1.4. Configuring replication between two Dovecot servers

Procedure

1. Create the /etc/dovecot/conf.d/10-replication.conf file and perform the following steps in it:

   1. Enable the notify and replication plugins:

      mail_plugins = $mail_plugins notify replication

   2. Add a service replicator section:

      service replicator {
        process_min_avail = 1
      
        unix_listener replicator-doveadm {
          mode = 0600
          user = vmail
        }
      }

      With these settings, Dovecot starts at least one replicator process when the dovecot service starts. Additionally, this section defines the settings on the replicator-doveadm socket.

   3. Add a service aggregator section to configure the replication-notify-fifo pipe and replication-notify socket:

      service aggregator {
        fifo_listener replication-notify-fifo {
          user = vmail
        }
        unix_listener replication-notify {
          user = vmail
        }
      }

   4. Add a service doveadm section to define the port of the replication service:

      service doveadm {
        inet_listener {
          port = 12345
        }
      }

   5. Set the password of the doveadm replication service:

      doveadm_password = <replication_password>

      The password must be the same on both servers.

   6. Configure the replication partner:

      plugin {
        mail_replica = tcp:server2.example.com:12345
      }

   7. Optional: Define the maximum number of parallel dsync processes:

      replication_max_conns = 20

      The default value of replication_max_conns is 10.

2. Set secure permissions on the /etc/dovecot/conf.d/10-replication.conf file:

   # chown root:root /etc/dovecot/conf.d/10-replication.conf
   # chmod 600 /etc/dovecot/conf.d/10-replication.conf

3. Enable the nis_enabled SELinux Boolean to allow Dovecot to open the doveadm replication port:

   # setsebool -P nis_enabled on

4. Configure firewalld rules to allow only the replication partner to access the replication port, for example:

   # firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.0.2.1/32" port protocol="tcp" port="12345" accept"
   # firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv6" source address="2001:db8:2::1/128" port protocol="tcp" port="12345" accept"
   # firewall-cmd --reload

   The subnet masks /32 for the IPv4 and /128 for the IPv6 address limit the access to the specified addresses.

5. Perform this procedure also on the other replication partner.

6. Reload Dovecot:

   # systemctl reload dovecot

Verification

1. Perform an action in a mailbox on one server and then verify if Dovecot has replicated the change to the other server.

2. Display the replicator status:

   # doveadm replicator status
   Queued 'sync' requests        0
   Queued 'high' requests        0
   Queued 'low' requests         0
   Queued 'failed' requests      0
   Queued 'full resync' requests 30
   Waiting 'failed' requests     0
   Total number of known users   75

3. Display the replicator status of a specific user:

   # doveadm replicator status <user_name>
   username        priority  fast sync  full sync  success sync  failed
   <user_user>     none      02:05:28   04:19:07   02:05:28      -