2016-02-17 23:56:40 +02:00
|
|
|
###############
|
|
|
|
# General
|
|
|
|
###############
|
2016-01-18 22:43:52 +02:00
|
|
|
|
2021-01-23 17:16:07 +02:00
|
|
|
{% if POSTFIX_LOG_SYSLOG != "local" %}
|
|
|
|
# Logging configuration
|
|
|
|
maillog_file = /dev/stdout
|
|
|
|
{% endif %}
|
|
|
|
|
2016-03-02 22:25:56 +02:00
|
|
|
# Main domain and hostname
|
|
|
|
mydomain = {{ DOMAIN }}
|
2017-09-24 17:49:39 +02:00
|
|
|
myhostname = {{ HOSTNAMES.split(",")[0] }}
|
2016-03-02 22:25:56 +02:00
|
|
|
myorigin = $mydomain
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2017-07-02 16:39:00 +02:00
|
|
|
# Queue location
|
|
|
|
queue_directory = /queue
|
|
|
|
|
2016-09-25 01:46:10 +02:00
|
|
|
# Message size limit
|
|
|
|
message_size_limit = {{ MESSAGE_SIZE_LIMIT }}
|
|
|
|
|
2016-03-02 22:25:56 +02:00
|
|
|
# Relayed networks
|
2021-11-09 13:22:53 +02:00
|
|
|
mynetworks = 127.0.0.1/32 [::1]/128 {{ SUBNET }} {% if RELAYNETS %}{{ RELAYNETS.split(",") | join(' ') }}{% endif %}
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2016-02-17 23:56:40 +02:00
|
|
|
# Empty alias list to override the configuration variable and disable NIS
|
2016-10-19 15:09:26 +02:00
|
|
|
alias_maps =
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2018-07-26 21:57:21 +02:00
|
|
|
# Podop configuration
|
|
|
|
podop = socketmap:unix:/tmp/podop.socket:
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2016-02-20 21:11:59 +02:00
|
|
|
# Only accept virtual emails
|
|
|
|
mydestination =
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2016-08-18 16:08:36 +02:00
|
|
|
# Relayhost if any is configured
|
|
|
|
relayhost = {{ RELAYHOST }}
|
2019-03-04 19:52:04 +02:00
|
|
|
{% if RELAYUSER %}
|
|
|
|
smtp_sasl_auth_enable = yes
|
2021-08-08 19:18:33 +02:00
|
|
|
smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
|
2021-08-09 16:55:23 +02:00
|
|
|
smtp_sasl_security_options = noanonymous, noplaintext
|
|
|
|
smtp_sasl_tls_security_options = noanonymous
|
2019-03-04 19:52:04 +02:00
|
|
|
{% endif %}
|
2016-01-18 22:43:52 +02:00
|
|
|
|
2017-09-03 16:18:08 +02:00
|
|
|
# Recipient delimiter for extended addresses
|
2017-09-10 14:09:16 +02:00
|
|
|
recipient_delimiter = {{ RECIPIENT_DELIMITER }}
|
2017-09-03 16:18:08 +02:00
|
|
|
|
2017-10-22 15:45:32 +02:00
|
|
|
# Only the front server is allowed to perform xclient
|
2018-12-03 03:16:53 +02:00
|
|
|
# In kubernetes and Docker swarm, such address cannot be determined using the hostname. Allow for the whole Mailu subnet instead.
|
|
|
|
smtpd_authorized_xclient_hosts={{ POD_ADDRESS_RANGE or SUBNET }}
|
2017-10-22 15:45:32 +02:00
|
|
|
|
2016-02-17 23:56:40 +02:00
|
|
|
###############
|
|
|
|
# TLS
|
|
|
|
###############
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2017-01-23 22:29:02 +02:00
|
|
|
# General TLS configuration
|
|
|
|
tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
|
|
|
|
tls_preempt_cipherlist = yes
|
2021-08-01 10:16:46 +02:00
|
|
|
tls_ssl_options = NO_COMPRESSION, NO_TICKET
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2020-05-02 20:58:07 +02:00
|
|
|
# By default, outgoing TLS is more flexible because
|
|
|
|
# 1. not all receiving servers will support TLS,
|
|
|
|
# 2. not all will have and up-to-date TLS stack.
|
2016-08-19 13:49:58 +02:00
|
|
|
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
|
|
|
|
smtp_tls_protocols =!SSLv2,!SSLv3
|
2021-08-30 14:21:28 +02:00
|
|
|
smtp_tls_security_level = {{ OUTBOUND_TLS_LEVEL|default('dane') }}
|
2021-09-09 17:30:46 +02:00
|
|
|
smtp_tls_dane_insecure_mx_policy = {{ 'dane' if DEFER_ON_TLS_ERROR else 'may' }}
|
2021-09-01 08:41:39 +02:00
|
|
|
smtp_tls_policy_maps=lmdb:/etc/postfix/tls_policy.map, ${podop}dane, socketmap:unix:/tmp/mta-sts.socket:postfix
|
2021-08-01 11:09:44 +02:00
|
|
|
smtp_tls_CApath = /etc/ssl/certs
|
2021-08-09 17:39:15 +02:00
|
|
|
smtp_tls_session_cache_database = lmdb:/dev/shm/postfix/smtp_scache
|
|
|
|
smtpd_tls_session_cache_database = lmdb:/dev/shm/postfix/smtpd_scache
|
2021-08-20 14:11:41 +02:00
|
|
|
smtp_host_lookup = dns
|
|
|
|
smtp_dns_support_level = dnssec
|
2021-08-30 14:21:28 +02:00
|
|
|
delay_warning_time = 5m
|
|
|
|
smtp_tls_loglevel = 1
|
|
|
|
notify_classes = resource, software, delay
|
2016-01-18 22:43:52 +02:00
|
|
|
|
2016-02-17 23:56:40 +02:00
|
|
|
###############
|
|
|
|
# Virtual
|
|
|
|
###############
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2016-11-01 13:57:22 +02:00
|
|
|
# The alias map actually returns both aliases and local mailboxes, which is
|
|
|
|
# required for reject_unlisted_sender to work properly
|
2018-09-26 00:15:24 +02:00
|
|
|
virtual_alias_domains =
|
|
|
|
virtual_alias_maps = ${podop}alias
|
|
|
|
virtual_mailbox_domains = ${podop}domain
|
|
|
|
virtual_mailbox_maps = ${podop}mailbox
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2017-09-11 08:12:04 +02:00
|
|
|
# Mails are transported if required, then forwarded to Dovecot for delivery
|
2018-09-27 16:30:20 +02:00
|
|
|
relay_domains = ${podop}transport
|
|
|
|
transport_maps = ${podop}transport
|
2019-02-18 14:46:48 +02:00
|
|
|
virtual_transport = lmtp:inet:{{ LMTP_ADDRESS }}
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2020-01-14 02:18:30 +02:00
|
|
|
# Sender and recipient canonical maps, mostly for SRS
|
|
|
|
sender_canonical_maps = ${podop}sendermap
|
|
|
|
sender_canonical_classes = envelope_sender
|
|
|
|
recipient_canonical_maps = ${podop}recipientmap
|
|
|
|
recipient_canonical_classes= envelope_recipient,header_recipient
|
|
|
|
|
2016-08-19 13:43:01 +02:00
|
|
|
# In order to prevent Postfix from running DNS query, enforce the use of the
|
|
|
|
# native DNS stack, that will check /etc/hosts properly.
|
2016-02-24 08:44:49 +02:00
|
|
|
lmtp_host_lookup = native
|
2016-05-29 15:54:34 +02:00
|
|
|
|
2016-11-01 12:05:47 +02:00
|
|
|
###############
|
|
|
|
# Restrictions
|
|
|
|
###############
|
|
|
|
|
|
|
|
# Delay all rejects until all information can be logged
|
|
|
|
smtpd_delay_reject = yes
|
|
|
|
|
|
|
|
# Allowed senders are: the user or one of the alias destinations
|
2018-10-07 16:23:53 +02:00
|
|
|
smtpd_sender_login_maps = ${podop}senderlogin
|
2016-11-01 12:05:47 +02:00
|
|
|
|
2017-10-22 15:00:16 +02:00
|
|
|
# Restrictions for incoming SMTP, other restrictions are applied in master.cf
|
2016-11-01 12:05:47 +02:00
|
|
|
smtpd_helo_required = yes
|
|
|
|
|
2021-08-09 14:58:58 +02:00
|
|
|
check_ratelimit = check_sasl_access ${podop}senderrate
|
|
|
|
|
2018-09-26 00:15:24 +02:00
|
|
|
smtpd_client_restrictions =
|
2017-10-22 15:00:16 +02:00
|
|
|
permit_mynetworks,
|
2018-10-07 16:23:53 +02:00
|
|
|
check_sender_access ${podop}senderaccess,
|
2017-10-22 15:00:16 +02:00
|
|
|
reject_non_fqdn_sender,
|
|
|
|
reject_unknown_sender_domain,
|
|
|
|
reject_unknown_recipient_domain,
|
|
|
|
permit
|
2016-11-01 12:05:47 +02:00
|
|
|
|
2018-09-26 00:15:24 +02:00
|
|
|
smtpd_relay_restrictions =
|
|
|
|
permit_mynetworks,
|
|
|
|
permit_sasl_authenticated,
|
2018-10-07 01:28:22 +02:00
|
|
|
reject_unauth_destination
|
2018-09-26 00:15:24 +02:00
|
|
|
|
2017-12-04 23:04:22 +02:00
|
|
|
unverified_recipient_reject_reason = Address lookup failure
|
|
|
|
|
2016-05-29 15:54:34 +02:00
|
|
|
###############
|
|
|
|
# Milter
|
|
|
|
###############
|
2016-08-19 13:49:58 +02:00
|
|
|
|
2019-10-12 01:01:35 +02:00
|
|
|
smtpd_milters = inet:{{ ANTISPAM_MILTER_ADDRESS }}
|
2016-05-29 15:54:34 +02:00
|
|
|
milter_protocol = 6
|
|
|
|
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
|
2016-08-01 10:29:15 +02:00
|
|
|
milter_default_action = tempfail
|
|
|
|
|
|
|
|
###############
|
|
|
|
# Extra Settings
|
|
|
|
###############
|
2020-10-04 16:36:37 +02:00
|
|
|
{# Ensure that the rendered file ends with newline in order to make `postconf` work correctly #}
|
|
|
|
{{- "\n" }}
|