Commit 8a365054 authored by Florian Pritz's avatar Florian Pritz
Browse files

postfix: merge main.cf from nymeria


Signed-off-by: Florian Pritz's avatarFlorian Pritz <bluewind@xinu.at>
parent 22f48217
......@@ -10,7 +10,7 @@
- { role: root_ssh, tags: ['root_ssh'] }
- { role: borg-client, backup_host: "borg@vostok.archlinux.org", backup_dir: "/backup/orion", postgres_backup_dir: None, tags: ['borg'] }
- { role: opendkim, dkim_selector: orion, tags: ['mail'] }
- { role: postfix, tags: ['mail'] }
- { role: postfix, postfix_server: false, tags: ['mail'] }
- { role: archusers, tags: ['archusers'] }
- { role: nginx, letsencrypt_validation_dir: "/var/lib/letsencrypt", tags: ["nginx"] }
- { role: dbscripts, repos_domain: "repos.archlinux.org", svntogit_repos: "/srv/svntogit/repos", tags: ['dbscripts', 'archusers'] }
......
patchwork@archlinux.org smtp:66.211.214.132
\ No newline at end of file
/X-Spam-Status: Yes,/ REJECT Your message has been rejected by Spamassassin
lists.archlinux.org mailman:
gmail.com smtp-ipv4:
......@@ -19,6 +19,28 @@
- name: update aliases db
command: postalias /etc/postfix/aliases
- name: install additional files
template: src=files/{{item}} dest=/etc/postfix/{{item}} owner=root group=root mode=644
with_items:
- access_client
- access_sender
- access_helo
- body_checks
- header_checks
- transport
- relocated
- compat_maps
- name: postmap additional files
command: postmap /etc/postfix/{{item}}
with_items:
- access_client
- access_sender
- access_helo
- transport
- relocated
- compat_maps
- name: create dhparam 2048
command: openssl dhparam -out /etc/postfix/dh2048.pem 2048 creates=/etc/postfix/dh2048.pem
notify:
......
......@@ -5,6 +5,11 @@ biff = no
append_dot_mydomain = no
{% if postfix_server %}
smtpd_tls_cert_file = /etc/letsencrypt/live/{{inventory_hostname}}/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/{{inventory_hostname}}/privkey.pem
{% endif %}
smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem
smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem
smtpd_tls_eecdh_grade = ultra
......@@ -28,17 +33,34 @@ smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtp_use_tls = yes
smtp_tls_CApath = /etc/ssl/certs
# TODO: daemon_directory should be the same as the default. drop it
daemon_directory = /usr/lib/postfix/bin
mydomain = {{inventory_hostname}}
myhostname = {{inventory_hostname}}
myorigin = archlinux.org
{% if postfix_server %}
mydestination = archlinux.org
{% else %}
mydestination =
{% endif %}
default_database_type=btree
indexed = ${default_database_type}:${config_directory}
alias_maps = ${indexed}/aliases
alias_database = ${indexed}/aliases
mynetworks =
127.0.0.1
[::ffff:127.0.0.0]/104
[::1]/128
mailbox_transport = lmtp:unix:private/dovecot-lmtp
lmtp_destination_recipient_limit=1
mailbox_size_limit = 0
message_size_limit = 104857600
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
# enable for testing new config
soft_bounce = no
......@@ -46,17 +68,127 @@ debug_peer_list =
smtp_connection_cache_on_demand = yes
message_size_limit = 104857600
inet_interfaces = all
inet_protocols = all
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
smtpd_milters=unix:/var/spool/opendkim/opendkim
non_smtpd_milters=unix:/var/spool/opendkim/opendkim
address_verify_map = ${default_database_type}:/var/lib/postfix/verify_cache
# custom restriction classes
policy_check =
# postfwd
{% if postfix_server %}
check_policy_service inet:127.0.0.1:10040
{% endif %}
submission_recipient_restrictions=
# allow postmaster
check_recipient_access btree:/etc/postfix/access_recipient,
permit_sasl_authenticated,
reject
strict_rfc821_envelopes = yes
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_recipient_restrictions =
# policy services
$policy_check,
# white-/blacklisting
check_recipient_access btree:/etc/postfix/access_recipient,
check_client_access btree:/etc/postfix/access_client,
check_helo_access btree:/etc/postfix/access_helo,
check_sender_access btree:/etc/postfix/access_sender,
# reject unclean mails
reject_unauth_pipelining,
reject_non_fqdn_recipient,
reject_non_fqdn_sender,
reject_unknown_recipient_domain,
reject_unknown_sender_domain,
# allow our users
reject_authenticated_sender_login_mismatch,
permit_sasl_authenticated,
permit_mynetworks,
# reject mailservers without proper rDNS and hostname->IP
#warn_if_reject reject_unknown_client_hostname,
# check RBLs
# check the HELO
#warn_if_reject reject_invalid_helo_hostname,
# reject relaying
reject_unauth_destination,
# cache if recipient exists
#reject_unverified_recipient,
#permit_mx_backup,
permit
# some rate limiting rules only work after data so check it again
smtpd_end_of_data_restrictions =
$policy_check
# needed to put our users on HOLD
post_queue_smtpd_recipient_restrictions =
check_sender_access btree:/etc/postfix/access_sender-post-filter,
permit_mynetworks,
reject
address_verify_map = ${default_database_type}:/var/lib/postfix/verify_cache
unverified_recipient_reject_code = 550
unknown_hostname_reject_code = 550
unknown_client_reject_code = 550
unknown_address_reject_code = 550
smtpd_reject_footer = For assistance contact <postmaster@archlinux.org>. Please provide the following information in your problem report: time ($localtime) and client ($client_address).
smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/run/dovecot/auth-client
smtpd_tls_received_header = yes
# needed for SA
smtpd_sasl_authenticated_header = yes
{% if postfix_server %}
smtpd_sender_login_maps =
btree:/etc/postfix/smtp_sender_map,
btree:/etc/postfix/users
{% endif %}
smtpd_helo_required = yes
smtpd_client_connection_rate_limit = 400
smtpd_client_message_rate_limit = 500
smtpd_client_recipient_rate_limit = 500
alias_maps =
btree:/etc/postfix/aliases
alias_database = $alias_maps
{% if postfix_server %}
virtual_alias_maps =
btree:/etc/postfix/users
btree:/etc/postfix/mailman_compat
virtual_alias_domains = btree:/etc/postfix/domains
{% endif %}
{% if postfix_server %}
# reject mails to system users (nobody looks in those mailboxes)
local_recipient_maps =
btree:/etc/postfix/users
$alias_maps
btree:/etc/postfix/mailman_compat
#btree:/etc/postfix/temporary_mailman_maps
btree:/etc/postfix/compat_maps
relocated_maps = btree:/etc/postfix/relocated
{% endif %}
transport_maps =
btree:/etc/postfix/transport
btree:/etc/postfix/compat_maps
#btree:/etc/postfix/temporary_mailman_maps
authorized_mailq_users = root
header_checks = pcre:/etc/postfix/header_checks
body_checks = pcre:/etc/postfix/body_checks
delay_warning_time = 4h
# vim: set ft=pfmain:
......@@ -9,7 +9,22 @@
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
{% if postfix_server %}
smtp inet n - n - - smtpd
-o smtpd_proxy_filter=[127.0.0.1]:10025
-o smtpd_client_connection_count_limit=20
-o smtpd_proxy_options=speed_adjust
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_recipient_restrictions=$submission_recipient_restrictions
-o content_filter=smtp:[127.0.0.1]:10025
-o smtpd_client_connection_count_limit=10
#-o smtpd_milters=unix:/var/spool/opendkim/opendkim
{% else %}
localhost:smtp inet n - n - - smtpd
{% endif %}
#smtp inet n - n - 1 postscreen
#smtpd pass - - n - - smtpd
#dnsblog unix - - n - 0 dnsblog
......@@ -62,69 +77,23 @@ virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
#maildrop unix - n n - - pipe
# flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
#
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
#uucp unix - n n - - pipe
# flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# ====================================================================
#
# Other external delivery methods.
#
#ifmail unix - n n - - pipe
# flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
#
#bsmtp unix - n n - - pipe
# flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
#
#scalemail-backend unix - n n - 2 pipe
# flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
# ${nexthop} ${user} ${extension}
#
#mailman unix - n n - - pipe
# flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
# ${nexthop} ${user}
{% if postfix_server %}
# After-filter SMTP server. Receive mail from the content filter
# on localhost port 10026.
#
127.0.0.1:10026 inet n - n - - smtpd
-o syslog_name=postfix/after-sa-smtp
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=$post_queue_smtpd_recipient_restrictions
-o smtpd_data_restrictions=
-o smtpd_end_of_data_restrictions=
-o mynetworks=127.0.0.0/8
-o receive_override_options=no_unknown_recipient_checks,no_milters
-o smtpd_tls_auth_only=no
-o smtpd_reject_footer=
-o smtpd_tls_security_level=none
{% endif %}
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment