mix
2c7f0da3d8
Generate the relay config from the environment at container start (build/postfix-config.sh, run from entrypoint.sh): - smtps 465 (implicit TLS) primary + optional submission 587 (STARTTLS), chroot=n so smtpd reaches the sasldb2/sender map under /data. - Cyrus SASL against the panel-maintained sasldb2; realm left implicit so the authenticated name equals the bare login in smtpd_sender_login_maps. - reject_sender_login_mismatch + relay/recipient restrictions with no permit_mynetworks: credentials-only, open relay impossible (spec 5, 5.1). - TLS cert/key from TLS_CERT_FILE/TLS_KEY_FILE; daily postfix reload picks up renewed certs (postfix-cert-reload.sh under supervisord, spec 5.2). - anvil level-1 rate limit from env (spec 5 p.5). - Milter chain with per-milter action: OpenDKIM strict (tempfail), journal fail-open (accept) so monitoring never blocks the relay (spec 7.3). Two integration fixes found on the server: - postconf -F '*/*/chroot=n': Debian's chrooted delivery agent can't read /etc/resolv.conf, so MX lookups failed and mail never left. - entrypoint sets /run/opendkim and /run/selfpost to group selfpost + setgid, and the journal stub chmods its socket 0660, so postfix can connect to both milter sockets (strict OpenDKIM was milter-rejecting all mail otherwise). Verified on selfpost.example.com: gofmt/vet/test green, image builds; container e2e — 465 auth+send DKIM-signed (d=domain,s=selfpost), 587 STARTTLS auth, cross-domain sender 553, list-mode per-address binding, unauth relay 554, real outbound delivery reaching the recipient MX over TLS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SelfPost
Self-hosted outbound SMTP relay with a web control panel, shipped as a single
Docker image. Postfix + OpenDKIM + a small Go panel run together under
supervisord; the panel manages multiple sending domains, per-domain DKIM keys
and SASL-authenticated applications bound to their domain.
SelfPost sends mail straight to the internet from your own IP, with DKIM signing, and is configured once through the panel. It is outbound only — it does not receive mail, provide mailboxes, or offer webmail.
Status: under active development. See docs/specification.md for the full requirements and docs/implementation-plan.md for the phased build plan.
Requirements (site prerequisites)
SelfPost assumes the host already provides the conditions for sending from your own IP — an unblocked outbound port 25, a static IP, configurable PTR/rDNS and a reasonable IP reputation. Providing these is the operator's job, not a feature of SelfPost. Detailed deployment docs land in a later phase.
Repository
- Primary: https://codeberg.org/mix/selfpost
- Mirror: https://github.com/mixeme/selfpost
License
AGPL-3.0. The AGPL closes the "SaaS loophole": if you run a modified version as a network-accessible service, you must make the modified source available to its users — not only when you distribute copies of the code.