[Dovecot] Advice for new dovecot / imap proxy? setup
Hello list.
I'm planning a new mail servers for our company's customers to replace the oldish Courier-IMAP based one, we already started to deploy some mail accounts on a dovecot-2.0 server as an early test. I'd like to implement the new system with dovecot-2 (I'll probably go straight to dovecot-2.1.x) and I'd like to get it right from the beginning so I'm here asking for some advice.
The issue I'm investigating right now is how to manage a single IMAP / POP / SMTP / webmail "entry point" for multiple mail servers... in other words an IMAP proxy. It would be desirable for multiple reasons:
- graceful migration from the current system: we'd make the mailserver hostname point to the proxy (along with its SSL certificates) and then the proxy would route each domain to the correct IMAP non-ssl server on our LAN. No need to update customer's systems configuration and we can move one domain at a time from the old to the new server, behind the scenes
- be ready for similar migrations in the future (eg. right now we're still keeping the imap servers with the qmail MTA, but we'd like to switch to postfix+dovecot in the future)
- be ready for sharding mail domains on multiple IMAP servers (if/when current hardware reach its capacity or needs to be swapped out for new gear)
- be ready to serve traffic over IPv6 without touching our precious mailbox servers
- isolate the mailbox servers from direct external access and just run IMAP on them, let other systems run ssl, pop3, smtp, webmail, etc...
Ideally the 'proxy' system would run dovecot imap and pop3 (SSL protected) and Roundcube webmail (PHP, on https) and just speak IMAP to the underlying mail servers on our internal LAN. We'd like to support all the recent IMAP goodies to make modern users happy (IMAP IDLE, LEMONADE, etc) and possibly implement Maildir quota on the new backend mailbox server to improve our operations (currently we just run du in a cronjob once a day on the current mailserver, IMAP clients including the webmail do not know about quota and thus cannot show amount of free space).
In addition to that, customer's will hit the SMTP server running on that 'proxy' system and this is good to keep its configuration separated from the SMTP server of the actual mail servers (which has a different configuration and is restricted to get connections only from our MX systems and not from outside sources).
I'd like to know if that plan sounds reasonable or if there's something stupid in it. Also, is the proxy going to support all kind of IMAP stuff of the backend server (IDLE, CONDSTORE, Maildir quota, immediate notification of IDLE clients thanks to linux inotify, etc...) or will it limit me somehow?
thanks,
Luca Lesinigo
On 21.3.2012, at 16.43, Luca Lesinigo wrote:
The issue I'm investigating right now is how to manage a single IMAP / POP / SMTP / webmail "entry point" for multiple mail servers... in other words an IMAP proxy.
Are you thinking about actual "dummy" proxying (which is normally what Dovecot proxying is about) or about the "imapc" backend (http://www.dovecot.fi/products/105-dovecot-imap-adaptor.html)? If you're using Dovecot as backend servers, there's really no reason to use imapc proxying.
We'd like to support all the recent IMAP goodies to make modern users happy (IMAP IDLE, LEMONADE, etc)
Dovecot doesn't support the full LEMONADE yet, but I don't know if there are any LEMONADE clients either.
Il giorno 23/mar/2012, alle ore 11:50, Timo Sirainen ha scritto:
Il giorno 23/mar/2012, alle ore 11:38, Miguel Tormo ha scritto:
However, I can confirm you that IMAP IDLE does work with imap proxy.
That's great, I really want to provide the best possible "push-like" experience to modern clients, and as far as I know IMAP IDLE on the protocol side plus some notification mechanism (as opposed to regular polling) on the backend side is the way to go.
You have my comments above, I think it is doable. In my opinion, the IMAP proxy part is the easiest one. MTA configuration to distribute the mails among the different mailbox servers can be trickier. Actually that part is already there. Mail enters my systems via some MX servers (with the usual antispam and so on) and it's finally delivered via SMTP to the correct mail server via postfix recipient maps (that's because I already receive on my MXes mail for domains not hosted on my mail server, the common scenario is where I route a domain's mail to the customer's exchange server). But right now the mail server also receives direct SMTP connections from the clients in addition to incoming mail from my MXes and I'd really prefer to separate the two things.
You could use dovecot LMTP proxy and make the MTA deliver mails through LMTP, thus the dovecot proxy instance will handle the sharding for delivering and for reading mail. On the proxy system I plan to run postfix to implement authenticated SMTP (it would authenticate on dovecot) and pop/imap-before-smtp (yes we still need to support that :| ), but all mail will be reinjected through our MX servers to be scanned before final delivery (either local or external).
Thanks people for the suggestions, my next stop is getting to know imapc and its details, and how the various other parts will fit with that (eg. giving pop3 service to clients).
-- Luca Lesinigo
On 03/23/2012 02:12 PM, Luca Lesinigo wrote:
The same proxy_maybe (dummy proxy) setup works great for POP3 too. Very simple to set up, works like a charm. Nothing much to think about.
However, I can confirm you that IMAP IDLE does work with imap proxy. That's great, I really want to provide the best possible "push-like" experience to modern clients, and as far as I know IMAP IDLE on the protocol side plus some notification mechanism (as opposed to regular polling) on the backend side is the way to go.
It will work as well as it was working with your existing courier server. But it will work great for accounts migrated to native dovecot.
You have my comments above, I think it is doable. In my opinion, the IMAP proxy part is the easiest one. MTA configuration to distribute the mails among the different mailbox servers can be trickier. Actually that part is already there. Mail enters my systems via some MX servers (with the usual antispam and so on) and it's finally delivered via SMTP to the correct mail server via postfix recipient maps (that's because I already receive on my MXes mail for domains not hosted on my mail server, the common scenario is where I route a domain's mail to the customer's exchange server). But right now the mail server also receives direct SMTP connections from the clients in addition to incoming mail from my MXes and I'd really prefer to separate the two things.
It's a very good idea to have completely separate machines for outgoing mail. Once you have imap-only boxes, you can eliminate the need for an MTA by using the dovecot LMTP server. Your postfix transport map can send mail to either smtp:imap.yourdomain.com:25 or lmtp:imap.yourdomain.com:2525 on a per account basis, and you can get rid of the MTA in due time.
You could use dovecot LMTP proxy and make the MTA deliver mails through LMTP, thus the dovecot proxy instance will handle the sharding for delivering and for reading mail. On the proxy system I plan to run postfix to implement authenticated SMTP (it would authenticate on dovecot) and pop/imap-before-smtp (yes we still need to support that :| ), but all mail will be reinjected through our MX servers to be scanned before final delivery (either local or external).
Since you're sending everything back to the MX, you might as well have your MX use LMTP, looking up the correct protocol and host from the database, and spend the next couple of years telling your customers to change their mail client configuration to use a dedicated outgoing mail server. It's worth the trouble.
participants (4)
-
Gedalya
-
Luca Lesinigo
-
Miguel Tormo
-
Timo Sirainen