docker/smtp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updates based on our current environment, added spf policy and checking receipt valid before doing recipient verify
All checks were successful
Create Docker Image / Build Docker Image (arm64) (push) Successful in 1m20s
Details
Create Docker Image / Build Docker Image (x86_64) (push) Successful in 1m30s
Details
Create Docker Image / Final Docker Image Manifest (push) Successful in 10s
Details

Browse Source
This commit is contained in:
Deon George 2025-04-24 12:41:20 +10:00
parent b6db6b1dae
commit cf4573b6e1
4 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
defaults/header_checks
View File

@ -548,7 +548,7 @@
#
# HEADER_CHECKS(5)
/^Received:\ from\ localhost\ \(localhost\ \[127.0.0.1\]\)/ IGNORE
/^Received:\ from\ efa-1-1.dege.au\ \(localhost\ \[127.0.0.1/ IGNORE
/^Received:\ from\ efa-1-1.dege.au\ \(localhost\ \[::1/ IGNORE
/^Received:\ from\ ov-3-1.graytech.net.au\ \(localhost\ \[127.0.0.1/ IGNORE
/^Received:\ from\ ov-3-1.graytech.net.au\ \(localhost\ \[::1/ IGNORE
/^Received:\ from\ efa-1-2.dege.au\ \(localhost\ \[127.0.0.1/ IGNORE
/^Received:\ from\ efa-1-2.dege.au\ \(localhost\ \[::1/ IGNORE
/^Received:\ from\ ov-3-2.graytech.net.au\ \(localhost\ \[127.0.0.1/ IGNORE
/^Received:\ from\ ov-3-2.graytech.net.au\ \(localhost\ \[::1/ IGNORE

8
docker/Dockerfile
View File

@ -6,15 +6,19 @@ FROM alpine
# Change to http respositories, so they we can cache the install packages
RUN if [ -n ${HTTP_PROXY} ] ; then sed -i -e s'/https/http/' /etc/apk/repositories; fi
RUN apk add --no-cache postfix postfix-ldap cyrus-sasl cyrus-sasl-login opendkim opendkim-utils
RUN apk add --no-cache postfix postfix-ldap cyrus-sasl cyrus-sasl-login opendkim opendkim-utils postfix-policyd-spf-perl
# SASL config
COPY smtpd.conf /etc/sasl2/
RUN apk add shadow && useradd -rc "HUB Mail Relay" -M relay -NG mail -s /sbin/nologin && echo relay:SmTpR3l2Y | chpasswd \
RUN apk add shadow \
&& useradd -r -M policyd-spf -s /usr/sbin/nologin \
&& useradd -rc "HUB Mail Relay" -M relay -NG mail -s /sbin/nologin \
&& echo relay:SmTpR3l2Y | chpasswd \
&& gpasswd -a postfix opendkim
# Config postfix
RUN echo "policyd-spf unix - n n - 0 spawn user=policyd-spf argv=/usr/bin/postfix-policyd-spf-perl" >> /etc/postfix/master.cf
RUN sed -i -e 's%^#mynetworks = hash:/etc/postfix/network_table%mynetworks = /etc/opendkim/signing/TrustedHosts%' /etc/postfix/main.cf
COPY include /etc/postfix/include
COPY ssl /etc/postfix/ssl

6
include/01-custom.cf
View File

@ -15,6 +15,7 @@ smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks, reject
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_helo_restrictions = check_helo_access lmdb:/etc/postfix/custom/helo_access, reject_invalid_hostname
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_non_fqdn_recipient, reject_unknown_recipient_domain, check_recipient_access lmdb:/etc/postfix/custom/recipient_access,
reject_unlisted_recipient,
#reject_rhsbl_sender @SPAMHAUS_DQS_KEY@.dbl.dq.spamhaus.net=127.0.1.[2..99],
#reject_rhsbl_helo @SPAMHAUS_DQS_KEY@.dbl.dq.spamhaus.net=127.0.1.[2..99],
#reject_rhsbl_reverse_client @SPAMHAUS_DQS_KEY@.dbl.dq.spamhaus.net=127.0.1.[2..99],
@ -22,9 +23,10 @@ smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, rej
#reject_rhsbl_helo @SPAMHAUS_DQS_KEY@.zrd.dq.spamhaus.net=127.0.2.[2..24],
#reject_rhsbl_reverse_client @SPAMHAUS_DQS_KEY@.zrd.dq.spamhaus.net=127.0.2.[2..24],
#reject_rbl_client @SPAMHAUS_DQS_KEY@.zen.dq.spamhaus.net=127.0.0.[2..255],
reject_unverified_recipient
reject_unverified_recipient,
check_policy_service unix:private/policyd-spf
rbl_reply_maps = lmdb:/etc/postfix/custom/dnsbl-reply-map
smtpd_sender_restrictions = permit_sasl_authenticated, check_sender_access lmdb:/etc/postfix/custom/sender_access, reject_non_fqdn_sender, reject_unknown_sender_domain
smtpd_use_tls = yes
unverified_recipient_reject_code = 450
unverified_recipient_reject_reason = No user at this address
postscreen_greet_action = enforce

1
include/10-ssl.cf
View File

@ -1,4 +1,3 @@
smtp_use_tls = yes
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_security_level = may
smtpd_tls_auth_only = yes