Modernize mail server setup
Plan (not in any particular order):
- Remove Postgrey (!43 (merged))
- Switch to Rspamd (!42)
- Use Rspamd DKIM signing moldule for signing instead of OpenDKIM
- Dovecot: Switch passdb from pam to passwd-file
- Pull users from Keycloak (somehow)
- Setup MTA-STS in testing mode and SMTP TLS Reporting (RFC 8460)
- Switch SPF to softfail and DMARC to reject
- Setup SPF for HELO name (RFC 7208 section 10.1.3)
- Setup ARC
- Switch submission port to 465 (RFC 8314)
- Cleanup Postfix and Dovecot config if possible
Original description:
Our mail server isn't ansibled and it's fairly opaque how everything is setup. Ansible the whole thing, put it on a separate box and modernize it in the process.
Some guides to follow along with a similar stack: https://prefetch.eu/blog/2020/email-server/ and https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/
There's also this: https://wiki.dovecot.org/PasswordDatabase/oauth2
@foxboron mentioned that perhaps OpenSMTPD is inadvisable due to its fairly bad security track record.
To upload designs, you'll need to enable LFS. More information