Initialize repo for alias mail role.
This commit is contained in:
commit
f63f8bf0a6
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
archive
|
17
LICENSE
Normal file
17
LICENSE
Normal file
@ -0,0 +1,17 @@
|
||||
MIT No Attribution License
|
||||
|
||||
Copyright (c) 2023 Brian Lee
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||
this software and associated documentation files (the “Software”), to deal in
|
||||
the Software without restriction, including without limitation the rights to
|
||||
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
|
||||
the Software, and to permit persons to whom the Software is furnished to do so.
|
||||
|
||||
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
|
||||
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
||||
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
69
README.md
Normal file
69
README.md
Normal file
@ -0,0 +1,69 @@
|
||||
# Ansible Role: disposable-mail
|
||||
|
||||
This is an Ansible role that sets up a [mail server](https://wiki.archlinux.org/title/Mail_server) by installing and configuring [postfix](https://www.postfix.org/), [dovecot](https://dovecot.org/), and opendkim.
|
||||
|
||||
It is intended to facilitate using smtp and imap service with disposable mail aliases for a single user. It stores mail using Maildir, which is a simple plaintext format. The configuration uses unix sockets for inter-process communication and prefers strong encryption for network connections. The configured [header_checks](files/header_checks) filter out unnecessary postfix mail headers to limit leakage of personal information.
|
||||
|
||||
This configuration is not intended to replace a user's primary personal email account. Do not use a disposable alias for important or sensitive accounts. Messages are by default stored in plaintext on your server (unless you've set up disk encryption separately).
|
||||
|
||||
It includes a helper script to create new email aliases. You can create an alias to call it.
|
||||
|
||||
```shell
|
||||
alias addmail='ssh root@host create-email-alias'
|
||||
```
|
||||
Usage: `addmail newservice` creates an alias to receive mail at newservice@example.com
|
||||
|
||||
## Requirements
|
||||
|
||||
* Debian/Ubuntu
|
||||
* [robertdebock.dovecot](https://github.com/robertdebock/ansible-role-dovecot)
|
||||
* oefenweb.postfix role, the [bleetube fork](https://github.com/bleetube/ansible-role-postfix)
|
||||
|
||||
See [requirements.yml](requirements.yml)
|
||||
|
||||
## Variables
|
||||
|
||||
```yaml
|
||||
postfix_domain: example.com
|
||||
postfix_hostname: mail.example.com
|
||||
postfix_smtpd_tls_cert_file: ""
|
||||
postfix_smtpd_tls_key_file: ""
|
||||
postfix_smtpd_tls_dh1024_param_file: ""
|
||||
```
|
||||
|
||||
See the [default variables](defaults/main.yml).
|
||||
|
||||
## Example Playbook
|
||||
|
||||
```yaml
|
||||
- hosts: mail
|
||||
become: yes
|
||||
roles:
|
||||
- bleetube.mail
|
||||
```
|
||||
|
||||
## Example Deployment
|
||||
|
||||
See [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md)
|
||||
|
||||
## Security
|
||||
|
||||
For hardening, we recommend that network access to dovecot (TCP/993) be restricted to trusted IPs. See [cve details](https://www.cvedetails.com/vulnerability-list/vendor_id-6485/Dovecot.html).
|
||||
|
||||
## Privacy
|
||||
|
||||
Postfix `master.cf` should configure smtpd behavior to require encrypted client connections. In practice, this means figuring out what connection method for a given mail client that is going to work with a mail server that requires strong encryption.
|
||||
|
||||
See [docs/CLIENTS.md](docs/CLIENTS.md) for notes on mail clients.
|
||||
|
||||
## Misc
|
||||
|
||||
There are some interesting mta implementations that may replace or compliment parts of this stack in the future:
|
||||
* [simple-nixos-mailserver](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver)
|
||||
* [maddy](https://github.com/foxcpp/maddy) (go)
|
||||
* [jmap](https://github.com/stalwartlabs/jmap-server), [vsmtp](https://github.com/viridIT/vSMTP) (rust)
|
||||
* [roundcube](https://roundcube.net/) (php)
|
||||
|
||||
## Credit
|
||||
|
||||
Thanks to [Mischa ter Smitten](https://blog.tersmitten.nl) for his work on the [ansible-postfix](https://github.com/Oefenweb/ansible-postfix) role. The postfix setup process is largely a modified version of that role. The relevant license and copyright notice can be found in [postfix.yml](tasks/postfix.yml).
|
121
defaults/main.yml
Normal file
121
defaults/main.yml
Normal file
@ -0,0 +1,121 @@
|
||||
---
|
||||
postfix_domain: ""
|
||||
postfix_virtual_mailbox_base: /var/disposable-mail
|
||||
|
||||
postfix_smtpd_banner: "$myhostname ESMTP $mail_name ({{ postfix_domain }})"
|
||||
dkim_selector: mail
|
||||
dkim_key_path: /etc/dkimkeys
|
||||
#postfix_hostname: "{{ dkim_selector }}.{{ postfix_domain }}"
|
||||
imap_bind_address: "{{ ansible_default_ipv4.address|default(ansible_all_ipv4_addresses[0]) }}"
|
||||
#postfix_maildir_user: maildir
|
||||
postfix_virtual_uid: "{{ ansible_facts.getent_passwd.maildir[1] }}"
|
||||
postfix_virtual_gid: "{{ ansible_facts.getent_group.maildir[1] }}"
|
||||
#postfix_inet_interfaces: all
|
||||
#postfix_mynetworks:
|
||||
# - 127.0.0.0/8
|
||||
|
||||
#postfix_inet_protocols: ipv4
|
||||
postfix_mydestination:
|
||||
- $myhostname
|
||||
|
||||
#smtpd_tls_security_level: may
|
||||
# https://www.postfix.org/SMTPD_ACCESS_README.html
|
||||
postfix_smtpd_relay_restrictions:
|
||||
- permit_mynetworks
|
||||
- permit_sasl_authenticated
|
||||
- reject_unauth_destination
|
||||
postfix_smtpd_recipient_restrictions:
|
||||
- permit_mynetworks
|
||||
- permit_sasl_authenticated
|
||||
- reject_unauth_destination
|
||||
|
||||
postfix_raw_options:
|
||||
# https://www.postfix.org/MILTER_README.html
|
||||
- |
|
||||
smtpd_milters = unix:opendkim/opendkim.sock
|
||||
- |
|
||||
non_smtpd_milters = $smtpd_milters
|
||||
|
||||
postfix_smtpd_client_connection_count_limit: 5
|
||||
postfix_smtpd_client_connection_rate_limit: 30
|
||||
postfix_smtpd_client_message_rate_limit: 3
|
||||
postfix_smtpd_client_new_tls_session_rate_limit: 3
|
||||
postfix_smtpd_client_auth_rate_limit: 3
|
||||
|
||||
# robertdebock.dovecot
|
||||
dovecot_mailbox_location: "maildir:{{ postfix_virtual_mailbox_base }}/{{ postfix_domain }}/%n"
|
||||
|
||||
postfix_install:
|
||||
- postfix
|
||||
# - mailutils
|
||||
- libsasl2-2
|
||||
# - sasl2-bin
|
||||
- libsasl2-modules
|
||||
|
||||
postfix_hostname: "{{ ansible_fqdn }}"
|
||||
postfix_mailname: "{{ ansible_fqdn }}"
|
||||
|
||||
postfix_default_database_type: hash
|
||||
postfix_aliases: []
|
||||
postfix_virtual_aliases: []
|
||||
postfix_sender_canonical_maps: []
|
||||
postfix_sender_canonical_maps_database_type: "{{ postfix_default_database_type }}"
|
||||
postfix_recipient_canonical_maps: []
|
||||
postfix_recipient_canonical_maps_database_type: "{{ postfix_default_database_type }}"
|
||||
postfix_transport_maps: []
|
||||
postfix_transport_maps_database_type: "{{ postfix_default_database_type }}"
|
||||
postfix_sender_dependent_relayhost_maps: []
|
||||
postfix_header_checks: []
|
||||
postfix_header_checks_database_type: regexp
|
||||
postfix_generic: "{{ postfix_smtp_generic_maps }}"
|
||||
postfix_smtp_generic_maps: []
|
||||
postfix_smtp_generic_maps_database_type: "{{ postfix_default_database_type }}"
|
||||
|
||||
postfix_relayhost: ''
|
||||
postfix_relayhost_mxlookup: false
|
||||
postfix_relayhost_port: 587
|
||||
postfix_relaytls: false
|
||||
|
||||
postfix_sasl_auth_enable: true
|
||||
postfix_sasl_user: "postmaster@{{ ansible_domain }}"
|
||||
postfix_sasl_password: "{{ lookup('ansible.builtin.env', 'POSTFIX_SASL_PASSWORD') }}"
|
||||
postfix_sasl_security_options: noanonymous
|
||||
postfix_sasl_tls_security_options: noanonymous
|
||||
postfix_sasl_mechanism_filter: ''
|
||||
|
||||
postfix_smtp_tls_security_level: encrypt
|
||||
postfix_smtp_tls_wrappermode: false
|
||||
postfix_smtp_tls_note_starttls_offer: true
|
||||
|
||||
postfix_inet_interfaces: all
|
||||
postfix_inet_protocols: all
|
||||
#postfix_mydestination:
|
||||
# - "{{ postfix_hostname }}"
|
||||
# - localdomain
|
||||
# - localhost
|
||||
# - localhost.localdomain
|
||||
postfix_mynetworks:
|
||||
- 127.0.0.0/8
|
||||
- '[::ffff:127.0.0.0]/104'
|
||||
- '[::1]/128'
|
||||
|
||||
#postfix_smtpd_banner: '$myhostname ESMTP $mail_name'
|
||||
postfix_disable_vrfy_command: true
|
||||
postfix_message_size_limit: 10240000
|
||||
|
||||
postfix_smtpd_tls_cert_file: /etc/ssl/certs/ssl-cert-snakeoil.pem
|
||||
postfix_smtpd_tls_key_file: /etc/ssl/private/ssl-cert-snakeoil.key
|
||||
postfix_smtpd_tls_security_level: may
|
||||
postfix_smtp_tls_CApath: /etc/ssl/certs
|
||||
postfix_smtpd_sasl_type: dovecot
|
||||
postfix_smtpd_sasl_security_options: noanonymous, noplaintext, forward_secrecy
|
||||
# path outside of chroot: /var/spool/postfix/private/auth
|
||||
postfix_smtpd_sasl_path: private/auth
|
||||
|
||||
#postfix_raw_options: []
|
||||
|
||||
#postfix_virtual_mailbox_base: /var/mail
|
||||
postfix_virtual_mailbox_maps: /etc/postfix/vmailbox
|
||||
#postfix_virtual_uid: 1000
|
||||
#postfix_virtual_gid: 1000
|
||||
postfix_maildir_user: maildir
|
13
docs/CLIENTS.md
Normal file
13
docs/CLIENTS.md
Normal file
@ -0,0 +1,13 @@
|
||||
# Mail Clients
|
||||
|
||||
This is where notes can be collected regarding various mail clients.
|
||||
|
||||
* Most apps will only work using port 25, ie. smtp with STARTTLS
|
||||
* Thunderbird only seems to work using port 465, ie. smtps with submissions
|
||||
|
||||
For some light reading, see the [TLS](https://www.postfix.org/TLS_README.html) article on postfix.org.
|
||||
|
||||
* smtp=25
|
||||
* smtps=submissions=465
|
||||
* submission=587
|
||||
|
36
docs/DEPLOYMENT.md
Normal file
36
docs/DEPLOYMENT.md
Normal file
@ -0,0 +1,36 @@
|
||||
# Mail Server: Deployment
|
||||
|
||||
1. Create MX and TXT records
|
||||
|
||||
2. Set a password for the "main" virtual inbox:
|
||||
|
||||
```shell
|
||||
echo main:$(doveadm pw -s BLF-CRYPT) >> files/$TARGET/imap.passwd
|
||||
```
|
||||
|
||||
3. Copy a vars/targets file, update the values, and run this playbook
|
||||
|
||||
Sanity check opendkim (may need restart):
|
||||
```shell
|
||||
l /var/spool/postfix/opendkim/opendkim.sock
|
||||
```
|
||||
|
||||
4. look at the maildir uid/gid in main.cf and use those in the imap.passwd file (switching to the dovecot role will fix that later)
|
||||
|
||||
5. configure some virtual aliases in /etc/postfix/virtual and run:
|
||||
|
||||
```shell
|
||||
postmap virtual vmailbox
|
||||
```
|
||||
|
||||
See `man 5 postconf` for details.
|
||||
|
||||
6. Create another TXT record for DKIM using the contents of /etc/dkimkeys/mail.txt
|
||||
|
||||
* See [scripts/print-rdata.py](../scripts/print-rdata.py) for an example of how to parse mail.txt
|
||||
* See [octodns](https://github.com/octodns/octodns-easydns) and [dnscontrol](https://dnscontrol.org/)
|
||||
|
||||
7. Sanity check: https://mxtoolbox.com/
|
||||
|
||||
8. After records propogate, verify outbound mail using: https://www.mail-tester.com/
|
||||
|
5
files/header_checks
Normal file
5
files/header_checks
Normal file
@ -0,0 +1,5 @@
|
||||
/^Received:.*/ IGNORE
|
||||
/^X-Originating-IP:/ IGNORE
|
||||
/^X-Mailer:/ IGNORE
|
||||
/^Mime-Version:/ IGNORE
|
||||
/^User-Agent:/ IGNORE
|
67
files/master.cf
Normal file
67
files/master.cf
Normal file
@ -0,0 +1,67 @@
|
||||
#
|
||||
# Postfix master process configuration file. For details on the format
|
||||
# of the file, see the master(5) manual page (command: "man 5 master" or
|
||||
# on-line: http://www.postfix.org/master.5.html).
|
||||
#
|
||||
# Do not forget to execute "postfix reload" after editing this file.
|
||||
#
|
||||
# ==========================================================================
|
||||
# service type private unpriv chroot wakeup maxproc command + args
|
||||
# (yes) (yes) (no) (never) (100)
|
||||
# ==========================================================================
|
||||
smtp inet n - y - - smtpd
|
||||
#smtp inet n - y - 1 postscreen
|
||||
#smtpd pass - - y - - smtpd
|
||||
#dnsblog unix - - y - 0 dnsblog
|
||||
#tlsproxy unix - - y - 0 tlsproxy
|
||||
submission inet n - y - - smtpd
|
||||
-o syslog_name=postfix/submission
|
||||
-o smtpd_tls_security_level=encrypt
|
||||
-o smtpd_sasl_auth_enable=yes
|
||||
-o smtpd_tls_auth_only=yes
|
||||
-o smtpd_reject_unlisted_recipient=no
|
||||
# -o smtpd_client_restrictions=$mua_client_restrictions
|
||||
# -o smtpd_helo_restrictions=$mua_helo_restrictions
|
||||
# -o smtpd_sender_restrictions=$mua_sender_restrictions
|
||||
-o smtpd_recipient_restrictions=
|
||||
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
||||
-o milter_macro_daemon_name=ORIGINATING
|
||||
submissions inet n - y - - smtpd
|
||||
-o syslog_name=postfix/smtps
|
||||
-o smtpd_tls_wrappermode=yes
|
||||
-o smtpd_sasl_auth_enable=yes
|
||||
-o smtpd_reject_unlisted_recipient=no
|
||||
# -o smtpd_client_restrictions=$mua_client_restrictions
|
||||
# -o smtpd_helo_restrictions=$mua_helo_restrictions
|
||||
# -o smtpd_sender_restrictions=$mua_sender_restrictions
|
||||
-o smtpd_recipient_restrictions=
|
||||
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
||||
-o milter_macro_daemon_name=ORIGINATING
|
||||
#628 inet n - y - - qmqpd
|
||||
pickup unix n - y 60 1 pickup
|
||||
cleanup unix n - y - 0 cleanup
|
||||
qmgr unix n - n 300 1 qmgr
|
||||
#qmgr unix n - n 300 1 oqmgr
|
||||
tlsmgr unix - - y 1000? 1 tlsmgr
|
||||
rewrite unix - - y - - trivial-rewrite
|
||||
bounce unix - - y - 0 bounce
|
||||
defer unix - - y - 0 bounce
|
||||
trace unix - - y - 0 bounce
|
||||
verify unix - - y - 1 verify
|
||||
flush unix n - y 1000? 0 flush
|
||||
proxymap unix - - n - - proxymap
|
||||
proxywrite unix - - n - 1 proxymap
|
||||
smtp unix - - y - - smtp
|
||||
relay unix - - y - - smtp
|
||||
-o syslog_name=postfix/$service_name
|
||||
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
|
||||
showq unix n - y - - showq
|
||||
error unix - - y - - error
|
||||
retry unix - - y - - error
|
||||
discard unix - - y - - discard
|
||||
local unix - n n - - local
|
||||
virtual unix - n n - - virtual
|
||||
lmtp unix - - y - - lmtp
|
||||
anvil unix - - y - 1 anvil
|
||||
scache unix - - y - 1 scache
|
||||
postlog unix-dgram n - n - 1 postlogd
|
25
handlers/main.yml
Normal file
25
handlers/main.yml
Normal file
@ -0,0 +1,25 @@
|
||||
---
|
||||
- name: reload dovecot
|
||||
service: name=dovecot state=reloaded
|
||||
|
||||
- name: restart dovecot
|
||||
service: name=dovecot state=restarted
|
||||
|
||||
- name: restart opendkim
|
||||
service: name=opendkim state=restarted
|
||||
|
||||
- name: restart postfix
|
||||
service: name=postfix state=restarted
|
||||
|
||||
- name: reload postfix
|
||||
service: name=postfix@- state=reload
|
||||
|
||||
- name: new virtual mailboxes
|
||||
ansible.builtin.command:
|
||||
chdir: /etc/postfix
|
||||
cmd: postmap vmailbox
|
||||
|
||||
- name: new virtual mail aliases
|
||||
ansible.builtin.command:
|
||||
chdir: /etc/postfix
|
||||
cmd: postmap virtual
|
5
meta/main.yml
Normal file
5
meta/main.yml
Normal file
@ -0,0 +1,5 @@
|
||||
---
|
||||
#dependencies: []
|
||||
dependencies:
|
||||
- robertdebock.dovecot
|
||||
# - oefenweb.postfix
|
8
requirements.yml
Normal file
8
requirements.yml
Normal file
@ -0,0 +1,8 @@
|
||||
---
|
||||
roles:
|
||||
- src: https://github.com/robertdebock/ansible-role-dovecot
|
||||
name: robertdebock.dovecot
|
||||
|
||||
# - src: https://github.com/bleetube/ansible-role-postfix
|
||||
# name: oefenweb.postfix
|
||||
# version: virtual
|
34
tasks/dovecot.yml
Normal file
34
tasks/dovecot.yml
Normal file
@ -0,0 +1,34 @@
|
||||
---
|
||||
- name: Remove default include path to manage configuration via a single template.
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/dovecot/dovecot.conf
|
||||
regexp: '^!include conf.d'
|
||||
line: '#!include conf.d/*.conf'
|
||||
|
||||
- name: Register Dovecot account database
|
||||
ansible.builtin.file:
|
||||
path: /etc/dovecot/imap.passwd
|
||||
state: touch
|
||||
owner: root
|
||||
group: dovecot
|
||||
mode: '0640'
|
||||
changed_when: false
|
||||
|
||||
- name: Ensure mail_home directory (Dovecot)
|
||||
ansible.builtin.file:
|
||||
name: /srv/mail
|
||||
owner: dovecot
|
||||
group: dovecot
|
||||
state: directory
|
||||
mode: '0770'
|
||||
|
||||
- name: Ensure local configuration file is included from dovecot.conf
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/dovecot/dovecot.conf
|
||||
line: '!include_try local.conf'
|
||||
|
||||
- name: Configure Dovecot
|
||||
ansible.builtin.template:
|
||||
src: dovecot.conf.j2
|
||||
dest: /etc/dovecot/local.conf
|
||||
notify: restart dovecot
|
43
tasks/maildir.yml
Normal file
43
tasks/maildir.yml
Normal file
@ -0,0 +1,43 @@
|
||||
---
|
||||
- name: Get nologin path for maildir user
|
||||
ansible.builtin.find:
|
||||
paths:
|
||||
- /bin
|
||||
- /sbin
|
||||
- /usr/bin
|
||||
- /usr/sbin
|
||||
patterns: nologin
|
||||
register: nologin_bin
|
||||
|
||||
- name: Create maildir group
|
||||
ansible.builtin.group:
|
||||
name: "{{ postfix_maildir_user }}"
|
||||
state: present
|
||||
|
||||
- name: Ensure maildir directory
|
||||
ansible.builtin.file:
|
||||
name: "{{ postfix_virtual_mailbox_base }}/{{ postfix_domain }}"
|
||||
owner: root
|
||||
group: "{{ postfix_maildir_user }}"
|
||||
state: directory
|
||||
mode: '0770'
|
||||
|
||||
- name: Create maildir user
|
||||
ansible.builtin.user:
|
||||
shell: "{{ nologin_bin.files[0].path }}"
|
||||
home: "{{ postfix_virtual_mailbox_base }}"
|
||||
name: "{{ postfix_maildir_user }}"
|
||||
group: "{{ postfix_maildir_user }}"
|
||||
groups: mail
|
||||
system: true
|
||||
append: true
|
||||
|
||||
- name: Get maildir user's id
|
||||
ansible.builtin.getent:
|
||||
database: passwd
|
||||
key: "{{ postfix_maildir_user }}"
|
||||
|
||||
- name: Get maildir user's group id
|
||||
ansible.builtin.getent:
|
||||
database: group
|
||||
key: "{{ postfix_maildir_user }}"
|
25
tasks/main.yml
Normal file
25
tasks/main.yml
Normal file
@ -0,0 +1,25 @@
|
||||
---
|
||||
#- name: Assert all required variables have been defined.
|
||||
# ansible.builtin.assert:
|
||||
# that:
|
||||
# - item is defined
|
||||
# - item != ''
|
||||
# fail_msg: "FAILED: Required mail settings are not configured."
|
||||
# quiet: true
|
||||
# loop:
|
||||
|
||||
- name: Set up Maildir
|
||||
import_tasks: maildir.yml
|
||||
tags: maildir, postfix
|
||||
|
||||
- name: Set up Postfix
|
||||
import_tasks: postfix.yml
|
||||
tags: postfix
|
||||
|
||||
- name: Install OpenDKIM and generate keys
|
||||
import_tasks: opendkim.yml
|
||||
tags: dkim
|
||||
|
||||
- name: Install and configure Dovecot
|
||||
import_tasks: dovecot.yml
|
||||
tags: dovecot
|
35
tasks/opendkim.yml
Normal file
35
tasks/opendkim.yml
Normal file
@ -0,0 +1,35 @@
|
||||
---
|
||||
- name: Install and update OpenDKIM
|
||||
ansible.builtin.package:
|
||||
name:
|
||||
- opendkim
|
||||
- opendkim-tools
|
||||
state: latest
|
||||
|
||||
- name: Configure OpenDKIM
|
||||
ansible.builtin.template:
|
||||
src: opendkim.conf.j2
|
||||
dest: /etc/opendkim.conf
|
||||
notify: restart opendkim
|
||||
|
||||
- name: Ensure OpenDKIM unix socket path for postfix
|
||||
ansible.builtin.file:
|
||||
path: /var/spool/postfix/opendkim
|
||||
state: directory
|
||||
owner: postfix
|
||||
group: opendkim
|
||||
mode: '0770'
|
||||
notify: restart opendkim
|
||||
|
||||
- name: Generate DKIM signing key
|
||||
ansible.builtin.command:
|
||||
cmd: "opendkim-genkey -r -s {{ dkim_selector }} -b 2048 -d {{ postfix_domain }} --directory /etc/dkimkeys"
|
||||
creates: "/etc/dkimkeys/{{ dkim_selector }}.private"
|
||||
become: true
|
||||
become_user: opendkim
|
||||
|
||||
- name: Ensure postfix is in opendkim group
|
||||
ansible.builtin.user:
|
||||
name: postfix
|
||||
groups: opendkim
|
||||
append: true
|
92
tasks/postfix.yml
Normal file
92
tasks/postfix.yml
Normal file
@ -0,0 +1,92 @@
|
||||
---
|
||||
# Much of the postfix setup process was based on github.com/Oefenweb/ansible-postfix
|
||||
#
|
||||
# Copyright (c) Oefenweb.nl <https://github.com/Oefenweb>
|
||||
#
|
||||
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
# of this software and associated documentation files (the "Software"), to deal
|
||||
# in the Software without restriction, including without limitation the rights
|
||||
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
# copies of the Software, and to permit persons to whom the Software is furnished
|
||||
# to do so, subject to the following conditions:
|
||||
#
|
||||
# The above copyright notice and this permission notice shall be included in all
|
||||
# copies or substantial portions of the Software.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
# THE SOFTWARE.
|
||||
|
||||
- name: Configure debconf
|
||||
debconf:
|
||||
name: "{{ item.name }}"
|
||||
question: "{{ item.question }}"
|
||||
value: "{{ item.value }}"
|
||||
vtype: "{{ item.vtype }}"
|
||||
with_items: "{{ postfix_debconf_selections }}"
|
||||
|
||||
- name: Install and configure Postfix
|
||||
ansible.builtin.package:
|
||||
name: "{{ postfix_install }}"
|
||||
|
||||
- name: Copy header checks
|
||||
ansible.builtin.copy:
|
||||
src: header_checks
|
||||
dest: /etc/postfix/
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
notify: restart postfix
|
||||
|
||||
- name: Configure Postfix master process
|
||||
ansible.builtin.copy:
|
||||
src: master.cf
|
||||
dest: /etc/postfix/
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
notify: restart postfix
|
||||
|
||||
- name: Configure Postfix main process
|
||||
ansible.builtin.template:
|
||||
src: main.cf.j2
|
||||
dest: /etc/postfix/main.cf
|
||||
|
||||
- name: Configure virtual mailboxes
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/postfix/vmailbox
|
||||
regexp: '^main@{{ postfix_domain }}\s+main/'
|
||||
line: 'main@{{ postfix_domain }} main/'
|
||||
create: true
|
||||
notify: new virtual mailboxes
|
||||
|
||||
- name: Postmap the virtual addresses
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/postfix/vmailbox
|
||||
regexp: '^main@{{ postfix_domain }}\s+main/'
|
||||
line: 'main@{{ postfix_domain }} main/'
|
||||
notify: new virtual aliases
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Generate Diffie-Hellman parameters with the size recommended by postconf (2048 bits)
|
||||
community.crypto.openssl_dhparam:
|
||||
path: "{{ postfix_smtpd_tls_dh1024_param_file }}"
|
||||
size: 2048
|
||||
|
||||
- name: Temporarily stop postfix
|
||||
ansible.builtin.service:
|
||||
name: postfix
|
||||
state: stopped
|
||||
enabled: false
|
||||
|
||||
- name: Set up helper script to create new email aliases
|
||||
ansible.builtin.template:
|
||||
src: create-email-alias.j2
|
||||
dest: /usr/local/bin/create-email-alias
|
||||
mode: '0755'
|
13
templates/create-email-alias.j2
Normal file
13
templates/create-email-alias.j2
Normal file
@ -0,0 +1,13 @@
|
||||
#!/bin/bash
|
||||
if [ -z $1 ];then
|
||||
echo "Usage: ${0} <alias_name>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if grep "$1@{{ postfix_domain }}" /etc/postfix/virtual
|
||||
then
|
||||
echo "already exists"
|
||||
exit 0
|
||||
fi
|
||||
echo "$1@{{ postfix_domain }} main@{{ postfix_domain }}" >> /etc/postfix/virtual
|
||||
postmap /etc/postfix/virtual
|
69
templates/dovecot.conf.j2
Normal file
69
templates/dovecot.conf.j2
Normal file
@ -0,0 +1,69 @@
|
||||
# https://doc.dovecot.org/settings/core/
|
||||
auth_mechanisms = plain scram-sha-256
|
||||
protocols = imap
|
||||
listen = {{ imap_bind_address }}
|
||||
|
||||
# /usr/share/doc/dovecot/example-config/conf.d/10-master.conf
|
||||
# disable plaintext imap
|
||||
service imap-login {
|
||||
inet_listener imap {
|
||||
port = 0
|
||||
}
|
||||
inet_listener imaps {
|
||||
port = 993
|
||||
ssl = yes
|
||||
}
|
||||
}
|
||||
|
||||
# authenticate using a hash in a password file
|
||||
# https://doc.dovecot.org/configuration_manual/authentication/passwd_file/#authentication-passwd-file
|
||||
# Generate a password:
|
||||
# doveadm pw -s BLF-CRYPT
|
||||
passdb {
|
||||
driver = passwd-file
|
||||
args = username_format=%n scheme=blf-crypt /etc/dovecot/imap.passwd
|
||||
auth_verbose=yes
|
||||
}
|
||||
|
||||
# after authentication, use the system user account details
|
||||
# https://doc.dovecot.org/configuration_manual/authentication/user_databases_userdb/#authentication-user-database
|
||||
userdb {
|
||||
driver = passwd-file
|
||||
|
||||
args = username_format=%n /etc/dovecot/imap.passwd
|
||||
|
||||
default_fields = uid={{ postfix_maildir_user }} gid={{ postfix_maildir_user }}
|
||||
# override_fields =
|
||||
|
||||
# skip = never
|
||||
# result_failure = continue
|
||||
# result_internalfail = continue
|
||||
# result_success = return-ok
|
||||
|
||||
# auth_verbose = default
|
||||
}
|
||||
|
||||
# IMAP
|
||||
ssl=yes
|
||||
ssl_cert=<{{ postfix_smtpd_tls_cert_file }}
|
||||
ssl_key=<{{ postfix_smtpd_tls_key_file }}
|
||||
ssl_dh=<{{ postfix_smtpd_tls_dh1024_param_file }}
|
||||
#verbose_ssl=yes
|
||||
|
||||
# SASL
|
||||
service auth {
|
||||
unix_listener /var/spool/postfix/private/auth {
|
||||
mode = 0660
|
||||
user = postfix
|
||||
group = postfix
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
# https://doc.dovecot.org/configuration_manual/home_directories_for_virtual_users/#ways-to-set-up-home-directory
|
||||
# https://doc.dovecot.org/admin_manual/filesystem_permission/
|
||||
mail_location = maildir:{{ postfix_virtual_mailbox_base }}/{{ postfix_domain }}/%n
|
||||
mail_home=/srv/mail/%Lu
|
||||
|
||||
# https://doc.dovecot.org/admin_manual/logging/#dovecot-logging
|
||||
#mail_debug=yes
|
190
templates/main.cf.j2
Normal file
190
templates/main.cf.j2
Normal file
@ -0,0 +1,190 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
|
||||
|
||||
myorigin = $mydomain
|
||||
|
||||
smtpd_banner = {{ postfix_smtpd_banner }}
|
||||
biff = no
|
||||
|
||||
{% if postfix_domain is defined %}
|
||||
mydomain = {{ postfix_domain }}
|
||||
|
||||
# https://www.postfix.org/VIRTUAL_README.html#virtual_mailbox
|
||||
# https://doc.dovecot.org/configuration_manual/home_directories_for_virtual_users/#ways-to-set-up-home-directory
|
||||
virtual_mailbox_domains = $mydomain
|
||||
virtual_mailbox_base = {{ postfix_virtual_mailbox_base }}/{{ postfix_domain }}
|
||||
virtual_mailbox_maps = {{ postfix_default_database_type }}:{{ postfix_virtual_mailbox_maps }}
|
||||
virtual_mailbox_limit = 0
|
||||
# User: {{ postfix_maildir_user }}
|
||||
virtual_uid_maps = static:{{ postfix_virtual_uid }}
|
||||
virtual_gid_maps = static:{{ postfix_virtual_gid }}
|
||||
virtual_alias_maps = {{ postfix_default_database_type }}:{{ postfix_virtual_aliases_file }}
|
||||
{% endif %}
|
||||
|
||||
## Delivering Mail
|
||||
# https://www.postfix.org/SMTPD_ACCESS_README.html
|
||||
smtpd_tls_security_level = {{ postfix_smtpd_tls_security_level }}
|
||||
smtp_tls_CApath = {{ postfix_smtp_tls_CApath }}
|
||||
|
||||
# Anvil
|
||||
# http://www.postfix.org/TUNING_README.html#conn_limit
|
||||
smtpd_client_connection_count_limit = {{ postfix_smtpd_client_connection_count_limit }}
|
||||
smtpd_client_connection_rate_limit = {{ postfix_smtpd_client_connection_rate_limit }}
|
||||
smtpd_client_message_rate_limit = {{ postfix_smtpd_client_message_rate_limit }}
|
||||
smtpd_client_new_tls_session_rate_limit = {{ postfix_smtpd_client_new_tls_session_rate_limit }}
|
||||
smtpd_client_auth_rate_limit = {{ postfix_smtpd_client_auth_rate_limit }}
|
||||
smtpd_client_event_limit_exceptions = $mynetworks
|
||||
|
||||
{% if postfix_compatibility_level is defined %}
|
||||
compatibility_level = {{ postfix_compatibility_level }}
|
||||
{% endif %}
|
||||
|
||||
# TLS parameters
|
||||
# http://www.postfix.org/TLS_README.html
|
||||
smtpd_tls_dh1024_param_file = {{ postfix_smtpd_tls_dh1024_param_file }}
|
||||
{% if postfix_smtpd_tls_security_level != 'encrypt' %}
|
||||
smtpd_tls_auth_only = yes
|
||||
{% endif %}
|
||||
smtpd_tls_cert_file = {{ postfix_smtpd_tls_cert_file }}
|
||||
smtpd_tls_key_file = {{ postfix_smtpd_tls_key_file }}
|
||||
smtpd_use_tls=yes
|
||||
# https://www.postfix.org/postconf.5.html#smtpd_tls_session_cache_database
|
||||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
||||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
||||
# https://weakdh.org/sysadmin.html
|
||||
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA
|
||||
# https://www.postfix.org/SASL_README.html
|
||||
smtpd_sasl_type = {{ postfix_smtpd_sasl_type }}
|
||||
smtpd_sasl_path = {{ postfix_smtpd_sasl_path }}
|
||||
{% if postfix_smtpd_client_restrictions is defined %}
|
||||
smtpd_sasl_security_options = {{ postfix_smtpd_sasl_security_options }}
|
||||
{% endif %}
|
||||
smtpd_sasl_local_domain = $myhostname
|
||||
|
||||
# https://github.com/Oefenweb/ansible-postfix/pull/123
|
||||
{% if postfix_smtp_tls_mandatory_ciphers is defined %}
|
||||
smtp_tls_mandatory_ciphers = {{ postfix_smtp_tls_mandatory_ciphers }}
|
||||
{% endif %}
|
||||
|
||||
{% if postfix_smtpd_tls_mandatory_ciphers is defined %}
|
||||
smtpd_tls_mandatory_ciphers = {{ postfix_smtpd_tls_mandatory_ciphers }}
|
||||
{% endif %}
|
||||
|
||||
{% if postfix_smtpd_tls_mandatory_protocols is defined %}
|
||||
smtpd_tls_mandatory_protocols = {{ postfix_smtpd_tls_mandatory_protocols }}
|
||||
{% endif %}
|
||||
|
||||
{% if postfix_smtpd_tls_protocols is defined %}
|
||||
smtpd_tls_protocols = {{ postfix_smtpd_tls_protocols }}
|
||||
{% endif %}
|
||||
|
||||
{% if postfix_smtp_tls_mandatory_protocols is defined %}
|
||||
smtp_tls_mandatory_protocols = {{ postfix_smtp_tls_mandatory_protocols }}
|
||||
{% endif %}
|
||||
|
||||
{% if postfix_smtp_tls_protocols is defined %}
|
||||
smtp_tls_protocols = {{ postfix_smtp_tls_protocols }}
|
||||
{% endif %}
|
||||
|
||||
{% if postfix_smtpd_tls_loglevel is defined %}
|
||||
smtpd_tls_received_header = yes
|
||||
smtpd_tls_loglevel = {{ postfix_smtpd_tls_loglevel }}
|
||||
{% endif %}
|
||||
|
||||
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
|
||||
# information on enabling SSL in the smtp client.
|
||||
|
||||
myhostname = {{ postfix_hostname }}
|
||||
default_database_type = {{ postfix_default_database_type }}
|
||||
alias_maps = {{ postfix_default_database_type }}:{{ postfix_aliases_file }}
|
||||
alias_database = {{ postfix_default_database_type }}:{{ postfix_aliases_file }}
|
||||
{% if postfix_virtual_aliases and postfix_domain is not defined %}
|
||||
virtual_alias_maps = {{ postfix_default_database_type }}:{{ postfix_virtual_aliases_file }}
|
||||
{% endif %}
|
||||
{% if postfix_sender_canonical_maps %}
|
||||
sender_canonical_maps = {{ postfix_sender_canonical_maps_database_type }}:{{ postfix_sender_canonical_maps_file }}
|
||||
{% endif %}
|
||||
{% if postfix_recipient_canonical_maps %}
|
||||
recipient_canonical_maps = {{ postfix_recipient_canonical_maps_database_type }}:{{ postfix_recipient_canonical_maps_file }}
|
||||
{% endif %}
|
||||
{% if postfix_transport_maps %}
|
||||
transport_maps = {{ postfix_transport_maps_database_type }}:{{ postfix_transport_maps_file }}
|
||||
{% endif %}
|
||||
{% if postfix_sender_dependent_relayhost_maps %}
|
||||
sender_dependent_relayhost_maps = {{ postfix_default_database_type }}:{{ postfix_sender_dependent_relayhost_maps_file }}
|
||||
{% endif %}
|
||||
{% if postfix_smtp_generic_maps %}
|
||||
smtp_generic_maps = {{ postfix_smtp_generic_maps_database_type }}:{{ postfix_smtp_generic_maps_file }}
|
||||
{% endif %}
|
||||
{% if postfix_header_checks %}
|
||||
smtp_header_checks = {{ postfix_header_checks_database_type }}:{{ postfix_header_checks_file }}
|
||||
{% endif %}
|
||||
mydestination = {{ postfix_mydestination | join(', ') }}
|
||||
mynetworks = {{ postfix_mynetworks | join(' ') }}
|
||||
mailbox_size_limit = 0
|
||||
recipient_delimiter = +
|
||||
{% if postfix_inet_interfaces is string %}
|
||||
inet_interfaces = {{ postfix_inet_interfaces }}
|
||||
{% else %}
|
||||
inet_interfaces = {{ postfix_inet_interfaces | join(', ') }}
|
||||
{% endif %}
|
||||
{% if postfix_inet_protocols is string %}
|
||||
inet_protocols = {{ postfix_inet_protocols }}
|
||||
{% else %}
|
||||
inet_protocols = {{ postfix_inet_protocols | join(', ') }}
|
||||
{% endif %}
|
||||
|
||||
{% if postfix_relayhost %}
|
||||
{% if postfix_relayhost_mxlookup %}
|
||||
relayhost = {{ postfix_relayhost }}:{{ postfix_relayhost_port }}
|
||||
{% else %}
|
||||
relayhost = [{{ postfix_relayhost }}]:{{ postfix_relayhost_port }}
|
||||
{% endif %}
|
||||
{% if postfix_sasl_auth_enable %}
|
||||
smtp_sasl_auth_enable = {{ postfix_sasl_auth_enable | bool | ternary('yes', 'no') }}
|
||||
smtp_sasl_password_maps = {{ postfix_default_database_type }}:{{ postfix_sasl_passwd_file }}
|
||||
smtp_sasl_security_options = {{ postfix_sasl_security_options }}
|
||||
smtp_sasl_tls_security_options = {{ postfix_sasl_tls_security_options }}
|
||||
smtp_sasl_mechanism_filter = {{ postfix_sasl_mechanism_filter }}
|
||||
{% endif %}
|
||||
{% if postfix_relaytls %}
|
||||
smtp_use_tls = {{ postfix_relaytls | bool | ternary('yes', 'no') }}
|
||||
smtp_tls_security_level = {{ postfix_smtp_tls_security_level }}
|
||||
smtp_tls_wrappermode = {{ postfix_smtp_tls_wrappermode | bool | ternary('yes', 'no') }}
|
||||
smtp_tls_note_starttls_offer = {{ postfix_smtp_tls_note_starttls_offer | bool | ternary('yes', 'no') }}
|
||||
{% if postfix_smtp_tls_cafile is defined %}
|
||||
smtp_tls_CAfile = {{ postfix_smtp_tls_cafile }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% else %}
|
||||
relayhost =
|
||||
{% endif %}
|
||||
|
||||
{% if postfix_smtpd_client_restrictions is defined %}
|
||||
smtpd_client_restrictions = {{ postfix_smtpd_client_restrictions | join(', ') }}
|
||||
{% endif %}
|
||||
{% if postfix_smtpd_helo_restrictions is defined %}
|
||||
smtpd_helo_restrictions = {{ postfix_smtpd_helo_restrictions | join(', ') }}
|
||||
{% endif %}
|
||||
{% if postfix_smtpd_sender_restrictions is defined %}
|
||||
smtpd_sender_restrictions = {{ postfix_smtpd_sender_restrictions | join(', ') }}
|
||||
{% endif %}
|
||||
{% if postfix_smtpd_recipient_restrictions is defined %}
|
||||
smtpd_recipient_restrictions = {{ postfix_smtpd_recipient_restrictions | join(', ') }}
|
||||
{% endif %}
|
||||
{% if postfix_smtpd_relay_restrictions is defined %}
|
||||
smtpd_relay_restrictions = {{ postfix_smtpd_relay_restrictions | join(', ') }}
|
||||
{% endif %}
|
||||
{% if postfix_smtpd_data_restrictions is defined %}
|
||||
smtpd_data_restrictions = {{ postfix_smtpd_data_restrictions | join(', ') }}
|
||||
{% endif %}
|
||||
|
||||
message_size_limit = {{ postfix_message_size_limit }}
|
||||
|
||||
# Disable the SMTP VRFY command. This stops some techniques used to harvest email addresses.
|
||||
disable_vrfy_command = {{ postfix_disable_vrfy_command | bool | ternary('yes', 'no') }}
|
||||
|
||||
{% for raw_option in postfix_raw_options | default([]) %}
|
||||
{{ raw_option }}
|
||||
{% endfor %}
|
52
templates/opendkim.conf.j2
Normal file
52
templates/opendkim.conf.j2
Normal file
@ -0,0 +1,52 @@
|
||||
# This is a basic configuration for signing and verifying. It can easily be
|
||||
# adapted to suit a basic installation. See opendkim.conf(5) and
|
||||
# /usr/share/doc/opendkim/examples/opendkim.conf.sample for complete
|
||||
# documentation of available configuration parameters.
|
||||
|
||||
Syslog yes
|
||||
SyslogSuccess yes
|
||||
#LogWhy no
|
||||
|
||||
# Common signing and verification parameters. In Debian, the "From" header is
|
||||
# oversigned, because it is often the identity key used by reputation systems
|
||||
# and thus somewhat security sensitive.
|
||||
Canonicalization relaxed/simple
|
||||
#Mode sv
|
||||
#SubDomains no
|
||||
OversignHeaders From
|
||||
|
||||
# Signing domain, selector, and key (required). For example, perform signing
|
||||
# for domain "example.com" with selector "2020" (2020._domainkey.example.com),
|
||||
# using the private key stored in /etc/dkimkeys/example.private. More granular
|
||||
# setup options can be found in /usr/share/doc/opendkim/README.opendkim.
|
||||
Domain {{ postfix_domain }}
|
||||
Selector {{ dkim_selector }}
|
||||
KeyFile {{ dkim_key_path}}/{{ dkim_selector }}.private
|
||||
|
||||
# In Debian, opendkim runs as user "opendkim". A umask of 007 is required when
|
||||
# using a local socket with MTAs that access the socket as a non-privileged
|
||||
# user (for example, Postfix). You may need to add user "postfix" to group
|
||||
# "opendkim" in that case.
|
||||
UserID opendkim
|
||||
UMask 007
|
||||
|
||||
# Socket for the MTA connection (required). If the MTA is inside a chroot jail,
|
||||
# it must be ensured that the socket is accessible. In Debian, Postfix runs in
|
||||
# a chroot in /var/spool/postfix, therefore a Unix socket would have to be
|
||||
# configured as shown on the last line below.
|
||||
#Socket local:/run/opendkim/opendkim.sock
|
||||
#Socket inet:8891@localhost
|
||||
#Socket inet:8891
|
||||
Socket local:/var/spool/postfix/opendkim/opendkim.sock
|
||||
|
||||
PidFile /run/opendkim/opendkim.pid
|
||||
|
||||
# Hosts for which to sign rather than verify, default is 127.0.0.1. See the
|
||||
# OPERATION section of opendkim(8) for more information.
|
||||
#InternalHosts 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12
|
||||
|
||||
# The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided
|
||||
# by the package dns-root-data.
|
||||
TrustAnchorFile /usr/share/dns/root.key
|
||||
#Nameservers 127.0.0.1
|
||||
SendReports no
|
24
vars/main.yml
Normal file
24
vars/main.yml
Normal file
@ -0,0 +1,24 @@
|
||||
# vars file
|
||||
---
|
||||
postfix_debconf_selections:
|
||||
- name: postfix
|
||||
question: postfix/main_mailer_type
|
||||
value: No configuration
|
||||
vtype: select
|
||||
|
||||
postfix_main_cf: /etc/postfix/main.cf
|
||||
postfix_mailname_file: /etc/mailname
|
||||
postfix_aliases_file: /etc/aliases
|
||||
postfix_virtual_aliases_file: /etc/postfix/virtual
|
||||
postfix_sasl_passwd_file: /etc/postfix/sasl_passwd
|
||||
postfix_sender_canonical_maps_file: /etc/postfix/sender_canonical_maps
|
||||
postfix_recipient_canonical_maps_file: /etc/postfix/recipient_canonical_maps
|
||||
postfix_transport_maps_file: /etc/postfix/transport_maps
|
||||
postfix_sender_dependent_relayhost_maps_file: /etc/postfix/sender_dependent_relayhost_maps
|
||||
postfix_smtp_generic_maps_file: /etc/postfix/generic
|
||||
postfix_header_checks_file: /etc/postfix/header_checks
|
||||
postfix_virtual_mailbox_file: /etc/postfix/vmailbox
|
||||
postfix_smtpd_tls_dh1024_param_file: /etc/ssh/dhaparams.pem
|
||||
|
||||
# https://github.com/vdukhovni/postfix/blob/master/postfix/INSTALL
|
||||
postfix_compatibility_level: 3.5 # Debian 11
|
Loading…
Reference in New Issue
Block a user