| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Signed-off-by: Malfurious <m@lfurio.us>
|
|
Incoming mail for an mlmmj list is caught by a virtual mapping and
directed via virtual transport to the mlmmj system for processing.
Outgoing mail is implicitly allowed since it originates from the
localhost.
The postfix entrypoint script now dynamically generates these mailing
list mappings on startup from data in the mlmmj spool directory, so user
configuration is minimal. In addition, the script will now sync the
user's mailing list parameters into the spool directory, thus
automatically creating new lists and deleting old ones.
The list creation logic is implemented in a new script `make_list.sh`.
This is made necessary as the mlmmj built in tooling for this must be
run interactively, so we duplicate the logic. This is separate from
`entrypoint.sh` mainly because we need to drop privileges to the mlmmj
user while creating files.
Signed-off-by: Malfurious <m@lfurio.us>
|
|
Prevent outgoing spoofed emails by requiring the MAIL FROM header to
match the SASL login name.
Specifically, the SASL user must "own" the address.
`smtpd_sender_login_maps` defines a lookup table to determine ownership.
We create a placeholder table that states each user simply owns their
own email address (aka: the value of their username).
Signed-off-by: Malfurious <m@lfurio.us>
|
|
Protect user privacy by stripping IP addresses from headers received
from authenticated mail submission. Headers for mail received from
other servers are unaffected.
Signed-off-by: Malfurious <m@lfurio.us>
|
|
Sending mail to an external server previously fails due to name
resolution error. ("Host or domain name not found. Name service error
for name=xxxxxxxxxx type=A: Host not found, try again")
The reason this was happening is because the relay process runs in a
chroot jail and can not access the docker container's resolve.conf file.
Given the system is containerized, which is like a chroot on steroids,
I'm comfortable disabling chrooting for mail processes to work around
this.
Signed-off-by: Malfurious <m@lfurio.us>
|
|
This allows output to be read with `docker compose logs`.
Signed-off-by: Malfurious <m@lfurio.us>
|
|
This is used to generate database files used by postfix daemons.
In theory, this could also be performed at build-time by the Dockerfile.
However, I intend to create only a single image that each service
separately spawns from, since there will be several commonalities
between them. Moving these postfix-specific tasks to an entrypoint
script keeps the common Dockerfile more managable.
Signed-off-by: Malfurious <m@lfurio.us>
|
|
The encrypted "submissions" port (465) is opened in postfix and is
configured for delivery of outgoing mail of authenticated users only.
The authentication is provided by dovecot via unix socket and account
data is sourced from the userconfig directory.
Signed-off-by: Malfurious <m@lfurio.us>
|
|
Setup postfix and dovecot to work with virtual domains/mailboxes and
user accounts defined in the userconfig directory. Services are also
configured to use TLS certificates that will later be provided by the
nginx-proxy acme service.
Basic formatting and informative comments are added to config files.
Signed-off-by: Malfurious <m@lfurio.us>
|
|
Signed-off-by: Malfurious <m@lfurio.us>
|
