From c75950125dce113844d5a850cd62ecb9de6df757 Mon Sep 17 00:00:00 2001
From: Joshua Tauberer <jt@occams.info>
Date: Fri, 2 Jan 2015 23:22:33 +0000
Subject: [PATCH] set dovecot default_process_limit and
 fs.inotify.max_user_instances to better defaults

See https://discourse.mailinabox.email/t/mailserver-limits/228.
---
 CHANGELOG.md          |  4 ++++
 setup/mail-dovecot.sh | 17 +++++++++++++++++
 setup/system.sh       |  4 +++-
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 09158323..97bdb467 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ CHANGELOG
 in development
 --------------
 
+Mail:
+
+* Set better default syste limits to accommodate boxes handling mail for 20+ users.
+
 Control panel:
 
 * Status checks would fail to load if openssh-sever was not pre-installed, but openssh-server is not required.
diff --git a/setup/mail-dovecot.sh b/setup/mail-dovecot.sh
index bad44b36..959ab393 100755
--- a/setup/mail-dovecot.sh
+++ b/setup/mail-dovecot.sh
@@ -26,6 +26,23 @@ apt_install \
 
 # The `dovecot-imapd` and `dovecot-lmtpd` packages automatically enable IMAP and LMTP protocols.
 
+# Set basic daemon options.
+
+# The `default_process_limit` is 100, which constrains the total number
+# of active IMAP connections (at, say, 5 open connections per user that
+# would be 20 users). Set it to 250 times the number of cores this
+# machine has, so on a two-core machine that's 500 processes/100 users).
+tools/editconf.py /etc/dovecot/conf.d/10-master.conf \
+	default_process_limit=$(echo "`nproc` * 250" | bc)
+
+# The inotify `max_user_instances` default is 128, which constrains
+# the total number of watched (IMAP IDLE push) folders by open connections.
+# See http://www.dovecot.org/pipermail/dovecot/2013-March/088834.html.
+# A reboot is required for this to take effect (which we don't do as
+# as a part of setup). Test with `cat /proc/sys/fs/inotify/max_user_instances`.
+tools/editconf.py /etc/sysctl.conf \
+	fs.inotify.max_user_instances=1024
+
 # Set the location where we'll store user mailboxes. '%d' is the domain name and '%n' is the
 # username part of the user's email address. We'll ensure that no bad domains or email addresses
 # are created within the management daemon.
diff --git a/setup/system.sh b/setup/system.sh
index 984d1a58..d0c80619 100755
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -20,9 +20,11 @@ hide_output apt-get -y upgrade
 # * ntp: keeps the system time correct
 # * fail2ban: scans log files for repeated failed login attempts and blocks the remote IP at the firewall
 # * sudo: allows privileged users to execute commands as root without being root
+# * coreutils: includes `nproc` tool to report number of processors
+# * bc: allows us to do math to compute sane defaults
 
 apt_install python3 python3-dev python3-pip \
-	wget curl sudo \
+	wget curl sudo coreutils bc \
 	haveged unattended-upgrades ntp fail2ban
 
 # Allow apt to install system updates automatically every day.