mirror of
https://github.com/chatmail/relay.git
synced 2026-05-10 16:04:37 +00:00
0d890274fd
On FreeBSD 127.0.0.2 is not assigned to any interface by default,
so 127.0.0.2 source address hack cannot be used to make OpenDKIM
verify the signature instead of signing.
This change sets InternalHosts to `-` so no IP addresses
make OpenDKIM sign the message. Instead of IP address,
OpenDKIM in the outgoing pipeline is explicitly told
to sign messages by setting `{daemon_name}` macro to `ORIGINATING`.
104 lines
4.9 KiB
Django/Jinja
104 lines
4.9 KiB
Django/Jinja
#
|
|
# Postfix master process configuration file. For details on the format
|
|
# of the file, see the master(5) manual page (command: "man 5 master" or
|
|
# on-line: http://www.postfix.org/master.5.html).
|
|
#
|
|
# Do not forget to execute "postfix reload" after editing this file.
|
|
#
|
|
# ==========================================================================
|
|
# service type private unpriv chroot wakeup maxproc command + args
|
|
# (yes) (yes) (no) (never) (100)
|
|
# ==========================================================================
|
|
{% if debug == true %}
|
|
smtp inet n - y - - smtpd -v
|
|
{%- else %}
|
|
smtp inet n - y - - smtpd
|
|
{%- endif %}
|
|
-o smtpd_tls_security_level=encrypt
|
|
-o smtpd_tls_mandatory_protocols=>=TLSv1.2
|
|
-o smtpd_proxy_filter=127.0.0.1:{{ config.filtermail_smtp_port_incoming }}
|
|
submission inet n - y - 5000 smtpd
|
|
-o syslog_name=postfix/submission
|
|
-o smtpd_tls_security_level=encrypt
|
|
-o smtpd_tls_mandatory_protocols=>=TLSv1.3
|
|
-o smtpd_sasl_auth_enable=yes
|
|
-o smtpd_sasl_type=dovecot
|
|
-o smtpd_sasl_path=private/auth
|
|
-o smtpd_tls_auth_only=yes
|
|
-o smtpd_reject_unlisted_recipient=no
|
|
-o smtpd_client_restrictions=$mua_client_restrictions
|
|
-o smtpd_helo_restrictions=$mua_helo_restrictions
|
|
-o smtpd_sender_restrictions=$mua_sender_restrictions
|
|
-o smtpd_recipient_restrictions=
|
|
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
|
-o smtpd_client_connection_count_limit=1000
|
|
-o smtpd_proxy_filter=127.0.0.1:{{ config.filtermail_smtp_port }}
|
|
smtps inet n - y - 5000 smtpd
|
|
-o syslog_name=postfix/smtps
|
|
-o smtpd_tls_wrappermode=yes
|
|
-o smtpd_tls_security_level=encrypt
|
|
-o smtpd_tls_mandatory_protocols=>=TLSv1.3
|
|
-o smtpd_sasl_auth_enable=yes
|
|
-o smtpd_sasl_type=dovecot
|
|
-o smtpd_sasl_path=private/auth
|
|
-o smtpd_reject_unlisted_recipient=no
|
|
-o smtpd_client_restrictions=$mua_client_restrictions
|
|
-o smtpd_helo_restrictions=$mua_helo_restrictions
|
|
-o smtpd_sender_restrictions=$mua_sender_restrictions
|
|
-o smtpd_recipient_restrictions=
|
|
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
|
-o smtpd_client_connection_count_limit=1000
|
|
-o smtpd_proxy_filter=127.0.0.1:{{ config.filtermail_smtp_port }}
|
|
#628 inet n - y - - qmqpd
|
|
pickup unix n - y 60 1 pickup
|
|
cleanup unix n - y - 0 cleanup
|
|
qmgr unix n - n 300 1 qmgr
|
|
#qmgr unix n - n 300 1 oqmgr
|
|
tlsmgr unix - - y 1000? 1 tlsmgr
|
|
rewrite unix - - y - - trivial-rewrite
|
|
bounce unix - - y - 0 bounce
|
|
defer unix - - y - 0 bounce
|
|
trace unix - - y - 0 bounce
|
|
verify unix - - y - 1 verify
|
|
flush unix n - y 1000? 0 flush
|
|
proxymap unix - - n - - proxymap
|
|
proxywrite unix - - n - 1 proxymap
|
|
smtp unix - - y - - smtp
|
|
relay unix - - y - - smtp
|
|
-o syslog_name=postfix/$service_name
|
|
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
|
|
showq unix n - y - - showq
|
|
error unix - - y - - error
|
|
retry unix - - y - - error
|
|
discard unix - - y - - discard
|
|
lmtp unix - - y - - lmtp
|
|
anvil unix - - y - 1 anvil
|
|
scache unix - - y - 1 scache
|
|
postlog unix-dgram n - n - 1 postlogd
|
|
filter unix - n n - - lmtp
|
|
# Local SMTP server for reinjecting outgoing filtered mail.
|
|
127.0.0.1:{{ config.postfix_reinject_port }} inet n - n - 100 smtpd
|
|
-o syslog_name=postfix/reinject
|
|
-o milter_macro_daemon_name=ORIGINATING
|
|
-o smtpd_milters=unix:opendkim/opendkim.sock
|
|
-o cleanup_service_name=authclean
|
|
|
|
# Local SMTP server for reinjecting incoming filtered mail
|
|
127.0.0.1:{{ config.postfix_reinject_port_incoming }} inet n - n - 100 smtpd
|
|
-o syslog_name=postfix/reinject_incoming
|
|
-o smtpd_milters=unix:opendkim/opendkim.sock
|
|
|
|
# Cleanup `Received` headers for authenticated mail
|
|
# to avoid leaking client IP.
|
|
#
|
|
# We do not do this for received mails
|
|
# as this will break DKIM signatures
|
|
# if `Received` header is signed.
|
|
#
|
|
# This service also rewrites
|
|
# Subject with `[...]`
|
|
# to make sure the users
|
|
# cannot send unprotected Subject.
|
|
authclean unix n - - - 0 cleanup
|
|
-o header_checks=regexp:/etc/postfix/submission_header_cleanup
|