Docker Mailserver Setup: Postfix, Dovecot

πŸ’‘ Docker Mailserver Setup: Postfix, Dovecot β€” Executive Summary

Technical architectural analysis, practical configuration manifests, and deployment instructions for Docker Mailserver Setup: Postfix, Dovecot.

Docker
Generate cf
bash
docker run --rm \
-e [email protected] \
-e MAIL_PASS=$pw \
-ti tvial/docker-mailserver:latest \
/bin/sh -c 'echo "$MAIL_USER|$(doveadm pw -s SHA512-CRYPT -u $MAIL_USER -p $MAIL_PASS)"' \
>> postfix-accounts.cf
K8s
helm install
bash
helm repo add docker-mailserver https://docker-mailserver.github.io/docker-mailserver-helm/
helm pull docker-mailserver/docker-mailserver --untar

# setting values.yaml
## tls setting (recomended cert-manager)
--set certificate = $TLS_SECRET
--set deployment.env.OVERRIDE_HOSTNAME = $MAIL_ADDRESS_HOST
--set deployment.env.TZ = "Asia/Seoul"
--set service.type = "NodePort"
--set service.nodePort.smtp = ""
--set persistence.mail-config.storageClass = $sc
--set persistence.mail-data.storageClass = $sc
--set persistence.mail-state.storageClass = $sc
--set persistence.mail-log.storageClass = $sc

# 졜초 계정생성 ν•„μˆ˜
Access the operation pod and register an account
bash
k exec -it -n $ns deployments/docker-mailserver -- bash
  setup email add $user@$OVERRIDE_HOSTNAME $pw
  cat /tmp/docker-mailserver/postfix-accounts.cf
Inside setup.sh (/usr/local/bin/setup)
yaml
#email μΆ”κ°€
setup email add $user@$OVERRIDE_HOSTNAME $pw
#dkim
setup config dkim
Exporter (failed)
bash
--set metrics.enabled = true
--set metrics.serviceMonitor.enabled = true
--set metrics.serviceMonitor.labels.release = $releaseLabel

# Image: blackflysolutions/postfix-exporter@sha256:7ed7c0534112aff5b44757ae84a206bf659171631edfc325c3c1638d78e74f73
# in container logic
/bin/postfix_exporter \
--postfix.showq_path /var/mail-state/spool-postfix/public/showq \
--postfix.logfile_path /var/log/mail/mail.log
>>>
2024/05/10 03:33:29 Reading log events from /var/log/mail/mail.log
2024/05/10 03:33:29 Listening on :9154
2024/05/10 03:33:29 FATAL -- failed to create Watcher
goroutine 34 [running]:
runtime/debug.Stack(0xc000418000, 0x21, 0x0)
        /usr/local/go/src/runtime/debug/stack.go:24 +0x9f
github.com/nxadm/tail/util.Fatal(0x9555f8, 0x18, 0x0, 0x0, 0x0)
        /go/pkg/mod/github.com/nxadm/[email protected]/util/util.go:23 +0xc7
github.com/nxadm/tail/watch.(*InotifyTracker).run(0xc000412000)
        /go/pkg/mod/github.com/nxadm/[email protected]/watch/inotify_tracker.go:220 +0x445
created by github.com/nxadm/tail/watch.glob..func1
        /go/pkg/mod/github.com/nxadm/[email protected]/watch/inotify_tracker.go:55 +0x12f
<<<
Service Port
yaml
## Send Mail: smtp
  - name: smtp
    nodePort: 30025
    port: 25
    protocol: TCP
    targetPort: smtp

## Send Mail: smtp (SSL)
  - name: submissions
    nodePort: 30465
    port: 465
    protocol: TCP
    targetPort: submissions

## Send Mail: smtp (STARTTLS)
  - name: submission 
    nodePort: 30587
    port: 587
    protocol: TCP
    targetPort: submission

## SMTP SSL 연결에 λŒ€ν•œ ν”„λ‘μ‹œ μ„œλ²„
  - name: subs-proxy
    nodePort: 30444
    port: 10465
    protocol: TCP
    targetPort: subs-proxy

## SMTP STARTTLS 연결에 λŒ€ν•œ ν”„λ‘μ‹œ μ„œλ²„
  - name: sub-proxy
    nodePort: 32074
    port: 10587
    protocol: TCP
    targetPort: sub-proxy

## Receive: imap ν΄λΌμ΄μ–ΈνŠΈ μˆ˜μ‹ ν¬νŠΈ
  - name: imap
    nodePort: 30143
    port: 143
    protocol: TCP
    targetPort: imap

## Receive: imap ν΄λΌμ΄μ–ΈνŠΈ SSL μˆ˜μ‹ ν¬νŠΈ (IMAPS)
  - name: imaps
    nodePort: 30993
    port: 993
    protocol: TCP
    targetPort: imaps

## Receive: imap ν΄λΌμ΄μ–ΈνŠΈ μˆ˜μ‹  ν”„λ‘μ‹œ μ„œλ²„
  - name: imap-proxy
    nodePort: 30845
    port: 10143
    protocol: TCP
    targetPort: imap-proxy

## Receive: imap ν΄λΌμ΄μ–ΈνŠΈ SSL μˆ˜μ‹  ν”„λ‘μ‹œ μ„œλ²„ (IMAPS)
  - name: imaps-proxy
    nodePort: 32648
    port: 10993
    protocol: TCP
    targetPort: imaps-proxy

## Rspamd: 이메일 슀팸 및 λ°”μ΄λŸ¬μŠ€λ₯Ό ν•„ν„°λ§ν•˜λŠ” 데 μ‚¬μš©λ  수 μžˆλŠ” 슀팸 필터링 및 이메일 뢄석 도ꡬ
  - name: rspamd
    nodePort: 30884
    port: 11334
    protocol: TCP
    targetPort: rspamd
Additional Service
yaml
# SRS (Sender Rewriting Scheme)
# Description: 이 μ„œλΉ„μŠ€λŠ” 보낸 이메일 μ£Όμ†Œλ₯Ό μž¬μž‘μ„±ν•˜μ—¬ 이메일을 λ‹€μ‹œ 전달할 λ•Œ 도메인 인증 문제λ₯Ό ν•΄κ²°ν•˜κΈ° μœ„ν•΄ μ‚¬μš©λ©λ‹ˆλ‹€. SRSλŠ” SPF (Sender Policy Framework)와 κ΄€λ ¨λœ 문제λ₯Ό ν•΄κ²°ν•˜λŠ” 데 도움이 λ©λ‹ˆλ‹€.
deployment.env.ENABLE_SRS = 0

# OPENDKIM (Open DomainKeys Identified Mail)
# Description: 이 μ„œλΉ„μŠ€λŠ” 이메일 μ„œλ²„μ—μ„œ λ‚˜κ°€λŠ” 이메일에 λ””μ§€ν„Έ μ„œλͺ…을 μΆ”κ°€ν•˜μ—¬ μ΄λ©”μΌμ˜ 신뒰성을 λ†’μ΄λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€. 이λ₯Ό 톡해 이메일 μˆ˜μ‹ μžλŠ” 이메일이 μ‹€μ œλ‘œ 보낸 μ‚¬λžŒμ—μ„œ μ™”λŠ”μ§€ 확인할 수 μžˆμŠ΅λ‹ˆλ‹€.
deployment.env.ENABLE_OPENDKIM = 0

# OPENDMARC (OpenDMARC)
# Description: 이 μ„œλΉ„μŠ€λŠ” 이메일 μˆ˜μ‹  ν”„λ‘œμ„ΈμŠ€μ—μ„œ DMARC (Domain-based Message Authentication, Reporting, and Conformance) 정책을 μ μš©ν•˜μ—¬ 이메일 λ„λ©”μΈμ˜ μœ„μ‘°λ₯Ό λ°©μ§€ν•˜κ³  이메일 μŠ€νŒΈμ„ μ°¨λ‹¨ν•˜λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_OPENDMARC = 0

# POLICYD_SPF (Policyd SPF)
# Description: 이 μ„œλΉ„μŠ€λŠ” SPF (Sender Policy Framework) 정책을 μ μš©ν•˜μ—¬ 이메일 μˆ˜μ‹ μžμ˜ λ„λ©”μΈμ—μ„œ 온 이메일을 ν™•μΈν•˜λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_POLICYD_SPF = 0

# POP3
# Description: POP3 (Post Office Protocol version 3)λŠ” 이메일 ν΄λΌμ΄μ–ΈνŠΈκ°€ μ„œλ²„μ—μ„œ 이메일을 κ°€μ Έμ˜€λŠ” 데 μ‚¬μš©λ˜λŠ” ν”„λ‘œν† μ½œμž…λ‹ˆλ‹€. 이 μ„œλΉ„μŠ€λŠ” POP3λ₯Ό μ‚¬μš©ν•˜μ—¬ 이메일을 κ°€μ Έμ˜€λŠ” 데 ν•„μš”ν•œ κΈ°λŠ₯을 μ œκ³΅ν•©λ‹ˆλ‹€.
deployment.env.ENABLE_POP3 =

# CLAMAV (Clam AntiVirus)
# Description: 이 μ„œλΉ„μŠ€λŠ” μ•…μ„± μ½”λ“œμ™€ λ°”μ΄λŸ¬μŠ€λ₯Ό νƒμ§€ν•˜μ—¬ 이메일 λ©”μ‹œμ§€λ₯Ό μŠ€μΊ”ν•˜λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_CLAMAV = 0

# AMAVIS (Amavis-New)
# Description: 이 μ„œλΉ„μŠ€λŠ” 이메일 λ©”μ‹œμ§€λ₯Ό μŠ€μΊ”ν•˜μ—¬ μ•…μ„± μ½”λ“œ, λ°”μ΄λŸ¬μŠ€ 및 μŠ€νŒΈμ„ νƒμ§€ν•˜κ³  μ²˜λ¦¬ν•˜λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_AMAVIS = 0

# DNSBL (DNS-based Blackhole List)
# Description: 이 μ„œλΉ„μŠ€λŠ” 슀팸 λ˜λŠ” μ•…μ„± 이메일을 ν•„ν„°λ§ν•˜κΈ° μœ„ν•΄ DNS 기반의 λΈ”λž™ν™€ 리슀트λ₯Ό μ‚¬μš©ν•©λ‹ˆλ‹€.
deployment.env.ENABLE_DNSBL = 0

# FAIL2BAN
# Description: 이 μ„œλΉ„μŠ€λŠ” μ„œλ²„μ˜ λ³΄μ•ˆμ„ κ°•ν™”ν•˜κΈ° μœ„ν•΄ 둜그λ₯Ό λͺ¨λ‹ˆν„°λ§ν•˜κ³  μ§€μ •λœ 쑰건에 따라 잘λͺ»λœ 둜그인 μ‹œλ„ 등을 μ°¨λ‹¨ν•˜λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_FAIL2BAN = 0

# MANAGESIEVE
# Description: MANAGESIEVEλŠ” 이메일 ν΄λΌμ΄μ–ΈνŠΈκ°€ 이메일 μ„œλ²„μ— λŒ€ν•œ ν•„ν„° 및 정책을 κ΄€λ¦¬ν•˜κΈ° μœ„ν•œ ν”„λ‘œν† μ½œμž…λ‹ˆλ‹€.
deployment.env.ENABLE_MANAGESIEVE =

# SPAMASSASSIN
# Description: 이 μ„œλΉ„μŠ€λŠ” 이메일 λ©”μ‹œμ§€λ₯Ό μŠ€μΊ”ν•˜μ—¬ μŠ€νŒΈμ„ νƒμ§€ν•˜κ³  μ²˜λ¦¬ν•˜λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_SPAMASSASSIN = 0

# SPAMASSASSIN_KAM
# Description: SPAMASSASSIN_KAM은 SPAMASSASSINκ³Ό ν•¨κ»˜ μ‚¬μš©λ˜λŠ” μΆ”κ°€ κΈ°λŠ₯으둜, μŠ€νŒΈμ„ νƒμ§€ν•˜κ³  λΆ„λ₯˜ν•˜λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_SPAMASSASSIN_KAM = 0

# FETCHMAIL
# Description: 이 μ„œλΉ„μŠ€λŠ” μ™ΈλΆ€ 이메일 μ„œλ²„μ—μ„œ 이메일을 κ°€μ Έμ˜€λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_FETCHMAIL = 0

# GETMAIL
# Description: GETMAIL은 μ™ΈλΆ€ 이메일 μ„œλ²„μ—μ„œ 이메일을 κ°€μ Έμ˜€λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_GETMAIL = 0

# POSTGREY
# Description: 이 μ„œλΉ„μŠ€λŠ” 이메일 μ„œλ²„μ— λŒ€ν•œ 그레이리슀트λ₯Ό κ΄€λ¦¬ν•˜μ—¬ 슀팸 λ©”μ‹œμ§€μ˜ 전달을 μ§€μ—°μ‹œν‚€λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€.
deployment.env.ENABLE_POSTGREY = 0

# SASLAUTHD
# Description: SASLAUTHDλŠ” SMTP 인증을 μ²˜λ¦¬ν•˜λŠ” 데 μ‚¬μš©λ©λ‹ˆλ‹€. (CRAM-MD5 λ“±)
deployment.env.ENABLE_SASLAUTHD = 0

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *