mail_location = maildir:~/Maildir

protocols = imap
disable_plaintext_auth = yes
auth_mechanisms = plain login

#imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags

passdb {
        driver = pam
}

userdb {
        driver = passwd
}

first_valid_uid = 1000
last_valid_uid = 64999

ssl = required
verbose_ssl = no
ssl_dh = </etc/dovecot/dhparms.pem
ssl_cert = </var/lib/dehydrated/certs/ECC/{{certpath}}/fullchain.pem
ssl_key = </var/lib/dehydrated/certs/ECC/{{certpath}}/privkey.pem
ssl_min_protocol = TLSv1.2
ssl_cipher_list = ECDHE:DHE:kGOST:!aNULL:!eNULL:!RC4:!MD5:!3DES:!AES128:!CAMELLIA128
ssl_prefer_server_ciphers = no

service imap-login {
        inet_listener imap {
                port = 0
        }
        inet_listener imaps {
                port = 993
                ssl = yes
        }
}

service auth {
        unix_listener /var/spool/postfix/private/auth {
                mode = 0660
                user = postfix
{% if system == 'freebsd' or system == 'netbsd' %}
                group = wheel
{% else %}
                group = root
{% endif %}
        }
}