From 8063b671cbb7edb8cdf29004c7d82a22c8e55b66 Mon Sep 17 00:00:00 2001
From: DerLinkman <niklas.meyer@servercow.de>
Date: Tue, 12 Aug 2025 16:35:00 +0200
Subject: [PATCH 1/7] indev: dovecot 2.4 config migration

---
 data/Dockerfiles/dovecot/Dockerfile           |   2 +-
 data/Dockerfiles/dovecot/docker-entrypoint.sh |   6 +-
 data/conf/dovecot/dovecot.conf                | 230 ++++++++++--------
 data/conf/dovecot/dovecot.folders.conf        |   1 -
 4 files changed, 141 insertions(+), 98 deletions(-)

diff --git a/data/Dockerfiles/dovecot/Dockerfile b/data/Dockerfiles/dovecot/Dockerfile
index f1152c8a1..109acaea2 100644
--- a/data/Dockerfiles/dovecot/Dockerfile
+++ b/data/Dockerfiles/dovecot/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.22
 
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh
index e58abbb6a..4e646fb8c 100755
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -108,7 +108,11 @@ map {
 }
 EOF
 
-echo -n ${ACL_ANYONE} > /etc/dovecot/acl_anyone
+if [[ "${ACL_ANYONE}" == "allow" ]]; then
+  echo -n "yes" > /etc/dovecot/acl_anyone
+else
+  echo -n "no" > /etc/dovecot/acl_anyone
+fi
 
 if [[ "${SKIP_FTS}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
 echo -e "\e[33mDetecting SKIP_FTS=y... not enabling Flatcurve (FTS) then...\e[0m"
diff --git a/data/conf/dovecot/dovecot.conf b/data/conf/dovecot/dovecot.conf
index 05d9264fa..48b70e21d 100644
--- a/data/conf/dovecot/dovecot.conf
+++ b/data/conf/dovecot/dovecot.conf
@@ -7,12 +7,17 @@
 #  driver = ldap
 #}
 
+dovecot_config_version = 2.4.0
+dovecot_storage_version = 2.4.0
+
+listen = *,[::]
+
 auth_mechanisms = plain login
 #mail_debug = yes
 #auth_debug = yes
 #log_debug = category=fts-flatcurve # Activate Logging for Flatcurve FTS Searchings
 log_path = syslog
-disable_plaintext_auth = yes
+auth_allow_cleartext = yes
 # Uncomment on NFS share
 #mmap_disable = yes
 #mail_fsync = always
@@ -20,30 +25,36 @@ disable_plaintext_auth = yes
 #mail_nfs_storage = yes
 login_log_format_elements = "user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k"
 mail_home = /var/vmail/%d/%n
-mail_location = maildir:~/
+mail_driver = maildir
+mail_path = ~/
+mail_index_path = /var/vmail_index/${user}
 mail_plugins = </etc/dovecot/mail_plugins
-mail_attachment_fs = crypt:set_prefix=mail_crypt_global:posix:
-mail_attachment_dir = /var/attachments
-mail_attachment_min_size = 128k
+
+fs mail_ext_attachment {
+  fs_driver = posix
+  mail_ext_attachment_path = /var/attachments
+  mail_ext_attachment_min_size = 128k
+}
+
+
 # Significantly speeds up very large mailboxes, but is only safe to enable if
 # you do not manually modify the files in the `cur` directories in
 # mailcowdockerized_vmail-vol-1.
 # https://docs.mailcow.email/manual-guides/Dovecot/u_e-dovecot-performance/
 maildir_very_dirty_syncs = yes
 
-# Dovecot 2.2
-#ssl_protocols = !SSLv3
-# Dovecot 2.3
 ssl_min_protocol = TLSv1.2
 
-ssl_prefer_server_ciphers = yes
-ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL:!3DES:!MD5:!PSK:!DSS:!RC4:!SEED:!IDEA:+HIGH:+MEDIUM
+ssl_server {
+  prefer_ciphers = server
+  dh_file = /etc/ssl/mail/dhparams.pem
+  cert_file = /etc/ssl/mail/cert.pem
+  key_file = /etc/ssl/mail/key.pem
+}
 
-# Default in Dovecot 2.3
+ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL:!3DES:!MD5:!PSK:!DSS:!RC4:!SEED:!IDEA:+HIGH:+MEDIUM
 ssl_options = no_compression no_ticket
 
-# New in Dovecot 2.3
-ssl_dh = </etc/ssl/mail/dhparams.pem
 # Dovecot 2.2
 #ssl_dh_parameters_length = 2048
 log_timestamp = "%Y-%m-%d %H:%M:%S "
@@ -51,29 +62,35 @@ recipient_delimiter = +
 auth_master_user_separator = *
 mail_shared_explicit_inbox = yes
 mail_prefetch_count = 30
-passdb {
-  driver = lua
-  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%s:%u:%w
-  result_success = return-ok
-  result_failure = continue
-  result_internalfail = continue
+passdb lua {
+  fields {
+    driver = lua
+    args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%s:%u:%w
+    result_success = return-ok
+    result_failure = continue
+    result_internalfail = continue
+  }
 }
 # try a master passwd
-passdb {
-  driver = passwd-file
-  args = /etc/dovecot/dovecot-master.passwd
-  master = yes
-  skip = authenticated
+passdb master {
+  fields {
+    driver = passwd-file
+    args = /etc/dovecot/dovecot-master.passwd
+    master = yes
+    skip = authenticated
+  }
 }
 # check for regular password - if empty (e.g. force-passwd-reset), previous pass=yes passdbs also fail
 # a return of the following passdb is mandatory
-passdb {
-  driver = lua
-  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes
+passdb empty-lua {
+  fields {
+    driver = lua
+    args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes
+  }
 }
 # Set doveadm_password=your-secret-password in data/conf/dovecot/extra.conf (create if missing)
 service doveadm {
-  inet_listener {
+  inet_listener doveadm {
     port = 12345
   }
   vsz_limit=2048 MB
@@ -119,12 +136,12 @@ service managesieve-login {
     port = 14190
     haproxy = yes
   }
-  service_count = 1
+  service_restart_request_count = 1
   process_min_avail = 2
   vsz_limit = 1G
 }
 service imap-login {
-  service_count = 1
+  service_restart_request_count = 1
   process_min_avail = 2
   process_limit = 10000
   vsz_limit = 1G
@@ -140,7 +157,7 @@ service imap-login {
   }
 }
 service pop3-login {
-  service_count = 1
+  service_restart_request_count = 1
   process_min_avail = 1
   vsz_limit = 1G
   inet_listener pop3_haproxy {
@@ -167,23 +184,31 @@ service lmtp {
   }
   user = vmail
 }
-listen = *,[::]
-ssl_cert = </etc/ssl/mail/cert.pem
-ssl_key = </etc/ssl/mail/key.pem
-userdb {
-  driver = passwd-file
-  args = /etc/dovecot/dovecot-master.userdb
+
+userdb master-userdb {
+  fields {
+    driver = passwd-file
+    args = /etc/dovecot/dovecot-master.userdb
+  }
 }
-userdb {
-  args = /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
-  driver = sql
-  skip = found
+userdb sql-userdb {
+  fields {
+    driver = sql
+    args = /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
+    skip = found
+  }
 }
 protocol imap {
   mail_plugins = </etc/dovecot/mail_plugins_imap
   imap_metadata = yes
 }
-mail_attribute_dict = file:%h/dovecot-attributes
+
+mail_attribute {
+  dict file {
+    path = /etc/dovecot/dovecot-attributes
+  }
+}
+
 protocol lmtp {
   mail_plugins = </etc/dovecot/mail_plugins_lmtp
   auth_socket_path = /var/run/dovecot/auth-master
@@ -191,66 +216,81 @@ protocol lmtp {
 protocol sieve {
   managesieve_logout_format = bytes=%i/%o
 }
-plugin {
-  # Allow "any" or "authenticated" to be used in ACLs
-  acl_anyone = </etc/dovecot/acl_anyone
-  acl_shared_dict = file:/var/vmail/shared-mailboxes.db
-  acl = vfile
-  acl_user = %u
-  quota = dict:Userquota::proxy::sqlquota
+
+# Allow "any" or "authenticated" to be used in ACLs
+imap_acl_allow_anyone = </etc/dovecot/acl_anyone
+
+
+acl_sharing_map {
+  dict file {
+    path = /var/vmail/shared-mailboxes.db
+  }
+}
+
+acl_driver = vfile
+acl_user = %u
+
+quota "User quota" {
+  dict sqlquota {
+    driver = sql
+    args = /etc/dovecot/sql/dovecot-dict-sql-quota.conf
+  }
+  quota_rule = *:storage=+100M
   quota_rule2 = Trash:storage=+100%%
-  sieve = /var/vmail/sieve/%u.sieve
-  sieve_plugins = sieve_imapsieve sieve_extprograms
-  sieve_vacation_send_from_recipient = yes
-  sieve_redirect_envelope_from = recipient
-  # From elsewhere to Spam folder
-  imapsieve_mailbox1_name = Junk
-  imapsieve_mailbox1_causes = COPY
-  imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve
-  # END
-  # From Spam folder to elsewhere
-  imapsieve_mailbox2_name = *
-  imapsieve_mailbox2_from = Junk
-  imapsieve_mailbox2_causes = COPY
-  imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve
-  # END
-  master_user = %u
   quota_warning = storage=95%% quota-warning 95 %u
   quota_warning2 = storage=80%% quota-warning 80 %u
-  sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
-  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute
-  sieve_extensions = +notify +imapflags +vacation-seconds +editheader
-  sieve_max_script_size = 1M
-  sieve_max_redirects = 100
-  sieve_max_actions = 101
-  sieve_quota_max_scripts = 0
-  sieve_quota_max_storage = 0
-  listescape_char = "\\"
-  sieve_vacation_min_period = 5s
-  sieve_vacation_max_period = 0
-  sieve_vacation_default_period = 60s
-  sieve_before = /var/vmail/sieve/global_sieve_before.sieve
-  sieve_before2 = dict:proxy::sieve_before;name=active;bindir=/var/vmail/sieve_before_bindir
-  sieve_after = dict:proxy::sieve_after;name=active;bindir=/var/vmail/sieve_after_bindir
-  sieve_after2 = /var/vmail/sieve/global_sieve_after.sieve
-  sieve_duplicate_default_period = 1m
-  sieve_duplicate_max_period = 7d
+} 
 
-  # -- Global keys
-  mail_crypt_global_private_key = </mail_crypt/ecprivkey.pem
-  mail_crypt_global_public_key = </mail_crypt/ecpubkey.pem
-  mail_crypt_save_version = 2
+sieve = /var/vmail/sieve/%u.sieve
+sieve_plugins = sieve_imapsieve sieve_extprograms
+sieve_vacation_send_from_recipient = yes
+sieve_redirect_envelope_from = recipient
+# From elsewhere to Spam folder
+imapsieve_mailbox1_name = Junk
+imapsieve_mailbox1_causes = COPY
+imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve
+# END
+# From Spam folder to elsewhere
+imapsieve_mailbox2_name = *
+imapsieve_mailbox2_from = Junk
+imapsieve_mailbox2_causes = COPY
+imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve
+# END
+master_user = %u
+sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
+sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute
+sieve_extensions = +notify +imapflags +vacation-seconds +editheader
+sieve_max_script_size = 1M
+sieve_max_redirects = 100
+sieve_max_actions = 101
+sieve_quota_max_scripts = 0
+sieve_quota_max_storage = 0
+listescape_char = "\\"
+sieve_vacation_min_period = 5s
+sieve_vacation_max_period = 0
+sieve_vacation_default_period = 60s
+sieve_before = /var/vmail/sieve/global_sieve_before.sieve
+sieve_before2 = dict:proxy::sieve_before;name=active;bindir=/var/vmail/sieve_before_bindir
+sieve_after = dict:proxy::sieve_after;name=active;bindir=/var/vmail/sieve_after_bindir
+sieve_after2 = /var/vmail/sieve/global_sieve_after.sieve
+sieve_duplicate_default_period = 1m
+sieve_duplicate_max_period = 7d
 
-  # Enable compression while saving, lz4 Dovecot v2.3.17+
-  zlib_save = lz4
+# -- Global keys
+mail_crypt_global_private_key = </mail_crypt/ecprivkey.pem
+mail_crypt_global_public_key = </mail_crypt/ecpubkey.pem
+mail_crypt_save_version = 2
 
-  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
-  mail_log_fields = uid box msgid size
-  mail_log_cached_only = yes
+# Enable compression while saving, lz4 Dovecot v2.3.17+
+zlib_save = lz4
+
+mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
+mail_log_fields = uid box msgid size
+mail_log_cached_only = yes
+
+# Try set mail_replica
+!include_try /etc/dovecot/mail_replica.conf
 
-  # Try set mail_replica
-  !include_try /etc/dovecot/mail_replica.conf
-}
 service quota-warning {
   executable = script /usr/local/bin/quota_notify.py
   # use some unprivileged user for executing the quota warnings
diff --git a/data/conf/dovecot/dovecot.folders.conf b/data/conf/dovecot/dovecot.folders.conf
index fa6872679..8de8daec6 100644
--- a/data/conf/dovecot/dovecot.folders.conf
+++ b/data/conf/dovecot/dovecot.folders.conf
@@ -1,6 +1,5 @@
 namespace inbox {
   inbox = yes
-  location =
   separator = /
   mailbox "Trash" {
     auto = subscribe

From 9d54fbcc3ee8fbb91d70f0c0baf3c25847e256f5 Mon Sep 17 00:00:00 2001
From: DerLinkman <niklas.meyer@servercow.de>
Date: Thu, 14 Aug 2025 11:11:35 +0200
Subject: [PATCH 2/7] dovecot: migrated config to 2.4 + config splitting

---
 data/Dockerfiles/dovecot/docker-entrypoint.sh | 149 ++++---
 data/conf/dovecot/auth/passwd-verify.lua      |  14 +-
 data/conf/dovecot/conf.d/05-core.conf         |   3 +
 data/conf/dovecot/conf.d/10-logging.conf      |  14 +
 data/conf/dovecot/conf.d/10-mail.conf         |   9 +
 data/conf/dovecot/conf.d/10-ssl.conf          |  13 +
 data/conf/dovecot/conf.d/11-sql.conf          |   3 +
 data/conf/dovecot/conf.d/12-mysql.conf        |   8 +
 .../conf.d/12-storage-attachments.conf        |   7 +
 data/conf/dovecot/conf.d/15-performance.conf  |  10 +
 data/conf/dovecot/conf.d/20-auth.conf         |  40 ++
 data/conf/dovecot/conf.d/20-userdb.conf       |  11 +
 data/conf/dovecot/conf.d/25-services.conf     | 135 +++++++
 data/conf/dovecot/conf.d/30-protocols.conf    |  17 +
 data/conf/dovecot/conf.d/35-fts.conf          |  45 +++
 data/conf/dovecot/conf.d/40-acl.conf          |  12 +
 data/conf/dovecot/conf.d/40-attributes.conf   |   7 +
 data/conf/dovecot/conf.d/50-quota.conf        |  25 ++
 .../dovecot/conf.d/60-sieve-pipeline.conf     |  78 ++++
 data/conf/dovecot/conf.d/70-crypto.conf       |   6 +
 data/conf/dovecot/conf.d/80-compress.conf     |   3 +
 data/conf/dovecot/conf.d/90-dict.conf         |  18 +
 data/conf/dovecot/conf.d/90-limits.conf       |   7 +
 data/conf/dovecot/conf.d/99-includes.conf     |  22 ++
 data/conf/dovecot/conf.d/fts.conf             |  37 --
 data/conf/dovecot/dovecot.conf                | 371 ++----------------
 data/conf/dovecot/dovecot.folders.conf        |   6 +
 27 files changed, 620 insertions(+), 450 deletions(-)
 create mode 100644 data/conf/dovecot/conf.d/05-core.conf
 create mode 100644 data/conf/dovecot/conf.d/10-logging.conf
 create mode 100644 data/conf/dovecot/conf.d/10-mail.conf
 create mode 100644 data/conf/dovecot/conf.d/10-ssl.conf
 create mode 100644 data/conf/dovecot/conf.d/11-sql.conf
 create mode 100644 data/conf/dovecot/conf.d/12-mysql.conf
 create mode 100644 data/conf/dovecot/conf.d/12-storage-attachments.conf
 create mode 100644 data/conf/dovecot/conf.d/15-performance.conf
 create mode 100644 data/conf/dovecot/conf.d/20-auth.conf
 create mode 100644 data/conf/dovecot/conf.d/20-userdb.conf
 create mode 100644 data/conf/dovecot/conf.d/25-services.conf
 create mode 100644 data/conf/dovecot/conf.d/30-protocols.conf
 create mode 100644 data/conf/dovecot/conf.d/35-fts.conf
 create mode 100644 data/conf/dovecot/conf.d/40-acl.conf
 create mode 100644 data/conf/dovecot/conf.d/40-attributes.conf
 create mode 100644 data/conf/dovecot/conf.d/50-quota.conf
 create mode 100644 data/conf/dovecot/conf.d/60-sieve-pipeline.conf
 create mode 100644 data/conf/dovecot/conf.d/70-crypto.conf
 create mode 100644 data/conf/dovecot/conf.d/80-compress.conf
 create mode 100644 data/conf/dovecot/conf.d/90-dict.conf
 create mode 100644 data/conf/dovecot/conf.d/90-limits.conf
 create mode 100644 data/conf/dovecot/conf.d/99-includes.conf
 delete mode 100644 data/conf/dovecot/conf.d/fts.conf

diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh
index 4e646fb8c..24b4600c4 100755
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -44,66 +44,83 @@ if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
 else
   QUOTA_TABLE=quota2replica
 fi
+
+cat <<EOF > /etc/dovecot/conf.d/12-mysql.conf
+# Autogenerated by mailcow - DO NOT TOUCH!
+mysql /var/run/mysqld/mysqld.sock {
+  dbname=${DBNAME}
+  user=${DBUSER}
+  password=${DBPASS}
+
+  ssl = no
+}
+EOF
+
+
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-quota.conf
 # Autogenerated by mailcow
-connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
-map {
-  pattern = priv/quota/storage
-  table = ${QUOTA_TABLE}
+dict_map priv/quota/storage {
+  sql_table = ${QUOTA_TABLE}
   username_field = username
-  value_field = bytes
+  value_field bytes {
+  }
 }
-map {
-  pattern = priv/quota/messages
-  table = ${QUOTA_TABLE}
+
+dict_map priv/quota/messages {
+  sql_table = ${QUOTA_TABLE}
   username_field = username
-  value_field = messages
+  value_field messages {
+  }
 }
 EOF
 
 # Create dict used for sieve pre and postfilters
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
 # Autogenerated by mailcow
-connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
-map {
-  pattern = priv/sieve/name/\$script_name
-  table = sieve_before
+
+dict_map priv/sieve/name/\$script_name {
+  sql_table = sieve_before
   username_field = username
-  value_field = id
-  fields {
-    script_name = \$script_name
+  value_field id {
+  }
+  key_field script_name {
+    value = \$script_name
   }
 }
-map {
-  pattern = priv/sieve/data/\$id
-  table = sieve_before
+
+dict_map priv/sieve/data/\$id {
+  sql_table = sieve_before
   username_field = username
-  value_field = script_data
-  fields {
-    id = \$id
+  key_field script_data {
+    value = \$script_data
+  }
+  value_field id {
   }
 }
+
+
 EOF
 
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
 # Autogenerated by mailcow
-connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
-map {
-  pattern = priv/sieve/name/\$script_name
-  table = sieve_after
+
+dict_map priv/sieve/name/\$script_name {
+  sql_table = sieve_after
   username_field = username
-  value_field = id
-  fields {
-    script_name = \$script_name
+  value_field id {
+  }
+  key_field script_name {
+    value = \$script_name
   }
 }
-map {
-  pattern = priv/sieve/data/\$id
-  table = sieve_after
+
+dict_map priv/sieve/data/\$id {
+  sql_table = sieve_after
   username_field = username
-  value_field = script_data
-  fields {
-    id = \$id
+  key_field script_name {
+    value = \$script_data
+  }
+  value_field id {
   }
 }
 EOF
@@ -116,22 +133,20 @@ fi
 
 if [[ "${SKIP_FTS}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
 echo -e "\e[33mDetecting SKIP_FTS=y... not enabling Flatcurve (FTS) then...\e[0m"
-echo -n 'quota acl zlib mail_crypt mail_crypt_acl mail_log notify listescape replication lazy_expunge' > /etc/dovecot/mail_plugins
-echo -n 'quota imap_quota imap_acl acl zlib imap_zlib imap_sieve mail_crypt mail_crypt_acl notify listescape replication mail_log' > /etc/dovecot/mail_plugins_imap
-echo -n 'quota sieve acl zlib mail_crypt mail_crypt_acl notify listescape replication' > /etc/dovecot/mail_plugins_lmtp
+echo -n 'quota quota_clone acl mail_crypt mail_crypt_acl mail_log mail_compress notify lazy_expunge' > /etc/dovecot/mail_plugins
+echo -n 'quota quota_clone imap_quota imap_acl acl imap_sieve mail_crypt mail_crypt_acl mail_compress notify mail_log' > /etc/dovecot/mail_plugins_imap
+echo -n 'quota quota_clone sieve acl mail_crypt mail_crypt_acl mail_compress notify' > /etc/dovecot/mail_plugins_lmtp
 else
 echo -e "\e[32mDetecting SKIP_FTS=n... enabling Flatcurve (FTS)\e[0m"
-echo -n 'quota acl zlib mail_crypt mail_crypt_acl mail_log notify fts fts_flatcurve listescape replication lazy_expunge' > /etc/dovecot/mail_plugins
-echo -n 'quota imap_quota imap_acl acl zlib imap_zlib imap_sieve mail_crypt mail_crypt_acl notify mail_log fts fts_flatcurve listescape replication' > /etc/dovecot/mail_plugins_imap
-echo -n 'quota sieve acl zlib mail_crypt mail_crypt_acl fts fts_flatcurve notify listescape replication' > /etc/dovecot/mail_plugins_lmtp
+echo -n 'quota quota_clone acl mail_crypt mail_crypt_acl mail_log mail_compress notify fts fts_flatcurve lazy_expunge' > /etc/dovecot/mail_plugins
+echo -n 'quota quota_clone imap_quota imap_acl acl imap_sieve mail_crypt mail_crypt_acl mail_compress notify mail_log fts fts_flatcurve' > /etc/dovecot/mail_plugins_imap
+echo -n 'quota quota_clone sieve acl mail_crypt mail_crypt_acl mail_compress fts fts_flatcurve notify' > /etc/dovecot/mail_plugins_lmtp
 fi
 chmod 644 /etc/dovecot/mail_plugins /etc/dovecot/mail_plugins_imap /etc/dovecot/mail_plugins_lmtp /templates/quarantine.tpl
 
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
 # Autogenerated by mailcow
-driver = mysql
-connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
-user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2')
+query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%{user | domain }}/%{user | username }/Maildir:VOLATILEDIR=/var/volatile/%{user}:INDEX=/var/vmail_index/%{user}') AS mail, '%{protocol}' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%{user}' AND (active = '1' OR active = '2')
 iterate_query = SELECT username FROM mailbox WHERE active = '1' OR active = '2';
 EOF
 
@@ -162,8 +177,8 @@ for cert_dir in /etc/ssl/mail/*/ ; do
   domains=($(cat ${cert_dir}domains))
   for domain in ${domains[@]}; do
     echo 'local_name '${domain}' {' >> /etc/dovecot/sni.conf;
-    echo '  ssl_cert = <'${cert_dir}'cert.pem' >> /etc/dovecot/sni.conf;
-    echo '  ssl_key = <'${cert_dir}'key.pem' >> /etc/dovecot/sni.conf;
+    echo '  ssl_server_cert_file = '${cert_dir}'cert.pem' >> /etc/dovecot/sni.conf;
+    echo '  ssl_server_key_file = '${cert_dir}'key.pem' >> /etc/dovecot/sni.conf;
     echo '}' >> /etc/dovecot/sni.conf;
   done
 done
@@ -187,11 +202,13 @@ else
 fi
 cat <<EOF > /etc/dovecot/shared_namespace.conf
 # Autogenerated by mailcow
-namespace {
+namespace shared {
     type = shared
     separator = /
-    prefix = Shared/%%u/
-    location = maildir:%%h${MAILDIR_SUB_SHARED}:INDEX=~${MAILDIR_SUB_SHARED}/Shared/%%u
+    prefix = Shared/\$user/
+    mail_driver = maildir
+    mail_path = %{owner_home}${MAILDIR_SUB_SHARED}
+    mail_index_private_path = ~${MAILDIR_SUB_SHARED}/Shared/%{owner_user}
     subscriptions = no
     list = children
 }
@@ -201,7 +218,7 @@ EOF
 cat <<EOF > /etc/dovecot/sogo_trusted_ip.conf
 # Autogenerated by mailcow
 remote ${IPV4_NETWORK}.248 {
-  disable_plaintext_auth = no
+  auth_allow_cleartext = yes
 }
 EOF
 
@@ -210,9 +227,13 @@ RAND_PASS=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 32 | head -n 1)
 echo -n ${RAND_PASS} > /etc/phpfpm/sogo-sso.pass
 cat <<EOF > /etc/dovecot/sogo-sso.conf
 # Autogenerated by mailcow
-passdb {
-  driver = static
-  args = allow_nets=${IPV4_NETWORK}.248/32 password={plain}${RAND_PASS}
+passdb static {
+  fields {
+    allow_real_nets=${IPV4_NETWORK}.248/32
+  }
+
+  password={plain}${RAND_PASS}
+  
 }
 EOF
 
@@ -240,9 +261,9 @@ fi
 if [[ "${SKIP_FTS}" =~ ^([nN][oO]|[nN])+$ ]]; then
   echo -e "\e[94mConfiguring FTS Settings...\e[0m"
   echo -e "\e[94mSetting FTS Memory Limit (per process) to ${FTS_HEAP} MB\e[0m"
-  sed -i "s/vsz_limit\s*=\s*[0-9]*\s*MB*/vsz_limit=${FTS_HEAP} MB/" /etc/dovecot/conf.d/fts.conf
+  sed -i "s/vsz_limit\s*=\s*[0-9]*\s*MB*/vsz_limit=${FTS_HEAP} MB/" /etc/dovecot/conf.d/35-fts.conf
   echo -e "\e[94mSetting FTS Process Limit to ${FTS_PROCS}\e[0m"
-  sed -i "s/process_limit\s*=\s*[0-9]*/process_limit=${FTS_PROCS}/" /etc/dovecot/conf.d/fts.conf
+  sed -i "s/process_limit\s*=\s*[0-9]*/process_limit=${FTS_PROCS}/" /etc/dovecot/conf.d/35-fts.conf
 fi
 
 # 401 is user dovecot
@@ -254,16 +275,16 @@ else
 	chown 401 /mail_crypt/ecprivkey.pem /mail_crypt/ecpubkey.pem
 fi
 
-# Fix OpenSSL 3.X TLS1.0, 1.1 support (https://community.mailcow.email/d/4062-hi-all/20)
-if grep -qE 'ssl_min_protocol\s*=\s*(TLSv1|TLSv1\.1)\s*$' /etc/dovecot/dovecot.conf /etc/dovecot/extra.conf; then
-    sed -i '/\[openssl_init\]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf
+# # Fix OpenSSL 3.X TLS1.0, 1.1 support (https://community.mailcow.email/d/4062-hi-all/20)
+# if grep -qE 'ssl_min_protocol\s*=\s*(TLSv1|TLSv1\.1)\s*$' /etc/dovecot/dovecot.conf /etc/dovecot/extra.conf; then
+#     sed -i '/\[openssl_init\]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf
 
-    echo "[ssl_configuration]" >> /etc/ssl/openssl.cnf
-    echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf
-    echo "[tls_system_default]" >> /etc/ssl/openssl.cnf
-    echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf
-    echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
-fi
+#     echo "[ssl_configuration]" >> /etc/ssl/openssl.cnf
+#     echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf
+#     echo "[tls_system_default]" >> /etc/ssl/openssl.cnf
+#     echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf
+#     echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
+# fi
 
 # Compile sieve scripts
 sievec /var/vmail/sieve/global_sieve_before.sieve
diff --git a/data/conf/dovecot/auth/passwd-verify.lua b/data/conf/dovecot/auth/passwd-verify.lua
index ea847932d..3fe43b6b4 100644
--- a/data/conf/dovecot/auth/passwd-verify.lua
+++ b/data/conf/dovecot/auth/passwd-verify.lua
@@ -1,4 +1,5 @@
 function auth_password_verify(request, password)
+  request.domain = request.auth_user:match("@(.+)") or nil
   if request.domain == nil then
     return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "No such user"
   end
@@ -9,10 +10,10 @@ function auth_password_verify(request, password)
   https.TIMEOUT = 30
 
   local req = {
-    username = request.user,
+    username = request.auth_user,
     password = password,
-    real_rip = request.real_rip,
-    service = request.service
+    real_rip = request.remote_ip,
+    service = request.protocol
   }
   local req_json = json.encode(req)
   local res = {}
@@ -33,7 +34,6 @@ function auth_password_verify(request, password)
   -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry,
   -- even if the TTL has expired. Useful to avoid cache eviction during backend issues.
   if c ~= 200 and c ~= 401 then
-    dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user)
     return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error"
   end
 
@@ -46,7 +46,7 @@ function auth_password_verify(request, password)
   end
 
   if response_json.success == true then
-    return dovecot.auth.PASSDB_RESULT_OK, ""
+    return dovecot.auth.PASSDB_RESULT_OK, { msg = "" }
   end
 
   return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Failed to authenticate"
@@ -55,3 +55,7 @@ end
 function auth_passdb_lookup(req)
    return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, ""
 end
+
+function auth_passdb_get_cache_key()
+  return "%{protocol}:%{user | username}\t:%{password}"
+end
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/05-core.conf b/data/conf/dovecot/conf.d/05-core.conf
new file mode 100644
index 000000000..e934e9724
--- /dev/null
+++ b/data/conf/dovecot/conf.d/05-core.conf
@@ -0,0 +1,3 @@
+# /etc/dovecot/conf.d/05-core.conf
+# Core, single-line settings that don't fit elsewhere.
+recipient_delimiter = +
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/10-logging.conf b/data/conf/dovecot/conf.d/10-logging.conf
new file mode 100644
index 000000000..f3211ecb7
--- /dev/null
+++ b/data/conf/dovecot/conf.d/10-logging.conf
@@ -0,0 +1,14 @@
+# /etc/dovecot/conf.d/10-logging.conf
+# Logging and debug.
+#mail_debug = yes
+#auth_debug = yes
+log_debug = category=fts-flatcurve
+#log_debug = category=auth
+log_path = syslog
+log_timestamp = "%Y-%m-%d %H:%M:%S "
+login_log_format_elements = "user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} session=<%{session}>"
+
+# Mail event logging.
+mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
+mail_log_fields = uid box msgid size
+mail_log_cached_only = yes
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/10-mail.conf b/data/conf/dovecot/conf.d/10-mail.conf
new file mode 100644
index 000000000..4d658449c
--- /dev/null
+++ b/data/conf/dovecot/conf.d/10-mail.conf
@@ -0,0 +1,9 @@
+# /etc/dovecot/conf.d/10-mail.conf
+# Mail storage paths and core mail settings.
+mail_home = /var/vmail/%{user | domain }/%{user | username }
+mail_driver = maildir
+mail_path = ~/Maildir
+mail_index_path = /var/vmail_index/%{user}
+mail_plugins = </etc/dovecot/mail_plugins
+mail_shared_explicit_inbox = yes
+mail_prefetch_count = 30
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/10-ssl.conf b/data/conf/dovecot/conf.d/10-ssl.conf
new file mode 100644
index 000000000..f2a1caea2
--- /dev/null
+++ b/data/conf/dovecot/conf.d/10-ssl.conf
@@ -0,0 +1,13 @@
+# /etc/dovecot/conf.d/10-ssl.conf
+# TLS/SSL settings.
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL:!3DES:!MD5:!PSK:!DSS:!RC4:!SEED:!IDEA:+HIGH:+MEDIUM
+ssl_options = no_ticket
+#ssl_dh_parameters_length = 2048
+
+ssl_server {
+  prefer_ciphers = server
+  dh_file = /etc/ssl/mail/dhparams.pem
+  cert_file = /etc/ssl/mail/cert.pem
+  key_file = /etc/ssl/mail/key.pem
+}
diff --git a/data/conf/dovecot/conf.d/11-sql.conf b/data/conf/dovecot/conf.d/11-sql.conf
new file mode 100644
index 000000000..597477b06
--- /dev/null
+++ b/data/conf/dovecot/conf.d/11-sql.conf
@@ -0,0 +1,3 @@
+# /etc/dovecot/conf.d/11-sql.conf
+# Default SQL driver used by SQL-based dicts/userdb.
+sql_driver = mysql
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/12-mysql.conf b/data/conf/dovecot/conf.d/12-mysql.conf
new file mode 100644
index 000000000..387e85d03
--- /dev/null
+++ b/data/conf/dovecot/conf.d/12-mysql.conf
@@ -0,0 +1,8 @@
+# Autogenerated by mailcow - DO NOT TOUCH!
+mysql /var/run/mysqld/mysqld.sock {
+  dbname=mailcow
+  user=mailcow
+  password=D8O9BIivJc7Pb2VCfpAeLbAzUOZ0
+
+  ssl = no
+}
diff --git a/data/conf/dovecot/conf.d/12-storage-attachments.conf b/data/conf/dovecot/conf.d/12-storage-attachments.conf
new file mode 100644
index 000000000..1151f909d
--- /dev/null
+++ b/data/conf/dovecot/conf.d/12-storage-attachments.conf
@@ -0,0 +1,7 @@
+# /etc/dovecot/conf.d/12-storage-attachments.conf
+# External attachment storage.
+fs mail_ext_attachment {
+  fs_driver = posix
+  mail_ext_attachment_path = /var/attachments
+  mail_ext_attachment_min_size = 128k
+}
diff --git a/data/conf/dovecot/conf.d/15-performance.conf b/data/conf/dovecot/conf.d/15-performance.conf
new file mode 100644
index 000000000..caf8acc57
--- /dev/null
+++ b/data/conf/dovecot/conf.d/15-performance.conf
@@ -0,0 +1,10 @@
+# /etc/dovecot/conf.d/15-performance.conf
+# Performance and mailbox tuning.
+# Enable only when you do not manually touch cur/.
+maildir_very_dirty_syncs = yes
+
+# NFS examples | Only modify if using NFS!:
+#mm ap_disable = yes
+#mail_fsync = always
+#mail_nfs_index = yes
+#mail_nfs_storage = yes
diff --git a/data/conf/dovecot/conf.d/20-auth.conf b/data/conf/dovecot/conf.d/20-auth.conf
new file mode 100644
index 000000000..17e481f0e
--- /dev/null
+++ b/data/conf/dovecot/conf.d/20-auth.conf
@@ -0,0 +1,40 @@
+# /etc/dovecot/conf.d/20-auth.conf
+# Authentication mechanisms, master/user separation, passdb chain, auth cache.
+auth_mechanisms = plain login
+auth_allow_cleartext = yes
+auth_master_user_separator = *
+
+auth_cache_verify_password_with_worker = yes
+auth_cache_negative_ttl = 60s
+auth_cache_ttl = 300s
+auth_cache_size = 10M
+auth_verbose_passwords = sha1:6
+
+# 1) Lua password verification (blocking, return mapping).
+passdb lua {
+  driver = lua
+  lua_file = /etc/dovecot/auth/passwd-verify.lua
+  lua_settings {
+    blocking=yes
+    result_success = return-ok
+    result_failure = continue
+    result_internalfail = continue
+  }
+}
+
+# 2) Master password for master user logins.
+passdb master {
+  driver = passwd-file
+  passwd_file_path = /etc/dovecot/dovecot-master.passwd 
+  master = yes
+  skip = authenticated
+}
+
+# 3) Mandatory return layer: empty Lua (e.g. for forced reset).
+passdb empty-lua {
+  driver = lua
+  lua_file = /etc/dovecot/auth/passwd-verify.lua
+  lua_settings {
+    blocking = yes
+  }
+}
diff --git a/data/conf/dovecot/conf.d/20-userdb.conf b/data/conf/dovecot/conf.d/20-userdb.conf
new file mode 100644
index 000000000..61e354162
--- /dev/null
+++ b/data/conf/dovecot/conf.d/20-userdb.conf
@@ -0,0 +1,11 @@
+# /etc/dovecot/conf.d/20-userdb.conf
+# User database chain.
+userdb passwd {
+  driver = passwd-file
+  passwd_file_path = /etc/dovecot/dovecot-master.userdb
+}
+
+userdb sql {
+  !include /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
+  skip = found
+}
diff --git a/data/conf/dovecot/conf.d/25-services.conf b/data/conf/dovecot/conf.d/25-services.conf
new file mode 100644
index 000000000..6d36b873e
--- /dev/null
+++ b/data/conf/dovecot/conf.d/25-services.conf
@@ -0,0 +1,135 @@
+# /etc/dovecot/conf.d/25-services.conf
+# All service listeners and workers.
+
+# doveadm remote admin
+# Set doveadm_password in extra.conf.
+service doveadm {
+  inet_listener doveadm {
+    port = 12345
+  }
+  vsz_limit = 2048 MB
+}
+
+# dict
+service dict {
+  unix_listener dict {
+    mode = 0660
+    user = vmail
+    group = vmail
+  }
+}
+
+# log
+service log {
+  user = dovenull
+}
+
+# config socket
+service config {
+  unix_listener config {
+    user = root
+    group = vmail
+    mode = 0660
+  }
+}
+
+# auth sockets and inet
+service auth {
+  inet_listener auth-inet {
+    port = 10001
+  }
+  unix_listener auth-master {
+    mode = 0600
+    user = vmail
+  }
+  unix_listener auth-userdb {
+    mode = 0600
+    user = vmail
+  }
+  vsz_limit = 2G
+}
+
+# managesieve login
+service managesieve-login {
+  inet_listener sieve {
+    port = 4190
+  }
+  inet_listener sieve_haproxy {
+    port = 14190
+    haproxy = yes
+  }
+  service_restart_request_count = 1
+  process_min_avail = 2
+  vsz_limit = 1G
+}
+
+# imap login
+service imap-login {
+  service_restart_request_count = 1
+  process_min_avail = 2
+  process_limit = 10000
+  vsz_limit = 1G
+  user = dovenull
+  inet_listener imap_haproxy {
+    port = 10143
+    haproxy = yes
+  }
+  inet_listener imaps_haproxy {
+    port = 10993
+    ssl = yes
+    haproxy = yes
+  }
+}
+
+# pop3 login
+service pop3-login {
+  service_restart_request_count = 1
+  process_min_avail = 1
+  vsz_limit = 1G
+  inet_listener pop3_haproxy {
+    port = 10110
+    haproxy = yes
+  }
+  inet_listener pop3s_haproxy {
+    port = 10995
+    ssl = yes
+    haproxy = yes
+  }
+}
+
+# imap worker
+service imap {
+  executable = imap
+  user = vmail
+  vsz_limit = 1G
+}
+
+# managesieve worker
+service managesieve {
+  process_limit = 256
+}
+
+# lmtp
+service lmtp {
+  inet_listener lmtp-inet {
+    port = 24
+  }
+  user = vmail
+}
+
+# quota warning hook
+service quota-warning {
+  executable = script /usr/local/bin/quota_notify.py
+  user = vmail
+  unix_listener quota-warning {
+    user = vmail
+  }
+}
+
+# stats
+service stats {
+  unix_listener stats-writer {
+    mode = 0660
+    user = vmail
+  }
+}
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/30-protocols.conf b/data/conf/dovecot/conf.d/30-protocols.conf
new file mode 100644
index 000000000..882f3c1e5
--- /dev/null
+++ b/data/conf/dovecot/conf.d/30-protocols.conf
@@ -0,0 +1,17 @@
+# /etc/dovecot/conf.d/30-protocols.conf
+# IMAP protocol specifics.
+protocol imap {
+  mail_plugins = </etc/dovecot/mail_plugins_imap
+  imap_metadata = yes
+}
+
+# LMTP protocol specifics.
+protocol lmtp {
+  mail_plugins = </etc/dovecot/mail_plugins_lmtp
+  auth_socket_path = /var/run/dovecot/auth-master
+}
+
+# ManageSieve protocol specifics.
+protocol sieve {
+  managesieve_logout_format = bytes=%i/%o
+}
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/35-fts.conf b/data/conf/dovecot/conf.d/35-fts.conf
new file mode 100644
index 000000000..e6bc1cd79
--- /dev/null
+++ b/data/conf/dovecot/conf.d/35-fts.conf
@@ -0,0 +1,45 @@
+# mailcow FTS Flatcurve Settings, change them as you like.
+
+# Maximum term length can be set via the 'maxlen' argument (maxlen is
+# specified in bytes, not number of UTF-8 characters)
+language_tokenizer_address_token_maxlen = 100
+language_tokenizer_generic_algorithm = simple
+language_tokenizer_generic_token_maxlen = 30
+
+# These are not flatcurve settings, but required for Dovecot FTS. See
+# Dovecot FTS Configuration link above for further information.
+language en {
+  default = yes
+  language_filters = lowercase snowball english-possessive stopwords
+}
+
+language de {
+  language_filters = lowercase snowball stopwords
+}
+
+language es {
+  language_filters = lowercase snowball stopwords
+}
+
+language_tokenizers = generic email-address
+
+fts_search_timeout = 300s
+
+fts_autoindex = yes
+# Tweak this setting if you only want to ensure big and frequent folders are indexed, not all.
+fts_autoindex_max_recent_msgs = 20
+fts flatcurve {
+  substring_search = no
+}
+
+### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
+
+service indexer-worker {
+  # Max amount of simultaniously running indexer jobs.
+  process_limit=1
+
+  # Max amount of RAM used by EACH indexer process.
+  vsz_limit=128 MB
+}
+
+### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/40-acl.conf b/data/conf/dovecot/conf.d/40-acl.conf
new file mode 100644
index 000000000..c18143581
--- /dev/null
+++ b/data/conf/dovecot/conf.d/40-acl.conf
@@ -0,0 +1,12 @@
+# /etc/dovecot/conf.d/40-acl.conf
+# ACL and shared mailboxes.
+imap_acl_allow_anyone = </etc/dovecot/acl_anyone
+
+acl_sharing_map {
+  dict file {
+    path = /var/vmail/shared-mailboxes.db
+  }
+}
+
+acl_driver = vfile
+acl_user = %{user}
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/40-attributes.conf b/data/conf/dovecot/conf.d/40-attributes.conf
new file mode 100644
index 000000000..c17b7cc23
--- /dev/null
+++ b/data/conf/dovecot/conf.d/40-attributes.conf
@@ -0,0 +1,7 @@
+# /etc/dovecot/conf.d/40-attributes.conf
+# User/mail attributes.
+mail_attribute {
+  dict file {
+    path = /etc/dovecot/dovecot-attributes
+  }
+}
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/50-quota.conf b/data/conf/dovecot/conf.d/50-quota.conf
new file mode 100644
index 000000000..8ba7807a4
--- /dev/null
+++ b/data/conf/dovecot/conf.d/50-quota.conf
@@ -0,0 +1,25 @@
+# /etc/dovecot/conf.d/50-quota.conf
+# Quota configuration and notifications.
+quota "User quota" {
+  driver = count
+
+  warning warn-95 {
+    quota_storage_percentage = 95
+    execute quota-warning {
+      args = 95 %{user}
+    }
+  }
+
+  warning warn-80 {
+    quota_storage_percentage = 80
+    execute quota-warning {
+      args = 80 %{user}
+    }
+  }
+}
+
+quota_clone {
+  dict proxy {
+    name = mysql_quota
+  }
+}
diff --git a/data/conf/dovecot/conf.d/60-sieve-pipeline.conf b/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
new file mode 100644
index 000000000..cdaf88209
--- /dev/null
+++ b/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
@@ -0,0 +1,78 @@
+# /etc/dovecot/conf.d/60-sieve-pipeline.conf
+# Complete Sieve pipeline: personal/global scripts, plugins, limits, training.
+
+# Personal scripts
+sieve_script personal {
+  driver = file
+  path = ~/sieve
+  active_path = ~/.dovecot.sieve
+}
+
+# Global before/after (file and dict)
+sieve_script before {
+  driver = file
+  path = /var/vmail/sieve/global_sieve_before.sieve
+}
+sieve_script before2 {
+  driver = dict
+  name = active
+  dict proxy {
+    name = sieve_before
+    sieve_script_bin_path = /var/vmail/sieve_before_bindir
+  }
+}
+sieve_script after {
+  driver = file
+  path = /var/vmail/sieve/global_sieve_after.sieve
+}
+sieve_script after2 {
+  driver = dict
+  name = active
+  dict proxy {
+    name = sieve_after
+    sieve_script_bin_path = /var/vmail/sieve_after_bindir
+  }
+}
+
+# Plugins and behavior
+sieve_plugins = sieve_imapsieve sieve_extprograms
+sieve_vacation_send_from_recipient = yes
+sieve_redirect_envelope_from = recipient
+
+# IMAPSieve training
+imapsieve_from Junk {
+  sieve_script ham {
+    type = before
+    cause = copy
+    path = /usr/lib/dovecot/sieve/report-ham.sieve
+  }
+}
+mailbox Junk {
+  sieve_script spam {
+    type = before
+    cause = copy
+    path = /usr/lib/dovecot/sieve/report-spam.sieve
+  }
+}
+
+# Extprograms and extensions
+sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
+sieve_plugins {
+  sieve_extprograms = yes
+}
+sieve_global_extensions {
+  vnd.dovecot.pipe = yes
+  vnd.dovecot.execute = yes
+}
+
+# Limits and duplicate handling
+sieve_max_script_size = 1M
+sieve_max_redirects = 100
+sieve_max_actions = 101
+sieve_quota_script_count = 0
+sieve_quota_storage_size = 0
+sieve_vacation_min_period = 5s
+sieve_vacation_max_period = 365d
+sieve_vacation_default_period = 60s
+sieve_duplicate_default_period = 1m
+sieve_duplicate_max_period = 7d
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/70-crypto.conf b/data/conf/dovecot/conf.d/70-crypto.conf
new file mode 100644
index 000000000..98787a42c
--- /dev/null
+++ b/data/conf/dovecot/conf.d/70-crypto.conf
@@ -0,0 +1,6 @@
+# /etc/dovecot/conf.d/70-crypto.conf
+# Global mail-crypt keys.
+crypt_global_private_key global {
+  crypt_private_key_file = /mail_crypt/ecprivkey.pem
+}
+crypt_global_public_key_file = /mail_crypt/ecpubkey.pem
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/80-compress.conf b/data/conf/dovecot/conf.d/80-compress.conf
new file mode 100644
index 000000000..f792aa257
--- /dev/null
+++ b/data/conf/dovecot/conf.d/80-compress.conf
@@ -0,0 +1,3 @@
+# /etc/dovecot/conf.d/80-compress.conf
+# Compression settings.
+mail_compress_write_method = lz4
diff --git a/data/conf/dovecot/conf.d/90-dict.conf b/data/conf/dovecot/conf.d/90-dict.conf
new file mode 100644
index 000000000..3aa994e17
--- /dev/null
+++ b/data/conf/dovecot/conf.d/90-dict.conf
@@ -0,0 +1,18 @@
+# /etc/dovecot/conf.d/90-dict.conf
+# Dict declarations and SQL bindings.
+dict_server {
+  dict sieveafter {
+    driver = sql
+    !include /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
+  }
+
+  dict sievebefore {
+    driver = sql
+    !include /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
+  }
+
+  dict mysql_quota {
+    driver = sql
+    !include /etc/dovecot/sql/dovecot-dict-sql-quota.conf
+  }
+}
diff --git a/data/conf/dovecot/conf.d/90-limits.conf b/data/conf/dovecot/conf.d/90-limits.conf
new file mode 100644
index 000000000..a278e6ce5
--- /dev/null
+++ b/data/conf/dovecot/conf.d/90-limits.conf
@@ -0,0 +1,7 @@
+# /etc/dovecot/conf.d/90-limits.conf
+# Connection and memory limits; doveadm port.
+mail_max_userip_connections = 500
+imap_max_line_length = 2 M
+default_client_limit = 10400
+default_vsz_limit = 1024 M
+doveadm_port = 12345
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/99-includes.conf b/data/conf/dovecot/conf.d/99-includes.conf
new file mode 100644
index 000000000..79ba61224
--- /dev/null
+++ b/data/conf/dovecot/conf.d/99-includes.conf
@@ -0,0 +1,22 @@
+# /etc/dovecot/conf.d/99-includes.conf
+# Late includes and site-specific bits.
+
+# Mailbox layout includes (if used)
+!include /etc/dovecot/dovecot.folders.conf
+
+# Optional replication
+!include_try /etc/dovecot/mail_replica.conf
+
+# Existing includes you already had
+!include_try /etc/dovecot/sni.conf
+!include_try /etc/dovecot/sogo_trusted_ip.conf
+!include_try /etc/dovecot/shared_namespace.conf
+!include_try /etc/dovecot/conf.d/fts.conf
+
+# Remote auth override
+remote 127.0.0.1 {
+  auth_allow_cleartext = yes
+}
+
+# Outbound submission target
+submission_host = postfix:588
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/fts.conf b/data/conf/dovecot/conf.d/fts.conf
deleted file mode 100644
index e8a2f73f5..000000000
--- a/data/conf/dovecot/conf.d/fts.conf
+++ /dev/null
@@ -1,37 +0,0 @@
-# mailcow FTS Flatcurve Settings, change them as you like.
-plugin {
-    fts_autoindex = yes
-    fts_autoindex_exclude = \Junk
-    fts_autoindex_exclude2 = \Trash
-    # Tweak this setting if you only want to ensure big and frequent folders are indexed, not all.
-    fts_autoindex_max_recent_msgs = 20
-    fts = flatcurve
-
-    # Maximum term length can be set via the 'maxlen' argument (maxlen is
-    # specified in bytes, not number of UTF-8 characters)
-    fts_tokenizer_email_address = maxlen=100
-    fts_tokenizer_generic = algorithm=simple maxlen=30
-
-    # These are not flatcurve settings, but required for Dovecot FTS. See
-    # Dovecot FTS Configuration link above for further information.
-    fts_languages = en es de
-    fts_tokenizers = generic email-address
-
-    # OPTIONAL: Recommended default FTS core configuration
-    fts_filters = normalizer-icu snowball stopwords
-    fts_filters_en = lowercase snowball english-possessive stopwords
-
-    fts_index_timeout = 300s
-}
-
-### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
-
-service indexer-worker {
-  # Max amount of simultaniously running indexer jobs.
-  process_limit=1
-
-  # Max amount of RAM used by EACH indexer process.
-  vsz_limit=128 MB
-}
-
-### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
\ No newline at end of file
diff --git a/data/conf/dovecot/dovecot.conf b/data/conf/dovecot/dovecot.conf
index 48b70e21d..d5b6a752f 100644
--- a/data/conf/dovecot/dovecot.conf
+++ b/data/conf/dovecot/dovecot.conf
@@ -1,351 +1,34 @@
-# --------------------------------------------------------------------------
-# Please create a file "extra.conf" for persistent overrides to dovecot.conf
-# --------------------------------------------------------------------------
-# LDAP example:
-#passdb {
-#  args = /etc/dovecot/ldap/passdb.conf
-#  driver = ldap
-#}
-
+# /etc/dovecot/dovecot.conf
+# Base file kept minimal. All real config lives under conf.d/.
 dovecot_config_version = 2.4.0
 dovecot_storage_version = 2.4.0
 
 listen = *,[::]
-
-auth_mechanisms = plain login
-#mail_debug = yes
-#auth_debug = yes
-#log_debug = category=fts-flatcurve # Activate Logging for Flatcurve FTS Searchings
-log_path = syslog
-auth_allow_cleartext = yes
-# Uncomment on NFS share
-#mmap_disable = yes
-#mail_fsync = always
-#mail_nfs_index = yes
-#mail_nfs_storage = yes
-login_log_format_elements = "user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k"
-mail_home = /var/vmail/%d/%n
-mail_driver = maildir
-mail_path = ~/
-mail_index_path = /var/vmail_index/${user}
-mail_plugins = </etc/dovecot/mail_plugins
-
-fs mail_ext_attachment {
-  fs_driver = posix
-  mail_ext_attachment_path = /var/attachments
-  mail_ext_attachment_min_size = 128k
-}
-
-
-# Significantly speeds up very large mailboxes, but is only safe to enable if
-# you do not manually modify the files in the `cur` directories in
-# mailcowdockerized_vmail-vol-1.
-# https://docs.mailcow.email/manual-guides/Dovecot/u_e-dovecot-performance/
-maildir_very_dirty_syncs = yes
-
-ssl_min_protocol = TLSv1.2
-
-ssl_server {
-  prefer_ciphers = server
-  dh_file = /etc/ssl/mail/dhparams.pem
-  cert_file = /etc/ssl/mail/cert.pem
-  key_file = /etc/ssl/mail/key.pem
-}
-
-ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL:!3DES:!MD5:!PSK:!DSS:!RC4:!SEED:!IDEA:+HIGH:+MEDIUM
-ssl_options = no_compression no_ticket
-
-# Dovecot 2.2
-#ssl_dh_parameters_length = 2048
-log_timestamp = "%Y-%m-%d %H:%M:%S "
-recipient_delimiter = +
-auth_master_user_separator = *
-mail_shared_explicit_inbox = yes
-mail_prefetch_count = 30
-passdb lua {
-  fields {
-    driver = lua
-    args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%s:%u:%w
-    result_success = return-ok
-    result_failure = continue
-    result_internalfail = continue
-  }
-}
-# try a master passwd
-passdb master {
-  fields {
-    driver = passwd-file
-    args = /etc/dovecot/dovecot-master.passwd
-    master = yes
-    skip = authenticated
-  }
-}
-# check for regular password - if empty (e.g. force-passwd-reset), previous pass=yes passdbs also fail
-# a return of the following passdb is mandatory
-passdb empty-lua {
-  fields {
-    driver = lua
-    args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes
-  }
-}
-# Set doveadm_password=your-secret-password in data/conf/dovecot/extra.conf (create if missing)
-service doveadm {
-  inet_listener doveadm {
-    port = 12345
-  }
-  vsz_limit=2048 MB
-}
-!include /etc/dovecot/dovecot.folders.conf
 protocols = imap sieve lmtp pop3
-service dict {
-  unix_listener dict {
-    mode = 0660
-    user = vmail
-    group = vmail
-  }
-}
-service log {
-  user = dovenull
-}
-service config {
-  unix_listener config {
-    user = root
-    group = vmail
-    mode = 0660
-  }
-}
-service auth {
-  inet_listener auth-inet {
-    port = 10001
-  }
-  unix_listener auth-master {
-    mode = 0600
-    user = vmail
-  }
-  unix_listener auth-userdb {
-    mode = 0600
-    user = vmail
-  }
-  vsz_limit = 2G
-}
-service managesieve-login {
-  inet_listener sieve {
-    port = 4190
-  }
-  inet_listener sieve_haproxy {
-    port = 14190
-    haproxy = yes
-  }
-  service_restart_request_count = 1
-  process_min_avail = 2
-  vsz_limit = 1G
-}
-service imap-login {
-  service_restart_request_count = 1
-  process_min_avail = 2
-  process_limit = 10000
-  vsz_limit = 1G
-  user = dovenull
-  inet_listener imap_haproxy {
-    port = 10143
-    haproxy = yes
-  }
-  inet_listener imaps_haproxy {
-    port = 10993
-    ssl = yes
-    haproxy = yes
-  }
-}
-service pop3-login {
-  service_restart_request_count = 1
-  process_min_avail = 1
-  vsz_limit = 1G
-  inet_listener pop3_haproxy {
-    port = 10110
-    haproxy = yes
-  }
-  inet_listener pop3s_haproxy {
-    port = 10995
-    ssl = yes
-    haproxy = yes
-  }
-}
-service imap {
-  executable = imap
-  user = vmail
-  vsz_limit = 1G
-}
-service managesieve {
-  process_limit = 256
-}
-service lmtp {
-  inet_listener lmtp-inet {
-    port = 24
-  }
-  user = vmail
-}
 
-userdb master-userdb {
-  fields {
-    driver = passwd-file
-    args = /etc/dovecot/dovecot-master.userdb
-  }
-}
-userdb sql-userdb {
-  fields {
-    driver = sql
-    args = /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
-    skip = found
-  }
-}
-protocol imap {
-  mail_plugins = </etc/dovecot/mail_plugins_imap
-  imap_metadata = yes
-}
+!include_try /etc/dovecot/conf.d/05-core.conf
+!include_try /etc/dovecot/conf.d/10-logging.conf
+!include_try /etc/dovecot/conf.d/10-mail.conf
+!include_try /etc/dovecot/conf.d/10-ssl.conf
+!include_try /etc/dovecot/conf.d/11-sql.conf
+!include_try /etc/dovecot/conf.d/12-mysql.conf
+!include_try /etc/dovecot/conf.d/12-storage-attachments.conf
+!include_try /etc/dovecot/conf.d/15-performance.conf
+!include_try /etc/dovecot/conf.d/20-auth.conf
+!include_try /etc/dovecot/conf.d/20-userdb.conf
+!include_try /etc/dovecot/conf.d/25-services.conf
+!include_try /etc/dovecot/conf.d/30-protocols.conf
+!include_try /etc/dovecot/conf.d/35-fts.conf
+!include_try /etc/dovecot/conf.d/40-acl.conf
+!include_try /etc/dovecot/conf.d/40-attributes.conf
+!include_try /etc/dovecot/conf.d/50-quota.conf
+!include_try /etc/dovecot/conf.d/60-sieve-pipeline.conf
+!include_try /etc/dovecot/conf.d/70-crypto.conf
+!include_try /etc/dovecot/conf.d/80-compress.conf
+!include_try /etc/dovecot/conf.d/80-mail-logging.conf
+!include_try /etc/dovecot/conf.d/90-limits.conf
+!include_try /etc/dovecot/conf.d/90-dict.conf
+!include_try /etc/dovecot/conf.d/99-includes.conf
 
-mail_attribute {
-  dict file {
-    path = /etc/dovecot/dovecot-attributes
-  }
-}
-
-protocol lmtp {
-  mail_plugins = </etc/dovecot/mail_plugins_lmtp
-  auth_socket_path = /var/run/dovecot/auth-master
-}
-protocol sieve {
-  managesieve_logout_format = bytes=%i/%o
-}
-
-# Allow "any" or "authenticated" to be used in ACLs
-imap_acl_allow_anyone = </etc/dovecot/acl_anyone
-
-
-acl_sharing_map {
-  dict file {
-    path = /var/vmail/shared-mailboxes.db
-  }
-}
-
-acl_driver = vfile
-acl_user = %u
-
-quota "User quota" {
-  dict sqlquota {
-    driver = sql
-    args = /etc/dovecot/sql/dovecot-dict-sql-quota.conf
-  }
-  quota_rule = *:storage=+100M
-  quota_rule2 = Trash:storage=+100%%
-  quota_warning = storage=95%% quota-warning 95 %u
-  quota_warning2 = storage=80%% quota-warning 80 %u
-} 
-
-sieve = /var/vmail/sieve/%u.sieve
-sieve_plugins = sieve_imapsieve sieve_extprograms
-sieve_vacation_send_from_recipient = yes
-sieve_redirect_envelope_from = recipient
-# From elsewhere to Spam folder
-imapsieve_mailbox1_name = Junk
-imapsieve_mailbox1_causes = COPY
-imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve
-# END
-# From Spam folder to elsewhere
-imapsieve_mailbox2_name = *
-imapsieve_mailbox2_from = Junk
-imapsieve_mailbox2_causes = COPY
-imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve
-# END
-master_user = %u
-sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
-sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute
-sieve_extensions = +notify +imapflags +vacation-seconds +editheader
-sieve_max_script_size = 1M
-sieve_max_redirects = 100
-sieve_max_actions = 101
-sieve_quota_max_scripts = 0
-sieve_quota_max_storage = 0
-listescape_char = "\\"
-sieve_vacation_min_period = 5s
-sieve_vacation_max_period = 0
-sieve_vacation_default_period = 60s
-sieve_before = /var/vmail/sieve/global_sieve_before.sieve
-sieve_before2 = dict:proxy::sieve_before;name=active;bindir=/var/vmail/sieve_before_bindir
-sieve_after = dict:proxy::sieve_after;name=active;bindir=/var/vmail/sieve_after_bindir
-sieve_after2 = /var/vmail/sieve/global_sieve_after.sieve
-sieve_duplicate_default_period = 1m
-sieve_duplicate_max_period = 7d
-
-# -- Global keys
-mail_crypt_global_private_key = </mail_crypt/ecprivkey.pem
-mail_crypt_global_public_key = </mail_crypt/ecpubkey.pem
-mail_crypt_save_version = 2
-
-# Enable compression while saving, lz4 Dovecot v2.3.17+
-zlib_save = lz4
-
-mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
-mail_log_fields = uid box msgid size
-mail_log_cached_only = yes
-
-# Try set mail_replica
-!include_try /etc/dovecot/mail_replica.conf
-
-service quota-warning {
-  executable = script /usr/local/bin/quota_notify.py
-  # use some unprivileged user for executing the quota warnings
-  user = vmail
-  unix_listener quota-warning {
-    user = vmail
-  }
-}
-dict {
-  sqlquota = mysql:/etc/dovecot/sql/dovecot-dict-sql-quota.conf
-  sieve_after = mysql:/etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
-  sieve_before = mysql:/etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
-}
-remote 127.0.0.1 {
-  disable_plaintext_auth = no
-}
-submission_host = postfix:588
-mail_max_userip_connections = 500
-service stats {
-  unix_listener stats-writer {
-    mode = 0660
-    user = vmail
-  }
-}
-imap_max_line_length = 2 M
-auth_cache_verify_password_with_worker = yes
-auth_cache_negative_ttl = 60s
-auth_cache_ttl = 300s
-auth_cache_size = 10M
-auth_verbose_passwords = sha1:6
-service replicator {
-  process_min_avail = 1
-}
-service aggregator {
-  fifo_listener replication-notify-fifo {
-    user = vmail
-  }
-  unix_listener replication-notify {
-    user = vmail
-  }
-}
-service replicator {
-  unix_listener replicator-doveadm {
-    mode = 0666
-  }
-}
-replication_max_conns = 10
-doveadm_port = 12345
-replication_dsync_parameters = -d -l 30 -U -n INBOX
-# <Includes>
-!include_try /etc/dovecot/sni.conf
-!include_try /etc/dovecot/sogo_trusted_ip.conf
-!include_try /etc/dovecot/extra.conf
-!include_try /etc/dovecot/shared_namespace.conf
-!include_try /etc/dovecot/conf.d/fts.conf
-# </Includes>
-default_client_limit = 10400
-default_vsz_limit = 1024 M
+# Last: local overrides
+!include_try /etc/dovecot/extra.conf
\ No newline at end of file
diff --git a/data/conf/dovecot/dovecot.folders.conf b/data/conf/dovecot/dovecot.folders.conf
index 8de8daec6..4d73d14f3 100644
--- a/data/conf/dovecot/dovecot.folders.conf
+++ b/data/conf/dovecot/dovecot.folders.conf
@@ -1,9 +1,14 @@
 namespace inbox {
   inbox = yes
   separator = /
+  mailbox storage/* {
+    quota_storage_extra = 100M
+  }
   mailbox "Trash" {
     auto = subscribe
     special_use = \Trash
+    quota_storage_percentage = 100
+    fts_autoindex = no
   }
   mailbox "Deleted Messages" {
     special_use = \Trash
@@ -194,6 +199,7 @@ namespace inbox {
   mailbox "Junk" {
     auto = subscribe
     special_use = \Junk
+    fts_autoindex = no
   }
   mailbox "Junk-E-Mail" {
     special_use = \Junk

From 58a26dc966c957bbb8514d7554e980601f44105d Mon Sep 17 00:00:00 2001
From: DerLinkman <niklas.meyer@servercow.de>
Date: Fri, 15 Aug 2025 10:56:46 +0200
Subject: [PATCH 3/7] dovecot: changes to config aligning to 2.4

---
 data/conf/dovecot/conf.d/10-logging.conf      |  3 +-
 data/conf/dovecot/conf.d/25-services.conf     |  9 ++++++
 .../dovecot/conf.d/60-sieve-pipeline.conf     | 30 ++++++++++++++-----
 data/conf/dovecot/conf.d/90-dict.conf         |  4 +--
 4 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/data/conf/dovecot/conf.d/10-logging.conf b/data/conf/dovecot/conf.d/10-logging.conf
index f3211ecb7..a37af5494 100644
--- a/data/conf/dovecot/conf.d/10-logging.conf
+++ b/data/conf/dovecot/conf.d/10-logging.conf
@@ -2,8 +2,7 @@
 # Logging and debug.
 #mail_debug = yes
 #auth_debug = yes
-log_debug = category=fts-flatcurve
-#log_debug = category=auth
+#log_debug = category=fts-flatcurve
 log_path = syslog
 log_timestamp = "%Y-%m-%d %H:%M:%S "
 login_log_format_elements = "user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} session=<%{session}>"
diff --git a/data/conf/dovecot/conf.d/25-services.conf b/data/conf/dovecot/conf.d/25-services.conf
index 6d36b873e..c97c2645d 100644
--- a/data/conf/dovecot/conf.d/25-services.conf
+++ b/data/conf/dovecot/conf.d/25-services.conf
@@ -33,6 +33,15 @@ service config {
   }
 }
 
+# anvil socket
+service anvil {
+  unix_listener anvil {
+    user = vmail
+    group = vmail
+    mode = 0660
+  }
+}
+
 # auth sockets and inet
 service auth {
   inet_listener auth-inet {
diff --git a/data/conf/dovecot/conf.d/60-sieve-pipeline.conf b/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
index cdaf88209..ea18921a6 100644
--- a/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
+++ b/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
@@ -1,19 +1,15 @@
 # /etc/dovecot/conf.d/60-sieve-pipeline.conf
 # Complete Sieve pipeline: personal/global scripts, plugins, limits, training.
 
-# Personal scripts
-sieve_script personal {
-  driver = file
-  path = ~/sieve
-  active_path = ~/.dovecot.sieve
-}
-
 # Global before/after (file and dict)
 sieve_script before {
+  type = before
   driver = file
   path = /var/vmail/sieve/global_sieve_before.sieve
 }
+
 sieve_script before2 {
+  type = before
   driver = dict
   name = active
   dict proxy {
@@ -21,11 +17,15 @@ sieve_script before2 {
     sieve_script_bin_path = /var/vmail/sieve_before_bindir
   }
 }
+
 sieve_script after {
+  type = after
   driver = file
   path = /var/vmail/sieve/global_sieve_after.sieve
 }
+
 sieve_script after2 {
+  type = after
   driver = dict
   name = active
   dict proxy {
@@ -34,6 +34,14 @@ sieve_script after2 {
   }
 }
 
+# Personal scripts
+sieve_script personal {
+  type = personal
+  driver = file
+  path = ~/sieve
+  active_path = ~/.dovecot.sieve
+}
+
 # Plugins and behavior
 sieve_plugins = sieve_imapsieve sieve_extprograms
 sieve_vacation_send_from_recipient = yes
@@ -75,4 +83,10 @@ sieve_vacation_min_period = 5s
 sieve_vacation_max_period = 365d
 sieve_vacation_default_period = 60s
 sieve_duplicate_default_period = 1m
-sieve_duplicate_max_period = 7d
\ No newline at end of file
+sieve_duplicate_max_period = 7d
+
+# pipe sockets in /var/run/dovecot/sieve-pipe
+sieve_pipe_socket_dir = sieve-pipe
+
+# execute sockets in /var/run/dovecot/sieve-execute
+sieve_execute_socket_dir = sieve-execute
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/90-dict.conf b/data/conf/dovecot/conf.d/90-dict.conf
index 3aa994e17..e690bea78 100644
--- a/data/conf/dovecot/conf.d/90-dict.conf
+++ b/data/conf/dovecot/conf.d/90-dict.conf
@@ -1,12 +1,12 @@
 # /etc/dovecot/conf.d/90-dict.conf
 # Dict declarations and SQL bindings.
 dict_server {
-  dict sieveafter {
+  dict sieve_after {
     driver = sql
     !include /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
   }
 
-  dict sievebefore {
+  dict sieve_before {
     driver = sql
     !include /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
   }

From 05fbd549f8805bdae561c6027ecd320d8aaba7a2 Mon Sep 17 00:00:00 2001
From: DerLinkman <niklas.meyer@servercow.de>
Date: Fri, 15 Aug 2025 10:57:42 +0200
Subject: [PATCH 4/7] dovecot: change dict declarations for before scripts

---
 data/Dockerfiles/dovecot/docker-entrypoint.sh | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh
index 24b4600c4..9d6173baf 100755
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -82,7 +82,10 @@ dict_map priv/sieve/name/\$script_name {
   sql_table = sieve_before
   username_field = username
   value_field id {
+    type = uuid
   }
+
+  # The script name field in the table to query
   key_field script_name {
     value = \$script_name
   }
@@ -91,14 +94,12 @@ dict_map priv/sieve/name/\$script_name {
 dict_map priv/sieve/data/\$id {
   sql_table = sieve_before
   username_field = username
-  key_field script_data {
-    value = \$script_data
+  value_field script_data {
   }
-  value_field id {
+  key_field id {
+    value = \$id
   }
 }
-
-
 EOF
 
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
@@ -108,6 +109,7 @@ dict_map priv/sieve/name/\$script_name {
   sql_table = sieve_after
   username_field = username
   value_field id {
+    type = uuid
   }
   key_field script_name {
     value = \$script_name
@@ -117,10 +119,10 @@ dict_map priv/sieve/name/\$script_name {
 dict_map priv/sieve/data/\$id {
   sql_table = sieve_after
   username_field = username
-  key_field script_name {
-    value = \$script_data
+  value_field script_data {
   }
-  value_field id {
+  key_field id {
+    value = \$id
   }
 }
 EOF

From 8e93a48ac08ee3b948f2d02b6affc5c9492e5ab7 Mon Sep 17 00:00:00 2001
From: DerLinkman <niklas.meyer@servercow.de>
Date: Tue, 19 Aug 2025 15:44:15 +0200
Subject: [PATCH 5/7] dovecot: rechanged id type from uuid to string

---
 data/Dockerfiles/dovecot/docker-entrypoint.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh
index 9d6173baf..0c392d41e 100755
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -82,7 +82,6 @@ dict_map priv/sieve/name/\$script_name {
   sql_table = sieve_before
   username_field = username
   value_field id {
-    type = uuid
   }
 
   # The script name field in the table to query
@@ -109,7 +108,6 @@ dict_map priv/sieve/name/\$script_name {
   sql_table = sieve_after
   username_field = username
   value_field id {
-    type = uuid
   }
   key_field script_name {
     value = \$script_name

From fb7bbc3fd8912ac8cce6d7f5d87bf4a267e84254 Mon Sep 17 00:00:00 2001
From: DerLinkman <niklas.meyer@servercow.de>
Date: Tue, 26 Aug 2025 12:10:23 +0200
Subject: [PATCH 6/7] dovecot: fix smaller config changes

---
 data/conf/dovecot/conf.d/10-mail.conf           | 1 +
 data/conf/dovecot/conf.d/60-sieve-pipeline.conf | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/data/conf/dovecot/conf.d/10-mail.conf b/data/conf/dovecot/conf.d/10-mail.conf
index 4d658449c..c8f0c1758 100644
--- a/data/conf/dovecot/conf.d/10-mail.conf
+++ b/data/conf/dovecot/conf.d/10-mail.conf
@@ -6,4 +6,5 @@ mail_path = ~/Maildir
 mail_index_path = /var/vmail_index/%{user}
 mail_plugins = </etc/dovecot/mail_plugins
 mail_shared_explicit_inbox = yes
+mailbox_list_storage_escape_char = "\\"
 mail_prefetch_count = 30
\ No newline at end of file
diff --git a/data/conf/dovecot/conf.d/60-sieve-pipeline.conf b/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
index ea18921a6..c3f2231af 100644
--- a/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
+++ b/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
@@ -85,6 +85,11 @@ sieve_vacation_default_period = 60s
 sieve_duplicate_default_period = 1m
 sieve_duplicate_max_period = 7d
 
+sieve_extensions {
+    vacation-seconds = yes
+    editheader = yes
+}
+
 # pipe sockets in /var/run/dovecot/sieve-pipe
 sieve_pipe_socket_dir = sieve-pipe
 

From 816b5cdb601335e1607797daae1cbf51947b2f58 Mon Sep 17 00:00:00 2001
From: DerLinkman <niklas.meyer@servercow.de>
Date: Thu, 28 Aug 2025 12:46:53 +0200
Subject: [PATCH 7/7] declare better sieve script paths per user (for after and
 before)

---
 data/conf/dovecot/conf.d/60-sieve-pipeline.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/data/conf/dovecot/conf.d/60-sieve-pipeline.conf b/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
index c3f2231af..a37be5ddd 100644
--- a/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
+++ b/data/conf/dovecot/conf.d/60-sieve-pipeline.conf
@@ -14,8 +14,8 @@ sieve_script before2 {
   name = active
   dict proxy {
     name = sieve_before
-    sieve_script_bin_path = /var/vmail/sieve_before_bindir
   }
+  bin_path = /var/vmail/sieve_before_bindir/%{user}
 }
 
 sieve_script after {
@@ -30,8 +30,8 @@ sieve_script after2 {
   name = active
   dict proxy {
     name = sieve_after
-    sieve_script_bin_path = /var/vmail/sieve_after_bindir
   }
+  bin_path = /var/vmail/sieve_after_bindir/%{user}
 }
 
 # Personal scripts