip"]}
 
     def install_from_archive(self, repository, target_dir):
         """Install from an archive."""
@@ -36,8 +33,7 @@ class Postwhite(base.Installer):
         if os.path.exists(archive_dir):
             shutil.rmtree(archive_dir)
         utils.exec_cmd("unzip master.zip", cwd=target_dir)
-        utils.exec_cmd(
-            "mv {name}-master {name}".format(name=app_name), cwd=target_dir)
+        utils.exec_cmd("mv {name}-master {name}".format(name=app_name), cwd=target_dir)
         os.unlink(target)
         return archive_dir
 
@@ -45,10 +41,8 @@ class Postwhite(base.Installer):
         """Additionnal tasks."""
         install_dir = "/usr/local/bin"
         self.install_from_archive(SPF_TOOLS_REPOSITORY, install_dir)
-        self.postw_dir = self.install_from_archive(
-            POSTWHITE_REPOSITORY, install_dir)
-        utils.copy_file(
-            os.path.join(self.postw_dir, "postwhite.conf"), self.config_dir)
+        self.postw_dir = self.install_from_archive(POSTWHITE_REPOSITORY, install_dir)
+        utils.copy_file(os.path.join(self.postw_dir, "postwhite.conf"), self.config_dir)
         self.postw_bin = os.path.join(self.postw_dir, "postwhite")
         utils.exec_cmd("{} /etc/postwhite.conf".format(self.postw_bin))
 
@@ -57,13 +51,13 @@ class Postwhite(base.Installer):
         postswhite_custom = "/etc/postwhite.conf"
         if os.path.isfile(postswhite_custom):
             utils.copy_file(postswhite_custom, path)
-            utils.printcolor(
-                "Postwhite configuration saved!", utils.GREEN)
+            utils.printcolor("Postwhite configuration saved!", utils.GREEN)
 
     def restore(self):
         """Restore config files."""
         postwhite_backup_configuration = os.path.join(
-            self.archive_path, "custom/postwhite.conf")
+            self.archive_path, "custom/postwhite/postwhite.conf"
+        )
         if os.path.isfile(postwhite_backup_configuration):
             utils.copy_file(postwhite_backup_configuration, self.config_dir)
             utils.success("postwhite.conf restored from backup")

modoboa_installer/scripts/radicale.py

@@ -18,10 +18,7 @@ class Radicale(base.Installer):
     appname = "radicale"
     config_files = ["config"]
     no_daemon = True
-    packages = {
-        "deb": ["supervisor"],
-        "rpm": ["supervisor"]
-    }
+    packages = {"deb": ["supervisor"], "rpm": ["supervisor"]}
     with_user = True
 
     def __init__(self, *args, **kwargs):
@@ -32,28 +29,25 @@ class Radicale(base.Installer):
     def _setup_venv(self):
         """Prepare a dedicated virtualenv."""
         python.setup_virtualenv(self.venv_path, sudo_user=self.user)
-        packages = [
-            "Radicale", "pytz", "radicale-modoboa-auth-oauth2"
-        ]
+        packages = ["Radicale", "pytz", "radicale-modoboa-auth-oauth2"]
         python.install_packages(packages, self.venv_path, sudo_user=self.user)
-        python.install_package_from_repository(
-            "radicale-storage-by-index",
-            "https://github.com/tonioo/RadicaleStorageByIndex",
-            venv=self.venv_path, sudo_user=self.user)
 
     def get_template_context(self):
         """Additional variables."""
         context = super().get_template_context()
         oauth2_client_id, oauth2_client_secret = utils.create_oauth2_app(
-            "Radicale", "radicale", self.config)
+            "Radicale", "radicale", self.config
+        )
         hostname = self.config.get("general", "hostname")
         oauth2_introspection_url = (
             f"https://{oauth2_client_id}:{oauth2_client_secret}"
             f"@{hostname}/api/o/introspect/"
         )
-        context.update({
-            "oauth2_introspection_url": oauth2_introspection_url,
-        })
+        context.update(
+            {
+                "oauth2_introspection_url": oauth2_introspection_url,
+            }
+        )
         return context
 
     def get_config_files(self):
@@ -71,16 +65,19 @@ class Radicale(base.Installer):
         if not os.path.exists(self.config_dir):
             utils.mkdir(
                 self.config_dir,
-                stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
-                stat.S_IROTH | stat.S_IXOTH,
-                0, 0
+                stat.S_IRWXU
+                | stat.S_IRGRP
+                | stat.S_IXGRP
+                | stat.S_IROTH
+                | stat.S_IXOTH,
+                0,
+                0,
             )
         super().install_config_files()
 
     def restore(self):
         """Restore collections."""
-        radicale_backup = os.path.join(
-            self.archive_path, "custom/radicale")
+        radicale_backup = os.path.join(self.archive_path, "custom/radicale")
         if os.path.isdir(radicale_backup):
             restore_target = os.path.join(self.home_dir, "collections")
             if os.path.isdir(restore_target):
@@ -91,18 +88,17 @@ class Radicale(base.Installer):
     def post_run(self):
         """Additional tasks."""
         self._setup_venv()
-        daemon_name = (
-            "supervisor" if package.backend.FORMAT == "deb" else "supervisord"
-        )
+        daemon_name = "supervisor" if package.backend.FORMAT == "deb" else "supervisord"
         system.enable_service(daemon_name)
         utils.exec_cmd("service {} stop".format(daemon_name))
         utils.exec_cmd("service {} start".format(daemon_name))
 
     def custom_backup(self, path):
         """Backup collections."""
-        radicale_backup = os.path.join(self.config.get(
-            "radicale", "home_dir", fallback="/srv/radicale"), "collections")
+        radicale_backup = os.path.join(
+            self.config.get("radicale", "home_dir", fallback="/srv/radicale"),
+            "collections",
+        )
         if os.path.isdir(radicale_backup):
-            shutil.copytree(radicale_backup, os.path.join(
-                path, "radicale"))
+            shutil.copytree(radicale_backup, path, dirs_exist_ok=True)
             utils.printcolor("Radicale files saved", utils.GREEN)

modoboa_installer/scripts/rspamd.py

@@ -16,11 +16,7 @@ class Rspamd(base.Installer):
     """Rspamd installer."""
 
     appname = "rspamd"
-    packages = {
-        "deb": [
-            "rspamd", "redis"
-        ]
-    }
+    packages = {"deb": ["rspamd", "redis"]}
     config_files = [
         "local.d/arc.conf",
         "local.d/dkim_signing.conf",
@@ -39,10 +35,9 @@ class Rspamd(base.Installer):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        self.generate_password_condition = (
-            not self.upgrade or utils.user_input(
-                "Do you want to (re)generate rspamd password ? (y/N)").lower().startswith("y")
-        )
+        self.generate_password_condition = not self.upgrade or utils.user_input(
+            "Do you want to (re)generate rspamd password ? (y/N)"
+        ).lower().startswith("y")
 
     @property
     def config_dir(self):
@@ -54,16 +49,20 @@ class Rspamd(base.Installer):
         if debian_based_dist:
             utils.mkdir_safe(
                 "/etc/apt/keyrings",
-                stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
-                stat.S_IROTH | stat.S_IXOTH,
-                0, 0
+                stat.S_IRWXU
+                | stat.S_IRGRP
+                | stat.S_IXGRP
+                | stat.S_IROTH
+                | stat.S_IXOTH,
+                0,
+                0,
             )
 
             package.backend.add_custom_repository(
                 "rspamd",
                 "http://rspamd.com/apt-stable/",
                 "https://rspamd.com/apt-stable/gpg.key",
-                codename
+                codename,
             )
             package.backend.update()
 
@@ -73,16 +72,18 @@ class Rspamd(base.Installer):
         """Make sure config directory exists."""
         user = self.config.get(self.appname, "user")
         pw = pwd.getpwnam(user)
-        targets = [
-            [self.app_config["dkim_keys_storage_dir"], pw[2], pw[3]]
-        ]
+        targets = [[self.app_config["dkim_keys_storage_dir"], pw[2], pw[3]]]
         for target in targets:
             if not os.path.exists(target[0]):
                 utils.mkdir(
                     target[0],
-                    stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
-                    stat.S_IROTH | stat.S_IXOTH,
-                    target[1], target[2]
+                    stat.S_IRWXU
+                    | stat.S_IRGRP
+                    | stat.S_IXGRP
+                    | stat.S_IROTH
+                    | stat.S_IXOTH,
+                    target[1],
+                    target[2],
                 )
         super().install_config_files()
 
@@ -101,16 +102,23 @@ class Rspamd(base.Installer):
 
     def get_template_context(self):
         _context = super().get_template_context()
-        _context["greylisting_disabled"] = "" if not self.app_config["greylisting"].lower() == "true" else "#"
-        _context["whitelist_auth_enabled"] = "" if self.app_config["whitelist_auth"].lower() == "true" else "#"
+        _context["greylisting_disabled"] = (
+            "" if not self.app_config["greylisting"].lower() == "true" else "#"
+        )
+        _context["whitelist_auth_enabled"] = (
+            "" if self.app_config["whitelist_auth"].lower() == "true" else "#"
+        )
         if self.generate_password_condition:
             code, controller_password = utils.exec_cmd(
-                r"rspamadm pw -p {}".format(self.app_config["password"]))
+                r"rspamadm pw -p {}".format(self.app_config["password"])
+            )
             if code != 0:
-                utils.error("Error setting rspamd password. "
-                            "Please make sure it is not 'q1' or 'q2'."
-                            "Storing the password in plain. See"
-                            "https://rspamd.com/doc/quickstart.html#setting-the-controller-password")
+                utils.error(
+                    "Error setting rspamd password. "
+                    "Please make sure it is not 'q1' or 'q2'."
+                    "Storing the password in plain. See"
+                    "https://rspamd.com/doc/quickstart.html#setting-the-controller-password"
+                )
                 _context["controller_password"] = self.app_config["password"]
             else:
                 controller_password = controller_password.decode().replace("\n", "")
@@ -120,35 +128,59 @@ class Rspamd(base.Installer):
     def post_run(self):
         """Additional tasks."""
         user = self.config.get(self.appname, "user")
-        system.add_user_to_group(
-            self.config.get("modoboa", "user"),
-            user
-        )
+        system.add_user_to_group(self.config.get("modoboa", "user"), user)
         if self.config.getboolean("clamav", "enabled"):
             install("clamav", self.config, self.upgrade, self.archive_path)
 
+    def backup(self, path):
+        self._dump_database(path)
+        super().backup(path)
+
+    def _dump_database(self, backup_path: str):
+        """Copy the rrd file containing the redis db for rspamd.
+        Uses the default path on debian 13,
+        it may be somewhere else on other distros..."""
+        rspamd_redis_db = "/var/lib/rspamd/rspamd.rrd"
+        if not os.path.isfile(rspamd_redis_db):
+            return
+        target_dir = os.path.join(backup_path, "databases")
+        target_file = os.path.join(target_dir, "rspamd.rrd")
+        system.stop_service("redis")
+        utils.copy_file(rspamd_redis_db, target_file)
+        system.restart_service("redis")
+
     def custom_backup(self, path):
         """Backup custom configuration if any."""
-        custom_config_dir = os.path.join(self.config_dir,
-                                         "/local.d/")
-        custom_backup_dir = os.path.join(path, "/rspamd/")
-        local_files = [f for f in os.listdir(custom_config_dir)
-                       if os.path.isfile(custom_config_dir, f)
-                       ]
+        custom_config_dir = os.path.join(self.config_dir, "local.d/")
+        local_files = [
+            os.path.join(custom_config_dir, f)
+            for f in os.listdir(custom_config_dir)
+            if os.path.isfile(os.path.join(custom_config_dir, f))
+        ]
+        backup_locald_path = os.path.join(path, "local.d")
+        if local_files:
+            utils.mkdir_safe(backup_locald_path)
         for file in local_files:
-            utils.copy_file(file, custom_backup_dir)
-        if len(local_files) != 0:
+            basename = os.path.basename(file)
+            utils.copy_file(file, os.path.join(backup_locald_path, basename))
+        if local_files:
             utils.success("Rspamd custom configuration saved!")
 
     def restore(self):
         """Restore custom config files."""
-        custom_config_dir = os.path.join(self.config_dir,
-                                         "/local.d/")
+        custom_config_dir = os.path.join(self.config_dir, "/local.d/")
         custom_backup_dir = os.path.join(self.archive_path, "/rspamd/")
         backed_up_files = [
-            f for f in os.listdir(custom_backup_dir)
+            f
+            for f in os.listdir(custom_backup_dir)
             if os.path.isfile(custom_backup_dir, f)
         ]
         for f in backed_up_files:
             utils.copy_file(f, custom_config_dir)
+        rspamd_redis_db = "/var/lib/rspamd"
+        rspamd_redis_db_backup = os.path.join(self.archive_path, "databases/rspamd.rrd")
+        if os.path.isdir(rspamd_redis_db) and os.path.isfile(rspamd_redis_db_backup):
+            system.stop_service("redis")
+            utils.copy_file(rspamd_redis_db_backup, rspamd_redis_db)
+            system.restart_service("redis")
         utils.success("Custom Rspamd configuration restored.")

modoboa_installer/scripts/uwsgi.py

@@ -83,24 +83,9 @@ class Uwsgi(base.Installer):
             utils.exec_cmd(
                 "perl -pi -e '{}' /etc/uwsgi.ini".format(pattern))
 
-    def _setup_automx_config(self):
-        """Custom automx configuration."""
-        dst = self._setup_config("automx")
-        if package.backend.FORMAT == "deb":
-            self._enable_config_debian(dst)
-        else:
-            system.add_user_to_group(
-                "uwsgi", self.config.get("automx", "user"))
-            pattern = (
-                "s/emperor-tyrant = true/emperor-tyrant = false/")
-            utils.exec_cmd(
-                "perl -pi -e '{}' /etc/uwsgi.ini".format(pattern))
-
     def post_run(self):
         """Additionnal tasks."""
         self._setup_modoboa_config()
-        if self.config.getboolean("automx", "enabled"):
-            self._setup_automx_config()
 
     def restart_daemon(self):
         """Restart daemon process."""

modoboa_installer/system.py

@@ -16,12 +16,13 @@ def create_user(name, home=None):
     else:
         extra_message = "."
         if home:
-            extra_message = (
-                " but please make sure the {} directory exists.".format(
-                    home))
+            extra_message = " but please make sure the {} directory exists.".format(
+                home
+            )
         utils.printcolor(
-            "User {} already exists, skipping creation{}".format(
-                name, extra_message), utils.YELLOW)
+            "User {} already exists, skipping creation{}".format(name, extra_message),
+            utils.YELLOW,
+        )
         return
     cmd = "useradd -m "
     if home:
@@ -62,3 +63,8 @@ def enable_and_start_service(name):
 def restart_service(name):
     """Restart a service."""
     utils.exec_cmd("service {} restart".format(name))
+
+
+def stop_service(name):
+    """Stop a service."""
+    utils.exec_cmd(f"service {name} stop")

modoboa_installer/utils.py

@@ -24,7 +24,6 @@ BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, WHITE = range(8)
 
 
 class FatalError(Exception):
-
     """A simple exception."""
 
     pass
@@ -77,16 +76,14 @@ def dist_info():
         info = {}
         with open(path) as fp:
             for line in fp.readlines():
-                if line == '\n':
+                if line == "\n":
                     continue
                 key, value = line.split("=")
                 value = value.rstrip('"\n')
                 value = value.strip('"')
                 info[key] = value
         return info["NAME"], info["VERSION_ID"]
-    printcolor(
-        "Failed to retrieve information about your system, aborting.",
-        RED)
+    printcolor("Failed to retrieve information about your system, aborting.", RED)
     sys.exit(1)
 
 
@@ -99,14 +96,27 @@ def is_dist_debian_based() -> (bool, str):
     """Check if current OS is Debian based or not."""
     status, codename = exec_cmd("lsb_release -c -s")
     codename = codename.decode().strip().lower()
-    return codename in [
-        "bionic", "bookworm", "bullseye", "buster",
-        "focal", "jammy", "jessie", "sid", "stretch",
-        "trusty", "wheezy", "xenial"
-    ], codename
+    return (
+        codename
+        in [
+            "bionic",
+            "bookworm",
+            "bullseye",
+            "buster",
+            "focal",
+            "jammy",
+            "jessie",
+            "sid",
+            "stretch",
+            "trusty",
+            "wheezy",
+            "xenial",
+        ],
+        codename,
+    )
 
 
-def mkdir(path, mode, uid, gid):
+def mkdir(path, mode=0o777, uid=os.getuid(), gid=os.getgid()):
     """Create a directory."""
     if not os.path.exists(path):
         os.mkdir(path, mode)
@@ -115,7 +125,7 @@ def mkdir(path, mode, uid, gid):
     os.chown(path, uid, gid)
 
 
-def mkdir_safe(path, mode, uid, gid):
+def mkdir_safe(path, mode=0o777, uid=os.getuid(), gid=os.getgid()):
     """Create a directory. Safe way (-p)"""
     if not os.path.exists(path):
         os.makedirs(os.path.abspath(path), mode)
@@ -125,8 +135,9 @@ def mkdir_safe(path, mode, uid, gid):
 def make_password(length=16):
     """Create a random password."""
     return "".join(
-        random.SystemRandom().choice(
-            string.ascii_letters + string.digits) for _ in range(length))
+        random.SystemRandom().choice(string.ascii_letters + string.digits)
+        for _ in range(length)
+    )
 
 
 @contextlib.contextmanager
@@ -149,8 +160,7 @@ def backup_file(fname):
     """Create a backup of a given file."""
     for f in glob.glob("{}.old.*".format(fname)):
         os.unlink(f)
-    bak_name = "{}.old.{}".format(
-        fname, datetime.datetime.now().isoformat())
+    bak_name = "{}.old.{}".format(fname, datetime.datetime.now().isoformat())
     shutil.copy(fname, bak_name)
 
 
@@ -171,17 +181,13 @@ def copy_from_template(template, dest, context):
     if os.path.isfile(dest):
         backup_file(dest)
     with open(dest, "w") as fp:
-        fp.write(
-            "# This file was automatically installed on {}\n"
-            .format(now))
+        fp.write("# This file was automatically installed on {}\n".format(now))
         fp.write(ConfigFileTemplate(buf).substitute(context))
 
 
-def check_config_file(dest,
-                      interactive=False,
-                      upgrade=False,
-                      backup=False,
-                      restore=False):
+def check_config_file(
+    dest, interactive=False, upgrade=False, backup=False, restore=False
+):
     """Create a new installer config file if needed."""
     is_present = True
     if os.path.exists(dest):
@@ -189,22 +195,25 @@ def check_config_file(dest,
     if upgrade:
         error(
             "You cannot upgrade an existing installation without a "
-            "configuration file.")
+            "configuration file."
+        )
         sys.exit(1)
     elif backup:
         is_present = False
         error(
             "Your configuration file hasn't been found. A new one will be generated. "
-            "Please edit it with correct password for the databases !")
+            "Please edit it with correct password for the databases !"
+        )
     elif restore:
         error(
             "You cannot restore an existing installation without a "
-            f"configuration file. (file : {dest} has not been found...")
+            f"configuration file. (file : {dest} has not been found..."
+        )
         sys.exit(1)
 
     printcolor(
-        "Configuration file {} not found, creating new one."
-        .format(dest), YELLOW)
+        "Configuration file {} not found, creating new one.".format(dest), YELLOW
+    )
     gen_config(dest, interactive)
     return is_present, None
 
@@ -217,6 +226,7 @@ def has_colours(stream):
         return False  # auto color only on TTYs
     try:
         import curses
+
         curses.setupterm()
         return curses.tigetnum("colors") > 2
     except:
@@ -251,8 +261,9 @@ def convert_version_to_int(version):
     numbers = [int(number_string) for number_string in version.split(".")]
     if len(numbers) > len(number_bits):
         raise NotImplementedError(
-            "Versions with more than {0} decimal places are not supported"
-            .format(len(number_bits) - 1)
+            "Versions with more than {0} decimal places are not supported".format(
+                len(number_bits) - 1
+            )
         )
     # add 0s for missing numbers
     numbers.extend([0] * (len(number_bits) - len(numbers)))
@@ -263,8 +274,9 @@ def convert_version_to_int(version):
         max_num = (bits + 1) - 1
         if num >= 1 << max_num:
             raise ValueError(
-                "Number {0} cannot be stored with only {1} bits. Max is {2}"
-                .format(num, bits, max_num)
+                "Number {0} cannot be stored with only {1} bits. Max is {2}".format(
+                    num, bits, max_num
+                )
             )
         number += num << total_bits
         total_bits += bits
@@ -315,7 +327,9 @@ def validate(value, config_entry):
         return True
 
 
-def get_entry_value(entry: dict, interactive: bool, config: configparser.ConfigParser) -> string:
+def get_entry_value(
+    entry: dict, interactive: bool, config: configparser.ConfigParser
+) -> string:
     default_entry = entry["default"]
     if type(default_entry) is type(list()):
         default_value = str(check_if_condition(config, default_entry)).lower()
@@ -325,7 +339,7 @@ def get_entry_value(entry: dict, interactive: bool, config: configparser.ConfigP
         default_value = default_entry
     user_value = None
     if entry.get("customizable") and interactive:
-        while (user_value != '' and not validate(user_value, entry)):
+        while user_value != "" and not validate(user_value, entry):
             question = entry.get("question")
             if entry.get("values"):
                 question += " from the list"
@@ -366,14 +380,10 @@ def load_config_template(interactive):
         config.add_section(section["name"])
         for config_entry in section["values"]:
             if config_entry.get("if") is not None:
-                interactive_section = (interactive_section and
-                                       check_if_condition(
-                                           config, config_entry["if"]
-                                           )
-                                       )
-            value = get_entry_value(config_entry,
-                                    interactive_section,
-                                    config)
+                interactive_section = interactive_section and check_if_condition(
+                    config, config_entry["if"]
+                )
+            value = get_entry_value(config_entry, interactive_section, config)
             config.set(section["name"], config_entry["option"], value)
     return config
 
@@ -393,10 +403,11 @@ def update_config(path, apply_update=True):
     dropped_sections = list(set(old_sections) - set(new_sections))
     added_sections = list(set(new_sections) - set(old_sections))
     if len(dropped_sections) > 0 and apply_update:
-        printcolor("Following section(s) will not be ported "
-                   "due to being deleted or renamed: " +
-                   ', '.join(dropped_sections),
-                   RED)
+        printcolor(
+            "Following section(s) will not be ported "
+            "due to being deleted or renamed: " + ", ".join(dropped_sections),
+            RED,
+        )
 
     if len(dropped_sections) + len(added_sections) > 0:
         update = True
@@ -409,11 +420,12 @@ def update_config(path, apply_update=True):
             dropped_options = list(set(old_options) - set(new_options))
             added_options = list(set(new_options) - set(old_options))
             if len(dropped_options) > 0 and apply_update:
-                printcolor(f"Following option(s) from section: {section}, "
-                           "will not be ported due to being "
-                           "deleted or renamed: " +
-                           ', '.join(dropped_options),
-                           RED)
+                printcolor(
+                    f"Following option(s) from section: {section}, "
+                    "will not be ported due to being "
+                    "deleted or renamed: " + ", ".join(dropped_options),
+                    RED,
+                )
             if len(dropped_options) + len(added_options) > 0:
                 update = True
 
@@ -466,29 +478,27 @@ def validate_backup_path(path: str, silent_mode: bool):
     """Check if provided backup path is valid or not."""
     path_exists = os.path.exists(path)
     if path_exists and os.path.isfile(path):
-        printcolor(
-            "Error, you provided a file instead of a directory!", RED)
+        printcolor("Error, you provided a file instead of a directory!", RED)
         return None
 
     if not path_exists:
         if not silent_mode:
             create_dir = input(
-                f"\"{path}\" doesn't exist, would you like to create it? [y/N]\n"
+                f'"{path}" doesn\'t exist, would you like to create it? [y/N]\n'
             ).lower()
 
         if silent_mode or (not silent_mode and create_dir.startswith("y")):
             pw = pwd.getpwnam("root")
             mkdir_safe(path, stat.S_IRWXU | stat.S_IRWXG, pw[2], pw[3])
         else:
-            printcolor(
-                "Error, backup directory not present.", RED
-            )
+            printcolor("Error, backup directory not present.", RED)
             return None
 
     if len(os.listdir(path)) != 0:
         if not silent_mode:
             delete_dir = input(
-                "Warning: backup directory is not empty, it will be purged if you continue... [y/N]\n").lower()
+                "Warning: backup directory is not empty, it will be purged if you continue... [y/N]\n"
+            ).lower()
 
         if silent_mode or (not silent_mode and delete_dir.startswith("y")):
             try:
@@ -496,22 +506,19 @@ def validate_backup_path(path: str, silent_mode: bool):
             except FileNotFoundError:
                 pass
 
-            shutil.rmtree(os.path.join(path, "custom"),
-                          ignore_errors=False)
+            shutil.rmtree(os.path.join(path, "custom"), ignore_errors=False)
             shutil.rmtree(os.path.join(path, "mails"), ignore_errors=False)
-            shutil.rmtree(os.path.join(path, "databases"),
-                          ignore_errors=False)
+            shutil.rmtree(os.path.join(path, "databases"), ignore_errors=False)
         else:
-            printcolor(
-                "Error: backup directory not clean.", RED
-            )
+            printcolor("Error: backup directory not clean.", RED)
             return None
 
     backup_path = path
     pw = pwd.getpwnam("root")
     for dir in ["custom/", "databases/"]:
-        mkdir_safe(os.path.join(backup_path, dir),
-                   stat.S_IRWXU | stat.S_IRWXG, pw[2], pw[3])
+        mkdir_safe(
+            os.path.join(backup_path, dir), stat.S_IRWXU | stat.S_IRWXG, pw[2], pw[3]
+        )
     return backup_path
 
 
@@ -539,7 +546,9 @@ def check_app_compatibility(section, config):
     if section in APP_INCOMPATIBILITY.keys():
         for app in APP_INCOMPATIBILITY[section]:
             if config.getboolean(app, "enabled"):
-                error(f"{section} cannot be installed if {app} is enabled. "
-                      "Please disable one of them.")
+                error(
+                    f"{section} cannot be installed if {app} is enabled. "
+                    "Please disable one of them."
+                )
                 incompatible_app.append(app)
     return len(incompatible_app) == 0

run.py

@@ -22,16 +22,15 @@ from modoboa_installer import disclaimers
 PRIMARY_APPS = [
     "fail2ban",
     "modoboa",
-    "automx",
     "radicale",
     "uwsgi",
     "nginx",
     "postfix",
-    "dovecot"
+    "dovecot",
 ]
 
 
-def backup_system(config, args):
+def backup_system(config, args, antispam_apps):
     """Launch backup procedure."""
     disclaimers.backup_disclaimer()
     backup_path = None
@@ -53,8 +52,7 @@ def backup_system(config, args):
         user_value = None
         while not user_value or not backup_path:
             utils.printcolor(
-                "Enter backup path (it must be an empty directory)",
-                utils.MAGENTA
+                "Enter backup path (it must be an empty directory)", utils.MAGENTA
             )
             utils.printcolor("CTRL+C to cancel", utils.MAGENTA)
             user_value = utils.user_input("-> ")
@@ -65,7 +63,9 @@ def backup_system(config, args):
     # Backup configuration file
     utils.copy_file(args.configfile, backup_path)
     # Backup applications
-    for app in PRIMARY_APPS:
+    for app in PRIMARY_APPS + antispam_apps:
+        if config.has_option(app, "enabled") and not config.getboolean(app, "enabled"):
+            continue
         if app == "dovecot" and args.no_mail:
             utils.printcolor("Skipping mail backup", utils.BLUE)
             continue
@@ -73,65 +73,97 @@ def backup_system(config, args):
 
 
 def config_file_update_complete(backup_location):
-    utils.printcolor("Update complete. It seems successful.",
-                     utils.BLUE)
+    utils.printcolor("Update complete. It seems successful.", utils.BLUE)
     if backup_location is not None:
-        utils.printcolor("You will find your old config file "
-                         f"here: {backup_location}",
-                         utils.BLUE)
+        utils.printcolor(
+            "You will find your old config file " f"here: {backup_location}", utils.BLUE
+        )
 
 
 def parser_setup(input_args):
     parser = argparse.ArgumentParser()
-    versions = (
-        ["latest"] + list(compatibility_matrix.COMPATIBILITY_MATRIX.keys())
-        )
-    parser.add_argument("--debug", action="store_true", default=False,
-                        help="Enable debug output")
-    parser.add_argument("--force", action="store_true", default=False,
-                        help="Force installation")
-    parser.add_argument("--configfile", default="installer.cfg",
-                        help="Configuration file to use")
+    versions = ["latest"] + list(compatibility_matrix.COMPATIBILITY_MATRIX.keys())
     parser.add_argument(
-        "--version", default="latest", choices=versions,
-        help="Modoboa version to install")
+        "--debug", action="store_true", default=False, help="Enable debug output"
+    )
     parser.add_argument(
-        "--stop-after-configfile-check", action="store_true", default=False,
-        help="Check configuration, generate it if needed and exit")
+        "--force", action="store_true", default=False, help="Force installation"
+    )
     parser.add_argument(
-        "--interactive", action="store_true", default=False,
-        help="Generate configuration file with user interaction")
+        "--configfile", default="installer.cfg", help="Configuration file to use"
+    )
     parser.add_argument(
-        "--upgrade", action="store_true", default=False,
-        help="Run the installer in upgrade mode")
+        "--version",
+        default="latest",
+        choices=versions,
+        help="Modoboa version to install",
+    )
     parser.add_argument(
-        "--beta", action="store_true", default=False,
-        help="Install latest beta release of Modoboa instead of the stable one")
+        "--stop-after-configfile-check",
+        action="store_true",
+        default=False,
+        help="Check configuration, generate it if needed and exit",
+    )
     parser.add_argument(
-        "--backup-path", type=str, metavar="path",
-        help="To use with --silent-backup, you must provide a valid path")
+        "--interactive",
+        action="store_true",
+        default=False,
+        help="Generate configuration file with user interaction",
+    )
     parser.add_argument(
-        "--backup", action="store_true", default=False,
-        help="Backing up interactively previously installed instance"
-        )
+        "--upgrade",
+        action="store_true",
+        default=False,
+        help="Run the installer in upgrade mode",
+    )
     parser.add_argument(
-        "--silent-backup", action="store_true", default=False,
+        "--beta",
+        action="store_true",
+        default=False,
+        help="Install latest beta release of Modoboa instead of the stable one",
+    )
+    parser.add_argument(
+        "--backup-path",
+        type=str,
+        metavar="path",
+        help="To use with --silent-backup, you must provide a valid path",
+    )
+    parser.add_argument(
+        "--backup",
+        action="store_true",
+        default=False,
+        help="Backing up interactively previously installed instance",
+    )
+    parser.add_argument(
+        "--silent-backup",
+        action="store_true",
+        default=False,
         help="For script usage, do not require user interaction "
         "backup will be saved at ./modoboa_backup/Backup_M_Y_d_H_M "
-        "if --backup-path is not provided")
+        "if --backup-path is not provided",
+    )
     parser.add_argument(
-        "--no-mail", action="store_true", default=False,
-        help="Disable mail backup (save space)")
+        "--no-mail",
+        action="store_true",
+        default=False,
+        help="Disable mail backup (save space)",
+    )
     parser.add_argument(
-        "--restore", type=str, metavar="path",
+        "--restore",
+        type=str,
+        metavar="path",
         help="Restore a previously backup up modoboa instance on a NEW machine. "
-        "You MUST provide backup directory"
-        )
+        "You MUST provide backup directory",
+    )
     parser.add_argument(
-        "--skip-checks", action="store_true", default=False,
-        help="Skip the checks the installer performs initially")
-    parser.add_argument("domain", type=str,
-                        help="The main domain of your future mail server")
+        "--skip-checks",
+        action="store_true",
+        default=False,
+        help="Skip the checks the installer performs initially",
+    )
+    parser.add_argument(
+        "domain", type=str, help="The main domain of your future mail server"
+    )
     return parser.parse_args(input_args)
 
 
@@ -148,9 +180,7 @@ def main(input_args):
         is_restoring = True
         args.configfile = os.path.join(args.restore, args.configfile)
         if not os.path.exists(args.configfile):
-            utils.error(
-                "Installer configuration file not found in backup!"
-            )
+            utils.error("Installer configuration file not found in backup!")
             sys.exit(1)
 
     utils.success("Welcome to Modoboa installer!\n")
@@ -162,26 +192,34 @@ def main(input_args):
         utils.success("Checks complete\n")
 
     is_config_file_available, outdate_config = utils.check_config_file(
-        args.configfile, args.interactive, args.upgrade, args.backup, is_restoring)
+        args.configfile, args.interactive, args.upgrade, args.backup, is_restoring
+    )
 
     if not is_config_file_available and (
-            args.upgrade or args.backup or args.silent_backup):
+        args.upgrade or args.backup or args.silent_backup
+    ):
         utils.error("No config file found.")
         return
 
     # Check if config is outdated and ask user if it needs to be updated
     if is_config_file_available and outdate_config:
-        answer = utils.user_input("It seems that your config file is outdated. "
-                                  "Would you like to update it? (Y/n) ")
+        answer = utils.user_input(
+            "It seems that your config file is outdated. "
+            "Would you like to update it? (Y/n) "
+        )
         if not answer or answer.lower().startswith("y"):
             config_file_update_complete(utils.update_config(args.configfile))
             if not args.stop_after_configfile_check:
-                answer = utils.user_input("Would you like to stop to review the updated config? (Y/n)")
+                answer = utils.user_input(
+                    "Would you like to stop to review the updated config? (Y/n)"
+                )
                 if not answer or answer.lower().startswith("y"):
                     return
         else:
-            utils.error("You might encounter unexpected errors ! "
-                        "Make sure to update your config before opening an issue!")
+            utils.error(
+                "You might encounter unexpected errors ! "
+                "Make sure to update your config before opening an issue!"
+            )
 
     if args.stop_after_configfile_check:
         return
@@ -202,7 +240,7 @@ def main(input_args):
         antispam_apps = ["rspamd"]
 
     if args.backup or args.silent_backup:
-        backup_system(config, args)
+        backup_system(config, args, antispam_apps)
         return
 
     # Display disclaimer python 3 linux distribution
@@ -217,11 +255,20 @@ def main(input_args):
     # Show concerned components
     components = []
     for section in config.sections():
-        if section in ["general", "antispam", "database", "mysql", "postgres",
-                       "certificate", "letsencrypt", "backup"]:
+        if section in [
+            "general",
+            "antispam",
+            "database",
+            "mysql",
+            "postgres",
+            "certificate",
+            "letsencrypt",
+            "backup",
+        ]:
             continue
-        if (config.has_option(section, "enabled") and
-                not config.getboolean(section, "enabled")):
+        if config.has_option(section, "enabled") and not config.getboolean(
+            section, "enabled"
+        ):
             continue
         incompatible_app_detected = not utils.check_app_compatibility(section, config)
         if incompatible_app_detected:
@@ -234,8 +281,9 @@ def main(input_args):
             return
     config.set("general", "force", str(args.force))
     utils.printcolor(
-        "The process can be long, feel free to take a coffee "
-        "and come back later ;)", utils.BLUE)
+        "The process can be long, feel free to take a coffee " "and come back later ;)",
+        utils.BLUE,
+    )
     utils.success("Starting...")
     package.backend.prepare_system()
     package.backend.install_many(["sudo", "wget"])
@@ -269,13 +317,8 @@ def main(input_args):
         "You like the project and want it to be sustainable?\n"
         "Then don't wait anymore and go sponsor it here:\n"
     )
-    utils.printcolor(
-        "https://github.com/sponsors/modoboa\n",
-        utils.YELLOW
-    )
-    utils.success(
-        "Thank you for your help :-)\n"
-    )
+    utils.printcolor("https://github.com/sponsors/modoboa\n", utils.YELLOW)
+    utils.success("Thank you for your help :-)\n")
 
 
 if __name__ == "__main__":

tests.py

@@ -126,7 +126,7 @@ class ConfigFileTestCase(unittest.TestCase):
             "example.test"])
         self.assertTrue(os.path.exists(self.cfgfile))
         self.assertIn(
-            "fail2ban modoboa automx amavis clamav dovecot nginx "
+            "fail2ban modoboa amavis clamav dovecot nginx "
             "postfix postwhite spamassassin uwsgi radicale opendkim",
             out.getvalue()
         )

version.txt

@@ -1 +1 @@
-53669b48de7ce85341a547ed2583380fcb06841b
+1d701353d900f4b6e2f7ffba6f6b7a46d304f58b