From f3d8a1412ceab85fa68ff4cc7afc962cf6b02ec1 Mon Sep 17 00:00:00 2001
From: Franziska Kunsmann <hi@kunsmann.eu>
Date: Sun, 24 Jan 2021 18:44:25 +0100
Subject: [PATCH] bundles/dovecot: better ssl

---
 bundles/dovecot/files/dovecot.conf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/bundles/dovecot/files/dovecot.conf b/bundles/dovecot/files/dovecot.conf
index e356fe7..c0dd7ce 100644
--- a/bundles/dovecot/files/dovecot.conf
+++ b/bundles/dovecot/files/dovecot.conf
@@ -32,6 +32,9 @@ ssl = yes
 ssl_cert = </var/lib/dehydrated/certs/${node.metadata['postfix']['myhostname']}/fullchain.pem
 ssl_key =  </var/lib/dehydrated/certs/${node.metadata['postfix']['myhostname']}/privkey.pem
 ssl_dh = </etc/dovecot/ssl/dhparam.pem
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = EECDH+AESGCM:EDH+AESGCM
+ssl_prefer_server_ciphers = yes
 
 login_greeting = IMAPd ready
 auth_mechanisms = plain login