pillar.example

dovecot:
  lookup:
    enable_service_control: True
    config:
      local: |
        # main
        listen = *
        login_trusted_networks = 192.168.100.0/24
        shutdown_clients = yes
  
        # auth
        disable_plaintext_auth = yes
        auth_cache_size = 10M
        auth_cache_ttl = 1 hour
        auth_mechanisms = plain
        !include conf.d/auth-system.conf.ext
  
        # logging
        log_timestamp = "%Y-%m-%d %H:%M:%S "
  
        # mail (for non-virtual users)
        mail_location = maildir:~/Maildir
        mail_privileged_group = mail
        first_valid_uid = 1000
        last_valid_uid = 2000
  
        # master
        service imap-login {
          inet_listener imap {
            address = 127.0.0.1
            port = 143
          }
          inet_listener imaps {
            port = 993
            ssl = yes
          }
        }
  
        # lda
        postmaster_address = postmaster@example.com
        hostname = example.com
        protocol lda {
          mail_plugins = $mail_plugins sieve
        }
  
        # imap
        protocols = imap
        mail_max_userip_connections = 50
  
        # managesieve
        service managesieve-login {
          inet_listener sieve_deprecated {
            address = 0.0.0.0
            port = 2000
          }
        }
  
        # sieve
        plugin {
          sieve = ~/.dovecot.sieve
          sieve_dir = ~/sieve
        }
  
        # ssl
        ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
        ssl_cert = </etc/ssl/private/dovecot-one.crt
        ssl_key = </etc/ssl/private/dovecot-one.key
    
      dovecotext:
        ldap: |
          hosts = 0.0.0.0
          base = dc=example, dc=com
          scope = subtree
          pass_attrs = uid=user,userPassword=password,\
          homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid
          pass_filter = (&(objectClass=posixAccount)(uid=%u))
          default_pass_scheme = SSHA
        dict-sql: |
          # Managed by salt
          
      conf: 
        10-mail: |
          mail_location = maildir:~/Maildir
      
      confext:
        auth-deny: |
          passdb {
            driver = passwd-file
            deny = yes
  
            # File contains a list of usernames, one per line
            args = /etc/dovecot/deny-users
          }
  
      ssl_certs:
        one: |
          -----BEGIN CERTIFICATE-----
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          -----END CERTIFICATE-----
  
      ssl_keys:
        one |
          -----BEGIN RSA PRIVATE KEY-----
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          -----END RSA PRIVATE KEY-----