2016-02-17 23:56:40 +02:00
|
|
|
###############
|
|
|
|
|
# General
|
|
|
|
|
###############
|
2016-01-18 22:43:52 +02:00
|
|
|
|
2016-03-02 22:25:56 +02:00
|
|
|
# Main domain and hostname
|
|
|
|
|
mydomain = {{ DOMAIN }}
|
|
|
|
|
myhostname = {{ HOSTNAME }}
|
|
|
|
|
myorigin = $mydomain
|
|
|
|
|
# Relayed networks
|
|
|
|
|
mynetworks = 127.0.0.1/32 [::1]/128 {{ RELAYNETS }}
|
2016-02-17 23:56:40 +02:00
|
|
|
# Empty alias list to override the configuration variable and disable NIS
|
|
|
|
|
alias_maps = hash:/etc/aliases
|
|
|
|
|
# SQLite configuration
|
|
|
|
|
sql = sqlite:${config_directory}/
|
2016-02-20 21:11:59 +02:00
|
|
|
# Only accept virtual emails
|
|
|
|
|
mydestination =
|
2016-08-18 16:08:36 +02:00
|
|
|
# Relayhost if any is configured
|
|
|
|
|
relayhost = {{ RELAYHOST }}
|
2016-01-18 22:43:52 +02:00
|
|
|
|
2016-02-17 23:56:40 +02:00
|
|
|
###############
|
|
|
|
|
# TLS
|
|
|
|
|
###############
|
|
|
|
|
smtpd_use_tls = yes
|
2016-08-19 13:43:01 +02:00
|
|
|
# Only one key/certificate pair is used, SNI not being supported by all
|
|
|
|
|
# services and not a strong requirement.
|
2016-02-24 08:44:49 +02:00
|
|
|
smtpd_tls_cert_file=/certs/cert.pem
|
|
|
|
|
smtpd_tls_key_file=/certs/key.pem
|
2016-02-17 23:56:40 +02:00
|
|
|
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
|
2016-08-19 13:43:01 +02:00
|
|
|
# Server-side TLS is hardened, it should be up to the client to update his or
|
|
|
|
|
# her TLS stack in order to connect to the mail server.
|
2016-08-19 13:20:50 +02:00
|
|
|
smtpd_tls_protocols=!SSLv2,!SSLv3
|
|
|
|
|
smtpd_tls_ciphers=medium
|
|
|
|
|
smtpd_tls_exclude_ciphers=aNULL,RC4
|
2016-08-19 13:43:01 +02:00
|
|
|
# Outgoing TLS is more flexible because 1. not all receiving servers will
|
|
|
|
|
# support TLS, 2. not all will have and up-to-date TLS stack.
|
|
|
|
|
smtp_tls_security_level = may
|
|
|
|
|
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
2016-01-18 22:43:52 +02:00
|
|
|
|
2016-02-17 23:56:40 +02:00
|
|
|
###############
|
|
|
|
|
# SASL
|
|
|
|
|
###############
|
|
|
|
|
smtpd_sasl_local_domain = $myhostname
|
2016-08-19 13:43:01 +02:00
|
|
|
# Authentication is done against dovecot, which acts as the main authention
|
|
|
|
|
# source
|
2016-01-18 22:43:52 +02:00
|
|
|
smtpd_sasl_type = dovecot
|
2016-04-20 21:17:43 +02:00
|
|
|
smtpd_sasl_path = inet:imap:2102
|
2016-01-18 22:43:52 +02:00
|
|
|
smtpd_sasl_auth_enable = yes
|
2016-02-17 23:56:40 +02:00
|
|
|
smtpd_sasl_security_options = noanonymous
|
|
|
|
|
|
|
|
|
|
###############
|
|
|
|
|
# Virtual
|
|
|
|
|
###############
|
|
|
|
|
virtual_mailbox_domains = ${sql}sqlite-virtual_mailbox_domains.cf
|
|
|
|
|
virtual_alias_maps = ${sql}sqlite-virtual_alias_maps.cf
|
2016-08-19 13:43:01 +02:00
|
|
|
# Mails are forwarded to Dovecot for delivery
|
2016-05-29 15:54:34 +02:00
|
|
|
virtual_transport = lmtp:inet:imap:2525
|
2016-08-19 13:43:01 +02:00
|
|
|
# In order to prevent Postfix from running DNS query, enforce the use of the
|
|
|
|
|
# native DNS stack, that will check /etc/hosts properly.
|
2016-02-24 08:44:49 +02:00
|
|
|
lmtp_host_lookup = native
|
2016-05-29 15:54:34 +02:00
|
|
|
|
|
|
|
|
###############
|
|
|
|
|
# Milter
|
|
|
|
|
###############
|
|
|
|
|
smtpd_milters = inet:milter:9900
|
|
|
|
|
milter_protocol = 6
|
|
|
|
|
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
|
2016-08-01 10:29:15 +02:00
|
|
|
milter_default_action = tempfail
|
|
|
|
|
|
|
|
|
|
###############
|
|
|
|
|
# Extra Settings
|
|
|
|
|
###############
|
