RedXen
/
aports
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
aports/config/postfix/main.cf

81 lines
2.6 KiB
CFEngine3
Raw Normal View History

Catch-all for throwaway domain
2023-07-05 16:37:36 +00:00
compatibility_level = 3.6
Reorganization, automation and more - More templating and inheritance - New commands + rx_replace + rx_install + rx_cpkgdir - More transparency with secrets being sourced as variables and replaced - Modularization of configs + telegraf + nginx (partial) + fastd + wireguard + unbound - Split of unbound configurations and bind zones - Bumping of key versions (rolling keys) + ZSK/KSK + OpenDKIM - Relaxed permission defaults and other smaller tweaks...
2021-06-01 23:17:41 +00:00
Add postfix configs
2021-01-05 04:21:09 +00:00
# General
smtpd_banner = $myhostname ESMTP RedXen Mail. DO NOT MESS WITH US OR WE WILL CUT YOUR BALLS OFF!
Postfix add sender maps and fix restrictions, remove mail subdomain from myorigin
2021-02-27 20:27:58 +00:00
mail_name = RedXen Mail Postfix
Add postfix configs
2021-01-05 04:21:09 +00:00
inet_interfaces = all
inet_protocols = all
Bump a few packages and prepare for mail migration
2021-01-12 23:37:34 +00:00
myorigin = redxen.eu
Add postfix configs
2021-01-05 04:21:09 +00:00
myhostname = mail.$myorigin
mydomain = $myorigin
Postfix add sender maps and fix restrictions, remove mail subdomain from myorigin
2021-02-27 20:27:58 +00:00
mydestination = $myorigin
Allow non-RDNS clients
2023-03-05 14:04:58 +00:00
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
Add postfix configs
2021-01-05 04:21:09 +00:00
relayhost =
relay_domains = $mydestination
Allow aliasing for other domains too
2024-03-30 18:45:58 +00:00
virtual_alias_domains = $myorigin, mail.ripped-condoms.$myorigin
virtual_alias_maps = proxy:pgsql:/etc/redxen/postfix/pgsql-aliases.cf, inline:{@mail.ripped-condoms.$myorigin=caskd}
Catch-all for throwaway domain
2023-07-05 16:37:36 +00:00
Allow aliasing for other domains too
2024-03-30 18:45:58 +00:00
local_transport = lmtp:unix:/run/dovecot/lmtp
Reorganization, automation and more - More templating and inheritance - New commands + rx_replace + rx_install + rx_cpkgdir - More transparency with secrets being sourced as variables and replaced - Modularization of configs + telegraf + nginx (partial) + fastd + wireguard + unbound - Split of unbound configurations and bind zones - Bumping of key versions (rolling keys) + ZSK/KSK + OpenDKIM - Relaxed permission defaults and other smaller tweaks...
2021-06-01 23:17:41 +00:00
smtpd_sender_login_maps = proxy:pgsql:/etc/redxen/postfix/pgsql-users.cf
A bit more tweaks and fixing cases where user parts would be rejected by login_mismatch even though the domain was remote
2021-02-28 12:29:26 +00:00
local_recipient_maps = $smtpd_sender_login_maps $alias_maps
Postfix & Dovecot changes batch - Use PGSQL directly from postfix - Fix queries - Remove auth socket - Change domain temporarily to mailtest.redxen.eu - Change TLS settings - Re-enable chroots where auth socket isn't required anymore - Add DNS records for unbound - Add postfix to pgsql hba - Use pre-built runfile instead of upstream to fix a "feature"
2021-01-07 17:13:22 +00:00
Add postfix configs
2021-01-05 04:21:09 +00:00
biff = no
append_dot_mydomain = no
delay_warning_time = 1h
readme_directory = no
mailbox_size_limit = 0
recipient_delimiter = +
notify_classes = resource, software, bounce
A bit more tweaks and fixing cases where user parts would be rejected by login_mismatch even though the domain was remote
2021-02-28 12:29:26 +00:00
smtpd_helo_required = yes
smtpd_delay_reject = yes
Add postfix configs
2021-01-05 04:21:09 +00:00
# SMTP TLS
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_security_level = may
Few postfix fixes
2021-02-19 15:03:17 +00:00
smtp_tls_note_starttls_offer = yes
Add postfix configs
2021-01-05 04:21:09 +00:00
smtpd_use_tls = yes
Reorganization, automation and more - More templating and inheritance - New commands + rx_replace + rx_install + rx_cpkgdir - More transparency with secrets being sourced as variables and replaced - Modularization of configs + telegraf + nginx (partial) + fastd + wireguard + unbound - Split of unbound configurations and bind zones - Bumping of key versions (rolling keys) + ZSK/KSK + OpenDKIM - Relaxed permission defaults and other smaller tweaks...
2021-06-01 23:17:41 +00:00
smtpd_tls_cert_file = /etc/redxen/letsencrypt/chain.crt
smtpd_tls_key_file = /etc/redxen/letsencrypt/private.key
Postfix & Dovecot changes batch - Use PGSQL directly from postfix - Fix queries - Remove auth socket - Change domain temporarily to mailtest.redxen.eu - Change TLS settings - Re-enable chroots where auth socket isn't required anymore - Add DNS records for unbound - Add postfix to pgsql hba - Use pre-built runfile instead of upstream to fix a "feature"
2021-01-07 17:13:22 +00:00
smtpd_tls_security_level = may
smtpd_tls_protocols = !SSLv2, !SSLv3
Add postfix configs
2021-01-05 04:21:09 +00:00
# Restrictions
Check only for current domain for now
2023-03-14 12:30:26 +00:00
smtpd_sender_restrictions = reject_known_sender_login_mismatch,
permit_sasl_authenticated,
A bit more tweaks and fixing cases where user parts would be rejected by login_mismatch even though the domain was remote
2021-02-28 12:29:26 +00:00
check_sender_access inline:{{$myorigin=553 not logged in}},
Fixup stuff for postfix
2023-03-01 16:04:14 +00:00
reject_invalid_helo_hostname,
Allow delivery where the address is unknown on the other side (automated mails from things like gitlab)
2021-03-09 09:48:40 +00:00
reject_unknown_sender_domain
Add postfix configs
2021-01-05 04:21:09 +00:00
smtpd_relay_restrictions = permit_sasl_authenticated,
reject_unauth_destination
smtpd_recipient_restrictions = permit_sasl_authenticated,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
A bit more tweaks and fixing cases where user parts would be rejected by login_mismatch even though the domain was remote
2021-02-28 12:29:26 +00:00
reject_unverified_recipient
Reject unauthenticated destination
2021-02-19 13:25:14 +00:00
smtpd_data_restrictions = reject_unauth_pipelining
Remove HELO checks
2021-02-28 19:39:57 +00:00
smtpd_helo_restrictions = reject_invalid_helo_hostname
Add postfix configs
2021-01-05 04:21:09 +00:00
Add back things that were actually important
2021-01-07 18:20:54 +00:00
# Dovecot auth
Few postfix fixes
2021-02-19 15:03:17 +00:00
smtpd_sasl_auth_enable = yes
Add back things that were actually important
2021-01-07 18:20:54 +00:00
smtpd_sasl_type = dovecot
smtpd_sasl_path = /run/dovecot/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myorigin
Add postfix configs
2021-01-05 04:21:09 +00:00
# OpenDKIM & RSpamD
Add rspamd
2021-01-10 22:02:37 +00:00
milter_protocol = 6
Few fixes for mail and backup scripts
2021-01-13 15:21:08 +00:00
milter_default_action = tempfail
Don't process body for internal mail and don't run internal mail via rspamd
2021-07-30 11:44:12 +00:00
internal_mail_filter_classes =
Few fixes for mail and backup scripts
2021-01-13 15:21:08 +00:00
Don't process body for internal mail and don't run internal mail via rspamd
2021-07-30 11:44:12 +00:00
smtpd_milters = inet:rspamd.routinginfo.internal:7510 $non_smtpd_milters
non_smtpd_milters = inet:opendkim.routinginfo.internal:7514
Allow aliasing for other domains too
2024-03-30 18:45:58 +00:00
# Caching
address_verify_negative_cache = yes
address_verify_negative_expire_time = 1d
address_verify_negative_refresh_time = 5m