Dovecot Integration¶

MFB uses Dovecot 2.4 as the IMAP server for providing read-only access to backed-up mail. The official dovecot/dovecot:2.4.2 Docker image (pinned: 2.4.3+ replaces the global ACL file with settings blocks, so mfb-acl must be ported before bumping) is used with no custom Dockerfile - all configuration is generated by MFB and volume-mounted.

Authentication¶

SQL Passdb¶

Password authentication uses SQL queries against MFB's PostgreSQL database:

SELECT username, password_hash AS password
FROM users
WHERE username = '%u'
  AND enabled = true
  AND migrating = false

Key behaviors:

Passwords are bcrypt-hashed (using the BLF-CRYPT scheme)
Disabled users cannot log in
Users being migrated between stores are blocked from login
Auth mechanisms: plain and login (login is required by Roundcube)
Cleartext auth is allowed on the internal Docker network (no TLS between containers)

Lua Userdb¶

User database lookup uses a Lua script (mfb-lua-userdb.lua) instead of static SQL. This enables dynamic namespace configuration per user.

The Lua script:

Receives the username from Dovecot
Makes an HTTP GET request to MFB: GET /api/internal/dovecot/userdb/{username}
MFB computes the full list of accounts the user can access:
- Directly owned accounts (via account_owners)
- Group-shared accounts (via group_members + account_groups)
Returns the user's home directory, mail location, and namespace fields

The response includes fields like:

userdb_home = /data/mailboxes/.dovecot-home/username
userdb_namespace/inbox/location = maildir:/data/mailboxes/{uuid}:LAYOUT=fs
userdb_namespace/shared1/prefix = Account Name (email@example.com)/
userdb_namespace/shared1/location = maildir:/data/mailboxes/{other-uuid}:LAYOUT=fs

Dynamic Namespaces¶

Each email account becomes a Dovecot namespace:

First account: the inbox namespace (no prefix, appears as INBOX, Sent, etc.)
Additional accounts: prefixed namespaces using the format "Name (email)/"

This means a user who owns three accounts and is a member of a group with two shared accounts sees five namespaces in their IMAP client:

INBOX                         # First owned account
Sent
Drafts
Work Email (work@corp.com)/   # Second owned account
  INBOX
  Sent
Archive (old@example.com)/    # Third owned account
  INBOX
Shared (shared@team.com)/     # Group-shared account
  INBOX
  Sent

The namespace list is computed fresh on every login. Changes to account ownership or group membership take effect on the next IMAP connection.

ACL (Read-Only)¶

Dovecot ACLs enforce read-only access to all mailboxes:

acl_driver = vfile
acl_globals_only = yes
acl_global_path = /etc/dovecot/dovecot-acl

The ACL file contains:

* owner lrs

This grants:

Right	Description
`l`	Lookup - can see the mailbox exists
`r`	Read - can read messages
`s`	Write-seen - can mark messages as read/unread

All other rights are denied:

Denied Right	Description
`w`	Write - modify flags
`i`	Insert - add new messages
`e`	Expunge - permanently delete
`k`	Create mailboxes
`x`	Delete mailboxes
`t`	Delete messages
`a`	Administer ACLs

mbsync is unaffected

mbsync writes directly to the Maildir filesystem, bypassing Dovecot entirely. ACLs only apply to IMAP clients connecting through Dovecot.

Doveadm HTTP API¶

MFB uses the doveadm HTTP API (port 8080) for:

Mailbox stats - per-account message counts, folder sizes, and unread counts displayed on the dashboard and account detail pages
Reload - signal Dovecot to reload configuration after changes
FTS reindex - trigger full-text search index rebuilding

Authentication uses the DOVEADM_PASSWORD environment variable set on the Dovecot container, which must match MAILFALLBACK_DOVECOT_API_KEY.

FTS (Full-Text Search)¶

Dovecot FTS Flatcurve is enabled by default. It indexes message headers and bodies for fast searching.

Configuration:

fts flatcurve {
  commit_limit = 500
  min_term_size = 2
  substring_search = no
  rotate_count = 5000
  rotate_time = 5000s
  optimize_limit = 10
}
fts_search_add_missing = yes

When Apache Tika is enabled, the FTS decoder extracts text from attachments before indexing:

fts_decoder_driver = tika
fts_decoder_tika_url = http://tika:9998/tika/

See FTS and Tika for details.

Prometheus Metrics¶

Dovecot exposes metrics on port 9900 in OpenMetrics format, compatible with Prometheus:

# Useful metrics
dovecot_imap_command_finished_count
dovecot_imap_command_finished_duration_usecs
dovecot_mail_delivery_count

SSL/TLS¶

SSL is disabled by default (ssl = no), suitable for internal Docker networking. To enable IMAPS:

Mount TLS certificates into the Dovecot container
Uncomment the IMAPS port (31993) in docker-compose.yml
Restart - MFB regenerates the SSL config on boot

See the Docker Compose guide for details.