CroneKorkN
f0b28126d1
postfix recreates the hash subdirectories of deferred and defer with mode 0700, whose mask cancels the inherited telegraf acl, so inputs.postfix failed with permission denied. Also drop the deprecated smtpd_use_tls; smtpd_tls_security_level = may already covers it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RywMtsL8qXG7GDY3MHq9Uh
60 lines
2.4 KiB
CFEngine3
60 lines
2.4 KiB
CFEngine3
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
|
|
biff = no
|
|
append_dot_mydomain = no
|
|
readme_directory = no
|
|
compatibility_level = 2
|
|
smtpd_tls_session_cache_database = <%text>btree:${data_directory}/smtpd_scache</%text>
|
|
smtp_tls_session_cache_database = <%text>btree:${data_directory}/smtp_scache</%text>
|
|
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
|
|
myhostname = ${hostname}
|
|
alias_maps = hash:/etc/aliases
|
|
alias_database = hash:/etc/aliases
|
|
myorigin = /etc/mailname
|
|
mydestination = $myhostname, localhost.localdomain, localhost
|
|
relayhost =
|
|
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
|
|
mailbox_size_limit = 0
|
|
recipient_delimiter = +
|
|
inet_interfaces = all
|
|
inet_protocols = all
|
|
message_size_limit = ${10**8}
|
|
# no hash subdirectories: postfix creates them with mode 0700, which masks the telegraf acl
|
|
hash_queue_names =
|
|
|
|
virtual_mailbox_domains = pgsql:/etc/postfix/virtual_mailbox_domains.cf
|
|
virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf
|
|
virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf,pgsql:/etc/postfix/virtual_mailbox_maps.cf
|
|
smtpd_sender_login_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
|
|
virtual_transport = lmtp:unix:private/dovecot-lmtp
|
|
|
|
smtpd_sasl_type = dovecot
|
|
smtpd_sasl_path = private/auth
|
|
smtpd_sasl_auth_enable = yes
|
|
|
|
smtpd_tls_security_level = may
|
|
smtpd_tls_auth_only = yes
|
|
smtpd_tls_cert_file = /var/lib/dehydrated/certs/${hostname}/fullchain.pem
|
|
smtpd_tls_key_file = /var/lib/dehydrated/certs/${hostname}/privkey.pem
|
|
smtp_tls_security_level = may
|
|
% if debug:
|
|
smtpd_tls_loglevel = 3
|
|
% endif
|
|
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
|
|
smtpd_restriction_classes = mua_sender_restrictions, mua_client_restrictions, mua_helo_restrictions
|
|
mua_client_restrictions = permit_sasl_authenticated, reject
|
|
mua_sender_restrictions = permit_sasl_authenticated, reject
|
|
## MS Outlook, incompatible with reject_non_fqdn_hostname and/or reject_invalid_hostname
|
|
## https://unix.stackexchange.com/a/91753/357916
|
|
mua_helo_restrictions = permit_mynetworks, permit
|
|
|
|
smtpd_milters = inet:localhost:8891 inet:127.0.0.1:11332
|
|
non_smtpd_milters = inet:localhost:8891 inet:127.0.0.1:11332
|
|
|
|
# opendkim
|
|
milter_protocol = 6
|
|
milter_default_action = accept
|
|
|
|
# rspamd
|
|
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
|