postfix: merge main.cf from nymeria

Signed-off-by: Florian Pritz <bluewind@xinu.at>

playbooks/orion.yml

@@ -10,7 +10,7 @@
     - { role: root_ssh, tags: ['root_ssh'] }
     - { role: borg-client, backup_host: "borg@vostok.archlinux.org", backup_dir: "/backup/orion", postgres_backup_dir: None, tags: ['borg'] }
     - { role: opendkim, dkim_selector: orion, tags: ['mail'] }
-    - { role: postfix, tags: ['mail'] }
+    - { role: postfix, postfix_server: false, tags: ['mail'] }
     - { role: archusers, tags: ['archusers'] }
     - { role: nginx, letsencrypt_validation_dir: "/var/lib/letsencrypt", tags: ["nginx"] }
     - { role: dbscripts, repos_domain: "repos.archlinux.org", svntogit_repos: "/srv/svntogit/repos", tags: ['dbscripts', 'archusers'] }

roles/postfix/files/compat_maps

+patchwork@archlinux.org smtp:66.211.214.132
\ No newline at end of file

roles/postfix/files/header_checks

+/X-Spam-Status: Yes,/ REJECT Your message has been rejected by Spamassassin

roles/postfix/files/transport

+lists.archlinux.org mailman:
+gmail.com smtp-ipv4:

roles/postfix/tasks/main.yml

@@ -19,6 +19,28 @@
 - name: update aliases db
   command: postalias /etc/postfix/aliases
 
+- name: install additional files
+  template: src=files/{{item}} dest=/etc/postfix/{{item}} owner=root group=root mode=644
+  with_items:
+    - access_client
+    - access_sender
+    - access_helo
+    - body_checks
+    - header_checks
+    - transport
+    - relocated
+    - compat_maps
+
+- name: postmap additional files
+  command: postmap /etc/postfix/{{item}}
+  with_items:
+    - access_client
+    - access_sender
+    - access_helo
+    - transport
+    - relocated
+    - compat_maps
+
 - name: create dhparam 2048
   command: openssl dhparam -out /etc/postfix/dh2048.pem 2048 creates=/etc/postfix/dh2048.pem
   notify:

roles/postfix/templates/main.cf.j2

@@ -5,6 +5,11 @@ biff = no
 
 append_dot_mydomain = no
 
+{% if postfix_server %}
+smtpd_tls_cert_file = /etc/letsencrypt/live/{{inventory_hostname}}/fullchain.pem
+smtpd_tls_key_file = /etc/letsencrypt/live/{{inventory_hostname}}/privkey.pem
+{% endif %}
+
 smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem
 smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem
 smtpd_tls_eecdh_grade = ultra
@@ -28,17 +33,34 @@ smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
 
 smtp_use_tls = yes
 smtp_tls_CApath = /etc/ssl/certs
+
+# TODO: daemon_directory should be the same as the default. drop it
 daemon_directory = /usr/lib/postfix/bin
 mydomain = {{inventory_hostname}}
 myhostname = {{inventory_hostname}}
 myorigin = archlinux.org
+{% if postfix_server %}
+mydestination = archlinux.org
+{% else %}
 mydestination =
+{% endif %}
 
 default_database_type=btree
 indexed = ${default_database_type}:${config_directory}
 
-alias_maps = ${indexed}/aliases
-alias_database = ${indexed}/aliases
+mynetworks =
+  127.0.0.1
+  [::ffff:127.0.0.0]/104
+  [::1]/128
+mailbox_transport = lmtp:unix:private/dovecot-lmtp
+lmtp_destination_recipient_limit=1
+mailbox_size_limit = 0
+message_size_limit = 104857600
+recipient_delimiter = +
+inet_interfaces = all
+inet_protocols = all
+disable_vrfy_command = yes
+strict_rfc821_envelopes = yes
 
 # enable for testing new config
 soft_bounce = no
@@ -46,17 +68,127 @@ debug_peer_list =
 
 smtp_connection_cache_on_demand = yes
 
-message_size_limit = 104857600
-inet_interfaces = all
-inet_protocols = all
-disable_vrfy_command = yes
-strict_rfc821_envelopes = yes
-
 smtpd_milters=unix:/var/spool/opendkim/opendkim
 non_smtpd_milters=unix:/var/spool/opendkim/opendkim
 
-address_verify_map = ${default_database_type}:/var/lib/postfix/verify_cache
+# custom restriction classes
+policy_check =
+# postfwd
+{% if postfix_server %}
+  check_policy_service inet:127.0.0.1:10040
+{% endif %}
+
+submission_recipient_restrictions=
+# allow postmaster
+  check_recipient_access btree:/etc/postfix/access_recipient,
+  permit_sasl_authenticated,
+  reject
 
-strict_rfc821_envelopes = yes
 smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
 
+smtpd_recipient_restrictions =
+# policy services
+  $policy_check,
+# white-/blacklisting
+  check_recipient_access btree:/etc/postfix/access_recipient,
+  check_client_access btree:/etc/postfix/access_client,
+  check_helo_access btree:/etc/postfix/access_helo,
+  check_sender_access btree:/etc/postfix/access_sender,
+# reject unclean mails
+  reject_unauth_pipelining,
+  reject_non_fqdn_recipient,
+  reject_non_fqdn_sender,
+  reject_unknown_recipient_domain,
+  reject_unknown_sender_domain,
+# allow our users
+  reject_authenticated_sender_login_mismatch,
+  permit_sasl_authenticated,
+  permit_mynetworks,
+# reject mailservers without proper rDNS and hostname->IP
+  #warn_if_reject reject_unknown_client_hostname,
+# check RBLs
+# check the HELO
+  #warn_if_reject reject_invalid_helo_hostname,
+# reject relaying
+  reject_unauth_destination,
+# cache if recipient exists
+  #reject_unverified_recipient,
+  #permit_mx_backup,
+  permit
+
+# some rate limiting rules only work after data so check it again
+smtpd_end_of_data_restrictions =
+  $policy_check
+
+# needed to put our users on HOLD
+post_queue_smtpd_recipient_restrictions =
+  check_sender_access btree:/etc/postfix/access_sender-post-filter,
+  permit_mynetworks,
+  reject
+
+address_verify_map = ${default_database_type}:/var/lib/postfix/verify_cache
+
+unverified_recipient_reject_code = 550
+unknown_hostname_reject_code = 550
+unknown_client_reject_code = 550
+unknown_address_reject_code = 550
+
+smtpd_reject_footer = For assistance contact <postmaster@archlinux.org>. Please provide the following information in your problem report: time ($localtime) and client ($client_address).
+
+smtpd_sasl_auth_enable = yes
+smtpd_tls_auth_only = yes
+
+smtpd_sasl_security_options = noanonymous
+broken_sasl_auth_clients = yes
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = /var/run/dovecot/auth-client
+smtpd_tls_received_header = yes
+# needed for SA
+smtpd_sasl_authenticated_header = yes
+
+{% if postfix_server %}
+smtpd_sender_login_maps =
+  btree:/etc/postfix/smtp_sender_map,
+  btree:/etc/postfix/users
+{% endif %}
+smtpd_helo_required = yes
+
+smtpd_client_connection_rate_limit = 400
+smtpd_client_message_rate_limit = 500
+smtpd_client_recipient_rate_limit = 500
+
+alias_maps =
+  btree:/etc/postfix/aliases
+alias_database = $alias_maps
+
+{% if postfix_server %}
+virtual_alias_maps =
+  btree:/etc/postfix/users
+  btree:/etc/postfix/mailman_compat
+virtual_alias_domains =  btree:/etc/postfix/domains
+{% endif %}
+
+{% if postfix_server %}
+# reject mails to system users (nobody looks in those mailboxes)
+local_recipient_maps =
+  btree:/etc/postfix/users
+  $alias_maps
+  btree:/etc/postfix/mailman_compat
+  #btree:/etc/postfix/temporary_mailman_maps
+  btree:/etc/postfix/compat_maps
+relocated_maps = btree:/etc/postfix/relocated
+{% endif %}
+
+transport_maps =
+  btree:/etc/postfix/transport
+  btree:/etc/postfix/compat_maps
+  #btree:/etc/postfix/temporary_mailman_maps
+
+authorized_mailq_users = root
+
+header_checks = pcre:/etc/postfix/header_checks
+body_checks = pcre:/etc/postfix/body_checks
+
+delay_warning_time = 4h
+
+# vim: set ft=pfmain:

roles/postfix/templates/master.cf.j2

@@ -9,7 +9,22 @@
 # service type  private unpriv  chroot  wakeup  maxproc command + args
 #               (yes)   (yes)   (no)    (never) (100)
 # ==========================================================================
+{% if postfix_server %}
+smtp      inet  n       -       n       -       -       smtpd
+    -o smtpd_proxy_filter=[127.0.0.1]:10025
+    -o smtpd_client_connection_count_limit=20
+    -o smtpd_proxy_options=speed_adjust
+submission inet n       -       n       -       -       smtpd
+    -o syslog_name=postfix/submission
+    -o smtpd_tls_security_level=encrypt
+    -o smtpd_sasl_auth_enable=yes
+    -o smtpd_recipient_restrictions=$submission_recipient_restrictions
+    -o content_filter=smtp:[127.0.0.1]:10025
+    -o smtpd_client_connection_count_limit=10
+    #-o smtpd_milters=unix:/var/spool/opendkim/opendkim
+{% else %}
 localhost:smtp      inet  n       -       n       -       -       smtpd
+{% endif %}
 #smtp      inet  n       -       n       -       1       postscreen
 #smtpd     pass  -       -       n       -       -       smtpd
 #dnsblog   unix  -       -       n       -       0       dnsblog
@@ -62,69 +77,23 @@ virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       n       -       -       lmtp
 anvil     unix  -       -       n       -       1       anvil
 scache    unix  -       -       n       -       1       scache
-#
-# ====================================================================
-# Interfaces to non-Postfix software. Be sure to examine the manual
-# pages of the non-Postfix software to find out what options it wants.
-#
-# Many of the following services use the Postfix pipe(8) delivery
-# agent.  See the pipe(8) man page for information about ${recipient}
-# and other message envelope options.
-# ====================================================================
-#
-# maildrop. See the Postfix MAILDROP_README file for details.
-# Also specify in main.cf: maildrop_destination_recipient_limit=1
-#
-#maildrop  unix  -       n       n       -       -       pipe
-#  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
-#
-# ====================================================================
-#
-# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
-#
-# Specify in cyrus.conf:
-#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
-#
-# Specify in main.cf one or more of the following:
-#  mailbox_transport = lmtp:inet:localhost
-#  virtual_transport = lmtp:inet:localhost
-#
-# ====================================================================
-#
-# Cyrus 2.1.5 (Amos Gouaux)
-# Also specify in main.cf: cyrus_destination_recipient_limit=1
-#
-#cyrus     unix  -       n       n       -       -       pipe
-#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
-#
-# ====================================================================
-#
-# Old example of delivery via Cyrus.
-#
-#old-cyrus unix  -       n       n       -       -       pipe
-#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
-#
-# ====================================================================
-#
-# See the Postfix UUCP_README file for configuration details.
-#
-#uucp      unix  -       n       n       -       -       pipe
-#  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
-#
-# ====================================================================
-#
-# Other external delivery methods.
-#
-#ifmail    unix  -       n       n       -       -       pipe
-#  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
-#
-#bsmtp     unix  -       n       n       -       -       pipe
-#  flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
-#
-#scalemail-backend unix -       n       n       -       2       pipe
-#  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
-#  ${nexthop} ${user} ${extension}
-#
-#mailman   unix  -       n       n       -       -       pipe
-#  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
-#  ${nexthop} ${user}
+
+{% if postfix_server %}
+# After-filter SMTP server. Receive mail from the content filter
+# on localhost port 10026.
+#
+127.0.0.1:10026 inet n  -       n       -        -      smtpd
+        -o syslog_name=postfix/after-sa-smtp
+        -o smtpd_authorized_xforward_hosts=127.0.0.0/8
+        -o smtpd_client_restrictions=
+        -o smtpd_helo_restrictions=
+        -o smtpd_sender_restrictions=
+        -o smtpd_recipient_restrictions=$post_queue_smtpd_recipient_restrictions
+        -o smtpd_data_restrictions=
+        -o smtpd_end_of_data_restrictions=
+        -o mynetworks=127.0.0.0/8
+        -o receive_override_options=no_unknown_recipient_checks,no_milters
+        -o smtpd_tls_auth_only=no
+        -o smtpd_reject_footer=
+        -o smtpd_tls_security_level=none
+{% endif %}