Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in
Toggle navigation
Menu
Open sidebar
Arch Linux
infrastructure
Commits
8a365054
Commit
8a365054
authored
Jul 11, 2016
by
Florian Pritz
Browse files
postfix: merge main.cf from nymeria
Signed-off-by:
Florian Pritz
<
bluewind@xinu.at
>
parent
22f48217
Changes
12
Hide whitespace changes
Inline
Side-by-side
playbooks/orion.yml
View file @
8a365054
...
...
@@ -10,7 +10,7 @@
-
{
role
:
root_ssh
,
tags
:
[
'
root_ssh'
]
}
-
{
role
:
borg-client
,
backup_host
:
"
borg@vostok.archlinux.org"
,
backup_dir
:
"
/backup/orion"
,
postgres_backup_dir
:
None
,
tags
:
[
'
borg'
]
}
-
{
role
:
opendkim
,
dkim_selector
:
orion
,
tags
:
[
'
mail'
]
}
-
{
role
:
postfix
,
tags
:
[
'
mail'
]
}
-
{
role
:
postfix
,
postfix_server
:
false
,
tags
:
[
'
mail'
]
}
-
{
role
:
archusers
,
tags
:
[
'
archusers'
]
}
-
{
role
:
nginx
,
letsencrypt_validation_dir
:
"
/var/lib/letsencrypt"
,
tags
:
[
"
nginx"
]
}
-
{
role
:
dbscripts
,
repos_domain
:
"
repos.archlinux.org"
,
svntogit_repos
:
"
/srv/svntogit/repos"
,
tags
:
[
'
dbscripts'
,
'
archusers'
]
}
...
...
roles/postfix/files/access_client
0 → 100644
View file @
8a365054
roles/postfix/files/access_helo
0 → 100644
View file @
8a365054
roles/postfix/files/access_sender
0 → 100644
View file @
8a365054
roles/postfix/files/body_checks
0 → 100644
View file @
8a365054
roles/postfix/files/compat_maps
0 → 100644
View file @
8a365054
patchwork@archlinux.org smtp:66.211.214.132
\ No newline at end of file
roles/postfix/files/header_checks
0 → 100644
View file @
8a365054
/X-Spam-Status: Yes,/ REJECT Your message has been rejected by Spamassassin
roles/postfix/files/relocated
0 → 100644
View file @
8a365054
roles/postfix/files/transport
0 → 100644
View file @
8a365054
lists.archlinux.org mailman:
gmail.com smtp-ipv4:
roles/postfix/tasks/main.yml
View file @
8a365054
...
...
@@ -19,6 +19,28 @@
-
name
:
update aliases db
command
:
postalias /etc/postfix/aliases
-
name
:
install additional files
template
:
src=files/{{item}} dest=/etc/postfix/{{item}} owner=root group=root mode=644
with_items
:
-
access_client
-
access_sender
-
access_helo
-
body_checks
-
header_checks
-
transport
-
relocated
-
compat_maps
-
name
:
postmap additional files
command
:
postmap /etc/postfix/{{item}}
with_items
:
-
access_client
-
access_sender
-
access_helo
-
transport
-
relocated
-
compat_maps
-
name
:
create dhparam
2048
command
:
openssl dhparam -out /etc/postfix/dh2048.pem 2048 creates=/etc/postfix/dh2048.pem
notify
:
...
...
roles/postfix/templates/main.cf.j2
View file @
8a365054
...
...
@@ -5,6 +5,11 @@ biff = no
append_dot_mydomain = no
{% if postfix_server %}
smtpd_tls_cert_file = /etc/letsencrypt/live/{{inventory_hostname}}/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/{{inventory_hostname}}/privkey.pem
{% endif %}
smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem
smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem
smtpd_tls_eecdh_grade = ultra
...
...
@@ -28,17 +33,34 @@ smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtp_use_tls = yes
smtp_tls_CApath = /etc/ssl/certs
# TODO: daemon_directory should be the same as the default. drop it
daemon_directory = /usr/lib/postfix/bin
mydomain = {{inventory_hostname}}
myhostname = {{inventory_hostname}}
myorigin = archlinux.org
{% if postfix_server %}
mydestination = archlinux.org
{% else %}
mydestination =
{% endif %}
default_database_type=btree
indexed = ${default_database_type}:${config_directory}
alias_maps = ${indexed}/aliases
alias_database = ${indexed}/aliases
mynetworks =
127.0.0.1
[::ffff:127.0.0.0]/104
[::1]/128
mailbox_transport = lmtp:unix:private/dovecot-lmtp
lmtp_destination_recipient_limit=1
mailbox_size_limit = 0
message_size_limit = 104857600
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
# enable for testing new config
soft_bounce = no
...
...
@@ -46,17 +68,127 @@ debug_peer_list =
smtp_connection_cache_on_demand = yes
message_size_limit = 104857600
inet_interfaces = all
inet_protocols = all
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
smtpd_milters=unix:/var/spool/opendkim/opendkim
non_smtpd_milters=unix:/var/spool/opendkim/opendkim
address_verify_map = ${default_database_type}:/var/lib/postfix/verify_cache
# custom restriction classes
policy_check =
# postfwd
{% if postfix_server %}
check_policy_service inet:127.0.0.1:10040
{% endif %}
submission_recipient_restrictions=
# allow postmaster
check_recipient_access btree:/etc/postfix/access_recipient,
permit_sasl_authenticated,
reject
strict_rfc821_envelopes = yes
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_recipient_restrictions =
# policy services
$policy_check,
# white-/blacklisting
check_recipient_access btree:/etc/postfix/access_recipient,
check_client_access btree:/etc/postfix/access_client,
check_helo_access btree:/etc/postfix/access_helo,
check_sender_access btree:/etc/postfix/access_sender,
# reject unclean mails
reject_unauth_pipelining,
reject_non_fqdn_recipient,
reject_non_fqdn_sender,
reject_unknown_recipient_domain,
reject_unknown_sender_domain,
# allow our users
reject_authenticated_sender_login_mismatch,
permit_sasl_authenticated,
permit_mynetworks,
# reject mailservers without proper rDNS and hostname->IP
#warn_if_reject reject_unknown_client_hostname,
# check RBLs
# check the HELO
#warn_if_reject reject_invalid_helo_hostname,
# reject relaying
reject_unauth_destination,
# cache if recipient exists
#reject_unverified_recipient,
#permit_mx_backup,
permit
# some rate limiting rules only work after data so check it again
smtpd_end_of_data_restrictions =
$policy_check
# needed to put our users on HOLD
post_queue_smtpd_recipient_restrictions =
check_sender_access btree:/etc/postfix/access_sender-post-filter,
permit_mynetworks,
reject
address_verify_map = ${default_database_type}:/var/lib/postfix/verify_cache
unverified_recipient_reject_code = 550
unknown_hostname_reject_code = 550
unknown_client_reject_code = 550
unknown_address_reject_code = 550
smtpd_reject_footer = For assistance contact <postmaster@archlinux.org>. Please provide the following information in your problem report: time ($localtime) and client ($client_address).
smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/run/dovecot/auth-client
smtpd_tls_received_header = yes
# needed for SA
smtpd_sasl_authenticated_header = yes
{% if postfix_server %}
smtpd_sender_login_maps =
btree:/etc/postfix/smtp_sender_map,
btree:/etc/postfix/users
{% endif %}
smtpd_helo_required = yes
smtpd_client_connection_rate_limit = 400
smtpd_client_message_rate_limit = 500
smtpd_client_recipient_rate_limit = 500
alias_maps =
btree:/etc/postfix/aliases
alias_database = $alias_maps
{% if postfix_server %}
virtual_alias_maps =
btree:/etc/postfix/users
btree:/etc/postfix/mailman_compat
virtual_alias_domains = btree:/etc/postfix/domains
{% endif %}
{% if postfix_server %}
# reject mails to system users (nobody looks in those mailboxes)
local_recipient_maps =
btree:/etc/postfix/users
$alias_maps
btree:/etc/postfix/mailman_compat
#btree:/etc/postfix/temporary_mailman_maps
btree:/etc/postfix/compat_maps
relocated_maps = btree:/etc/postfix/relocated
{% endif %}
transport_maps =
btree:/etc/postfix/transport
btree:/etc/postfix/compat_maps
#btree:/etc/postfix/temporary_mailman_maps
authorized_mailq_users = root
header_checks = pcre:/etc/postfix/header_checks
body_checks = pcre:/etc/postfix/body_checks
delay_warning_time = 4h
# vim: set ft=pfmain:
roles/postfix/templates/master.cf.j2
View file @
8a365054
...
...
@@ -9,7 +9,22 @@
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
{% if postfix_server %}
smtp inet n - n - - smtpd
-o smtpd_proxy_filter=[127.0.0.1]:10025
-o smtpd_client_connection_count_limit=20
-o smtpd_proxy_options=speed_adjust
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_recipient_restrictions=$submission_recipient_restrictions
-o content_filter=smtp:[127.0.0.1]:10025
-o smtpd_client_connection_count_limit=10
#-o smtpd_milters=unix:/var/spool/opendkim/opendkim
{% else %}
localhost:smtp inet n - n - - smtpd
{% endif %}
#smtp inet n - n - 1 postscreen
#smtpd pass - - n - - smtpd
#dnsblog unix - - n - 0 dnsblog
...
...
@@ -62,69 +77,23 @@ virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
#maildrop unix - n n - - pipe
# flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
#
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
#uucp unix - n n - - pipe
# flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# ====================================================================
#
# Other external delivery methods.
#
#ifmail unix - n n - - pipe
# flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
#
#bsmtp unix - n n - - pipe
# flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
#
#scalemail-backend unix - n n - 2 pipe
# flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
# ${nexthop} ${user} ${extension}
#
#mailman unix - n n - - pipe
# flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
# ${nexthop} ${user}
{% if postfix_server %}
# After-filter SMTP server. Receive mail from the content filter
# on localhost port 10026.
#
127.0.0.1:10026 inet n - n - - smtpd
-o syslog_name=postfix/after-sa-smtp
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=$post_queue_smtpd_recipient_restrictions
-o smtpd_data_restrictions=
-o smtpd_end_of_data_restrictions=
-o mynetworks=127.0.0.0/8
-o receive_override_options=no_unknown_recipient_checks,no_milters
-o smtpd_tls_auth_only=no
-o smtpd_reject_footer=
-o smtpd_tls_security_level=none
{% endif %}
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment