refactor the mail setup scripts

As the scripts keep growing, it's time to split them up to
keep them understandable.

This splits mail.sh into mail-postfix.sh, mail-dovecot.sh,
and mail-users.sh, which has all of the user database-related
configurations shared by Dovecot and Postfix. Also from
spamassassin.sh the core sieve configuration is moved into
mail-dovecot.sh and the virtual transport setting is moved
into mail-postfix.sh.

Also revising one of the sed scripts in mail-dovecot to
not insert a new additional # at the start of a line each
time the script is run.

setup/mail-dovecot.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+#
+# Dovecot (IMAP and LDA)
+#
+# Dovecot is *both* the IMAP server (the protocol that email applications
+# use to query a mailbox) as well as the local delivery agent (LDA),
+# meaning it is responsible for writing emails to mailbox storage on disk.
+# You could imagine why these things would be bundled together.
+#
+# As part of local mail delivery, Dovecot executes actions on incoming
+# mail as defined in a "sieve" script.
+#
+# Dovecot's LDA role comes after spam filtering. Postfix hands mail off
+# to Spamassassin which in turn hands it off to Dovecot. This all happens
+# using the LMTP protocol.
+
+source setup/functions.sh # load our functions
+source /etc/mailinabox.conf # load global vars
+
+# Install packages.
+
+apt_install \
+	dovecot-core dovecot-imapd dovecot-lmtpd dovecot-sqlite sqlite3 dovecot-sieve
+
+# The dovecot-imapd dovecot-lmtpd packages automatically enable IMAP and LMTP protocols.
+
+# Set the location where we'll store user mailboxes.
+tools/editconf.py /etc/dovecot/conf.d/10-mail.conf \
+	mail_location=maildir:$STORAGE_ROOT/mail/mailboxes/%d/%n \
+	mail_privileged_group=mail \
+	first_valid_uid=0
+
+# IMAP
+
+# Require that passwords are sent over SSL only, and allow the usual IMAP authentication mechanisms.
+# The LOGIN mechanism is supposedly for Microsoft products like Outlook to do SMTP login (I guess
+# since we're using Dovecot to handle SMTP authentication?).
+tools/editconf.py /etc/dovecot/conf.d/10-auth.conf \
+	disable_plaintext_auth=yes \
+	"auth_mechanisms=plain login"
+
+# Enable SSL, specify the location of the SSL certificate and private key files,
+# and allow only good ciphers per http://baldric.net/2013/12/07/tls-ciphers-in-postfix-and-dovecot/.
+tools/editconf.py /etc/dovecot/conf.d/10-ssl.conf \
+	ssl=required \
+	"ssl_cert=<$STORAGE_ROOT/ssl/ssl_certificate.pem" \
+	"ssl_key=<$STORAGE_ROOT/ssl/ssl_private_key.pem" \
+	"ssl_cipher_list=TLSv1+HIGH !SSLv2 !RC4 !aNULL !eNULL !3DES @STRENGTH"
+
+# Disable in-the-clear IMAP and POP because we're paranoid (we haven't even
+# enabled POP).
+sed -i "s/#port = 143/port = 0/" /etc/dovecot/conf.d/10-master.conf
+sed -i "s/#port = 110/port = 0/" /etc/dovecot/conf.d/10-master.conf
+
+# LDA (LMTP)
+
+# Enable Dovecot's LDA service with the LMTP protocol. It will listen
+# in port 10026, and Spamassassin will be configured to pass mail there.
+#
+# The disabled unix socket listener is normally how Postfix and Dovecot
+# would communicate (see the Postfix setup script for the corresponding
+# setting also commented out).
+#
+# Also increase the number of allowed IMAP connections per mailbox because
+# we all have so many devices lately.
+cat > /etc/dovecot/conf.d/99-local.conf << EOF;
+service lmtp {
+  #unix_listener /var/spool/postfix/private/dovecot-lmtp {
+  #  user = postfix
+  #  group = postfix
+  #}
+  inet_listener lmtp {
+    address = 127.0.0.1
+    port = 10026
+  }
+}
+
+protocol imap {
+  mail_max_userip_connections = 20
+}
+EOF
+
+# Setting a postmaster_address seems to be required or LMTP won't start.
+tools/editconf.py /etc/dovecot/conf.d/15-lda.conf \
+	postmaster_address=postmaster@$PRIMARY_HOSTNAME
+
+# SIEVE
+
+# Enable the Dovecot sieve plugin which let's us set a script that automatically moves
+# spam into the user's Spam mail filter. (Note: Be careful if we want to use multiple
+# plugins later.)
+#
+# The actual sieve script is copied into user mailboxes at the time the user account
+# is created. Our script moves spam into the user's Spam folder.
+sudo sed -i "s/#mail_plugins = .*/mail_plugins = \$mail_plugins sieve/" /etc/dovecot/conf.d/20-lmtp.conf
+
+# PERMISSIONS
+
+# Make the place for mailboxes.
+mkdir -p $STORAGE_ROOT/mail
+
+# Ensure configuration files are owned by dovecot and not world readable.
+chown -R mail:dovecot /etc/dovecot
+chmod -R o-rwx /etc/dovecot
+
+# Ensure mailbox files have a directory that exists and are owned by the mail user.
+mkdir -p $STORAGE_ROOT/mail/mailboxes
+chown -R mail.mail $STORAGE_ROOT/mail/mailboxes
+
+# Allow the IMAP port in the firewall.
+ufw_allow imaps
+
+# Restart services.
+service dovecot restart
+
+