mirror of
https://github.com/chatmail/relay.git
synced 2026-05-10 16:04:37 +00:00
cf96be2cbb
feat: support self-signed TLS via underscore domain convention Domains starting with "_" (e.g. _chat.example.org) automatically use self-signed TLS certificates instead of ACME/Let's Encrypt. The TLS mode is derived from the domain name — no separate config option needed. Internally, when config.tls_cert_mode is "self" (underscore domain): - Generate self-signed certificates via openssl - Set Postfix smtp_tls_security_level to "encrypt" (opportunistic TLS) - Add smtp_tls_policy_map entry for underscore domains - Skip ACME, MTA-STS and www CNAME checks in `cmdeploy dns` - Serve /new via GET (not redirect to dcaccount:) with rate-limiting (nginx limit_req, 2r/s burst=5) - Return dclogin: URLs with ic=3 (AcceptInvalidCertificates) from /new - Render QR codes client-side via JavaScript and qrcode-svg - Use config.tls_cert_path/tls_key_path in Postfix, Dovecot and nginx templates instead of hardcoded ACME paths
33 lines
1.2 KiB
Django/Jinja
33 lines
1.2 KiB
Django/Jinja
;
|
|
; Required DNS entries for chatmail servers
|
|
;
|
|
{% if A %}
|
|
{{ mail_domain }}. A {{ A }}
|
|
{% endif %}
|
|
{% if AAAA %}
|
|
{{ mail_domain }}. AAAA {{ AAAA }}
|
|
{% endif %}
|
|
{{ mail_domain }}. MX 10 {{ mail_domain }}.
|
|
{% if strict_tls %}
|
|
_mta-sts.{{ mail_domain }}. TXT "v=STSv1; id={{ sts_id }}"
|
|
mta-sts.{{ mail_domain }}. CNAME {{ mail_domain }}.
|
|
{% endif %}
|
|
www.{{ mail_domain }}. CNAME {{ mail_domain }}.
|
|
{{ dkim_entry }}
|
|
|
|
;
|
|
; Recommended DNS entries for interoperability and security-hardening
|
|
;
|
|
{{ mail_domain }}. TXT "v=spf1 a ~all"
|
|
_dmarc.{{ mail_domain }}. TXT "v=DMARC1;p=reject;adkim=s;aspf=s"
|
|
|
|
{% if acme_account_url %}
|
|
{{ mail_domain }}. CAA 0 issue "letsencrypt.org;accounturi={{ acme_account_url }}"
|
|
{% endif %}
|
|
_adsp._domainkey.{{ mail_domain }}. TXT "dkim=discardable"
|
|
|
|
_submission._tcp.{{ mail_domain }}. SRV 0 1 587 {{ mail_domain }}.
|
|
_submissions._tcp.{{ mail_domain }}. SRV 0 1 465 {{ mail_domain }}.
|
|
_imap._tcp.{{ mail_domain }}. SRV 0 1 143 {{ mail_domain }}.
|
|
_imaps._tcp.{{ mail_domain }}. SRV 0 1 993 {{ mail_domain }}.
|