Re: Simple virtual user setup with multiple domains

[Unicorn]

> No, it means that unless there is a more specific alias before, all
> those 4 aliases, whatever is the domain part amongst the domains you
> receive for, will be delivered to mainu...@maindomain.tld

> No, you need to deliver to vmail for all users, Dovecot will be
> responsible for placing emails into the right folders.

Now I got it to work and I understood the way it works finally! 
Thank you Archange and Uwe for helping along the way, please let me
know if there is anything else you would change since I intend to make
a proper guide for this entire setup as it is pretty basic and
versatile. I don't want to recommend bad practices so please let me
know if there is something I should change.

For anybody else who may look at this in the future, here are the
relevant config files that I ended up with:

#### /etc/mail/smtpd.conf ##########################################
pki mail.domain.tld cert "/etc/ssl/mail.domain.org.fullchain.pem"
pki mail.domain.tld key "/etc/ssl/private/mail.domain.tld.key"

# Junk filters, rspamd also for DKIM signing
filter check_dyndns phase connect match rdns regex { '.*\.dyn\..*',
'.*\.dsl\..*' } junk
filter check_rdns phase connect match !rdns junk
filter check_fcrdns phase connect match !fcrdns junk
filter rspamd proc-exec "filter-rspamd"

# Tables
table usermap file:/etc/mail/usermap
table credentials file:/etc/mail/credentials
table domains { domain.tld, second.tld, third.tld }

# Listen for incoming mail and send through filters
listen on all tls pki mail.domain.tld \
    filter { check_dyndns, check_rdns, check_fcrdns, rspamd }

# Listen for, authenticate and DKIM-sign outgoing mail requests
listen on all port submission tls-require pki mail.domain.tld \
    auth <credentials> filter rspamd

action "inbound" lmtp "/var/dovecot/lmtp" rcpt-to virtual <usermap>
action "outbound" relay helo mail.domain.tld

# Match incoming mail
match from any for domain <domains> action "inbound"
match for local action "inbound"

# Match outgoing mail
match from any auth for any action "outbound"
match for any action "outbound"
####################################################################

#### /etc/mail/usermap #############################################
abuse                                admin
hostmaster                           admin
postmaster                           admin
webmaster                            admin
www                                  admin
operator                             admin
security                             admin
root                                 admin
contact                              admin

cl...@domain.tld                     admin

admin                                ad...@domain.tld

ad...@domain.tld                     vmail
unic...@third.tld                    vmail
####################################################################
(This makes practically everything go to the inbox of ad...@domain.tld
 with the exception of unic...@third.tld which also gets its own
inbox)

#### /etc/mail/credentials #########################################
ad...@domain.tld:$2b$09$blahblahhashgoeshereblahblahhashgoeshere
cl...@domain.tld:$2b$09$blahblahhashgoeshereblahblahhashgoeshere
ad...@second.tld:$2b$09$blahblahhashgoeshereblahblahhashgoeshere
cont...@second.tld:$2b$09$blahblahhashgoeshereblahblahhashgoeshere
ad...@third.tld:$2b$09$blahblahhashgoeshereblahblahhashgoeshere
unic...@third.tld:$2b$09$blahblahhashgoeshereblahblahhashgoeshere
####################################################################
(Credentials are needed for every inbox and for every sender. In my
case only ad...@domain.tld and unic...@third.tld have inboxes, so the
others are just other identities that I can use to send emails from.)

#### /etc/rsmapd/local.d/dkim-signing.conf #########################
allow_username_mismatch = true;
domain {
    domain.tld {
        path = "/etc/mail/dkim/domain.tld.key";
        selector = "selectorone";
    }
    second.tld {
        path = "/etc/mail/dkim/second.tld.key";
        selector = "selectortwo";
    }
    third.tld {
        path = "/etc/mail/dkim/third.tld.key";
        selector = "selectorthree";
    }
}
####################################################################
(The allow_username_mismatch can probably be left out for this setup,
haven't tried yet though)

#### /etc/dovecot/dovecot.conf #####################################
protocols = imap lmtp
####################################################################

#### /etc/dovecot/conf.d/10-auth.conf ##############################
passdb {
  driver = passwd-file
  args = scheme=CRYPT /etc/mail/credentials
}
userdb {
  driver = static
  args = uid=vmail gid=vmail home=/var/maildirs/%d/%n
}
####################################################################

#### /etc/dovecot/conf.d/10-mail.conf ##############################
mail_location = maildir:~/Maildir
####################################################################

#### /etc/dovecot/conf.d/10-ssl.conf ###############################
ssl_cert = </etc/ssl/mail.domain.tld.fullchain.pem
ssl_key = </etc/ssl/private/mail.domain.tld.key
####################################################################

#### /etc/dovecot/conf.d/15-mailboxes.conf #########################
namespace inbox {
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Archive {
    auto = subscribe
    special_use = \Archive
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
}
####################################################################

And that is it as far as mail-related config files go. :)
I will also look into sieve rules further, thanks for the pointer
Archange.

Best,
Unicorn