aboutsummaryrefslogblamecommitdiff
path: root/src/xyz/euandreh/queue.scm
blob: 79f17ab6e0c2f89bf3dd23d491b3a0ce60d50a6c (plain) (tree)
1
2
3
4
5
6
7
8
9
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
                                   
                                                                
                                                  
                                               


                                          
                              
                          
                                  
                              
                             
                           
                    
                                   
                                   

                                  

                                        
                                   

                                   
                                  

                                     
                                                
                                  
                                          

                                           
                                        
                                  
                                 
                                 
























                                                  
                                



















                                                      





                                      
 





                                                                                
 
 





























































































































                                                                                                                                       
















































































































































                                                                                                                 
                                                                      


                                                               
 










                                                                                
                                                                  






                                                   
                                                                   






















                                                   
                                         





                                                  
                                              

                                                                         




                                               


                                                                                             
                                                                                                

                                                                                         



                                                                                                     
                                                                                                      

                                                                                     

                                     

                                                                       
                                                 

                                             
                   
                       

                                                                          
                                             


                                      
                                                                                          
                                     
                                          
                                           



                                                 
                          

                                        

                                       



                                                                             
 

                                                 
                                       



                    
                                                  

                                         


                                              




                       
 

                                                 










































                                                                                          











                                                                             

                                              










                                                             
                                         





                                                 











                                                                                                          
                                                                                                                                  
                                                                                       




                                                    


         
 

           
 
                                 
 




                                                           








                                                   
                   
                                                                          







                                                   
                                                    
                                    


                                              












                                                    
                                                                               





                                                                             

                                                                                    






                                                                       
                                                                                   

                                             
                                                                                              







                                                          
                                                                                                                                 




                                          
 

                                                   



















                                                                                  

                        
                                    
                                              
                                            
                                                           






                                        
                                                   


                                                              
 
 
                                        
               
                        












                                                                              
                                         


 



































                                                                                                                          
                                                                                                                             

























































































































































































































































































































































































































































































































































































































                                                                                                                      
     
        
                     
(define-module (xyz euandreh queue)
  #:use-module ((gnu build linux-container) #:prefix container:)
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module ((srfi srfi-1) #:prefix srfi-1:)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system python)
  #:use-module (guix build-system trivial)
  #:use-module (guix download)
  #:use-module (guix gexp)
  #:use-module (guix git-download)
  #:use-module (guix packages)
  #:use-module (guix records)
  #:use-module (guix utils)
  #:use-module (gnu)
  #:use-module (gnu packages admin)
  #:use-module (gnu packages check)
  #:use-module (gnu packages cpio)
  #:use-module (gnu packages cups)
  #:use-module (gnu packages cyrus-sasl)
  #:use-module (gnu packages dbm)
  #:use-module (gnu packages image)
  #:use-module (gnu packages glib)
  #:use-module (gnu packages gnome)
  #:use-module (gnu packages mail)
  #:use-module (gnu packages m4)
  #:use-module (gnu packages onc-rpc)
  #:use-module (gnu packages package-management)
  #:use-module (gnu packages perl)
  #:use-module (gnu packages python-build)
  #:use-module (gnu packages python-crypto)
  #:use-module (gnu packages python-web)
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages time)
  #:use-module (gnu packages tls)
  #:use-module (gnu packages xml)
  #:use-module (gnu services shepherd)
  #:export (<shadow-group-configuration>
             shadow-group-configuration
             shadow-group-configuration-group

             shadow-group-activation
             shadow-group-accounts
             shadow-group-service-type


            <cyrus-service-configuration>
             cyrus-service-configuration
             cyrus-service-configuration-name
             cyrus-service-configuration-authmech
             cyrus-service-configuration-log-level

            <cyrus-sasl-configuration>
             cyrus-sasl-configuration
             cyrus-sasl-configuration-cyrus-sasl
             cyrus-sasl-configuration-authmech
             cyrus-sasl-configuration-services
             cyrus-sasl-configuration-state-dir

             cyrus-sasl-etc-files
             cyrus-sasl-activation
             cyrus-sasl-accounts
             cyrus-sasl-shepherd-service
             cyrus-sasl-service-type


            <dkimproxyout-configuration>
             dkimproxyout-configuration
             dkimproxyout-configuration-dkimproxy
             dkimproxyout-configuration-user
             dkimproxyout-configuration-group
             dkimproxyout-configuration-listen
             dkimproxyout-configuration-relay
             dkimproxyout-configuration-domains
             dkimproxyout-configuration-selector
             dkimproxyout-configuration-key-size
             dkimproxyout-configuration-data-directory

             dkimproxyout-etc-files
             dkimproxyout-accounts
             dkimproxyout-activation
             dkimproxyout-shepherd-service
             dkimproxyout-service-type

             postfix-service-type
             postfix-configuration

             dovecot2-service-type))



;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;; packages ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;



(define-public postfix
  (package
    (name "postfix")
    (version "3.8-20221023")
    (source
      (origin
        (method url-fetch)
        (uri
          (string-append
           "http://cdn.postfix.johnriley.me/mirrors/postfix-release/experimental/postfix-"
           version
           ".tar.gz"))
        (sha256
          (base32 "0aaylhn81n9z3kidx53kzf2jrilr3lgwfxsk1r4hn7nkrp62bcwm"))))
    (build-system gnu-build-system)
    (arguments
      (list
       #:tests? #f
       #:modules `((srfi srfi-26)
                   ,@%gnu-build-system-modules)
       #:phases
       #~(modify-phases %standard-phases
           (add-before 'configure 'patch-/bin/sh
             (lambda _
               (substitute* (find-files "." "^Makefile")
                 (("/bin/sh")
                  (which "sh")))))
           (add-before 'configure 'patch-bdb-include
             (lambda* (#:key inputs #:allow-other-keys)
               (substitute* "makedefs"
                 (("/usr/include")
                  (string-append (assoc-ref inputs "bdb")
                                 "/include")))))
           (add-before 'configure 'dont-hardcode-PATH
             (lambda _
               (substitute* '("postfix-install"
                              "conf/post-install")
                 (("^PATH=")
                  "# PATH="))))
           (add-before 'configure 'fix-strict-PATH
             (lambda _
               (substitute* "src/util/sys_defs.h"
                 (("^#define (ROOT_PATH|_PATH_DEFPATH|_PATH_STDPATH).*")
                    "#define ROOT_PATH \"/run/setuid-programs:/run/current-system/profile/bin:/run/current-system/profile/sbin\"\n"))))
           (add-before 'configure 'use-relative-symlink-to-store
             (lambda _
               (substitute* "postfix-install"
                 (("ln -sf")
                   "ln -rsf"))))
           (add-before 'configure 'fix-absolute-path-to-setuid-programs
             (lambda _
               (substitute* "conf/postfix-script"
                 (("\\$command_directory/postqueue")
                   "/run/setuid-programs/postqueue")
                 (("\\$command_directory/postdrop")
                   "/run/setuid-programs/postdrop"))))
           (add-before 'configure 'disable-warning-on-non-writable-config-files
             (lambda _
               (substitute* "conf/postfix-script"
                 (("find \\$todo \\\\\\( -perm -020 -o -perm -002 \\\\\\) \\\\\n")
                   " # find $todo \\( -perm -020 -o -perm -002 \\)"))))
           (add-before 'configure 'disable-write-to-/etc/postfix
             (lambda _
               (substitute* "src/postconf/postconf_edit.c"
                 (("pcf_set_config_dir.*")
                  "return;"))))
           (add-before 'configure 'setup-environment
             (lambda* (#:key outputs inputs #:allow-other-keys)
               (setenv "CCARGS" (string-append "-DUSE_TLS -DUSE_SASL_AUTH -DUSE_CYRUS_SASL -I"
                                               (assoc-ref inputs "cyrus-sasl")
                                               "/include/sasl"))
               (setenv "AUXLIBS" "-lnsl -lcrypto -lssl -lsasl2")
               (let* ((out  (assoc-ref outputs "out"))
                      (bin     (string-append out "/bin"))
                      (sbin    (string-append out "/sbin"))
                      (lib     (string-append out "/lib/postfix"))
                      (libexec (string-append out "/libexec/postfix"))
                      (etc     (string-append out "/etc/postfix"))
                      (man     (string-append out "/share/man"))
                      (doc     (string-append out "/share/doc/postfix-" #$version))
                      (html    (string-append doc "/html")))
                 (setenv "install_root"         "wip-prefix")
                 (setenv "newaliases_path"      (string-append bin  "/newaliases"))
                 (setenv "mailq_path"           (string-append bin  "/mailq"))
                 (setenv "sendmail_path"        (string-append sbin "/sendmail"))
                 (setenv "command_directory"    sbin)
                 (setenv "shlib_directory"      lib)
                 (setenv "daemon_directory"     libexec)
                 (setenv "meta_directory"       etc)
                 (setenv "sample_directory"     etc)
                 (setenv "manpage_directory"    man)
                 (setenv "readme_directory"     doc)
                 (setenv "html_directory"       html)
                 (setenv "sample_directory"     (string-append out "/share/postfix")))))
           (replace 'configure
             (lambda _
               (invoke "make" "makefiles"
                              "pie=yes"
                              "dynamicmaps=yes")))
           (replace 'install
             (lambda* (#:key outputs #:allow-other-keys)
               (let ((out (assoc-ref outputs "out")))
                 (invoke "make" "non-interactive-package")
                 (delete-file-recursively "wip-prefix/var")
                 (copy-recursively "wip-prefix/etc" (string-append out "/etc"))
                 (copy-recursively (string-append "wip-prefix" out) out)))))))
    (inputs
      (list bdb
            cyrus-sasl
            libnsl
            openssl
            perl))
    (native-inputs
      (list m4))
    (home-page "https://www.postfix.org")
    (synopsis "sendmail compatible MTA")
    (description
     "Postfix is Wietse Venema's mail server that started life at IBM research
as an alternative to the widely-used Sendmail program.  Now at Google, Wietse
continues to support Postfix.

Postfix attempts to be fast, easy to administer, and secure.  The outside has a
definite Sendmail-ish flavor, but the inside is completely different.")
    (license (list license:ibmpl1.0
                   license:epl2.0))))

(define-public python-pytest-tornado5
  (package
    (name "python-pytest-tornado5")
    (version "2.0.0")
    (source
      (origin
        (method url-fetch)
        (uri
          (pypi-uri "pytest-tornado5" version))
        (sha256
         (base32 "0qb62jw2w0xr6y942yp0qxiy755bismjfpnxaxjjm05gy2pymr8d"))))
    (build-system python-build-system)
    (propagated-inputs (list python-pytest python-tornado))
    (home-page "https://github.com/vidartf/pytest-tornado")
    (synopsis
     "A py.test plugin providing fixtures and markers to simplify testing of asynchronous tornado applications.")
    (description
     "This package provides a py.test plugin providing fixtures and markers to
simplify testing of asynchronous tornado applications.")
    (license license:asl2.0)))

;; FIXME
#;
(define-public python-futures
  (package
    (name "python-futures")
    (version "3.3.0")
    (source
      (origin
        (method url-fetch)
        (uri
          (pypi-uri "futures" version))
        (sha256
          (base32 "154pvaybk9ncyb1wpcnzgd7ayvvhhzk92ynsas7gadaydbvkl0vy"))))
    (build-system python-build-system)
    (home-page "https://github.com/agronholm/pythonfutures")
    (synopsis "Backport of the concurrent.futures package from Python 3")
    (description "Backport of the concurrent.futures package from Python 3")
    (license #f)))

(define-public python-ordereddict
  (package
    (name "python-ordereddict")
    (version "1.1")
    (source
      (origin
        (method url-fetch)
        (uri
          (pypi-uri "ordereddict" version))
        (sha256
          (base32 "07qvy11nvgxpzarrni3wrww3vpc9yafgi2bch4j2vvvc42nb8d8w"))))
    (build-system python-build-system)
    (arguments
      `(#:phases
        (modify-phases %standard-phases
          (delete 'sanity-check))))
    (home-page "UNKNOWN")
    (synopsis
     "A drop-in substitute for Py2.7's new collections.OrderedDict that works in Python 2.4-2.6.")
    (description "This package provides a drop-in substitute for Py2.7's new
collections.OrderedDict that works in Python 2.4-2.6.")
    (license #f)))

(define-public python-funcsigs
  (package
    (name "python-funcsigs")
    (version "1.0.2")
    (source
      (origin
        (method url-fetch)
        (uri
          (pypi-uri "funcsigs" version))
        (sha256
          (base32 "0l4g5818ffyfmfs1a924811azhjj8ax9xd1cffr1mzd3ycn0zfx7"))))
    (build-system python-build-system)
    (propagated-inputs
      (list python-ordereddict))
    (native-inputs
      (list python-unittest2))
    (home-page "http://funcsigs.readthedocs.org")
    (synopsis
     "Python function signatures from PEP362 for Python 2.6, 2.7 and 3.2+")
    (description
     "Python function signatures from PEP362 for Python 2.6, 2.7 and 3.2+")
    (license #f)))

(define-public python-apscheduler
  (package
    (name "python-apscheduler")
    (version "3.9.1")
    (source
      (origin
        (method url-fetch)
        (uri
          (pypi-uri "APScheduler" version))
        (sha256
          (base32 "1qzi1pr7q72vs49p7vr1mp350zaggs52lpq43lvqsjcmcd5mgrk5"))))
    (build-system python-build-system)
    (arguments
      `(#:tests? #f))
    (propagated-inputs
      (list python-funcsigs
            ; python-futures
            python-pytz
            python-setuptools
            python-six
            python-tzlocal))
    (native-inputs
      (list python-mock
            python-pytest
            python-pytest-asyncio
            python-pytest-cov
            python-pytest-tornado5
            python-setuptools-scm))
    (home-page "https://github.com/agronholm/apscheduler")
    (synopsis "In-process task scheduler with Cron-like capabilities")
    (description "In-process task scheduler with Cron-like capabilities")
    (license license:expat)))

(define-public python-telegram-bot
  (package
    (name "python-telegram-bot")
    (version "13.12")
    (source
      (origin
        (method url-fetch)
        (uri
          (pypi-uri "python-telegram-bot" version))
        (sha256
          (base32 "1rbdyr1f9mndlh83in47k8if65yp9n1dy4px2wipbf0qyjv5zxfs"))))
    (build-system python-build-system)
    (arguments
      `(#:tests? #f
        #:phases
        (modify-phases %standard-phases
          (delete 'sanity-check))))
    (native-inputs
      (list python-apscheduler))
    (propagated-inputs
      (list python-apscheduler
            python-cachetools
            python-certifi
            python-pytz
            python-tornado))
    (home-page "https://python-telegram-bot.org/")
    (synopsis "Python library to interface with the Telegram Bot API")
    (description "We have made you a wrapper you can't refuse")
    (license #f)))



;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;; services ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;



(define-record-type* <shadow-group-configuration>
  shadow-group-configuration
  make-shadow-group-configuration
  shadow-group-configuration?
  (group shadow-group-configuration-group (default "etc-shadow")))

(define (shadow-group-activation config)
  (match-record config <shadow-group-configuration>
      (group)
    #~(begin
        (use-modules (guix build utils))
        (format (current-error-port)
         "Setting ownership and permission for \"/etc/shadow\".~%")
        (chown "/etc/shadow"
               (passwd:uid (getpwnam "root"))
               (group:gid  (getgrnam #$group)))
        (chmod "/etc/shadow" #o640))))

(define (shadow-group-accounts config)
  (match-record config <shadow-group-configuration>
      (group)
    (list
     (user-group
       (name group)
       (system? #t)))))

(define shadow-group-service-type
  (service-type
    (name 'shadow-group)
    (extensions
      (list
       (service-extension activation-service-type
                          shadow-group-activation)
       (service-extension account-service-type
                          shadow-group-accounts)))
    (default-value (shadow-group-configuration))
    (description "FIXME:DOCUMENTATION")))


(define-record-type* <cyrus-service-configuration>
  cyrus-service-configuration
  make-cyrus-service-configuration
  cyrus-service-configuration?
  (name      cyrus-service-configuration-name)
  (authmech  cyrus-service-configuration-authmech  (default "saslauthd"))
  (log-level cyrus-service-configuration-log-level (default 7)))

(define-record-type* <cyrus-sasl-configuration>
  cyrus-sasl-configuration
  make-cyrus-sasl-configuration
  cyrus-sasl-configuration?
  (cyrus-sasl           cyrus-sasl-configuration-cyrus-sasl           (default cyrus-sasl))
  (user                 cyrus-sasl-configuration-user                 (default "cyrus-sasl"))
  (group                cyrus-sasl-configuration-group                (default "cyrus-sasl"))
  (supplementary-groups cyrus-sasl-configuration-supplementary-groups (default '("etc-shadow")))
  (authmech             cyrus-sasl-configuration-authmech             (default "shadow"))
  (services             cyrus-sasl-configuration-services             (default '()))
  (config-dirname       cyrus-sasl-configuration-config-dirname       (default "sasl2"))
  (run-directory        cyrus-sasl-configuration-run-directory        (default "/var/run/saslauthd"))
  (run-in-container?    cyrus-sasl-configuration-run-in-container?    (default #t))
  (container-name       cyrus-sasl-configuration-container-name       (default "saslauthd"))
  (container-namespaces cyrus-sasl-configuration-container-namespaces (default container:%namespaces))
  (extra-mappings       cyrus-sasl-configuration-extra-mappings       (default '())))


(define (cyrus-sasl-etc-files config)
  ;; FIXME: support opaque files
  ;; FIXME: extend this with postfix instead of making postfix add here
  (match-record config <cyrus-sasl-configuration>
      (services config-dirname run-directory)
    `((,config-dirname
       ,(file-union
         config-dirname
         (map (lambda (service-config)
                (match-record service-config <cyrus-service-configuration>
                    (name authmech log-level)
                  `(,name ,(plain-file
                            name
                            (format #f
                             "pwcheck_method: ~a~%saslauthd_path: ~a/mux~%log_level: ~a~%"
                             authmech
                             run-directory
                             log-level)))))
              services))))))

(define (cyrus-sasl-activation config)
  (match-record config <cyrus-sasl-configuration>
      (user run-directory)
    #~(begin
        (use-modules (guix build utils))
        (let ((user (getpwnam #$user)))
          (format (current-error-port)
           "Creating Cyrus SASL socket directory: \"~a\".~%" #$run-directory)
          (mkdir-p #$run-directory)
          (chown #$run-directory (passwd:uid user) (passwd:gid user))
          (chmod #$run-directory #o755)))))

(define (cyrus-sasl-accounts config)
  (match-record config <cyrus-sasl-configuration>
      (user group supplementary-groups)
    (list
     (user-account
       (name user)
       (group group)
       (supplementary-groups supplementary-groups)
       (comment "Cyrus SASL system user")
       (home-directory "/var/empty")
       (create-home-directory? #f)
       (shell
         (file-append shadow "/sbin/nologin"))
       (system? #t))
     (user-group
       (name group)
       (system? #t)))))


(define (cyrus-sasl-shepherd-service config)
  (match-record config <cyrus-sasl-configuration>
      (cyrus-sasl user group supplementary-groups authmech config-dirname run-directory
       services run-in-container? container-name container-namespaces extra-mappings)
    (let* ((config-dir (string-append "/etc/" config-dirname))
           (bin (file-append cyrus-sasl "/sbin/saslauthd"))
           (cmd (if (not run-in-container?)
                  bin
                  (least-authority-wrapper
                   bin
                   #:name container-name
                   #:mappings (append
                               (list
                                (file-system-mapping
                                  (source run-directory)
                                  (target source)
                                  (writable? #t))
                                (file-system-mapping
                                  (source "/etc/passwd")
                                  (target source))
                                (file-system-mapping
                                  (source "/etc/shadow")
                                  (target source)))
                                extra-mappings)
                   #:namespaces container-namespaces))))
      (list
       (shepherd-service
         (provision '(cyrus-sasl))
         (documentation "FIXME:DOCUMENTATION")
         (start #~(make-forkexec-constructor
                   (list #$cmd "-a" #$authmech "-d" "-m" #$run-directory)
                   #:user #$user
                   #:group #$group
                   #:supplementary-groups '(#$@supplementary-groups)))
         (stop #~(make-kill-destructor))
         (actions
           (list
            (shepherd-action
              (name 'configuration)
              (documentation "FIXME:DOCUMENTATION")
              (procedure
                #~(lambda _
                    (for-each (lambda (name)
                                (format #t "~a/~a~%" #$config-dir name))
                              (map cyrus-service-configuration-name #$services))))))))))))

(define cyrus-sasl-service-type
  (service-type
    (name 'cyrus-sasl)
    (extensions
      (list
       (service-extension etc-service-type
                          cyrus-sasl-etc-files)
       (service-extension activation-service-type
                          cyrus-sasl-activation)
       (service-extension profile-service-type
                          (compose list cyrus-sasl-configuration-cyrus-sasl))
       (service-extension account-service-type
                          cyrus-sasl-accounts)
       (service-extension shepherd-root-service-type
                          cyrus-sasl-shepherd-service)))
    (compose srfi-1:concatenate)
    (extend (lambda (config services)
              (cyrus-sasl-configuration
                (inherit config)
                (services
                  (append
                   (cyrus-sasl-configuration-services config)
                   services)))))
    (default-value (cyrus-sasl-configuration))
    (description "FIXME:DOCUMENTATION")))


(define-record-type* <dkimproxyout-configuration>
  dkimproxyout-configuration
  make-dkimproxyout-configuration
  dkimproxyout-configuration?
  (dkimproxy            dkimproxyout-configuration-dkimproxy            (default dkimproxy))
  (user                 dkimproxyout-configuration-user                 (default "dkimproxyout"))
  (group                dkimproxyout-configuration-group                (default "dkimproxyout"))
  (config-name          dkimproxyout-configuration-config-name          (default "dkimproxyout.conf"))
  (listen               dkimproxyout-configuration-listen               (default "127.0.0.1:10027"))
  (relay                dkimproxyout-configuration-relay                (default "127.0.0.1:10028"))
  (domains              dkimproxyout-configuration-domains              (default (list (gethostname))))
  (selector             dkimproxyout-configuration-selector             (default "dkimproxyout"))
  (key-size             dkimproxyout-configuration-key-size             (default 2048))
  (data-directory       dkimproxyout-configuration-data-directory       (default "/var/lib/dkimproxyout"))
  (run-in-container?    dkimproxyout-configuration-run-in-container?    (default #f))
  (container-name       dkimproxyout-configuration-container-name       (default "dkimproxyout"))
  (container-namespaces dkimproxyout-configuration-container-namespaces (default (srfi-1:fold delq container:%namespaces '(net))))
  (extra-mappings       dkimproxyout-configuration-extra-mappings       (default '())))

(define (generate-out.cf config)
  (match-record config <dkimproxyout-configuration>
      (listen relay domains selector data-directory)
    (format #f
"
listen ~a
relay ~a

domain ~a
selector ~a

signature dkim(c=relaxed/relaxed)

# FIXME:DOCUMENTATION add this to the service documentation
# the corresponding public key is available at:
# ~a/public.key
keyfile ~a/private.key
"
       listen
       relay
       (string-join domains ",")
       selector
       data-directory
       data-directory)))

(define (dkimproxyout-etc-files config)
  (match-record config <dkimproxyout-configuration>
      (config-name)
    `((,config-name ,(plain-file config-name (generate-out.cf config))))))

(define (dkimproxyout-accounts config)
  (match-record config <dkimproxyout-configuration>
      (user group)
    (list
     (user-account
       (name user)
       (group group)
       (comment "DKIMproxy.out signing system user")
       (home-directory "/var/empty")
       (create-home-directory? #f)
       (shell
         (file-append shadow "/sbin/nologin"))
       (system? #t))
     (user-group
       (name group)
       (system? #t)))))

(define (dkimproxyout-activation config)
  (match-record config <dkimproxyout-configuration>
      (user group data-directory key-size)
    #~(begin
        (use-modules (guix build utils))
        (let ((uid (passwd:uid (getpwnam #$user)))
              (gid (group:gid  (getgrnam #$group))))
          (format (current-error-port)
           "Creating DKIMproxy.out data directory: \"~a\".~%" #$data-directory)
          (mkdir-p #$data-directory)
          (chown #$data-directory uid gid)
          (chmod #$data-directory #o755)
          (let ((private-key (string-append #$data-directory "/private.key"))
                (public-key  (string-append #$data-directory "/public.key")))
            (unless (file-exists? private-key)
              (format (current-error-port)
               "The public/private keypair doesn't exist yet.  Generating one...~%")
              (cond
                ((zero? (system* #$(file-append openssl "/bin/openssl")
                                 "genrsa"
                                 "-out"
                                 private-key
                                 (number->string #$key-size)))
                 (format (current-error-port)
                  "DKIMproxy.out private key file created: \"~a\".~%" private-key))
                (else
                 (format (current-error-port)
                  "Failed to create DKIMproxy.out private key file: \"~a\".~%" private-key))))
            (invoke #$(file-append openssl "/bin/openssl")
                    "rsa"
                    "-in"
                    private-key
                    "-pubout"
                    "-out"
                    public-key)
            (format (current-error-port)
             "Setting permissions for the public/private DKIMproxy.out keypair: \"~a/{public,private}.key\".~%" #$data-directory)
            (chown private-key uid gid)
            (chown public-key  uid gid)
            (chmod private-key #o400)
            (chmod public-key  #o644))))))


(define (dkimproxyout-shepherd-service config)
  (match-record config <dkimproxyout-configuration>
      (dkimproxy user group config-name data-directory
       run-in-container? container-name container-namespaces extra-mappings)
    (let* ((config-file (string-append "/etc/" config-name))
           (bin (file-append dkimproxy "/bin/dkimproxy.out"))
           (cmd (if (not run-in-container?)
                  bin
                  (least-authority-wrapper
                   bin
                   #:name container-name
                   #:mappings (append
                               (list
                                (file-system-mapping
                                  (source config-file)
                                  (target source))
                                (file-system-mapping
                                  (source
                                    (string-append data-directory "/private.key"))
                                  (target source)))
                               extra-mappings)
                   #:namespaces container-namespaces))))
      (list
       (shepherd-service
         (provision '(dkimproxyout))
         (documentation "FIXME:DOCUMENTATION")
         (start #~(make-forkexec-constructor
                   (list #$cmd "--conf_file" #$config-file)
                   #:user  #$user
                   #:group #$group))
         (stop #~(make-kill-destructor))
         (actions
           (list
            (shepherd-action
              (name 'configuration)
              (documentation "FIXME:DOCUMENTATION")
              (procedure
                #~(lambda _
                    (format #t "~a~%" #$config-file)))))))))))


(define-public dkimproxyout-service-type
  (service-type
    (name 'dkimproxyout)
    (extensions
      (list
       (service-extension etc-service-type
                          dkimproxyout-etc-files)
       (service-extension account-service-type
                          dkimproxyout-accounts)
       (service-extension activation-service-type
                          dkimproxyout-activation)
       (service-extension profile-service-type
                          (compose list dkimproxyout-configuration-dkimproxy))
       (service-extension shepherd-root-service-type
                          dkimproxyout-shepherd-service)))
    (default-value (dkimproxyout-configuration))
    (description "FIXME:DOCUMENTATION")))











;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Postfix ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;



(define-record-type* <postfix-configuration>
  postfix-configuration
  make-postfix-configuration
  postfix-configuration?
  (postfix              postfix-configuration-postfix              (default postfix))
  (set-sendmail?        postfix-configuration-set-sendmail?        (default #t))
  (master.cf-file       postfix-configuration-master.cf-file       (default #f))
  (main.cf-file         postfix-configuration-main.cf-file         (default #f))
  (master.cf-extra      postfix-configuration-master.cf-extra      (default ""))
  (main.cf-extra        postfix-configuration-main.cf-extra        (default ""))
  (config-dirname       postfix-configuration-config-dirname       (default "postfix"))
  (data-directory       postfix-configuration-data-directory       (default "/var/lib/postfix"))
  (queue-directory      postfix-configuration-queue-directory      (default "/var/spool/postfix"))
  (user                 postfix-configuration-user                 (default "postfix"))
  (group                postfix-configuration-group                (default "postfix"))
  (setgid-group         postfix-configuration-setgid-group         (default "postdrop"))
  (root-aliases         postfix-configuration-root-aliases         (default '("abuse" "admin" "hostmaster" "postmaster")))
  (cert-file            postfix-configuration-cert-file            (default #f))
  (key-file             postfix-configuration-key-file             (default #f))
  (hostname             postfix-configuration-hostname             (default (gethostname)))
  (run-in-container?    postfix-configuration-run-in-container?    (default #f))
  (container-name       postfix-configuration-container-name       (default "postfix"))
  (container-namespaces postfix-configuration-container-namespaces (default (srfi-1:fold delq container:%namespaces '(net))))
  (extra-mappings       postfix-configuration-extra-mappings       (default '())))

; FIXME: hardcoded value of dkimproxy listen and relay
(define (generate-master.cf config)
  (match-record config <postfix-configuration>
      (master.cf-extra)
    (format #f
     #"-
       # ============================================================================================================
       # service   type       private  unpriv  chroot  wakeup   maxproc  command + args
       #                      (yes)    (yes)   (no)    (never)  (100)
       # =============================================================================================================


       anvil       unix       -        -       n       -        1        anvil
       bounce      unix       -        -       n       -        0        bounce
       cleanup     unix       n        -       n       -        0        cleanup
       defer       unix       -        -       n       -        0        bounce
       discard     unix       -        -       n       -        -        discard
       error       unix       -        -       n       -        -        error
       flush       unix       n        -       n       1000?    0        flush
       lmtp        unix       -        -       n       -        -        lmtp
       local       unix       -        n       n       -        -        local
       # FIXME: replace 127.0.0.1 with localhost
       pickup      unix       n        -       n       60       1        pickup
         -o content_filter=dksign:[127.0.0.1]:10027
       proxymap    unix       -        -       n       -        -        proxymap
       proxywrite  unix       -        -       n       -        1        proxymap
       qmgr        unix       n        -       n       300      1        qmgr
       relay       unix       -        -       n       -        -        smtp  -o syslog_name=postfix/relay
       retry       unix       -        -       n       -        -        error
       rewrite     unix       -        -       n       -        -        trivial-rewrite
       scache      unix       -        -       n       -        1        scache
       showq       unix       n        -       n       -        -        showq
       smtp        inet       n        -       n       -        -        smtpd -o syslog_name=postfix/smtp
       smtp        unix       -        -       n       -        -        smtp
       submission  inet       n        -       n       -        -        smtpd -o syslog_name=postfix/submission
         -o smtpd_tls_security_level=encrypt
         -o content_filter=dksign:[127.0.0.1]:10027
       tlsmgr      unix       -        -       n       1000?    1        tlsmgr
       trace       unix       -        -       n       -        0        bounce
       verify      unix       -        -       n       -        1        verify
       virtual     unix       -        n       n       -        -        virtual
       postlog     unix-dgram n        -       n       -        1        postlogd

       # FIXME: doesn't work for sendmail -t in localhost
       dksign      unix       -        -       n       -        -        smtp
         -o syslog_name=postfix/dkimproxyout-listen
         -o smtp_send_xforward_command=yes
         -o smtp_discard_ehlo_keywords=8bitmime,starttls
       127.0.0.1:10028 inet   n        -       n       -        -        smtpd
         -o syslog_name=postfix/dkimproxyout-relay
         -o content_filter=
         -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
         -o smtpd_helo_restrictions=
         -o smtpd_client_restrictions=
         -o smtpd_sender_restrictions=
         -o smtpd_recipient_restrictions=permit_mynetworks,reject
         -o mynetworks=127.0.0.0/8
         -o smtpd_authorized_xforward_hosts=127.0.0.0/8
       ~a
       "#
     master.cf-extra)))

(define (cert-for config)
  (match-record config <postfix-configuration>
      (cert-file hostname)
    (or cert-file (format #f "/etc/letsencrypt/live/~a/fullchain.pem" hostname))))

(define (key-for config)
  (match-record config <postfix-configuration>
      (key-file hostname)
    (or key-file (format #f "/etc/letsencrypt/live/~a/privkey.pem" hostname))))

(define (generate-main.cf config)
  (match-record config <postfix-configuration>
      (postfix queue-directory data-directory user setgid-group hostname main.cf-extra)
    (format #f
     #"-
       compatibility_level = 3.6

       queue_directory = ~a
       data_directory = ~a
       mail_owner = ~a
       setgid_group = ~a

       myhostname = ~a
       mydestination = $myhostname, $mydomain, localhost.$mydomain, localhost

       alias_maps = hash:/etc/aliases
       # alias_maps = hash:/etc/aliases, static:andreh

       mail_spoo_directory = /var/mail/

       header_checks = regexp:{ { /^Received:.*/ IGNORE }, { /^X-Originating-IP:.*/ IGNORE } }

       smtpd_use_tls = yes
       smtpd_tls_cert_file = ~a
       smtpd_tls_key_file  = ~a
       smtp_use_tls       = $smtpd_use_tls
       smtp_tls_cert_file = $smtpd_tls_cert_file
       smtp_tls_key_file  = $smtpd_tls_key_file

       smtp_tls_security_level  = may

       recipient_delimiter = +

       # smtpd_sasl_security_options = FIXME: deny all
       smtpd_sasl_tls_security_options = noanonymous
       # FIXME: shouldn't this be "encrypt"?
       smtpd_tls_security_level = may
       smtpd_tls_auth_only = yes

       smtpd_relay_restrictions = $smtpd_recipient_restrictions
       smtpd_recipient_restrictions = permit_mynetworks,
         permit_sasl_authenticated, reject_unauth_destination
       smtpd_sasl_auth_enable = yes
       cyrus_sasl_config_path = /etc/sasl2
       debug_peer_list = 127.0.0.1

       milter_default_action = accept
       # smtpd_milters = FIXME
       ~a
       "#
     queue-directory
     data-directory
     user
     setgid-group
     hostname

     (cert-for config)
     (key-for  config)
     main.cf-extra)))

(define (postfix-etc-files config)
  (match-record config <postfix-configuration>
      (master.cf-file main.cf-file config-dirname)
    `((,config-dirname
       ,(file-union
         config-dirname
         `(("master.cf" ,(plain-file "master.cf" (or master.cf-file (generate-master.cf config))))
           ("main.cf"   ,(plain-file "main.cf"   (or main.cf-file   (generate-main.cf   config))))))))))

(define (postfix-accounts config)
  (match-record config <postfix-configuration>
      (user group setgid-group)
    (list
     (user-account
       (name user)
       (group group)
       (comment "Postfix system user")
       (home-directory "/var/empty")
       (create-home-directory? #f)
       (shell
         (file-append shadow "/sbin/nologin"))
       (system? #t))
     (user-group
       (name group)
       (system? #t))
     (user-group
       (name setgid-group)
       (system? #t)))))

(define (postfix-setuid-programs config)
  (match-record config <postfix-configuration>
      (postfix setgid-group set-sendmail?)
    (append
     (list
      (setuid-program
        (program (file-append postfix "/sbin/postdrop"))
        (setuid? #f)
        (setgid? #t)
        (group setgid-group))
      (setuid-program
        (program (file-append postfix "/sbin/postqueue"))
        (setuid? #f)
        (setgid? #t)
        (group setgid-group)))
     (if set-sendmail?
       (list
        (setuid-program
          (program (file-append postfix "/sbin/sendmail"))
          (setuid? #f)
          (setgid? #t)
          (group setgid-group)))
       '()))))

(define (postfix-activation config)
  (match-record config <postfix-configuration>
      (queue-directory)
    #~(begin
        (use-modules (guix build utils))
        (let ((user (getpwnam "root")))
          (format (current-error-port)
           "Creating Postfix queue directory: \"~a\".~%" #$queue-directory)
          (mkdir-p #$queue-directory)
          (chown #$queue-directory (passwd:uid user) (passwd:gid user))
          (chmod #$queue-directory #o755)
          (format (current-error-port)
           "Creating email spool director: \"/var/mail\".~%")
          (mkdir-p "/var/mail")
          (format (current-error-port)
           "Updating /etc/aliases: FIXME.~%")
          ;; FIXME: add -c option
#;
          (invoke #$(file-append postfix "/sbin/postalias") "/etc/aliases")))))

(define (postfix-shepherd-service config)
  (match-record config <postfix-configuration>
      (postfix config-dirname data-directory queue-directory
       run-in-container? container-name container-namespaces extra-mappings)
    (let* ((config-dir (string-append "/etc/" config-dirname))
           (bin (file-append postfix "/sbin/postfix"))
           (cmd (if (not run-in-container?)
                  bin
                  (least-authority-wrapper
                   bin
                   #:name container-name
                   #:mappings (append
                               (list
                                (file-system-mapping
                                  (source data-directory)
                                  (target source)
                                  (writable? #t))
                                (file-system-mapping
                                  (source queue-directory)
                                  (target source)
                                  (writable? #t)))
                                extra-mappings)
                   #:namespaces container-namespaces))))
      (list
       (shepherd-service
         (provision '(postfix))
         (documentation
           #"-
             Run the Postfix MTA.

             This is the entrypoint for starting the "master" process.  Then the
             "master" process itself takes responsability of starting all the
             required daemons and commands."#)
         (start #~(make-forkexec-constructor
                   (list
                    #$(file-append postfix "/sbin/postfix")
                    "-c"
                    #$config-dir
                    "start-fg")
                   #:pid-file "/var/lib/postfix/master.lock"))
         (stop #~(make-kill-destructor SIGKILL))
         (actions
           (list
            (shepherd-action
              (name 'configuration)
              (documentation
                #"-
                  FIXME:DOCUMENTATION
                  "#)
              (procedure
                #~(lambda _
                    (format #t "~a/master.cf~%" #$config-dir)
                    (format #t "~a/main.cf~%"   #$config-dir))))
            (shepherd-action
              (name 'reload)
              (documentation
                #"-
                  Re-read the "master.cf" and "main.cf" configuration files.

                  Daemon processes terminate when possible, and when restarted
                  use the values of the new configuration files.

                  This live-reload option is usually preferable over a stop/start
                  cycle, as it incurs in no interruption of the running service."#)
              (procedure
                #~(lambda _
                    (invoke #$(file-append postfix "/sbin/postfix")
                            "-c"
                            #$config-dir
                            "reload")))))))))))

(define (postfix-aliases config)
  (match-record config <postfix-configuration>
      (root-aliases)
    (map (lambda (alias)
           `(,alias "root"))
         root-aliases)))


(define (postfix-nginx-locations config)
  (match-record config <postfix-configuration>)
      (hostname)
    (nginx-server-configuration
      (server-name (list (string-append "mta-sts." hostname)))
      (listen '("[::]:443 ssl http2" "443 ssl http2"))
      (ssl-certificate     (cert-for config))
      (ssl-certificate-key (key-for  config))
      (locations
        (list
         (nginx-location-configuration
           (uri "= /.well-known/mta-sts.txt")
           (body
             (list
              (list "alias "
                    (plain-file
                     "mta-sts.txt"
                     (format #f #"-
                        version: STSv1
                        mode: enforce
                        mx: ~a
                        max_age: 604800
                        "#
                      hostname))
                    ";"))))))))

(define (postfix-certificates config)
  (match-record config <postfix-configuration>
      (hostname)
    (list
     (certificate-configuration
       (domains (list hostname (string-append "mta-sts." hostname)))))))

(define (postfix-sasl-service _config)
  (list
   (cyrus-service-configuration
     (name "smtpd.conf"))))


(define postfix-service-type
  (service-type
    (name 'postfix)
    (extensions
      (list
       (service-extension etc-service-type
                          postfix-etc-files)
       (service-extension account-service-type
                          postfix-accounts)
       (service-extension setuid-program-service-type
                          postfix-setuid-programs)
       (service-extension activation-service-type
                          postfix-activation)
       (service-extension mail-aliases-service-type
                          postfix-aliases)
       (service-extension profile-service-type
                          (compose list postfix-configuration-postfix))
       (service-extension shepherd-root-service-type
                          postfix-shepherd-service)
       (service-extension nginx-service-type
                          postfix-nginx-locations)
       (service-extension certbot-service-type
                          postfix-certificates)
       (service-extension cyrus-sasl-service-type
                          postfix-sasl-services)))
    (default-value (postfix-configuration))
    (description
      #"-
        Run the Postfix MTA.

        This is the top-level system service for Postfix.

        It includes:
        - populating /etc/postfix/ with read-only configuration files;
        - the user and groups used by Postfix when handling email delivery;
        - the special setgid binaries for daily usage, such as "sendmail";
        - the Shepherd service for starting, stopping and *reloading* the
          service without restarting it;
        - the activation script for creating the required directories and
          configuring them with the correct permissions;
        - the binaries in the system profile so that one doesn't need to explicilty
          include the package when the service is already enabled.

        An extension to the log-rotation service isn't included: the default
        rottlog configuration already includes /var/log/maillog in its routine,
        so it is kept out.

        The defaults of <postfix-configuration> provide sane default values for
        most things, such as group names, data and queue directories, etc.  When
        used as-is, it creates a Postfix server that sends email from local users
        of the domain provided by "/etc/hostname"."#)))



;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Dovecot ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;



(define-record-type* <dovecot2-configuration>
  dovecot2-configuration
  make-dovecot2-configuration
  dovecot2-configuration?
  (dovecot2          dovecot2-configuration-dovecot2          (default dovecot))
  (raw-file          dovecot2-configuration-raw-file          (default #f))
  (extra-content     dovecot2-configuration-extra-content     (default ""))
  (config-name       dovecot2-configuration-config-name       (default "dovecot2.conf"))
  (user              dovecot2-configuration-user              (default "dovecot2"))
  (group             dovecot2-configuration-group             (default "dovecot2"))
  (auth-worker-group dovecot2-configuration-auth-worker-group (default "etc-shadow"))
  (untrusted-user    dovecot2-configuration-untrusted-user    (default "dovenull2"))
  (untrusted-group   dovecot2-configuration-untrusted-group   (default "dovenull2"))
  (base-dir          dovecot2-configuration-base-dir          (default "/var/run/dovecot2"))
  (state-dir         dovecot2-configuration-state-dir         (default "/var/lib/dovecot2"))
  (hostname          dovecot2-configuration-hostname          (default (gethostname))))

(define (generate-dovecot-config config)
  (match-record config <dovecot2-configuration>
      (user group auth-worker-group untrusted-user
       hostname base-dir state-dir extra-content)
    (format #f
     #"-
       protocols = imap

       default_internal_user = ~a
       default_internal_group = ~a
       default_login_user = ~a
       auth_mechanisms = plain login
       auth_username_format = %n

       passdb {
         driver = shadow
       }
       userdb {
         driver = passwd
       }
       service auth-worker {
         group = ~a
       }


       ssl = required
       ssl_cert = </etc/letsencrypt/live/~a/fullchain.pem
       ssl_key  = </etc/letsencrypt/live/~a/privkey.pem
       ssl_dh = <~a/dhparam.pem

       base_dir = ~a
       state_dir = ~a

       verbose_proctitle = yes

       # FIXMEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
       # mail_location = maildir:~~/Mail:INBOX=~~/Mail/Inbox:LAYOUT=fs
       # mail_location = maildir:~~/Mail:INBOX=~~/Mail/Inbox:LAYOUT=fs

       # FIXME:
       # mail_plugins


       namespace inbox {
         inbox = yes
         mailbox Drafts {
           special_use = \Drafts
           auto = subscribe
         }
         mailbox Sent {
           special_use = \Sent
           auto = subscribe
         }
         mailbox Archive {
           special_use = \Archive
           auto = subscribe
         }
         mailbox Spam {
           special_use = \Junk
           auto = subscribe
           autoexpunge = 30d
         }
         mailbox Trash {
           special_use = \Trash
           auto = subscribe
         }
       }
       ~a
       "#
     user
     group
     untrusted-user
     auth-worker-group
     hostname
     hostname
     state-dir
     base-dir
     state-dir
     extra-content)))

(define (dovecot2-etc-files config)
  (match-record config <dovecot2-configuration>
      (raw-file config-name)
    `((,config-name ,(plain-file config-name
                                 (or raw-file
                                     (generate-dovecot-config config)))))))

(define (dovecot2-accounts config)
  (match-record config <dovecot2-configuration>
      (user group untrusted-user untrusted-group)
    (list
     (user-account
       (name user)
       (group group)
       (comment "Dovecot system user")
       (home-directory "/var/empty")
       (create-home-directory? #f)
       (shell
         (file-append shadow "/sbin/nologin"))
       (system? #t))
     (user-account
       (name untrusted-user)
       (group untrusted-group)
       (comment "Dovecot user for untrusted logins")
       (home-directory "/var/empty")
       (create-home-directory? #f)
       (shell
         (file-append shadow "/sbin/nologin"))
       (system? #t))
     (user-group
       (name group)
       (system? #t))
     (user-group
       (name untrusted-group)
       (system? #t)))))

(define (dovecot2-activation config)
  (match-record config <dovecot2-configuration>
      (base-dir state-dir)
    #~(begin
        (use-modules (guix build utils))
        (let ((user (getpwnam "root")))
          (format (current-error-port)
           "Creating Dovecot base_dir directory: \"~a\".~%" #$base-dir)
          (mkdir-p #$base-dir)
          (let ((dhparam.pem (string-append #$state-dir "/dhparam.pem")))
            (unless (file-exists? dhparam.pem)
              (format (current-error-port)
               "dhparam.pem file doesn't exist yet.  Generating one...~%")
              (cond
               ((zero? (system* (string-append #$openssl "/bin/openssl")
                                "dhparam" "-out" dhparam.pem "2048"))
                (format (current-error-port)
                 "Dovecot2 dhparam.pem file created: \"~a\".~%" dhparam.pem))
               (else
                (format (current-error-port)
                        "Failed to create dhparam.pem file: \"~a\".~%" dhparam.pem)))))))))

(define (dovecot2-shepherd-service config)
  (match-record config <dovecot2-configuration>
      (dovecot2 config-name)
    (let ((config-file (string-append "/etc/" config-name)))
      (list
       (shepherd-service
         (provision '(dovecot2))
         (documentation "FIXME:DOCUMENTATION: heredoc syntax")
         (start #~(make-forkexec-constructor
                   (list
                    #$(file-append dovecot2 "/sbin/dovecot")
                    "-F"
                    "-c"
                    #$config-file)))
         (stop #~(make-kill-destructor))
         (actions
           (list
            (shepherd-action
              (name 'configuration)
              (documentation "FIXME:DOCUMENTATION: heredoc syntax")
              (procedure
                #~(lambda _
                    (format #t "~a~%" #$config-file))))
            (shepherd-action
              (name 'reload)
              (documentation "FIXME:DOCUMENTATION: heredoc syntax")
              (procedure
                #~(lambda _
                    (invoke #$(file-append dovecot "/bin/doveadm")
                            "-c"
                            #$config-file
                            "reload")))))))))))

(define dovecot2-service-type
  (service-type
    (name 'dovecot2)
    (extensions
      (list
       (service-extension etc-service-type
                          dovecot2-etc-files)
       (service-extension account-service-type
                          dovecot2-accounts)
       (service-extension activation-service-type
                          dovecot2-activation)
       (service-extension profile-service-type
                          (compose list dovecot2-configuration-dovecot2))
       (service-extension shepherd-root-service-type
                          dovecot2-shepherd-service)))
    (default-value (dovecot2-configuration))
    (description "FIXME:DOCUMENTATION: heredoc syntax")))

;; FIXME
;; automate personal server with:
;; - euandreh:git-service-type
;; - euandreh:mail-service-type

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; OS ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;



(list
 postfix
 python-telegram-bot)