Add Dovecot IMAP + Fetchmail, fix Gitea SSO, simplify credential management

- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
  Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
  configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
  allows Keycloak-authenticated users to get accounts while blocking public sign-up;
  disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
  plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
  at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
  list-type secrets
- Update provisioning and configuration runbooks throughout

ansible/roles/mail/tasks/main.yml

@@ -1,6 +1,5 @@
 ---
-# Roundcube webmail client — connects to any external IMAP/SMTP server
-- name: Create Roundcube data directories
+- name: Create mail data directories
   ansible.builtin.file:
     path: "{{ item }}"
     state: directory
@@ -20,6 +19,45 @@
     mode: "0700"
   tags: mail
 
+- name: Create Dovecot maildir (vmail UID 5000)
+  ansible.builtin.file:
+    path: "{{ mail_data_dir }}/maildir"
+    state: directory
+    owner: "5000"
+    group: "5000"
+    mode: "0755"
+  tags: mail
+
+- name: Deploy Dovecot config
+  ansible.builtin.template:
+    src: dovecot.conf.j2
+    dest: "{{ mail_data_dir }}/dovecot.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart mail
+  tags: mail
+
+- name: Deploy Dovecot passwd file
+  ansible.builtin.template:
+    src: passwd.j2
+    dest: "{{ mail_data_dir }}/passwd"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: Restart mail
+  tags: mail
+
+- name: Deploy fetchmail config
+  ansible.builtin.template:
+    src: fetchmailrc.j2
+    dest: "{{ mail_data_dir }}/fetchmailrc"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart mail
+  tags: mail
+
 - name: Deploy Docker Compose file
   ansible.builtin.template:
     src: docker-compose.yml.j2
@@ -30,7 +68,7 @@
   notify: Restart mail
   tags: mail
 
-- name: Start Roundcube
+- name: Start mail stack
   community.docker.docker_compose_v2:
     project_src: "{{ mail_data_dir }}"
     state: present

ansible/roles/mail/templates/docker-compose.yml.j2

@@ -18,6 +18,41 @@ services:
       timeout: 5s
       retries: 5
 
+  dovecot:
+    image: dovecot/dovecot:{{ dovecot_version }}
+    container_name: dovecot
+    restart: unless-stopped
+    volumes:
+      - {{ mail_data_dir }}/dovecot.conf:/etc/dovecot/dovecot.conf:ro
+      - {{ mail_data_dir }}/passwd:/etc/dovecot/passwd:ro
+      - {{ mail_data_dir }}/maildir:/var/mail
+    networks:
+      - traefik_public
+      - mail_internal
+    labels:
+      - "traefik.enable=true"
+      # TCP router — Traefik terminates TLS on port 993 and forwards plain IMAP to port 143
+      - "traefik.tcp.routers.imaps.rule=HostSNI(`{{ domain_mail }}`)"
+      - "traefik.tcp.routers.imaps.entrypoints=imaps"
+      - "traefik.tcp.routers.imaps.tls.certresolver=letsencrypt"
+      - "traefik.tcp.services.imaps.loadbalancer.server.port=143"
+
+{% if fetchmail_accounts | default([]) | length > 0 %}
+  fetchmail:
+    image: alpine:3
+    container_name: fetchmail
+    restart: unless-stopped
+    # apk add runs on each start — acceptable for a home server
+    command: ["sh", "-c", "apk add --no-cache fetchmail && exec fetchmail --nodetach -f /etc/fetchmail/fetchmailrc"]
+    volumes:
+      - {{ mail_data_dir }}/fetchmailrc:/etc/fetchmail/fetchmailrc:ro
+    networks:
+      - traefik_public
+      - mail_internal
+    depends_on:
+      - dovecot
+
+{% endif %}
   roundcube:
     image: roundcube/roundcubemail:{{ roundcube_version }}
     container_name: roundcube
@@ -30,14 +65,13 @@ services:
       ROUNDCUBEMAIL_DB_USER: roundcube
       ROUNDCUBEMAIL_DB_PASSWORD: "{{ roundcube_db_password }}"
       ROUNDCUBEMAIL_DB_NAME: roundcube
-      # IMAP — leave empty to let users enter their own server at login,
-      # or set to a specific host to lock it down (e.g. ssl://imap.example.com)
-      ROUNDCUBEMAIL_DEFAULT_HOST: "{{ roundcube_imap_host }}"
-      ROUNDCUBEMAIL_DEFAULT_PORT: "{{ roundcube_imap_port }}"
-      # SMTP
+      # IMAP — local Dovecot container
+      ROUNDCUBEMAIL_DEFAULT_HOST: "dovecot"
+      ROUNDCUBEMAIL_DEFAULT_PORT: "143"
+      # SMTP — outgoing mail server (leave empty if not configured)
       ROUNDCUBEMAIL_SMTP_SERVER: "{{ roundcube_smtp_host }}"
       ROUNDCUBEMAIL_SMTP_PORT: "{{ roundcube_smtp_port }}"
-      # Security — 24-character random string used to encrypt session data
+      # Security
       ROUNDCUBEMAIL_DES_KEY: "{{ roundcube_des_key }}"
       ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
     networks:
@@ -53,6 +87,8 @@ services:
     depends_on:
       mail-db:
         condition: service_healthy
+      dovecot:
+        condition: service_started
 
 networks:
   traefik_public:

ansible/roles/mail/templates/dovecot.conf.j2

@@ -0,0 +1,43 @@
+# Managed by Ansible — do not edit manually
+protocols = imap lmtp
+
+# Plaintext auth is fine — connections come from within Docker or via
+# Traefik TLS termination, never plain from the internet
+disable_plaintext_auth = no
+auth_mechanisms = plain login
+
+passdb {
+  driver = passwd-file
+  args = /etc/dovecot/passwd
+}
+
+userdb {
+  driver = passwd-file
+  args = /etc/dovecot/passwd
+  default_fields = uid=5000 gid=5000 home=/var/mail/%u
+}
+
+mail_location = maildir:/var/mail/%u/Maildir
+mail_uid = 5000
+mail_gid = 5000
+
+service imap-login {
+  inet_listener imap {
+    port = 143
+  }
+  # IMAPS disabled — Traefik terminates TLS on port 993 and forwards plain IMAP
+  inet_listener imaps {
+    port = 0
+  }
+}
+
+# LMTP listener for fetchmail delivery — reachable on mail_internal network only
+service lmtp {
+  inet_listener lmtp {
+    address = *
+    port = 24
+  }
+}
+
+# SSL disabled — Traefik handles TLS
+ssl = no

ansible/roles/mail/templates/fetchmailrc.j2

@@ -0,0 +1,20 @@
+# Managed by Ansible — do not edit manually
+set postmaster "postmaster"
+set bouncemail
+set logfile /dev/stdout
+# Wake up every 60 seconds; each server's 'interval' is a multiplier of this
+set daemon 60
+
+{% for account in fetchmail_accounts | default([]) %}
+poll {{ account.server }} proto {{ account.protocol | default('pop3') }}{% if account.ssl | default(true) %} ssl{% endif %}
+
+  user "{{ account.username }}" password "{{ account.password }}"
+  is {{ account.local_user }} here
+  smtphost dovecot
+  smtpport 24
+  lmtp
+  fetchall
+  {{ 'keep' if account.keep | default(true) else 'no keep' }}
+  interval {{ account.poll_minutes | default(10) }}
+
+{% endfor %}

ansible/roles/mail/templates/passwd.j2

@@ -0,0 +1,4 @@
+# Managed by Ansible — do not edit manually
+{% for user in dovecot_users | default([]) %}
+{{ user.username }}:{SHA512-CRYPT}{{ user.password | password_hash('sha512', (user.username | hash('md5'))[:16]) }}
+{% endfor %}