RedXen/aports
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Postfix & Dovecot changes batch

Browse Source 
- Use PGSQL directly from postfix
- Fix queries
- Remove auth socket
- Change domain temporarily to mailtest.redxen.eu
- Change TLS settings
- Re-enable chroots where auth socket isn't required anymore
- Add DNS records for unbound
- Add postfix to pgsql hba
- Use pre-built runfile instead of upstream to fix a "feature"
This commit is contained in:
Alex D. 2021-01-07 17:13:22 +00:00
parent 5d15ee3d6a
commit 6dc788f369
Signed by: caskd
GPG Key ID: F92BA85F61F4C173
15 changed files with 118 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -11,3 +11,5 @@ configs/grafana/grafana.ini
configs/pleroma/secret.exs
configs/gitea/gitea.ini
configs/dovecot/pgsql.conf
configs/postfix/pgsql-aliases.cf
configs/postfix/pgsql-users.cf

8
configs/dovecot/APKBUILD
View File

@ -1,8 +1,8 @@
# Contributor: Alex Denes <caskd@redxen.eu>
# Maintainer: Alex Denes <caskd@redxen.eu>
pkgname=redxen-config-dovecot
pkgver=2021.01.06
pkgrel=4
pkgver=2021.01.07
pkgrel=0
pkgdesc="Dovecot configuration"
url="https://git.redxen.eu/RedXen"
arch="noarch"
@ -23,6 +23,6 @@ package() {
install -d "$pkgdir"/var/mail
}
sha512sums="14c83a329c6bd6705e4fcdae68b309a0e083ab94afa8d7ca855a98fbb96bb842cf0927c5a5871c9c25b78092e643158169925944e7b18e490602f3849a5d1542 dovecot.conf
5dd060068e0d54a3e5c4dbd259935adc70add545628c6c5dac64f93889771729418397656a7cb4a2bb62ec28c5673190edbf824ae05192a001bce07d97b58426 pgsql.conf
sha512sums="00dcd8cae91bdddaa6e55cca6060d326ea38716426c028a5e481d55893df818236ec2556d8d496502cc356b5b53d71c76cdcf4cdee713242ceee10061f2a0714 dovecot.conf
d4646d31915b6fc0df7cc9c06d66c369f6a622f2f0c783fd9463a05a53d1b3b3ba2ebcbe32b2391f0e44fe2a67c6eeeef3b00d3067325152054e184ac67ff745 pgsql.conf
e305a5ee8196f09d805278acf27a2b66eae9c9e3c6e3458bca391597b1c720c063f8c92034d1af070c750fd0858da7eaa16e75a3b060064eac6b5bcb7b2452e7 rspamd.sieve"

2
configs/dovecot/README.md
View File

@ -3,7 +3,7 @@
NOTE: THIS SETUP DOESN'T HANDLE PER-DOMAIN USERS
First create the database and the tables by importing base.sql
Then change the password with `ALTER USER dovecot PASSWORD '...';`
Then change the password with `ALTER ROLE dovecot PASSWORD '...';`
Adding users:

11
configs/dovecot/base.sql
View File

@ -1,4 +1,3 @@
CREATE USER dovecot PASSWORD 'CHANGEME' WITH LOGIN;
CREATE DATABASE mail OWNER postgres;
CREATE TABLE users (
userid VARCHAR(128) NOT NULL,
@ -11,8 +10,10 @@ CREATE TABLE aliases (
target VARCHAR(128) NOT NULL,
alias VARCHAR(128) NOT NULL,
active boolean NOT NULL,
PRIMARY KEY (target),
UNIQUE (alias),
FOREIGN KEY (target) REFERENCES users (userid)
PRIMARY KEY (alias),
UNIQUE (alias)
);
GRANT SELECT ON TABLE users, aliases TO dovecot;
CREATE ROLE dovecot PASSWORD 'CHANGEME' LOGIN;
GRANT SELECT ON TABLE users TO dovecot;
CREATE ROLE postfix PASSWORD 'CHANGEME' LOGIN;
GRANT SELECT ON TABLE users, aliases TO postfix;

9
configs/dovecot/dovecot.conf
View File

@ -49,15 +49,6 @@ service imap-login {
}
}
service auth {
unix_listener auth {
mode = 0660
user = dovecot
group = mail
}
user = root
}
service lmtp {
unix_listener lmtp {
mode = 0660

20
configs/postfix/APKBUILD
View File

@ -1,24 +1,30 @@
# Contributor: Alex Denes <caskd@redxen.eu>
# Maintainer: Alex Denes <caskd@redxen.eu>
pkgname=redxen-config-postfix
pkgver=2021.01.06
pkgrel=0
pkgver=2021.01.07
pkgrel=2
pkgdesc="Postfix configuration files"
url="https://git.redxen.eu/RedXen"
arch="noarch"
license="none"
depends="postfix redxen-secret-letsencrypt-chain redxen-secret-letsencrypt-private"
depends="postfix postfix-pgsql redxen-secret-letsencrypt-chain redxen-secret-letsencrypt-private"
options="!check"
install="$pkgname.pre-install"
source="
master.cf
main.cf
pgsql-aliases.cf
pgsql-users.cf
"
package() {
install -Dm644 master.cf "$pkgdir"/etc/postfix.redxen/master.cf
install -Dm644 main.cf "$pkgdir"/etc/postfix.redxen/main.cf
install -Dm644 master.cf "$pkgdir"/etc/postfix/redxen/master.cf
install -Dm644 main.cf "$pkgdir"/etc/postfix/redxen/main.cf
install -Dm644 pgsql-aliases.cf "$pkgdir"/etc/postfix/redxen/pgsql-aliases.cf
install -Dm644 pgsql-users.cf "$pkgdir"/etc/postfix/redxen/pgsql-users.cf
}
sha512sums="2138eadcfd40ffd952767ecb0a288ceb2bdc93b830612c7499f55cd107ac91b3f5514a7c299cd72a17696cff52d71dc6548291ed93394790941efe4ec9362480 master.cf
1b475ab41aa1990432ceb88f968646043baf2fa955401ed352c7e452b421d6e701373782c98081791072cb1fde508903f4482fd853d625a0fb5490794369e388 main.cf"
sha512sums="e90b800f4be6ccaae76fa0bb9037005820c1a1aa1da7ed1e23cecb87a59b43901aa6a684445348c8f66c09d9e1a1de46818b57ae164f35ce4a1ae5363b12cc63 master.cf
761c774435813be60d6f0bf0d71742c270fc7d3c760922dec172653dc70dd2bdae4d79a0f019ea7c9c59063280d78b500200cecce47a45fc000b318d546cd386 main.cf
a1778901dbc12de543d9d5897b9d50ee5ebe47b7ef6ed87a0087249657f146ff8493de455d32016660cca3c8d669592e0ea9fbe9b6696d92cac6f014277f29e5 pgsql-aliases.cf
72c50fe20b4d1a7ea2e60fb2cac0164814ab41011eb7f0d67a8a5715a0cc43d3ad573f198a7933eb130f68ec5c25c558fad791300e5bb25e020ca76a4303db4c pgsql-users.cf"

17
configs/postfix/main.cf
View File

@ -4,15 +4,18 @@ smtpd_banner = $myhostname ESMTP RedXen Mail. DO NOT MESS WITH US OR WE WILL CUT
inet_interfaces = all
inet_protocols = all
myorigin = redxen.eu
myorigin = mailtest.redxen.eu
myhostname = mail.$myorigin
mydomain = $myorigin
mydestination = mail.redxen.eu, smtp.redxen.eu, redxen.eu
mydestination = mail.$myorigin, $myorigin
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
relayhost =
relay_domains = $mydestination
alias_maps = proxy:pgsql:/etc/postfix/redxen/pgsql-aliases.cf
local_recipient_maps = proxy:pgsql:/etc/postfix/redxen/pgsql-users.cf $alias_maps
biff = no
append_dot_mydomain = no
delay_warning_time = 1h
@ -25,12 +28,12 @@ notify_classes = resource, software, bounce
# SMTP TLS
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/ssl/redxen/letsencrypt/chain.crt
smtpd_tls_key_file = /etc/ssl/redxen/letsencrypt/private.key
smtpd_tls_security_level = encrypt
smtpd_tls_security_level = may
smtpd_tls_protocols = !SSLv2, !SSLv3
# Restrictions
smtpd_sender_restrictions = reject_unknown_sender_domain
@ -47,12 +50,6 @@ smtpd_recipient_restrictions = permit_sasl_authenticated,
reject_rhsbl_sender dbl.spamhaus.org
smtpd_helo_restrictions = reject_rhsbl_helo dbl.spamhaus.org
# Dovecot auth
smtpd_sasl_type = dovecot
smtpd_sasl_path = /run/dovecot/auth
smtpd_sasl_security_options=noanonymous
smtpd_sasl_local_domain=$myhostname
# Dovecot LMTP
mailbox_transport = lmtp:unix:/run/dovecot/lmtp

5
configs/postfix/master.cf
View File

@ -5,10 +5,9 @@
submission inet n - y - - smtpd
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
smtp unix - - n - - smtp
smtp inet n - n - - smtpd
smtp inet n - y - - smtpd
-o smtpd_sasl_auth_enable=yes
smtps inet n - n - - smtpd
smtps inet n - y - - smtpd
-o smtpd_sasl_auth_enable=yes
-o syslog_name=postfix/$service_name
-o smtpd_tls_wrappermode=yes

4
configs/postgresql/APKBUILD
View File

@ -1,7 +1,7 @@
# Contributor: Alex Denes <caskd@redxen.eu>
# Maintainer: Alex Denes <caskd@redxen.eu>
pkgname=redxen-config-postgresql
pkgver=2021.01.04
pkgver=2021.01.07
pkgrel=0
pkgdesc="PostgreSQL configuration files"
url="https://git.redxen.eu/RedXen"
@ -23,5 +23,5 @@ package() {
}
sha512sums="8bb7d9a9c442da7652a79f70f5ab253cab68cdc98652c8e3a9a90bacb953db8de9811a6fdec70b1eaa8552217240cb633ca3d7a3e5c8b9eed423532532dbbc67 postgresql.conf
23c7a029af7d130e177241542626e5b96acc94c4575cdb575ef6116f5335c1133fed5d833b2635b0be2837b8a48ed9fc615b635ce1d7598705d25d3ebfe08a93 pg_hba.conf
fc4faccaf8d8a7e0a683e20b959a0ca1c6aa8b190ab1e5f1568deb9483329e82a43264ff676845eeafd4f6c8d812ce2648702ba3ea52de4eadff8dbafece274b pg_hba.conf
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e pg_ident.conf"

1
configs/postgresql/pg_hba.conf
View File

@ -3,5 +3,6 @@ host murmur murmur 0200::/7 md5
host grafana grafana 0200::/7 md5
host gitea gitea 0200::/7 md5
host mail dovecot 0200::/7 md5
host mail postfix 0200::/7 md5
host all telegraf 127.0.0.1/32 md5
host all telegraf ::1/128 md5

4
configs/unbound/APKBUILD
View File

@ -2,7 +2,7 @@
# Maintainer: Alex Denes <caskd@redxen.eu>
pkgname=redxen-config-unbound
pkgver=2021.01.06
pkgrel=1
pkgrel=3
pkgdesc="Unbound configurations and some other stuff."
url="https://git.redxen.eu/RedXen"
arch="noarch"
@ -63,4 +63,4 @@ d3754ced9d8055ff7f1d364a93c403bba3f220a60ea519bceee5e9c43112d6a00d20d15cf659fdd6
d94ad338e2ea43c3ecdc62c861eddc0bb706807b738dd985309bcdf0b5fb435d7260bf272e2bbe40a774ec5b8fa49cbf23624c2c5213eea94f4f14aa3720abfa rctrl.conf
2183abc076166cd2026ccbf8d65e51870ca26a6fe11fbe48f2dbf9e8b8801b8b7c91c3607b2a48a254aeb8e364564fea361a2e3eccf13e0477542f7f3919bb5c internal.conf
28c917fe7f69643887097553312c4f1ffc747dffdbf150430e6c4b2e5833567922810716cb59a27887915664777ac3263be3c826956f504499f0ebdcc0b3aac5 auth-zones.conf
45ac400a46c81b4e5adde43bc832f0b45c101883ebea5b1621b36e658c29e37b88af135ee4fa1e55f67e4cffedf4d330be09f75c218ca8d8834bed8b775c9726 redxen.eu"
76794d08af7716f6b862969cded7a1f50c6c5cab0e0257b5362f26aeee22e003c2803cda23f5c335e252c4edae1165359d67467b43baba89513d682a5f35fb50 redxen.eu"

3
configs/unbound/zones/redxen.eu
View File

@ -54,7 +54,8 @@ seed.redxen.eu. 86400 IN CNAME redxen.eu.
wireguard.redxen.eu. 86400 IN CNAME 9013723.fsn1-dc14.hetzner.redxen.eu.
; Mail (staging)
newmail.redxen.eu. 86400 IN CNAME 9227948.nbg1-dc3.hetzner.redxen.eu.
mailtest.redxen.eu. 86400 IN MX 10 mail.mailtest.redxen.eu.
mail.mailtest.redxen.eu. 86400 IN CNAME 9227948.nbg1-dc3.hetzner.redxen.eu.
; Mumble
_mumble._tcp.redxen.eu. 86400 IN SRV 0 5 64738 8101153.nbg1-dc3.hetzner.redxen.eu.

11
openrc/postfix/APKBUILD
View File

@ -1,8 +1,8 @@
# Contributor: Alex Denes <caskd@redxen.eu>
# Maintainer: Alex Denes <caskd@redxen.eu>
pkgname=redxen-openrc-postfix
pkgver=2020.12.10
pkgrel=0
pkgver=2021.01.06
pkgrel=3
pkgdesc="Postfix OpenRC service files"
url="https://git.redxen.eu/RedXen"
arch="noarch"
@ -10,13 +10,14 @@ license="none"
depends="openrc postfix-openrc redxen-config-postfix"
options="!check"
source="
runfile
conffile
"
builddir="$srcdir"
package() {
mkdir -p "$pkgdir"/etc/init.d
ln -s postfix "$pkgdir"/etc/init.d/postfix.redxen
install -Dm755 runfile "$pkgdir"/etc/init.d/postfix.redxen
install -Dm644 conffile "$pkgdir"/etc/conf.d/postfix.redxen
}
sha512sums="cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e conffile"
sha512sums="f810dcb32530c60c48f813a5a6741763bbf34b4d1cac961cdab9eb3e072174a982040a93319aef08b3dc74de209ed2b082228a39757742f0077cacb7eba3c906 runfile
9da3af881cc36690434b9a0809edad205478f4e4e2cba5c5a2d04de701141d38ac16c0942c1cdf242d5a81bf9a580bdd8166e74fa31b51227bbaf6fa8afd8cb9 conffile"

1
openrc/postfix/conffile
View File

@ -0,0 +1 @@
CONF_DIR="/etc/postfix/redxen"

69
openrc/postfix/runfile Normal file
View File

@ -0,0 +1,69 @@
#!/sbin/openrc-run
# Copyright 1999-2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/mail-mta/postfix/files/postfix.rc6.2.6,v 1.3 2011/10/24 12:52:32 eras Exp $
# Please read http://www.postfix.org/MULTI_INSTANCE_README.html for multi instance support
if [ "${CONF_DIR}" = "/etc/postfix" ]; then
CONF_PARAM=""
CONF_MESSAGE=""
else
CONF_PARAM="-c ${CONF_DIR}"
CONF_MESSAGE="(${CONF_DIR})"
fi
extra_started_commands="reload abort flush"
description_reload="Re-read configuration files. Running processes terminate at their earliest convenience."
description_abort="Stop the Postfix mail system abruptly. Running processes are signaled to stop immediately."
description_flush="Force delivery: attempt to deliver every message in the deferred mail queue."
depend() {
use logger dns ypbind amavisd antivirus postfix_greylist net saslauthd
after firewall
if [ "${SVCNAME}" = "postfix" ]; then
provide mta
fi
}
start() {
if [ ! -z "${CONF_PARAM}" ]; then
einfo "Please consider updating your config for postmulti support."
fi
ebegin "Starting postfix ${CONF_MESSAGE}"
if [ ! -d ${CONF_DIR} ]; then
eend 1 "${CONF_DIR} does not exist"
return 1
fi
/usr/sbin/postfix ${CONF_PARAM} start >/dev/null 2>&1
eend $?
}
stop() {
ebegin "Stopping postfix ${CONF_MESSAGE}"
/usr/sbin/postfix ${CONF_PARAM} stop >/dev/null 2>&1
eend $?
}
reload() {
ebegin "Reloading postfix ${CONF_MESSAGE}"
/usr/sbin/postfix ${CONF_PARAM} reload >/dev/null 2>&1
eend $?
}
abort() {
ebegin "Aborting postfix ${CONF_MESSAGE}"
if service_started "${SVCNAME}"; then
mark_service_stopped "${SVCNAME}"
fi
/usr/sbin/postfix ${CONF_PARAM} abort >/dev/null 2>&1
eend $?
}
flush() {
ebegin "Flushing postfix ${CONF_MESSAGE}"
/usr/sbin/postfix ${CONF_PARAM} flush >/dev/null 2>&1
eend $?
}