Connect chasquid to Dovecot authentication and mailboxes

chasquid handles SMTP; Dovecot supplies mailbox access in the project’s small-server how-to. Sharing an account source reduces drift, but authentication and message storage still have distinct sockets, permissions, and failure modes.

Connect the components

1. Configure Dovecot’s chosen account backend and mailbox location for the supported release.
2. Expose only the authentication sockets needed by chasquid, with restricted service ownership/mode as documented.
3. Configure chasquid’s Dovecot authentication integration and the intended local delivery path. Do not assume a working auth socket also creates mailboxes.
4. Enable the intended IMAP/TLS listener and test using the real client hostname.

The upstream recipe shows both Dovecot userdb/client socket configuration and chasquid’s matching setup. Review it against the installed Dovecot version instead of mixing unrelated major-version examples.

Test each boundary

Create an approved test account through your actual account-management system. Verify correct/incorrect SMTP credentials, a controlled received message reaching the mailbox, and authorized IMAP retrieval. An unknown recipient should not be accepted into an unmonitored failure path.

Keep mailbox passwords, socket access, and SMTP relay policy separate from application API credentials. If an app needs an isolated incoming address, route that address deliberately; do not expose every mailbox because one automation needs access. Back up both account metadata and mailbox contents before changing authentication backends.