diff --git a/docker-compose.yml b/docker-compose.yml index 0d118bf..10e5e1f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -83,6 +83,7 @@ services: - traefik postfix: build: ./postfix + tty: true image: baloan/postfix ports: - 8025:25 @@ -90,6 +91,7 @@ services: - spool:/var/spool/postfix spampd: build: ./spampd + tty: true image: baloan/spampd volumes: - spamassassin:/var/lib/spamassassin diff --git a/etc-baloghs/postfix/master.cf b/etc-baloghs/postfix/master.cf index 26f51e5..246486c 100644 --- a/etc-baloghs/postfix/master.cf +++ b/etc-baloghs/postfix/master.cf @@ -9,7 +9,9 @@ # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (no) (never) (100) # ========================================================================== -smtp inet n - y - - smtpd +smtp inet n - n - - smtpd + -o content_filter=scan:localhost:10025 + -o receive_override_options=no_address_mappings #smtp inet n - y - 1 postscreen #smtpd pass - - y - - smtpd #dnsblog unix - - y - 0 dnsblog @@ -65,3 +67,32 @@ lmtp unix - - n - - lmtp anvil unix - - y - 1 anvil scache unix - - y - 1 scache postlog unix-dgram n - n - 1 postlogd +# +# ==================================================================== +# Interfaces to non-Postfix software. Be sure to examine the manual +# pages of the non-Postfix software to find out what options it wants. +# +# Many of the following services use the Postfix pipe(8) delivery +# agent. See the pipe(8) man page for information about ${recipient} +# and other message envelope options. +# ==================================================================== +# +# Kopano mail delivery agent +# +kopano unix - n n - 10 pipe + flags=DRhu user=vmail argv=/usr/sbin/kopano-dagent ${user} +# +# Proxy receiver, see https://cwiki.apache.org/confluence/display/spamassassin/IntegratePostfixViaSpampd +# +localhost:10026 inet n - n - 10 smtpd + -o content_filter= + -o myhostname=kopano.baloghs.de + -o mynetworks=127.0.0.0/8 + -o smtpd_authorized_xforward_hosts=127.0.0.0/8 + -o smtpd_tls_security_level=none + -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters + -o smtpd_helo_restrictions= + -o smtpd_client_restrictions= + -o smtpd_sender_restrictions= + -o smtpd_relay_restrictions= + -o smtpd_recipient_restrictions=permit_mynetworks,reject diff --git a/etc-zntrl/postfix/main.cf b/etc-zntrl/postfix/main.cf index ab53dc0..4bb165d 100644 --- a/etc-zntrl/postfix/main.cf +++ b/etc-zntrl/postfix/main.cf @@ -1,7 +1,9 @@ # See /usr/share/postfix/main.cf.dist for a commented, more complete version smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) biff = no -maillog_file = /dev/stdout +# maillog_file = /dev/stdout +# maillog_file=/var/log/postfix.log +# maillog_file_permissions=0644 # appending .domain is the MUA's job. append_dot_mydomain = no @@ -14,11 +16,11 @@ readme_directory = no compatibility_level = 2 # local domains -myhostname = mta.zntrl.de -mydestination = $mydomain, localhost.$mydomain, localhost +myhostname = nuc0.zntrl.de +mydestination = $myhostname, localhost.$mydomain, localhost alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases -myorigin = zntrl.de +myorigin = $mydomain # mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 # trusts all hosts in the kopano docker network mynetworks_style = subnet @@ -29,6 +31,7 @@ virtual_mailbox_maps = hash:/etc/postfix/vmailbox virtual_alias_maps = hash:/etc/postfix/virtual # virtual_transport = lmtp:unix:/var/spool/kopano/dagent.sock virtual_transport = lmtp:dagent:2003 +lmtp_tls_loglevel = 1 # default outbound transport for all domains, use one relay for all domains # authenticates to relay.zntrl.de for authorisation to relay mail, see also: SMTP (outbound) @@ -46,9 +49,9 @@ smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_una # SMTP (outbound) smtp_tls_CApath=/etc/ssl/certs -smtd_tls_CAfile = /usr/local/share/ca-certificates/kopano-ca.crt -smtd_tls_key_file = /etc/ssl/private/zntrl.key -smtd_tls_cert_file = /etc/ssl/zntrl.crt +smtp_tls_CAfile = /usr/local/share/ca-certificates/kopano-ca.crt +smtp_tls_key_file = /etc/ssl/private/zntrl.key +smtp_tls_cert_file = /etc/ssl/zntrl.crt smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_tls_wrappermode = yes smtp_tls_security_level = encrypt diff --git a/etc-zntrl/postfix/master.cf b/etc-zntrl/postfix/master.cf index 26f51e5..17ecf60 100644 --- a/etc-zntrl/postfix/master.cf +++ b/etc-zntrl/postfix/master.cf @@ -10,6 +10,8 @@ # (yes) (yes) (no) (never) (100) # ========================================================================== smtp inet n - y - - smtpd + -o content_filter=scan:kopano-spampd-1:10025 + -o receive_override_options=no_address_mappings #smtp inet n - y - 1 postscreen #smtpd pass - - y - - smtpd #dnsblog unix - - y - 0 dnsblog @@ -65,3 +67,18 @@ lmtp unix - - n - - lmtp anvil unix - - y - 1 anvil scache unix - - y - 1 scache postlog unix-dgram n - n - 1 postlogd +# +# Proxy receiver, see https://cwiki.apache.org/confluence/display/spamassassin/IntegratePostfixViaSpampd +# +10026 inet n - n - 10 smtpd + -o content_filter= + -o myhostname=mta.zntrl.de + -o mynetworks=127.0.0.0/8 + -o smtpd_authorized_xforward_hosts=127.0.0.0/8 + -o smtpd_tls_security_level=none + -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters + -o smtpd_helo_restrictions= + -o smtpd_client_restrictions= + -o smtpd_sender_restrictions= + -o smtpd_relay_restrictions= + -o smtpd_recipient_restrictions=permit_mynetworks,reject diff --git a/postfix/Dockerfile b/postfix/Dockerfile index 72d1856..fe2c454 100644 --- a/postfix/Dockerfile +++ b/postfix/Dockerfile @@ -4,15 +4,24 @@ FROM ubuntu:20.04 ENV TZ Europe/Berlin RUN <