aither/simple-nixos-mailserver
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
803 Commits 9 Branches 0 Tags
85f0a9446633633db01321dfe0f5d6aea065ccd5
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Weinelt 85f0a94466 flake.nix: update sphinx-rtd-theme package attribute 
'sphinx_rtd_theme' has been renamed to/replaced by 'sphinx-rtd-theme'
 2025-11-04 00:51:49 +01:00
Martin Weinelt 70256c7d6e flake.lock: Update 
Flake lock file updates:

• Updated input 'flake-compat':
    'github:edolstra/flake-compat/9100a0f413b0c601e0533d1d94ffd501ce2e7885' (2025-05-12)
  → 'github:edolstra/flake-compat/f387cd2afec9419c8ee37694406ca490c3f34ee5' (2025-10-27)
• Updated input 'git-hooks':
    'github:cachix/git-hooks.nix/54df955a695a84cd47d4a43e08e1feaf90b1fd9b' (2025-09-17)
  → 'github:cachix/git-hooks.nix/ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37' (2025-10-17)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/e9f00bd893984bc8ce46c895c3bf7cac95331127' (2025-09-28)
  → 'github:NixOS/nixpkgs/b3d51a0365f6695e7dd5cdf3e180604530ed33b4' (2025-11-02)
• Updated input 'nixpkgs-25_05':
    'github:NixOS/nixpkgs/5ed4e25ab58fd4c028b59d5611e14ea64de51d23' (2025-09-29)
  → 'github:NixOS/nixpkgs/3de8f8d73e35724bf9abef41f1bdbedda1e14a31' (2025-11-01)
 2025-11-04 00:48:17 +01:00
Martin Weinelt 1e80fb2594 flake.lock: Update 
Flake lock file updates:

• Updated input 'git-hooks':
    'github:cachix/git-hooks.nix/16ec914f6fb6f599ce988427d9d94efddf25fe6d' (2025-06-24)
  → 'github:cachix/git-hooks.nix/54df955a695a84cd47d4a43e08e1feaf90b1fd9b' (2025-09-17)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/94def634a20494ee057c76998843c015909d6311' (2025-07-31)
  → 'github:NixOS/nixpkgs/e9f00bd893984bc8ce46c895c3bf7cac95331127' (2025-09-28)
• Updated input 'nixpkgs-25_05':
    'github:NixOS/nixpkgs/1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a' (2025-07-29)
  → 'github:NixOS/nixpkgs/5ed4e25ab58fd4c028b59d5611e14ea64de51d23' (2025-09-29)
 2025-10-01 12:18:02 +02:00
Martin Weinelt 39ead49eb4 ci: disable command execution in jobset generation 
When GitLab PR descriptions contain markdown inline code blocks they get
interpreted as command substitutions in bash.

This is because the here-doc string previously allowed for this behavior.
 2025-09-22 15:23:26 +02:00
Martin Weinelt 54f37811dd Disable plaintext access per RFC 8314 
This deprecates the `enableImap` and `enablePop` options and opens them
up for future removal.
 2025-09-22 03:46:43 +02:00
Martin Weinelt 1a2d7a4bf5 rspamd: restrict addresses we disable checks for to localhost 
By default this includes private network subnets, but those should really
use authentication instead, if they want to skip checks.

Closes: #326
 2025-08-25 04:12:30 +02:00
Martin Weinelt 2204f55329 Increase default DKIM key bits to 2048 
This is the current recommendation in RFC 8301 from early 2018.

Fixes: #333
 2025-08-22 22:38:31 +02:00
Martin Weinelt fc955088e3 Respect configureLocally flag for redis 2025-08-08 00:01:45 +02:00
Martin Weinelt 43f87f5520 Tokenize dmarc reporter commandline 2025-08-08 00:01:45 +02:00
Martin Weinelt aa06b2f489 Allow AF_UNIX sockets for dmarc reporter and allow group access 
This is required to use redis over UNIX domain sockets.
 2025-08-08 00:01:45 +02:00
Martin Weinelt b76a547bec treewide: reformat with nixfmt 1.0.0 2025-08-02 02:19:15 +02:00
Martin Weinelt cea6f25a40 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/1fd8bada0b6117e6c7eb54aad5813023eed37ccb' (2025-07-06)
  → 'github:NixOS/nixpkgs/94def634a20494ee057c76998843c015909d6311' (2025-07-31)
• Updated input 'nixpkgs-25_05':
    'github:NixOS/nixpkgs/29e290002bfff26af1db6f64d070698019460302' (2025-07-05)
  → 'github:NixOS/nixpkgs/1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a' (2025-07-29)
 2025-08-02 02:12:47 +02:00
Martin Weinelt 027e6bcd76 postfix: don't cast message_size_limit to string 
On unstable this will become a signed integer and there was never a good
reason for this to be a string.
 2025-08-02 02:11:11 +02:00
Martin Weinelt e9953aa154 ruff: reject implicit string concat 
This is a common mistake that could have been prevented.

```
migrations/nixos-mailserver-migration-03.py:42:9: ISC002 Implicitly concatenated string literals over multiple lines
   |
40 |   def is_maildir_related(path: Path, layout: FolderLayout) -> bool:
41 |       if path.name in [
42 | /         "subscriptions"
43 | |         # https://doc.dovecot.org/2.3/admin_manual/mailbox_formats/maildir/#imap-uid-mapping
44 | |         "dovecot-uidlist",
   | |_________________________^ ISC002
45 |           # https://doc.dovecot.org/2.3/admin_manual/mailbox_formats/maildir/#imap-keywords
46 |           "dovecot-keywords",
   |
```
 2025-07-09 03:59:54 +02:00
Martin WeineltandEmily 2b240501e0 Introduce system name and domain options 
Bring them up from the DMARC reporting section to the mailserver toplevel
so they become reusable for the upcoming TLSRPT integration.

We default to the first domain in the domains option, if not set
explicitly, so that `systemDomain` doesn't become a blocker for existing
setups. We still encourage picking out the intended one, which is likely
the one used for the MX hostname.

This also simplifies the DMARC reporting configuration, which doesn't
need to be so fine-grained.

Co-Authored-By: Emily <git@emilylange.de>
 2025-07-09 01:44:10 +02:00
Martin Weinelt 0aeb2849ad mail-check: fix format string 2025-07-08 04:39:36 +02:00
Martin Weinelt 47786932cb tests: fix deprecate machine config access 2025-07-08 03:58:37 +02:00
Martin Weinelt 679bce8bbb flake.lock: Update 
Flake lock file updates:

• Updated input 'git-hooks':
    'github:cachix/git-hooks.nix/623c56286de5a3193aa38891a6991b28f9bab056' (2025-06-11)
  → 'github:cachix/git-hooks.nix/16ec914f6fb6f599ce988427d9d94efddf25fe6d' (2025-06-24)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/3e3afe5174c561dee0df6f2c2b2236990146329f' (2025-06-07)
  → 'github:NixOS/nixpkgs/1fd8bada0b6117e6c7eb54aad5813023eed37ccb' (2025-07-06)
• Updated input 'nixpkgs-25_05':
    'github:NixOS/nixpkgs/fd487183437963a59ba763c0cc4f27e3447dd6dd' (2025-06-12)
  → 'github:NixOS/nixpkgs/29e290002bfff26af1db6f64d070698019460302' (2025-07-05)
 2025-07-08 03:20:45 +02:00
Martin Weinelt d6d2053b80 dovecot: use marker option as unit name migration indicator 
In nixpkgs we expose `services.dovecot.hasNewUnitName` option that can be
safely inspected to understand that whether to use the `dovecot` systemd
service name instead of `dovecot2`.
 2025-07-07 01:10:19 +02:00
Martin Weinelt f9a52ca4b5 dovecot: fix check for dovecot systemd unit name 
and migrate the preStart script in systemd.nix as well.
 2025-07-06 05:18:01 +02:00
Martin Weinelt b38dc8085c dovecot: add compat shim for dovecot unit name migration 
In nixpkgs I renamed dovecot2 to dovecot and made dovecot2 an alias, so
adding the script to the alias does us no good.
 2025-07-06 02:52:31 +02:00
Martin Weinelt b10c54606b migrations: ignore maildir when in folder layout 
Otherwise we'd be tryhing to move the maildir into itself and error out.
 2025-06-26 16:52:49 +02:00
Martin Weinelt d91d94be94 migrations: also migrate dovecot control files 2025-06-25 22:09:41 +02:00
Martin Weinelt b9e28e23af migrations: fix move of subscriptions 
It is a file and we skip over files in the location I added it before.
 2025-06-23 03:48:18 +02:00
Martin Weinelt 67f0b864cc migrations: also migrate subscriptions file in maildir migration 
Otherwise users will be unsubscribed from all maildir folders.
 2025-06-23 02:38:01 +02:00
Martin Weinelt 3c1cff431c tests: test for the expected maildir and index dir locations 
These are not ideal yet, but we should make them a fixture, so that we
are always aware what they are for the different supported setups.
 2025-06-21 10:28:43 +02:00
Martin Weinelt f25495cabf dovecot: fix custom index dir configuration for ldap users 2025-06-21 09:47:03 +02:00
Martin Weinelt 62ea8a7e00 dovecot: migrate to dedicated homedir and separate maildir paths 
Per the dovecot documentation[0] we were previously running with an
unsupported home directory configuration, because we shared them among
all virtual users at /var/vmail.

After resolving this by creating per user home directories at
/var/vmail/%{domain}/%{user} this now also overlaps with the location of
the Maildir, which is not recommended.

As a result we now need to migrate our Maildirs into
/var/vmail/%{domain}/%{user}/mail, for which a small shell script is
provided as part of this change.

The script is included in the documentation because we cannot provide it
in time for users, because they might already be seeing the relevant
assertion and there is no safe waiting period that would allow us to skip
shipping it like that.

[0] https://doc.dovecot.org/2.3/configuration_manual/mail_location/
 2025-06-21 09:46:32 +02:00
Martin Weinelt 601b33d2a7 tests/minimal: drop 
We have other tests that are minimal, e.g. the multiple test. And this
test wasn't even hooked up in flake.nix, so I'm doubtful that we really
need it.
 2025-06-19 01:04:56 +02:00
Martin Weinelt 64aca4f2ce postfix: disable SHA1 for SMTP connections 2025-06-18 06:58:42 +02:00
Martin Weinelt 0774c93ae6 tests: make rspamd not block on dns queries 
These will never suceed while running the tests in the Nix sandbox, and
skipping them leads to very noticable (~51%) speedups.

Before:
```
Benchmark 1: nix build .#hydraJobs.x86_64-linux.external-unstable --rebuild
  Time (mean ± σ):     151.737 s ±  1.074 s    [User: 0.310 s, System: 0.289 s]
  Range (min … max):   150.321 s … 153.512 s    10 runs
```

After:
```
Benchmark 1: nix build .#hydraJobs.x86_64-linux.external-unstable --rebuild
  Time (mean ± σ):     74.010 s ±  0.746 s    [User: 0.269 s, System: 0.266 s]
  Range (min … max):   72.814 s … 75.190 s    10 runs
```
 2025-06-17 22:04:46 +02:00
Martin Weinelt f08ee8da38 tests: provide a second cpu core 
Provides a small (~7.5%) reduction in the test runtime measured for the external
test:

Before:
```
Benchmark 1: nix build .#hydraJobs.x86_64-linux.external-unstable --rebuild
  Time (mean ± σ):     151.737 s ±  1.074 s    [User: 0.310 s, System: 0.289 s]
  Range (min … max):   150.321 s … 153.512 s    10 runs
```

After:
```
Benchmark 1: nix build .#hydraJobs.x86_64-linux.external-unstable --rebuild
  Time (mean ± σ):     140.647 s ±  1.092 s    [User: 0.331 s, System: 0.296 s]
  Range (min … max):   138.536 s … 142.298 s    10 runs
```
 2025-06-17 22:04:08 +02:00
Martin Weinelt cf6ef5e9ca Create per service debug logging toggles 
Enabling the rspamd debug log drowns out everything else and should be
selected explicitly as needed.

The external test does not require it and removing it makes it much
(~40.5%) faster, since it now does not block on terminal output anymore.

Before:
```
Benchmark 1: nix build .#hydraJobs.x86_64-linux.external-unstable --rebuild
  Time (mean ± σ):     151.737 s ±  1.074 s    [User: 0.310 s, System: 0.289 s]
  Range (min … max):   150.321 s … 153.512 s    10 runs
```

After:
```
Benchmark 1: nix build .#hydraJobs.x86_64-linux.external-unstable --rebuild
  Time (mean ± σ):     90.531 s ±  0.557 s    [User: 0.054 s, System: 0.045 s]
  Range (min … max):   89.579 s … 91.278 s    10 runs
```
 2025-06-17 22:02:31 +02:00
Martin Weinelt 6652b57dda postfix: rearrange smtpd_tls_chain_files option 2025-06-16 07:27:03 +02:00
Martin Weinelt c8f809fa76 postfix: migrate more options to services.postfix.config 
I'm working on deprecating the top-level options, that configure main.cf
upstream in nixpkgs. With this change we stay ahead of the curve.

The `networks_style` option already defaults to `host` since Postfix 3.0,
so I dropped the setting.

```
$ postconf -d | grep networks_style
mynetworks_style = ${{$compatibility_level} <level {2} ? {subnet} : {host}}
````
 2025-06-16 07:03:49 +02:00
Martin Weinelt a2152f9807 treewide: remove overly broad with cfg 
Makes it really hard to follow references and we were being explicit in
most places already anyway.
 2025-06-15 05:39:20 +02:00
Martin Weinelt fb56bcf747 treewide: remove global with lib 
Instead inherit required functions from lib.
 2025-06-15 05:08:47 +02:00
Martin Weinelt 1a7f3d718c treewide: reformat with nixfmt-rfc-style 2025-06-15 03:39:44 +02:00
Martin Weinelt 03433d472f flake.nix: enable nixfmt-rfc-style hook and formatter 2025-06-15 03:34:20 +02:00
Martin Weinelt c7497cd5f6 treewide: remove redundant parenthesis in nix code 2025-06-15 03:28:48 +02:00
Martin Weinelt 21ce4b4ff8 dovecot: disable Diffie-Hellman support 
Recommended in the modern recommendation by Mozilla. Support for elliptic
curves is widespread and they are much faster.
 2025-06-15 00:22:58 +02:00
Martin Weinelt efebf59b13 dovecot: configure preferred elliptic curves 2025-06-15 00:22:57 +02:00
Martin Weinelt 4fd9508d41 postfix: drop tls_random_source config 
The setting already defaults to /dev/urandom.
 2025-06-15 00:22:57 +02:00
Martin Weinelt 3828b00dea postfix: configure preferred curves and disable FFDHE 
This aligns with the intermediate configuration recommended by Mozilla.
 2025-06-15 00:22:57 +02:00
Martin Weinelt e27326d317 postfix: refactor and prune TLS settings 
- Groups settings between server and client
- Uses a range comparator for supported TLS versions
- Prune excluded primitives to what affects the supported TLS versions
 2025-06-15 00:22:57 +02:00
Martin Weinelt e0ab4eeb67 docs/setup-guide: bump example stateVersion to 2 
If you do a fresh install now you should be able to skip the first
migration step.
 2025-06-14 01:20:27 +02:00
Martin Weinelt 3b7cda8cc5 flake.lock: Update 
Flake lock file updates:

• Updated input 'git-hooks':
    'github:cachix/git-hooks.nix/dcf5072734cb576d2b0c59b2ac44f5050b5eac82' (2025-03-22)
  → 'github:cachix/git-hooks.nix/623c56286de5a3193aa38891a6991b28f9bab056' (2025-06-11)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/adaa24fbf46737f3f1b5497bf64bae750f82942e' (2025-05-13)
  → 'github:NixOS/nixpkgs/3e3afe5174c561dee0df6f2c2b2236990146329f' (2025-06-07)
• Updated input 'nixpkgs-25_05':
    'github:NixOS/nixpkgs/ca49c4304acf0973078db0a9d200fd2bae75676d' (2025-05-18)
  → 'github:NixOS/nixpkgs/fd487183437963a59ba763c0cc4f27e3447dd6dd' (2025-06-12)
 2025-06-13 04:00:52 +02:00
Martin Weinelt f1bd4b8215 postfix: remove option to toggle SMTP smuggling workarounnd 
It has been default enabled since Postfix 3.9 and can still be configured
from the NixOS option mentioned in the removal warning.

Removing the option makes our interface leaner.

Information is based on https://www.postfix.org/smtp-smuggling.html#long.
 2025-06-13 00:21:16 +02:00
Martin Weinelt e540dc864c postfix: configure cert/key using smtpd_tls_chain_files 
The sslCert and sslKey options are going away, because they do too much,
e.g. provision the keypair for client certificate authentication, which
is not at all what we want or need.
 2025-06-12 01:05:51 +02:00
Martin Weinelt f9b15192b8 postfix: allow client to select the preferred cipher 
As long as all cipher we support are considered safe we can allow clients
to select one that suits them best.
 2025-06-03 00:45:12 +02:00
Martin Weinelt 8c835feaa7 docs/migrations: Improve title scoping for LDAP home dir migration 2025-06-02 04:31:41 +02:00
Martin Weinelt c9f61e02ae docs/howto-develop: fix stateVersion assertion example 2025-05-31 13:06:29 +02:00
Martin Weinelt ea1b0f8e2b assertions: guard by enable flag and reformat 
None of these should trigger when you've not enabled mailserver.
 2025-05-30 18:28:16 +02:00
Martin Weinelt 7cb61e6e3a dovecot: respect the mailDirectory base for LDAP home directories 
This change is safe, if you have not altered the default value of the
 `mailserver.mailDirectory` setting.
 2025-05-29 23:10:33 +02:00
Martin Weinelt 233c5e1a70 dovecot: remove workaround for services.dovecot2.modules removal 2025-05-29 14:06:34 +02:00
Martin Weinelt 11bfdbf136 tests: drop dhparam default length configuration 
This has been the default value since the option was introduced back in
2018[0].

[0] https://github.com/NixOS/nixpkgs/commit/81fc2c35097f81ecb29a576148486cc1ce5a5bcc
 2025-05-29 08:49:37 +02:00
Martin Weinelt 10cccc7706 docs: fix code block syntax in migration init 2025-05-29 08:48:56 +02:00
Martin Weinelt 792225e256 Introduce stateVersion concept 
With upcoming changes to the dovecot home and maildirectories we need to
introduce a way to nudge users to inform themselves about manual
migration steps they might need to carry out.

The idea here is to allow us to safely make breaking changes and notify
the user of required migration steps at eval time, so they can make the
necessary changes in time.
 2025-05-27 23:54:15 +02:00
Martin Weinelt 51d48f1492 Release 25.11 2025-05-22 01:31:46 +02:00
Martin Weinelt b4ae17d224 Reformat release notes 2025-05-21 00:58:06 +02:00
Martin Weinelt f7a221bc69 flake.nix: expose packages for custom pre-commit hooks in devshell 2025-05-21 00:56:01 +02:00
Martin Weinelt aa8366d234 treewide: remove dead nix references 2025-05-15 16:41:30 +02:00
Martin Weinelt 9a6190ceea rspamd: remove indirection in path to runtime directory 2025-05-15 16:29:06 +02:00
Martin Weinelt 1e51a503b1 dovecot: drop unused pipe scripts 
Leftovers from d507bd9c95
 2025-05-15 16:29:05 +02:00
Martin Weinelt fce540024a docs/howto-develop: document the devshell 2025-05-15 16:29:05 +02:00
Martin Weinelt 040f07ff45 docs/howto-develop: update chat room references 2025-05-15 16:29:05 +02:00
Martin Weinelt a73982f5b4 docs: migrate wiki references to wiki.nixos.org 
This has been the official wiki platform for a while now.
 2025-05-15 16:29:05 +02:00
Martin Weinelt fbfd948535 flake.nix: remove clamav from devshell, add glab 
With glab we provide the GitLab CLI utility to interact programatically
with the platform. Useful for checking our Merge request branches for
example.
 2025-05-15 16:29:05 +02:00
Martin Weinelt 4c25278507 flake.nix: print options.md outpath during build 
Helpful for debugging the resulting options file.
 2025-05-15 16:29:05 +02:00
Martin Weinelt 3268d8b0d8 scripts/generate-options: refactor 
- Extract the md syntax part into reusable functions
- Rename variables so their purpose becomes clearer
 2025-05-15 16:29:04 +02:00
Martin Weinelt 4839fa6614 scripts: migrate format strings to f-strings 2025-05-15 16:29:04 +02:00
Martin Weinelt ddc6ce61db docs: fix linting issues 
https://github.com/sphinx-doc/sphinx/issues/3921
 2025-05-15 16:29:04 +02:00
Martin Weinelt a6eb2a8f9a README.md: reformat with markdownlint 2025-05-15 16:29:04 +02:00
Martin Weinelt a7d580b934 treewide: reformat python code 2025-05-15 16:29:04 +02:00
Martin Weinelt f9fcbe9430 scripts/generate-options: fix typing issue 2025-05-15 16:29:04 +02:00
Martin Weinelt 1615c93511 scripts/mail-check: fix typing issues 
Replaces the body payload parsing with proper handling for multipart
messages.
 2025-05-15 16:29:04 +02:00
Martin Weinelt 313f94ed8f flake.nix: create pre-commit hydra job 2025-05-15 16:29:04 +02:00
Martin Weinelt ff9087adb4 flake.nix: drop CC from devshell 
We absolutely do not need a C compiler in here.
 2025-05-15 16:29:03 +02:00
Martin Weinelt d0ac5ce64c flake.nix: annotate flake-compat usage 
It is not used within flake.nix, so add a note that it is used elsewhere.
 2025-05-15 16:29:03 +02:00
Martin Weinelt dccca0506a Provide direnv integration for flake devshell 2025-05-15 16:29:03 +02:00
Martin Weinelt 41e513da64 flake.nix: configure pre-commit 2025-05-15 16:29:03 +02:00
Martin Weinelt dd83a2c7ad dovecot: rename sieve bayes/ham learning script 
Updates the spamassasin reference to talk about rspamd.
 2025-05-15 16:16:17 +02:00
Martin Weinelt 235dba2d82 tests/external: ignore new xapian warnings 
These looks harmless.

Closes: #322
 2025-05-15 16:16:17 +02:00
Martin Weinelt edd828ca88 flake.lock: Update 
Flake lock file updates:

• Updated input 'flake-compat':
    'github:edolstra/flake-compat/0f9255e01c2351cc7d116c072cb317785dd33b33' (2023-10-04)
  → 'github:edolstra/flake-compat/9100a0f413b0c601e0533d1d94ffd501ce2e7885' (2025-05-12)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/23e89b7da85c3640bbc2173fe04f4bd114342367' (2024-11-19)
  → 'github:NixOS/nixpkgs/adaa24fbf46737f3f1b5497bf64bae750f82942e' (2025-05-13)
• Updated input 'nixpkgs-24_11':
    'github:NixOS/nixpkgs/314e12ba369ccdb9b352a4db26ff419f7c49fa84' (2024-12-13)
  → 'github:NixOS/nixpkgs/5d736263df906c5da72ab0f372427814de2f52f8' (2025-05-14)
 2025-05-15 16:16:16 +02:00
Martin Weinelt 1ce644871b flake.nix: ignore the flake registry 
There is no real benefit using it anyway.
 2025-05-15 16:16:16 +02:00
Martin Weinelt 1f82d59d67 ci: use hydra-cli from pinned nixpkgs 2025-05-10 21:18:17 +02:00
Martin Weinelt ef1e02e555 flake.nix: run tests against pinned nixpkgs 
and migrate to the new runTest, which evaluates much faster.
 2025-05-10 02:43:35 +02:00
Martin Weinelt b92870c240 treewide: drop nixops docs and examples 
This is not a deployment system we recommend using anymore in 2025.

Closes: #320
 2025-05-08 23:22:29 +02:00
Martin Weinelt a1ff289bf9 dovecot: migrate queue-status to UNIX domain socket 2025-05-07 18:00:53 +02:00
Martin Weinelt 86b48f368f tests: remove invalid escape sequences 
>>> "\@"
<stdin>:1: SyntaxWarning: invalid escape sequence '\@'
'\\@'
 2025-05-07 03:56:41 +02:00
Martin Weinelt 2e254b4b5e postfix: adjust comments around smtpd_recipient_restrictions 2025-05-07 02:52:28 +02:00
Martin Weinelt fac7efe946 postfix: Support opportunistic DANE TLS 
This migrates the security level for outgoing SMTP connections to
dane[1]. Either a server is configured for DANE or it now uses mandatory
unauthenticated TLS.

If DANE validation fails, the delivery will be tempfailed.

If DANE is invalid or unusable the connection will fall back to
unauthenticated mandatory TLS

This has been the default in various mail distributions:
- Mailcow since December 2016[2]
- mailinabox since July 2014[3]

[1] https://www.postfix.org/TLS_README.html#client_tls_dane
[2] https://github.com/mailcow/mailcow-dockerized/commit/47a5166383a4ecae780ffd6ad2081dc3f070bd45
[3] https://github.com/mail-in-a-box/mailinabox/commit/e713af5f5aeca202c2bf88be324472b3ef898dc7
 2025-05-07 02:23:32 +02:00
Martin Weinelt f6a64f713c docs/release-notes: advertise mailserver.forwards with ldap 2025-05-06 05:32:59 +02:00
Martin Weinelt 2d0b3fdeb0 README: Add automatic client configuration support to the roadmap 2025-05-06 03:37:23 +02:00
Martin Weinelt 4320259e34 README: add matrix room, reference libera connection information 2025-05-06 03:29:35 +02:00
Martin Weinelt 2520e662f7 tests/external: make DKIM signing test more explicit 2025-05-06 01:05:10 +02:00
Martin Weinelt 630b5c4fdd Use rspamd for DKIM signing, drop OpenDKIM 
OpenDKIM has not been updated in the last 7 years and failed to adopt
RFC8463, which introduces Ed25519-SHA256 signatures.

It has thereby held back the DKIM ecosystem, which relies on the DNS
system to publish its public keys. The DNS system in turn does not handle
large record sizes well (see RFC8301), which is why Ed25519 public keys
would be preferable, but I'm not sure the ecosystem has caught up, so we
stay on the conservative side with RSA for now.

Fixes: #203 #210 #279
Obsoletes: !162 !338
Supersedes: !246
 2025-05-06 01:05:10 +02:00
Martin Weinelt 8800bccab8 dovecot: fix config indent 2025-05-05 22:31:16 +02:00
Martin Weinelt 84bf0c0c07 README.md: remove mailing list information 
Has been unused since 2019, so it is not a good recommendation to
subscribe there anymore.
 2025-05-05 22:31:16 +02:00
Martin Weinelt a071813b97 README: reword feature list 
and remove the v2.0 release title.
 2025-05-05 22:31:15 +02:00