mailmig: Stalwart -> SNM IMAP migration tool (initial)

mailmig.example.toml

@@ -0,0 +1,71 @@
+# mailmig configuration: Stalwart (old) -> Simple NixOS Mailserver (new).
+# Secrets are read from environment variables or files, never stored here.
+
+# ---- old server: Stalwart -------------------------------------------------
+[source]
+host = "mail.b4l.co.th"
+tls = "implicit"            # implicit (993) | starttls (143) | none
+# Stalwart impersonation: the master account needs the `impersonate`
+# permission; mailmig logs in as "<account>%<master>" with the master's
+# *main* password (app passwords are refused for impersonation).
+[source.auth]
+mode = "master"
+user = "mailmig@b4l.co.th"
+password_env = "MAILMIG_SRC_MASTER_PASSWORD"
+login_format = "{user}%{master}"
+
+# Management API, used by `mailmig inventory`.
+[stalwart]
+url = "https://mail.b4l.co.th"
+kind = "auto"               # auto | rest (<= 0.15) | jmap (>= 0.16)
+user = "admin"
+password_env = "MAILMIG_STALWART_ADMIN_PASSWORD"
+# token_env = "MAILMIG_STALWART_TOKEN"   # API key instead of user/password
+
+# ---- new server: Simple NixOS Mailserver ----------------------------------
+[destination]
+host = "mx1.cnx.email"
+tls = "implicit"
+# Temporary Dovecot master user from out/dovecot-master-user.nix.
+[destination.auth]
+mode = "master"
+user = "mailmig"
+password_env = "MAILMIG_DST_MASTER_PASSWORD"
+login_format = "{user}*{master}"
+
+# ---- folders ----------------------------------------------------------------
+[folders]
+# Special-use folders (\Sent, \Trash, ...) are matched by attribute; Stalwart's
+# "Sent Items"/"Deleted Items"/"Junk Mail" land in SNM's Sent/Trash/Junk.
+exclude = ["Shared Folders/*"]
+separator_replacement = "_"
+# [folders.map]
+# "Old Name" = "New Name"
+
+[sync]
+jobs = 4
+skip_deleted = true
+retries = 2
+
+# ---- users (SNM / clan) ---------------------------------------------------------
+[snm]
+clan_machine = "mx1"
+clan_generator_prefix = "mail-passwd-"
+master_user = "mailmig"
+
+# ---- DNS ------------------------------------------------------------------
+[dns]
+provider = "cloudflare"     # cloudflare | zonefile
+api_token_env = "CLOUDFLARE_API_TOKEN"   # Zone:DNS:Edit on the mail domains
+mx = ["10 mx1.cnx.email"]
+spf = "v=spf1 mx -all"
+dmarc = "v=DMARC1; p=quarantine; rua=mailto:dmarc@cnx.email"
+dkim_selector = "mail"
+dkim_dir = "dkim"           # scp 'mx1:/var/dkim/*.txt' dkim/
+old_hosts = ["mail.b4l.co.th"]
+client_host = "mail.cnx.email"
+srv = true
+ttl = 300
+
+# [dns.overrides."poyrecords.com"]
+# spf = "v=spf1 mx include:_spf.google.com -all"