michael/containers
1
0
Fork 0
Code Packages Activity

Mail

Browse Source
This commit is contained in:
=
2024-12-19 22:32:42 -05:00
parent 12e996003e
commit 9803b2f155
27 changed files with 268 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
postfix/Dockerfile
View File

@ -4,6 +4,7 @@ RUN apk add --update --no-cache \
bash \
nano \
curl \
bind-tools \
postfix \
postfix-ldap \
postfix-pcre \
@ -12,12 +13,19 @@ RUN apk add --update --no-cache \
RUN update-ca-certificates && \
mkdir /cert && \
chown 100:101 /cert
mkdir /dh && \
chown 100:101 /cert && \
chown 100:101 /dh
COPY --chown=root:root start.sh config /
COPY --chown=root:root start.sh /
COPY --chown=root:root config/ /config/
COPY --chown=root:root templates/ /templates/
RUN chown -R 100:101 /var/lib/postfix && \
chmod 750 /var/lib/postfix
VOLUME /config
VOLUME /cert
VOLUME /dh
VOLUME /var/spool/postfix
EXPOSE 10025/tcp

11
postfix/config/master.cf
View File

@ -10,14 +10,14 @@
-o smtpd_sasl_authenticated_header=yes
-o smtpd_sasl_local_domain=$mydomain
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=inet:127.0.0.1:12345
-o smtpd_sasl_path=unix:/socket/sasl
-o smtpd_sasl_security_options=noanonymous,noplaintext
-o smtpd_sasl_tls_security_options=noanonymous
-o smtpd_sender_login_maps=ldap:/config/ldap_senders.cf
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=reject_non_fqdn_sender,reject_sender_login_mismatch
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o smtpd_sender_restrictions=reject_non_fqdn_sender,reject_authenticated_sender_login_mismatch,reject_unauthenticated_sender_login_mismatch
-o smtpd_relay_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-o smtpd_recipient_restrictions=reject_non_fqdn_recipient
-o smtpd_data_restrictions=
-o smtpd_tls_auth_only=yes
@ -31,6 +31,9 @@ defer unix - - n - 0 bounce
verify unix - - n - 1 verify
pickup unix n - n 60 1 pickup
-o receive_override_options=no_header_body_checks
# Inbound SPF checks
spf unix - n n - 0 spawn
user=policyd-spf argv=/usr/bin/policyd-spf
# Outputs
error unix - - n - - error

18
postfix/start.sh
View File

@ -18,9 +18,17 @@
# --- 2024-12-18 ---
IP=$(curl https://ipv4.icanhazip.com)
/usr/sbin/postconf proxy_interfaces="$IP"
/usr/sbin/postconf ldap_bind_pw="$LDAP_BIND_PW"
# Start postfix
PUBLIC_IP=$(curl https://ipv4.icanhazip.com)
echo "Public IP: $PUBLIC_IP"
echo "Hostname: $POSTFIX_HOST"
echo "Domain: $POSTFIX_DOMAIN"
echo "Templating files..."
eval "echo \"$(cat /templates/ldap_aliases.cf.tmpl)\"" > /config/ldap_aliases.cf
eval "echo \"$(cat /templates/ldap_senders.cf.tmpl)\"" > /config/ldap_senders.cf
eval "echo \"$(cat /templates/main.cf.tmpl)\"" > /config/main.cf
echo "Copying resolv.conf into /var/spool/postfix"
mkdir -p /var/spool/postfix/etc
chmod o+rx /var/spool/postfix/etc
cp /etc/resolv.conf /var/spool/postfix/etc/resolv.conf
echo "Starting Postfix..."
/usr/sbin/postfix -v -c /config start-fg

5
postfix/config/ldap_aliases.cf → postfix/templates/ldap_aliases.cf.tmpl
View File

@ -1,8 +1,9 @@
server_host = ldaps://ldap.balsillie.net:636
start_tls = no
server_host = ${LDAP_SCHEME}://${LDAP_HOST}:${LDAP_PORT}
version = 3
bind = yes
bind_dn = cn=bind,dc=balsillie,dc=net
bind_pw = $ldap_bind_pw
bind_pw = ${LDAP_BIND_PW}
search_base = ou=users,dc=balsillie,dc=net
scope = sub
query_filter = (&(objectClass=mailAccount)(mailEnabled=TRUE)(|(mailAlias=%s)(mail=%s)))

5
postfix/config/ldap_senders.cf → postfix/templates/ldap_senders.cf.tmpl
View File

@ -1,8 +1,9 @@
server_host = ldaps://ldap.balsillie.net:636
start_tls = no
server_host = ${LDAP_SCHEME}://${LDAP_HOST}:${LDAP_PORT}
version = 3
bind = yes
bind_dn = cn=bind,dc=balsillie,dc=net
bind_pw = $ldap_bind_pw
bind_pw = ${LDAP_BIND_PW}
search_base = ou=users,dc=balsillie,dc=net
scope = sub
query_filter = (&(objectClass=mailAccount)(mailEnabled=TRUE)(|(mailAlias=%s)(mail=%s)))

84
postfix/config/main.cf → postfix/templates/main.cf.tmpl
View File

@ -1,8 +1,8 @@
myhostname = smtp.balsillie.net
mydomain = balsillie.net
myorigin = $mydomain
mynetworks = 127.0.0.0/8 10.64.0.0/12 10.96.10.0/24
mydestination = $myhostname localhost
myhostname = ${POSTFIX_HOST}
mydomain = ${POSTFIX_DOMAIN}
myorigin = ${POSTFIX_DOMAIN}
mynetworks = 127.0.0.0/8 10.64.0.0/12 10.96.10.10/32 10.96.10.254/32
mydestination = ${POSTFIX_HOST} localhost
biff = no
bounce_queue_lifetime = 1d
@ -14,30 +14,28 @@ header_checks = pcre:/config/header_checks.pcre
inet_interfaces = all
inet_protocols = ipv4
lmtp_tls_loglevel = 1
lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
lmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
lmtp_tls_security_level = none
lmtp_tls_wrappermode = no
lmtp_use_tls = no
# Not needed, lmtp uses unix socket
# lmtp_tls_loglevel = 1
# lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
# lmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
# lmtp_tls_security_level = none
# lmtp_tls_wrappermode = no
# lmtp_use_tls = no
local_recipient_maps =
local_transport = local:$myhostname
local_transport = local:${POSTFIX_HOST}
mailbox_size_limit = 51200000
maillog_file = /dev/stdout
maximal_queue_lifetime = 1d
message_size_limit = 51200000
mime_header_checks = $header_checks
mime_header_checks = pcre:/config/header_checks.pcre
# Milters
milter_protocol = 6
milter_default_action = accept
dkim_milter = inet:127.0.0.1:8891
# dmarc_milter = inet:localhost:8893
# smtpd_milters = $dkim_milter,$dmarc_milter
smtpd_milters = $dkim_milter
non_smtpd_milters = $dkim_milter
smtpd_milters = unix:/socket/dkim
non_smtpd_milters = unix:/socket/dkim
postscreen_access_list =
postscreen_denylist_action = drop
@ -68,22 +66,40 @@ smtp_tls_policy_maps =
smtp_tls_protocols = !SSLv2, !SSLv3
smtp_tls_security_level = dane
smtpd_banner = $myhostname ESMTP
smtpd_banner = ${POSTFIX_HOST} ESMTP
# SASL - SMTPS sasl settings specified in master.cf
smtpd_sasl_auth_enable = no
# SPF
policyd-spf_time_limit = 3600
# SMTPD restrictions
smtpd_helo_required = yes
smtpd_delay_reject = yes
smtpd_client_restrictions = reject_unknown_client_hostname
smtpd_helo_restrictions = reject_unknown_helo_hostname, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname
smtpd_sender_restrictions = reject_non_fqdn_sender, reject_unknown_sender_domain
smtpd_relay_restrictions = permit_auth_destination, reject_unauth_destination
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unlisted_recipient
smtpd_data_restrictions = reject_unauth_pipelining, reject_multi_recipient_bounce
smtpd_client_restrictions =
reject_unknown_reverse_client_hostname
smtpd_helo_restrictions =
reject_unknown_helo_hostname,
reject_non_fqdn_helo_hostname,
reject_invalid_helo_hostname
smtpd_sender_restrictions =
reject_non_fqdn_sender,
reject_unknown_sender_domain
smtpd_relay_before_recipient_restrictions = yes
smtpd_relay_restrictions =
permit_auth_destination,
reject_unauth_destination,
check_policy_service unix:private/spf
smtpd_recipient_restrictions =
reject_non_fqdn_recipient,
reject_unlisted_recipient
smtpd_data_restrictions =
reject_unauth_pipelining,
reject_multi_recipient_bounce
# client , reject_rbl_client zen.spamhaus.org, reject_rhsbl_reverse_client dbl.spamhaus.org
# helo , reject_rhsbl_helo dbl.spamhaus.org
@ -91,7 +107,7 @@ smtpd_data_restrictions = reject_unauth_pipelining, reject_multi_recipient_bounc
smtpd_tls_cert_file=/cert/tls.crt
smtpd_tls_key_file=/cert/tls.key
smtpd_tls_dh1024_param_file = /cert/dhparams.pem
smtpd_tls_dh1024_param_file = /dh/dhparams.pem
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
@ -104,8 +120,16 @@ tls_ssl_options = NO_COMPRESSION
unverified_recipient_reject_code = 577
virtual_alias_maps = ldap:/config/ldap_users.cf
virtual_alias_maps = ldap:/config/ldap_aliases.cf
virtual_mailbox_base =
virtual_mailbox_domains = $mydomain
virtual_mailbox_maps = $virtual_alias_maps
virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = ${POSTFIX_DOMAIN}
virtual_mailbox_maps = ldap:/config/ldap_aliases.cf
virtual_transport = lmtp:unix:/socket/lmtp
# External IP templated at container start
proxy_interfaces=${PUBLIC_IP}
disable_dns_lookups = no
smtp_dns_support_level = enabled
smtp_host_lookup = dns
smtpd_peername_lookup = yes