config: Try to fail with settings inside impossible filters

data/settings.js

@@ -7442,12 +7442,45 @@ distinguish different listener types that one service may employ.`
 	inet_listener_port: {
 		tags: [ 'service' ],
 		values: setting_types.IN_PORT,
-		seealso: [ 'listen' ],
+		seealso: [ 'inet_listener_listen' ],
 		default: 0,
 		text: `
 Port number where to listen. \`0\` disables the listener.`
 	},
 
+	inet_listener_listen: {
+		tags: [ 'service' ],
+		default: '\*, \:\:',
+		values: setting_types.IPADDR,
+		changed: {
+			settings_listen_renamed: `
+Renamed from \`listen\`, which still works as an alias.`
+		},
+		text: `
+A comma-separated list of IP addresses or hostnames on which external network
+connections will be handled.
+
+\`*\` listens at all IPv4 interfaces, and \`::\` listens at all IPv6
+interfaces.
+
+Example:
+
+\`\`\`
+listen = 127.0.0.1, 192.168.0.1
+\`\`\`
+
+The setting can be used globally, inside a \`service { .. }\` and inside an
+[[setting,inet_listener]], where the most specific value wins, e.g.:
+
+\`\`\`
+service imap-login {
+  inet_listener imap {
+    listen = 192.168.0.1
+  }
+}
+\`\`\``
+	},
+
 	inet_listener_ssl: {
 		tags: [ 'service' ],
 		values: setting_types.BOOLEAN,
@@ -7567,31 +7600,10 @@ The directory from which you execute commands via doveadm-exec.`
 	},
 
 	listen: {
-		default: '\*, \:\:',
 		values: setting_types.IPADDR,
+		seealso: [ 'inet_listener_listen' ],
 		text: `
-A comma-separated list of IP addresses or hostnames on which external network
-connections will be handled.
-
-\`*\` listens at all IPv4 interfaces, and \`::\` listens at all IPv6
-interfaces.
-
-Example:
-
-\`\`\`
-listen = 127.0.0.1, 192.168.0.1
-\`\`\`
-
-This setting can be used also inside an [[setting,inet_listener]] to override
-the listener address, e.g.:
-
-\`\`\`
-service imap-login {
-  inet_listener imap {
-    listen = 192.168.0.1
-  }
-}
-\`\`\``
+Alias for [[setting,inet_listener_listen]].`
 	},
 
 	lmtp_add_received_header: {

data/updates.js

@@ -89,6 +89,7 @@ export const updates = {
 	settings_boolean_values_changed: '2.4.6',
 	settings_delayed_expansion_changed: '2.4.2',
 	settings_list_key_variables_changed: '2.4.5',
+	settings_listen_renamed: '2.4.6',
 	settings_path_types_added: '2.4.6',
 	settings_syntax_named_filters_added: '2.4.0',
 	sieve_ext_imapflags: '2.4.0',

docs/installation/upgrade/2.4-to-2.4.x.md

@@ -197,6 +197,10 @@ INBOX namespace.
 
 <!-- @include: include/2.4.6-shutdown-clients.inc -->
 
+<!-- @include: include/2.4.6-filter-inherited-settings.inc -->
+
+<!-- @include: include/2.4.6-listen-setting.inc -->
+
 #### Doveadm Logging Changes
 
 <!-- @include: include/2.4.6-doveadm-logging.inc -->

docs/installation/upgrade/include/2.4-converted-settings.inc

@@ -16,7 +16,7 @@
 | `event_exporter_transport_args` | Split off to driver-specific settings, see [[link,event_export]]. |
 | `event_exporter_transport_timeout` | Replaced by [[setting,http_client_request_timeout]] and [[setting,event_exporter_unix_connect_timeout]]. |
 | `imap_capability = +CAPA1` | Use [[setting,imap_capability]] `{ CAPA1 = yes }` instead. |
-| `inet_listener { address }` | Replaced by [[setting,listen]] setting. |
+| `inet_listener { address }` | Replaced by [[setting,inet_listener_listen]] setting. |
 | `push_notification_backend` | Use [[setting,push_notification_driver]] instead. |
 | `mail_crypt_require_encrypted_user_key` | Replaced by [[setting,crypt_user_key_require_encrypted]], [[setting,crypt_user_key_password]] and [[setting,crypt_user_key_encryption_key]]. |
 | `verbose_ssl` | Use [[setting,log_debug,category=ssl]] instead. |

docs/installation/upgrade/include/2.4.6-filter-inherited-settings.inc

@@ -0,0 +1,12 @@
+ * Some settings can now be used only where they have an effect. Using one
+   inside a filter that doesn't use it is a configuration error instead of
+   being silently ignored. For example [[setting,quota_mail_size]] applies to
+   the user rather than to a quota root, so it can't be used inside
+   `quota { .. }`.
+ * The global `default_*` settings and [[setting,protocols]] can be used only
+   globally. Setting a `default_*` inside `service { .. }` used to change that
+   service's derived settings, because their defaults expand
+   `$SET:default_internal_user` and similar within the filter. Use the
+   per-service setting instead, e.g. [[setting,service_user]] rather than
+   `service foo { default_internal_user = .. }`. Referring to the global
+   settings with `$SET:` inside a filter keeps working.

docs/installation/upgrade/include/2.4.6-listen-setting.inc

@@ -0,0 +1,3 @@
+ * The `listen` setting is now called [[setting,inet_listener_listen]]. The old
+   name still works as an alias, so configurations don't need changes, but
+   `doveconf` writes the new name outside of `inet_listener { .. }` blocks.