Does domain quota work and how?

[Kai Schaetzl]

Hello,

I'm in the process of moving users from an old dovecot setup with system 
users to a modern virtual user setup.

I can't find good documentation on domain quota.
It is mentioned in the docs as
quota2 = dict:domain:%d:proxy::quota_domain
but not much more.
Searching the mailing list or Google doesn't reveal much more info. 
Searching the German mailing list at jpberlin finds mostly information 
where they say that it doesn't work.
So, does it or does it not?

And if it works, does it work like I'm used to? 
e.g. with system users and aquota the filesystem quota kicks in whenever 
either the user or the domain quota is reached. That makes sense. It 
prohibits that single users can "fill" the whole domain (group) quota.

I found one particular example where they say the dict quota works 
different, e.g. it's an either/or. They give this example for the 
user_query (the relevant part):

CONCAT('*:bytes=', \
IF(mailbox.quota = 0, domain.maxquota*1024000, mailbox.quota)) \
as quota_rule

So, this works as a default domain quota that is overridden on a user by 
user basis. But this means that a user quota that is set cannot honor the 
domain quota. So, in theory all users together can reach a maximum quota 
that is way over the domain quota. Not desirable.

Concluding from the example in 90-quota.conf I want to set up this 
user_query (relevant part):

concat('*:bytes=', m.quota) AS quota_rule, concat('*:bytes=', 
(s.quota*1024*1024)) AS quota2_rule

(with m and s being the two tables for user and domain quota and s holding 
the domain quota in MB)

Does this work together with this quota plugin setup and would provide 
both a user and domain quota?

quota = dict:user::proxy::quota
quota2 = dict:domain:%d:proxy::quota_domain
quota_rule = *:storage=100M # default
quota2_rule = *:storage=1000M # default

I would like to know if this is supposed to work (and how) before I start 
testing in vain.

One thing that I can confirm from several statements on the mailing lists 
is that the recalc option of doveadm doesn't work correctly. A
doveadm quota recalc -A
sets the used domain quota to the user used quota that it handles last for 
the domain (and a recalc -u sets the whole domain used quota to the one of 
that user). Which sets the domain quota completely wrong. I tried 
iterating thru the various users but got the same result as with -A. So, 
this is clearly broken, at least from my point of view.

I'm using dovecot 2.3 from this repo:
deb https://repo.dovecot.org/ce-2.3-latest/ubuntu/xenial xenial main

I installed it because of the native blowfish encryption support. So far, 
it seems to be running great. Except for this particular aspect.

Thanks!

Kai