diff --git a/modules/services/mail/dovecot2.nix b/modules/services/mail/dovecot2.nix
index c5f5da41d31..fc97e0d3ad0 100644
--- a/modules/services/mail/dovecot2.nix
+++ b/modules/services/mail/dovecot2.nix
@@ -14,9 +14,10 @@ let
     ''
     + (if cfg.sslServerCert!="" then
     ''
-      ssl_cert_file = ${cfg.sslServerCert}
-      ssl_key_file = ${cfg.sslServerKey}
-      ssl_ca_file = ${cfg.sslCACert}
+      ssl_cert = <${cfg.sslServerCert}
+      ssl_key = <${cfg.sslServerKey}
+      ssl_ca = <${cfg.sslCACert}
+      disable_plaintext_auth = yes
     '' else ''
       ssl = no
       disable_plaintext_auth = no
@@ -40,14 +41,9 @@ let
         driver = pam
         args = dovecot2
       }
-      #auth_debug = yes
-      #auth_verbose = yes
-      #debug_log_path = /tmp/dovecot2debug.log
 
       pop3_uidl_format = %08Xv%08Xu
-
-      log_path = /var/log/dovecot2.log
-    '';
+    '' + cfg.extraConfig;
 
   confFile = pkgs.writeText "dovecot.conf" dovecotConf;
 
@@ -76,6 +72,12 @@ in
         description = "Dovecot group name.";
       };
 
+      extraConfig = mkOption {
+        default = "";
+        example = "mail_debug = yes";
+        description = "Additional entries to put verbatim into Dovecot's config file.";
+      };
+
       mailLocation = mkOption {
         default = "maildir:/var/spool/mail/%u"; /* Same as inbox, as postfix */
         example = "maildir:~/mail:INBOX=/var/spool/mail/%u";