docker-mailserver ๊ตฌ์ถ•: PostfixยทDovecot ๋ฐ DKIM

๐Ÿ’ก ํ•ต์‹ฌ ์š”์•ฝ (Executive Summary)

๋ณธ ๊ฐ€์ด๋“œ๋Š” docker mailserver ํ•ต์‹ฌ ๊ฐ€์ด๋“œ ๋ฐ ์‹ค์ „ ์•„ํ‚คํ…์ฒ˜์˜ ํ•ต์‹ฌ ๊ฐœ๋…, ์‹ค์ „ ๊ตฌ์„ฑ ๋ช…๋ น์–ด ๋ฐ ์•„ํ‚คํ…์ฒ˜ ๋ฒ ์ŠคํŠธ ํ”„๋ž™ํ‹ฐ์Šค๋ฅผ ๋‹ค๋ฃน๋‹ˆ๋‹ค. ํด๋ผ์šฐ๋“œ ๋„ค์ดํ‹ฐ๋ธŒ ๋ฐ ์ธํ”„๋ผ ์—”์ง€๋‹ˆ์–ด๋ง ์‹ค๋ฌด์— ์ฆ‰์‹œ ํ™œ์šฉ ๊ฐ€๋Šฅํ•˜๋„๋ก ์ฒด๊ณ„์ ์œผ๋กœ ์ •๋ฆฌํ–ˆ์Šต๋‹ˆ๋‹ค.

๐Ÿ“‘ Table of Contents

Docker
Generate cf
bash
docker run --rm \
-e [email protected] \
-e MAIL_PASS=$pw \
-ti tvial/docker-mailserver:latest \
/bin/sh -c 'echo "$MAIL_USER|$(doveadm pw -s SHA512-CRYPT -u $MAIL_USER -p $MAIL_PASS)"' \
>> postfix-accounts.cf
K8s
helm install
bash
helm repo add docker-mailserver https://docker-mailserver.github.io/docker-mailserver-helm/
helm pull docker-mailserver/docker-mailserver --untar

# setting values.yaml
## tls setting (recomended cert-manager)
--set certificate = $TLS_SECRET
--set deployment.env.OVERRIDE_HOSTNAME = $MAIL_ADDRESS_HOST
--set deployment.env.TZ = "Asia/Seoul"
--set service.type = "NodePort"
--set service.nodePort.smtp = ""
--set persistence.mail-config.storageClass = $sc
--set persistence.mail-data.storageClass = $sc
--set persistence.mail-state.storageClass = $sc
--set persistence.mail-log.storageClass = $sc

# ์ตœ์ดˆ ๊ณ„์ •์ƒ์„ฑ ํ•„์ˆ˜
์šด์˜ Pod ์ ‘๊ทผํ•˜์—ฌ ๊ณ„์ • ๋“ฑ๋ก
bash
k exec -it -n $ns deployments/docker-mailserver -- bash
  setup email add $user@$OVERRIDE_HOSTNAME $pw
  cat /tmp/docker-mailserver/postfix-accounts.cf
๋‚ด๋ถ€ setup.sh (/usr/local/bin/setup)
yaml
#email ์ถ”๊ฐ€
setup email add $user@$OVERRIDE_HOSTNAME $pw
#dkim
setup config dkim
Exporter (failed)
bash
--set metrics.enabled = true
--set metrics.serviceMonitor.enabled = true
--set metrics.serviceMonitor.labels.release = $releaseLabel

# Image: blackflysolutions/postfix-exporter@sha256:7ed7c0534112aff5b44757ae84a206bf659171631edfc325c3c1638d78e74f73
# in container logic
/bin/postfix_exporter \
--postfix.showq_path /var/mail-state/spool-postfix/public/showq \
--postfix.logfile_path /var/log/mail/mail.log
>>>
2024/05/10 03:33:29 Reading log events from /var/log/mail/mail.log
2024/05/10 03:33:29 Listening on :9154
2024/05/10 03:33:29 FATAL -- failed to create Watcher
goroutine 34 [running]:
runtime/debug.Stack(0xc000418000, 0x21, 0x0)
        /usr/local/go/src/runtime/debug/stack.go:24 +0x9f
github.com/nxadm/tail/util.Fatal(0x9555f8, 0x18, 0x0, 0x0, 0x0)
        /go/pkg/mod/github.com/nxadm/[email protected]/util/util.go:23 +0xc7
github.com/nxadm/tail/watch.(*InotifyTracker).run(0xc000412000)
        /go/pkg/mod/github.com/nxadm/[email protected]/watch/inotify_tracker.go:220 +0x445
created by github.com/nxadm/tail/watch.glob..func1
        /go/pkg/mod/github.com/nxadm/[email protected]/watch/inotify_tracker.go:55 +0x12f
<<<
Service Port
yaml
## Send Mail: smtp
  - name: smtp
    nodePort: 30025
    port: 25
    protocol: TCP
    targetPort: smtp

## Send Mail: smtp (SSL)
  - name: submissions
    nodePort: 30465
    port: 465
    protocol: TCP
    targetPort: submissions

## Send Mail: smtp (STARTTLS)
  - name: submission 
    nodePort: 30587
    port: 587
    protocol: TCP
    targetPort: submission

## SMTP SSL ์—ฐ๊ฒฐ์— ๋Œ€ํ•œ ํ”„๋ก์‹œ ์„œ๋ฒ„
  - name: subs-proxy
    nodePort: 30444
    port: 10465
    protocol: TCP
    targetPort: subs-proxy

## SMTP STARTTLS ์—ฐ๊ฒฐ์— ๋Œ€ํ•œ ํ”„๋ก์‹œ ์„œ๋ฒ„
  - name: sub-proxy
    nodePort: 32074
    port: 10587
    protocol: TCP
    targetPort: sub-proxy

## Receive: imap ํด๋ผ์ด์–ธํŠธ ์ˆ˜์‹ ํฌํŠธ
  - name: imap
    nodePort: 30143
    port: 143
    protocol: TCP
    targetPort: imap

## Receive: imap ํด๋ผ์ด์–ธํŠธ SSL ์ˆ˜์‹ ํฌํŠธ (IMAPS)
  - name: imaps
    nodePort: 30993
    port: 993
    protocol: TCP
    targetPort: imaps

## Receive: imap ํด๋ผ์ด์–ธํŠธ ์ˆ˜์‹  ํ”„๋ก์‹œ ์„œ๋ฒ„
  - name: imap-proxy
    nodePort: 30845
    port: 10143
    protocol: TCP
    targetPort: imap-proxy

## Receive: imap ํด๋ผ์ด์–ธํŠธ SSL ์ˆ˜์‹  ํ”„๋ก์‹œ ์„œ๋ฒ„ (IMAPS)
  - name: imaps-proxy
    nodePort: 32648
    port: 10993
    protocol: TCP
    targetPort: imaps-proxy

## Rspamd: ์ด๋ฉ”์ผ ์ŠคํŒธ ๋ฐ ๋ฐ”์ด๋Ÿฌ์Šค๋ฅผ ํ•„ํ„ฐ๋งํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋  ์ˆ˜ ์žˆ๋Š” ์ŠคํŒธ ํ•„ํ„ฐ๋ง ๋ฐ ์ด๋ฉ”์ผ ๋ถ„์„ ๋„๊ตฌ
  - name: rspamd
    nodePort: 30884
    port: 11334
    protocol: TCP
    targetPort: rspamd
Additional Service
yaml
# SRS (Sender Rewriting Scheme)
# Description: ์ด ์„œ๋น„์Šค๋Š” ๋ณด๋‚ธ ์ด๋ฉ”์ผ ์ฃผ์†Œ๋ฅผ ์žฌ์ž‘์„ฑํ•˜์—ฌ ์ด๋ฉ”์ผ์„ ๋‹ค์‹œ ์ „๋‹ฌํ•  ๋•Œ ๋„๋ฉ”์ธ ์ธ์ฆ ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜๊ธฐ ์œ„ํ•ด ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. SRS๋Š” SPF (Sender Policy Framework)์™€ ๊ด€๋ จ๋œ ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜๋Š” ๋ฐ ๋„์›€์ด ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_SRS = 0

# OPENDKIM (Open DomainKeys Identified Mail)
# Description: ์ด ์„œ๋น„์Šค๋Š” ์ด๋ฉ”์ผ ์„œ๋ฒ„์—์„œ ๋‚˜๊ฐ€๋Š” ์ด๋ฉ”์ผ์— ๋””์ง€ํ„ธ ์„œ๋ช…์„ ์ถ”๊ฐ€ํ•˜์—ฌ ์ด๋ฉ”์ผ์˜ ์‹ ๋ขฐ์„ฑ์„ ๋†’์ด๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. ์ด๋ฅผ ํ†ตํ•ด ์ด๋ฉ”์ผ ์ˆ˜์‹ ์ž๋Š” ์ด๋ฉ”์ผ์ด ์‹ค์ œ๋กœ ๋ณด๋‚ธ ์‚ฌ๋žŒ์—์„œ ์™”๋Š”์ง€ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.
deployment.env.ENABLE_OPENDKIM = 0

# OPENDMARC (OpenDMARC)
# Description: ์ด ์„œ๋น„์Šค๋Š” ์ด๋ฉ”์ผ ์ˆ˜์‹  ํ”„๋กœ์„ธ์Šค์—์„œ DMARC (Domain-based Message Authentication, Reporting, and Conformance) ์ •์ฑ…์„ ์ ์šฉํ•˜์—ฌ ์ด๋ฉ”์ผ ๋„๋ฉ”์ธ์˜ ์œ„์กฐ๋ฅผ ๋ฐฉ์ง€ํ•˜๊ณ  ์ด๋ฉ”์ผ ์ŠคํŒธ์„ ์ฐจ๋‹จํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_OPENDMARC = 0

# POLICYD_SPF (Policyd SPF)
# Description: ์ด ์„œ๋น„์Šค๋Š” SPF (Sender Policy Framework) ์ •์ฑ…์„ ์ ์šฉํ•˜์—ฌ ์ด๋ฉ”์ผ ์ˆ˜์‹ ์ž์˜ ๋„๋ฉ”์ธ์—์„œ ์˜จ ์ด๋ฉ”์ผ์„ ํ™•์ธํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_POLICYD_SPF = 0

# POP3
# Description: POP3 (Post Office Protocol version 3)๋Š” ์ด๋ฉ”์ผ ํด๋ผ์ด์–ธํŠธ๊ฐ€ ์„œ๋ฒ„์—์„œ ์ด๋ฉ”์ผ์„ ๊ฐ€์ ธ์˜ค๋Š” ๋ฐ ์‚ฌ์šฉ๋˜๋Š” ํ”„๋กœํ† ์ฝœ์ž…๋‹ˆ๋‹ค. ์ด ์„œ๋น„์Šค๋Š” POP3๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์ด๋ฉ”์ผ์„ ๊ฐ€์ ธ์˜ค๋Š” ๋ฐ ํ•„์š”ํ•œ ๊ธฐ๋Šฅ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_POP3 =

# CLAMAV (Clam AntiVirus)
# Description: ์ด ์„œ๋น„์Šค๋Š” ์•…์„ฑ ์ฝ”๋“œ์™€ ๋ฐ”์ด๋Ÿฌ์Šค๋ฅผ ํƒ์ง€ํ•˜์—ฌ ์ด๋ฉ”์ผ ๋ฉ”์‹œ์ง€๋ฅผ ์Šค์บ”ํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_CLAMAV = 0

# AMAVIS (Amavis-New)
# Description: ์ด ์„œ๋น„์Šค๋Š” ์ด๋ฉ”์ผ ๋ฉ”์‹œ์ง€๋ฅผ ์Šค์บ”ํ•˜์—ฌ ์•…์„ฑ ์ฝ”๋“œ, ๋ฐ”์ด๋Ÿฌ์Šค ๋ฐ ์ŠคํŒธ์„ ํƒ์ง€ํ•˜๊ณ  ์ฒ˜๋ฆฌํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_AMAVIS = 0

# DNSBL (DNS-based Blackhole List)
# Description: ์ด ์„œ๋น„์Šค๋Š” ์ŠคํŒธ ๋˜๋Š” ์•…์„ฑ ์ด๋ฉ”์ผ์„ ํ•„ํ„ฐ๋งํ•˜๊ธฐ ์œ„ํ•ด DNS ๊ธฐ๋ฐ˜์˜ ๋ธ”๋ž™ํ™€ ๋ฆฌ์ŠคํŠธ๋ฅผ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_DNSBL = 0

# FAIL2BAN
# Description: ์ด ์„œ๋น„์Šค๋Š” ์„œ๋ฒ„์˜ ๋ณด์•ˆ์„ ๊ฐ•ํ™”ํ•˜๊ธฐ ์œ„ํ•ด ๋กœ๊ทธ๋ฅผ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜๊ณ  ์ง€์ •๋œ ์กฐ๊ฑด์— ๋”ฐ๋ผ ์ž˜๋ชป๋œ ๋กœ๊ทธ์ธ ์‹œ๋„ ๋“ฑ์„ ์ฐจ๋‹จํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_FAIL2BAN = 0

# MANAGESIEVE
# Description: MANAGESIEVE๋Š” ์ด๋ฉ”์ผ ํด๋ผ์ด์–ธํŠธ๊ฐ€ ์ด๋ฉ”์ผ ์„œ๋ฒ„์— ๋Œ€ํ•œ ํ•„ํ„ฐ ๋ฐ ์ •์ฑ…์„ ๊ด€๋ฆฌํ•˜๊ธฐ ์œ„ํ•œ ํ”„๋กœํ† ์ฝœ์ž…๋‹ˆ๋‹ค.
deployment.env.ENABLE_MANAGESIEVE =

# SPAMASSASSIN
# Description: ์ด ์„œ๋น„์Šค๋Š” ์ด๋ฉ”์ผ ๋ฉ”์‹œ์ง€๋ฅผ ์Šค์บ”ํ•˜์—ฌ ์ŠคํŒธ์„ ํƒ์ง€ํ•˜๊ณ  ์ฒ˜๋ฆฌํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_SPAMASSASSIN = 0

# SPAMASSASSIN_KAM
# Description: SPAMASSASSIN_KAM์€ SPAMASSASSIN๊ณผ ํ•จ๊ป˜ ์‚ฌ์šฉ๋˜๋Š” ์ถ”๊ฐ€ ๊ธฐ๋Šฅ์œผ๋กœ, ์ŠคํŒธ์„ ํƒ์ง€ํ•˜๊ณ  ๋ถ„๋ฅ˜ํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_SPAMASSASSIN_KAM = 0

# FETCHMAIL
# Description: ์ด ์„œ๋น„์Šค๋Š” ์™ธ๋ถ€ ์ด๋ฉ”์ผ ์„œ๋ฒ„์—์„œ ์ด๋ฉ”์ผ์„ ๊ฐ€์ ธ์˜ค๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_FETCHMAIL = 0

# GETMAIL
# Description: GETMAIL์€ ์™ธ๋ถ€ ์ด๋ฉ”์ผ ์„œ๋ฒ„์—์„œ ์ด๋ฉ”์ผ์„ ๊ฐ€์ ธ์˜ค๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_GETMAIL = 0

# POSTGREY
# Description: ์ด ์„œ๋น„์Šค๋Š” ์ด๋ฉ”์ผ ์„œ๋ฒ„์— ๋Œ€ํ•œ ๊ทธ๋ ˆ์ด๋ฆฌ์ŠคํŠธ๋ฅผ ๊ด€๋ฆฌํ•˜์—ฌ ์ŠคํŒธ ๋ฉ”์‹œ์ง€์˜ ์ „๋‹ฌ์„ ์ง€์—ฐ์‹œํ‚ค๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.
deployment.env.ENABLE_POSTGREY = 0

# SASLAUTHD
# Description: SASLAUTHD๋Š” SMTP ์ธ์ฆ์„ ์ฒ˜๋ฆฌํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. (CRAM-MD5 ๋“ฑ)
deployment.env.ENABLE_SASLAUTHD = 0

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *