Dovecot + SpamAssassin through dovecot-antispam

[Bernard]

Hello,

I am new to the list. /Waving at everyone/

I got a basic SpamAssassin working on a Debian setup (w/ debian-spamd
user), running as a Postfix transport.

I am currently trying to switch it to a dovecot plugin in order to make
it interactively work with the email storage (react to mail
classification, being able to train it from already received emails, aso.)
My problem is now making it able to access my emails.

Here is my setup:
userdb {
    driver = static
    args = uid=<fixed> gid=<fixed> home=/var/mail/vhosts/%d/%n
}

passdb {
  driver = passwd-file
    args = <path to passwords file>
}

mail_location = maildir:~/mail:LAYOUT=fs
mail_privileged_group = vmail

Translating into this on the FS:
drwxrwsr-x root mail /var/mail/
drwxrws--- root vmail /var/mail/vhosts
drwx--S--- vmail vmail /var/mail/vhosts/domain1
drwx--S--- vmail vmail /var/mail/vhosts/domain1/user1
drwx--S--- vmail vmail /var/mail/vhosts/domain1/user2
drwx--S--- vmail vmail /var/mail/vhosts/domain2
drwx--S--- vmail vmail /var/mail/vhosts/domain2/user1

The drwx--S--- access rights are propagated into lower branches/leafs.

I am having a hard time understanding what to do, reading
http://wiki2.dovecot.org/SharedMailboxes/Permissions, to make all the
folders and subsequent files readable by the vmail group too.
Based on this documentation, the way dovecot propagate permissions from
parent folders is a bit cryptic to me. What needs to be done to achieve
that?

The idea would be that even if I decided to allocated per-virtual-user a
system user for stored files, all the files would still be stored and
accessible with the same system group.
I understand this would be done with the help of mail_access_groups =
vmail, right?

FWIW, I am getting inspiration from the following explanations:
https://www.christianroessler.net/tech/2015/spamassassin-dovecot-postfix.html
If I understand correctly, the guy is bypassing the authentication
completely with allow_all_users=yes, right? I do not want to do that anyway.

I hope what I am trying to achieve is clear enough and that I provided
information enough.
Would you help me?
---
Bernard