mirror of
https://github.com/chatmail/relay.git
synced 2026-08-11 11:00:52 +00:00
link2xt
deca1ef2a3
Default behavior is processing headers that are actually part of the message body. This is unlikely to be needed as headers such as Received are not added into MIME parts, but may result in broken DKIM signatures if the body is modified.
138 lines
5.0 KiB
Django/Jinja
138 lines
5.0 KiB
Django/Jinja
myorigin = {{ config.mail_domain }}
|
|
|
|
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
|
|
biff = no
|
|
|
|
# appending .domain is the MUA's job.
|
|
append_dot_mydomain = no
|
|
|
|
# Uncomment the next line to generate "delayed mail" warnings
|
|
#delay_warning_time = 4h
|
|
|
|
readme_directory = no
|
|
|
|
# See http://www.postfix.org/COMPATIBILITY_README.html
|
|
compatibility_level = 3.6
|
|
|
|
# TLS parameters
|
|
smtpd_tls_cert_file={{ config.tls_cert_path }}
|
|
smtpd_tls_key_file={{ config.tls_key_path }}
|
|
smtpd_tls_security_level=may
|
|
|
|
smtp_tls_CApath=/etc/ssl/certs
|
|
smtp_tls_security_level=verify
|
|
# Send SNI extension when connecting to other servers.
|
|
# <https://www.postfix.org/postconf.5.html#smtp_tls_servername>
|
|
smtp_tls_servername = hostname
|
|
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
|
|
smtp_tls_policy_maps = regexp:/etc/postfix/smtp_tls_policy_map
|
|
smtp_tls_protocols = >=TLSv1.2
|
|
smtp_tls_mandatory_protocols = >=TLSv1.2
|
|
|
|
# Disable anonymous cipher suites
|
|
# and known insecure algorithms.
|
|
#
|
|
# Disabling anonymous ciphers
|
|
# does not generally improve security
|
|
# because clients that want to verify certificate
|
|
# will not select them anyway,
|
|
# but makes cipher suite list shorter and security scanners happy.
|
|
# See <https://www.postfix.org/TLS_README.html> for discussion.
|
|
#
|
|
# Only ancient insecure ciphers should be disabled here
|
|
# as MTA clients that do not support more secure cipher
|
|
# likely do not support MTA-STS either and will
|
|
# otherwise fall back to using plaintext connection.
|
|
smtpd_tls_exclude_ciphers = aNULL, RC4, MD5, DES
|
|
|
|
# Override client's preference order.
|
|
# <https://www.postfix.org/postconf.5.html#tls_preempt_cipherlist>
|
|
#
|
|
# This is mostly to ensure cipher suites with forward secrecy
|
|
# are preferred over non cipher suites without forward secrecy.
|
|
# See <https://www.postfix.org/FORWARD_SECRECY_README.html#server_fs>.
|
|
tls_preempt_cipherlist = yes
|
|
|
|
# Reject by default, override per smtpd in master.cf
|
|
smtpd_relay_restrictions = reject
|
|
myhostname = {{ config.postfix_myhostname }}
|
|
alias_maps = hash:/etc/aliases
|
|
alias_database = hash:/etc/aliases
|
|
|
|
# When postfix receives mail for $mydestination,
|
|
# it hands it over to dovecot via $local_transport.
|
|
# Note: IP literals must be handled via local delivery / mydestination.
|
|
mydestination = {{ config.mail_domain }}
|
|
local_transport = lmtp:unix:private/dovecot-lmtp
|
|
# postfix doesn't check whether local users exist or not:
|
|
local_recipient_maps =
|
|
|
|
relayhost =
|
|
{% if disable_ipv6 %}
|
|
mynetworks = 127.0.0.0/8
|
|
{% else %}
|
|
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
|
|
{% endif %}
|
|
mailbox_size_limit = 0
|
|
message_size_limit = {{config.max_message_size}}
|
|
recipient_delimiter = +
|
|
inet_interfaces = all
|
|
{% if disable_ipv6 %}
|
|
inet_protocols = ipv4
|
|
{% else %}
|
|
inet_protocols = all
|
|
{% endif %}
|
|
|
|
lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup
|
|
|
|
# Do not apply header checks to MIME headers
|
|
# and other headers that are actually part of the message body.
|
|
# Reference:
|
|
# <https://www.postfix.org/postconf.5.html#disable_mime_input_processing>
|
|
# <https://www.postfix.org/header_checks.5.html>
|
|
# <https://stump.io/blog/2020/11/29/a-little-gotcha-with-postfixs-header_checks/>
|
|
disable_mime_input_processing = yes
|
|
|
|
mua_client_restrictions = permit_sasl_authenticated, reject
|
|
mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticated, reject
|
|
mua_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit
|
|
|
|
# 1:1 map MAIL FROM to SASL login name.
|
|
smtpd_sender_login_maps = regexp:/etc/postfix/login_map
|
|
|
|
# Do not lookup SMTP client hostnames to reduce delays
|
|
# and avoid unnecessary DNS requests.
|
|
smtpd_peername_lookup = no
|
|
|
|
# Use filtermail-transport to relay messages.
|
|
# We can't force postfix to split messages per destination,
|
|
# when specifying a custom next-hop,
|
|
# so instead this is handled in filtermail.
|
|
# We use LMTP instead SMTP so we can communicate per-recipient errors back to postfix.
|
|
default_transport = lmtp-filtermail:inet:[127.0.0.1]:{{ config.filtermail_lmtp_port_transport }}
|
|
|
|
# All deliveries over lmtp-filtermail are treated
|
|
# as having the same destination [127.0.0.1],
|
|
# so it is not possible to limit per-destination concurrency here,
|
|
# it is a job for filtermail-transport.
|
|
# Total number of parallel deliveries is limited
|
|
# by "maxproc" column in /etc/postfix/master.cf for lmtp-filtermail.
|
|
# Settings below are to prevent Postfix queue manager
|
|
# from limiting the number of LMTP connections to filtermail-transport.
|
|
# Read <https://www.postfix.org/TUNING_README.html#rope> and
|
|
# <https://www.postfix.org/SCHEDULER_README.html> for the details
|
|
# of the Postfix algorithm that we effectively disable here.
|
|
lmtp-filtermail_initial_destination_concurrency=10000
|
|
lmtp-filtermail_destination_concurrency_limit=10000
|
|
|
|
# Do not try to deliver messages for more than 2 days.
|
|
maximal_queue_lifetime = 2d
|
|
|
|
{% if not config.ipv4_relay %}
|
|
# DKIM-sign locally generated mail (bounces, DSNs).
|
|
# These bypass smtpd, so they need explicit milter configuration.
|
|
non_smtpd_milters = unix:opendkim/opendkim.sock
|
|
internal_mail_filter_classes = bounce
|
|
milter_macro_daemon_name = ORIGINATING
|
|
{% endif %}
|