diff mbox series

[bug#69858,1/2] services: dovecot: Prefer server ciphers by default.

Message ID 20240317153440.27064-1-herman@rimm.ee
State New
Headers show
Series [bug#69858,1/2] services: dovecot: Prefer server ciphers by default. | expand

Commit Message

Herman Rimm March 17, 2024, 3:34 p.m. UTC 
* gnu/services/mail.scm (dovecot-configuration): Add
'ssl-prefer-server-ciphers?' field.
* doc/guix.texi (Mail Services)[Dovecot Service]: Describe field.

Change-Id: I1ea7c53466ebc3b01082938b5d9dee47c683017d
---
 doc/guix.texi         | 5 +++++
 gnu/services/mail.scm | 7 +++++++
 2 files changed, 12 insertions(+)
diff mbox series

Patch

diff --git a/doc/guix.texi b/doc/guix.texi
index eca1cb3712..b58ed90b2f 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -26989,6 +26989,11 @@  Time to delay before replying to failed authentications.
 Defaults to @samp{"2 secs"}.
 @end deftypevr
 
+@deftypevr {@code{dovecot-configuration} parameter} boolean auth-ssl-prefer-server-ciphers?
+Prefer a server's allowed cipher list over own cipher list.
+Defaults to @samp{#t}.
+@end deftypevr
+
 @deftypevr {@code{dovecot-configuration} parameter} boolean auth-ssl-require-client-cert?
 Require a valid SSL client certificate or the authentication
 fails.
diff --git a/gnu/services/mail.scm b/gnu/services/mail.scm
index afe1bb6016..cd3f961094 100644
--- a/gnu/services/mail.scm
+++ b/gnu/services/mail.scm
@@ -7,6 +7,7 @@ 
 ;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de>
 ;;; Copyright © 2023 Thomas Ieong <th.ieong@free.fr>
 ;;; Copyright © 2023 Saku Laesvuori <saku@laesvuori.fi>
+;;; Copyright © 2024 Herman Rimm <herman@rimm.ee>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1261,9 +1262,15 @@  (define-configuration dovecot-configuration
 intend to use @samp{ssl-verify-client-cert? #t}.  The file should
 contain the CA certificate(s) followed by the matching
 CRL(s).  (e.g. @samp{ssl-ca </etc/ssl/certs/ca.pem}).")
+
+  (ssl-prefer-server-ciphers?
+   (boolean #t)
+   "Prefer the server’s cipher list over a client’s cipher list.")
+
   (ssl-require-crl?
    (boolean #t)
    "Require that CRL check succeeds for client certificates.")
+
   (ssl-verify-client-cert?
    (boolean #f)
    "Request client to send a certificate.  If you also want to require