mikenye/postfix

mikenye/postfix

Postfix是Wietse Venema开发的优秀邮件服务器。本容器旨在简化入站和出站邮件中继的设置，以保护和增强自托管邮件服务器（如Microsoft Exchange）。容器采用Postfix的Postscreen提供增强保护。

除基本邮件中继功能外，容器还可选择性提供以下功能：

• 为SMTP连接实施最新的TLS/SSL安全
• 使用ClamAV对所有入站/出站邮件执行病毒扫描
• 为入站邮件实施DNSBL（基于DNS的黑洞列表）
• 为所有出站邮件执行DKIM签名
• 为所有入站邮件执行DKIM验证
• 为入站邮件实施SPF检查
• 为入站邮件实施灰名单)
• 为入站邮件实施基于LDAP的收件人验证

容器通过环境变量完全配置，容器启动时会根据环境变量构建各服务的配置文件，同时支持通过卷映射部分配置文件。目前支持的Docker架构包括linux/386、linux/amd64、linux/arm/v7和linux/arm64。

服务

本容器使用优秀的https://github.com/just-containers/s6-overlay%E8%BF%9B%E8%A1%8C%E8%BF%9B%E7%A8%8B%E7%AE%A1%E7%90%86%EF%BC%88%E5%8F%8A%E5%85%B6%E4%BB%96%E5%AE%9E%E7%94%A8%E5%8A%9F%E8%83%BD%EF%BC%89%E3%80%82

部署示例

包装本地Exchange服务器

!https://github.com/mikenye/docker-postfix/blob/dev/deployment_recipe_wrap_exchange.png?raw=true

在此部署示例中，创建两个容器（mail_in和mail_out）：

mail_in设计为位于互联网与本地传统Exchange服务器之间，处理入站邮件，提供以下功能：

• 使用postscreen确保发送MTA符合标准
• 使用DNSBL作为初始反垃圾邮件措施
• 为传入客户端提供最新TLS
• 实施灰名单作为另一层反垃圾邮件措施
• 执行SPF和DKIM验证
• 执行各种邮件头/发件人/收件人检查以确保邮件有效性
• 通过LDAP对内部Active Directory执行收件人验证
• 使用ClamAV扫描邮件病毒
• 将邮件转发至传统Exchange服务器

mail_out设计为位于本地传统Exchange服务器与互联网之间，处理出站邮件，提供以下功能：

• 为与外部MTA通信提供最新TLS
• 执行DKIM签名
• 使用ClamAV扫描邮件病毒
• 投递出站邮件

网络配置方面：

• 站点的互联网路由器配置为将TCP 25端口的入站连接NAT到运行mail_in的Docker主机的TCP 2525端口
• 站点的Exchange服务器配置为通过"智能主机"将邮件发送到Docker主机（固定使用TCP 25端口）

以下是docker-compose.yml示例：

yaml
version: '3.8'

volumes:
  queue_out:
    driver: local
  queue_in:
    driver: local
  certs:
    driver: local
  dkim:
    driver: local
  clamav_in:
    driver: local
  clamav_out:
    driver: local
  postgrey_in:
    driver: local
  tables_in:
    driver: local
  aliases_in:
    driver: local
  asupdata_in:
    driver: local
  logs_in:
    driver: local
  logs_out:
    driver: local

services:

  mail_out:
    image: mikenye/postfix
    container_name: mail_out
    restart: always
    logging:
      driver: "json-file"
      options:
        max-file: "10"
        max-size: "10m"
    ports:
      - "25:25"
    environment:
      TZ: "Australia/Perth"
      POSTMASTER_EMAIL: "postmaster@yourdomain.tld"
      POSTFIX_INET_PROTOCOLS: "ipv4"
      POSTFIX_MYORIGIN: "mail.yourdomain.tld"
      POSTFIX_PROXY_INTERFACES: "your.external.IP.address"
      POSTFIX_MYNETWORKS: "your.local.LAN.subnet/prefix"
      POSTFIX_MYDOMAIN: "yourdomain.tld"
      POSTFIX_MYHOSTNAME: "mail.yourdomain.tld"
      POSTFIX_MAIL_NAME: "outbound"
      POSTFIX_SMTPD_TLS_CHAIN_FILES: "/etc/postfix/certs/privkey.pem, /etc/postfix/certs/fullchain.pem"
      POSTFIX_SMTP_TLS_CHAIN_FILES: "/etc/postfix/certs/privkey.pem, /etc/postfix/certs/fullchain.pem"
      POSTFIX_SMTPD_TLS_SECURITY_LEVEL: "may"
      POSTFIX_SMTPD_TLS_LOGLEVEL: 1
      POSTFIX_REJECT_INVALID_HELO_HOSTNAME: "false"
      POSTFIX_REJECT_NON_FQDN_HELO_HOSTNAME: "false"
      POSTFIX_REJECT_UNKNOWN_HELO_HOSTNAME: "false"
      ENABLE_OPENDKIM: "true"
      OPENDKIM_SIGNINGTABLE: "/etc/mail/dkim/SigningTable"
      OPENDKIM_KEYTABLE: "/etc/mail/dkim/KeyTable"
      OPENDKIM_MODE: "s"
      OPENDKIM_INTERNALHOSTS: "your.local.LAN.subnet/prefix"
      OPENDKIM_LOGRESULTS: "true"
      OPENDKIM_LOGWHY: "true"
      ENABLE_CLAMAV: "true"
      CLAMAV_MILTER_REPORT_HOSTNAME: "mail.yourdomain.tld"
    volumes:
      - "certs:/etc/postfix/certs:ro"
      - "dkim:/etc/mail/dkim:rw"
      - "clamav_out:/var/lib/clamav:rw"
      - "queue_out:/var/spool/postfix:rw"
      - "logs_out:/var/log:rw"

  mail_in:
    image: mikenye/postfix
    container_name: mail_in
    restart: always
    logging:
      driver: "json-file"
      options:
        max-file: "10"
        max-size: "10m"
    dns:
      - 8.8.8.8
      - 8.8.4.4
    ports:
      - "2525:25"
    environment:
      TZ: "Australia/Perth"
      POSTMASTER_EMAIL: "postmaster@yourdomain.tld"
      POSTFIX_INET_PROTOCOLS: "ipv4"
      POSTFIX_MYORIGIN: "mail.yourdomain.tld"
      POSTFIX_PROXY_INTERFACES: "your.external.IP.address"
      POSTFIX_MYDOMAIN: "yourdomain.tld"
      POSTFIX_MYHOSTNAME: "mail.yourdomain.tld"
      POSTFIX_MAIL_NAME: "inbound"
      POSTFIX_SMTPD_TLS_CHAIN_FILES: "/etc/postfix/certs/privkey.pem, /etc/postfix/certs/fullchain.pem"
      POSTFIX_SMTP_TLS_CHAIN_FILES: "/etc/postfix/certs/privkey.pem, /etc/postfix/certs/fullchain.pem"
      POSTFIX_SMTPD_TLS_SECURITY_LEVEL: "may"
      POSTFIX_SMTPD_TLS_LOGLEVEL: 1
      POSTFIX_RELAYHOST: "exchange.server.IP.addr"
      POSTFIX_RELAY_DOMAINS: "yourdomain.tld,someotherdomain.tld"
      POSTFIX_DNSBL_SITES: "hostkarma.junkemailfilter.com=127.0.0.2, bl.spamcop.net, cbl.abuseat.org=127.0.0.2, zen.spamhaus.org"
      ENABLE_OPENDKIM: "true"
      OPENDKIM_MODE: "v"
      OPENDKIM_LOGRESULTS: "true"
      OPENDKIM_LOGWHY: "true"
      ENABLE_SPF: "true"
      ENABLE_CLAMAV: "true"
      CLAMAV_MILTER_REPORT_HOSTNAME: "mail.yourdomain.tld"
      ENABLE_POSTGREY: "true"
      ENABLE_LDAP_RECIPIENT_ACCESS: "true"
      POSTFIX_LDAP_SERVERS: "active.directory.server.IP,active.directory.server.IP"
      POSTFIX_LDAP_BIND_DN: "CN=mailrelay,OU=Service Accounts,OU=Users,DC=yourdomain,DC=tld"
      POSTFIX_LDAP_BIND_PW: "12345"
      POSTFIX_LDAP_SEARCH_BASE: "DC=yourdomain,DC=tld"
    volumes:
      - "certs:/etc/postfix/certs:ro"
      - "queue_in:/var/spool/postfix:rw"
      - "clamav_in:/var/lib/clamav:rw"
      - "postgrey_in:/etc/postgrey:ro"
      - "tables_in:/etc/postfix/tables:ro"
      - "aliases_in:/etc/postfix/local_aliases:ro"
      - "logs_in:/var/log:rw"

建议将卷挂载到可访问的路径，以便轻松编辑文件、加载证书和查看日志。例如，可映射到本地已知路径：

yaml
volumes:
  queue_out:
    driver: local
      type: 'none'
      o: 'bind'
      device: '/opt/mail/queue_out'

或使用NFS映射到文件服务器：

yaml
volumes:
  queue_out:
    driver: local
      type: nfs
      o: addr=1.2.3.4,rw
      device: ":/vol/mail/queue_out"

环境变量

容器配置

系统日志配置

Postfix配置