{{ ansible_managed | comment }}

# postfix integration and dovecot(lda) auth access


# Log a line for each authentication attempt failure.
auth_verbose = yes

service auth {

  # dovecot auth: Error: client doesn't have lookup permissions for this user:
  # userdb uid (15xx) doesn't match peer uid (1200) (to bypass this check,
  # set: service auth { unix_listener /run/dovecot/auth-userdb { mode=0777 } })
  unix_listener auth-userdb {
    user = vmail
    group = vmail
    mode = 0660
  }

  # allow auth service for postfix:

  # auth_socket_path points to this userdb socket by default. It's typically
  # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
  # full permissions to this socket are able to get a list of all usernames and
  # get the results of everyone's userdb lookups.
  #
  # The default 0666 mode allows anyone to connect to the socket, but the
  # userdb lookups will succeed only if the userdb returns an "uid" field that
  # matches the caller process's UID. Also if caller's uid or gid matches the
  # socket's uid or gid the lookup succeeds. Anything else causes a failure.
  #
  # To give the caller full permissions to lookup all users, set the mode to
  # something else than 0666 and Dovecot lets the kernel enforce the
  # permissions (e.g. 0777 allows everyone full permissions).
  #
  unix_listener /var/spool/postfix/private/dovecot-auth {
    # Assuming the default Postfix user and group
    user = postfix
    group = postfix
    mode = 0660
  }
}

