mix
2c7f0da3d8
Generate the relay config from the environment at container start (build/postfix-config.sh, run from entrypoint.sh): - smtps 465 (implicit TLS) primary + optional submission 587 (STARTTLS), chroot=n so smtpd reaches the sasldb2/sender map under /data. - Cyrus SASL against the panel-maintained sasldb2; realm left implicit so the authenticated name equals the bare login in smtpd_sender_login_maps. - reject_sender_login_mismatch + relay/recipient restrictions with no permit_mynetworks: credentials-only, open relay impossible (spec 5, 5.1). - TLS cert/key from TLS_CERT_FILE/TLS_KEY_FILE; daily postfix reload picks up renewed certs (postfix-cert-reload.sh under supervisord, spec 5.2). - anvil level-1 rate limit from env (spec 5 p.5). - Milter chain with per-milter action: OpenDKIM strict (tempfail), journal fail-open (accept) so monitoring never blocks the relay (spec 7.3). Two integration fixes found on the server: - postconf -F '*/*/chroot=n': Debian's chrooted delivery agent can't read /etc/resolv.conf, so MX lookups failed and mail never left. - entrypoint sets /run/opendkim and /run/selfpost to group selfpost + setgid, and the journal stub chmods its socket 0660, so postfix can connect to both milter sockets (strict OpenDKIM was milter-rejecting all mail otherwise). Verified on selfpost.example.com: gofmt/vet/test green, image builds; container e2e — 465 auth+send DKIM-signed (d=domain,s=selfpost), 587 STARTTLS auth, cross-domain sender 553, list-mode per-address binding, unauth relay 554, real outbound delivery reaching the recipient MX over TLS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
96 lines
3.8 KiB
Docker
96 lines
3.8 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# SelfPost — single Debian-slim image running postfix + opendkim + panel under
|
|
# supervisord (spec 4). Build from the repository root:
|
|
#
|
|
# docker build -f build/Dockerfile -t selfpost:dev --build-arg VERSION=dev .
|
|
|
|
# ---- build stage -------------------------------------------------------------
|
|
FROM golang:1.26-bookworm AS build
|
|
|
|
WORKDIR /src
|
|
|
|
# Version stamped into both binaries; MUST match the image tag (spec 7.5.A).
|
|
ARG VERSION=dev
|
|
|
|
# Module metadata first for layer caching. go.sum arrived in Phase 2 with the
|
|
# SQLite driver and bcrypt.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY cmd ./cmd
|
|
COPY internal ./internal
|
|
|
|
ENV CGO_ENABLED=0
|
|
RUN go vet ./... \
|
|
&& go build -trimpath \
|
|
-ldflags "-X codeberg.org/mix/selfpost/internal/buildinfo.Version=${VERSION}" \
|
|
-o /out/panel ./cmd/panel \
|
|
&& go build -trimpath \
|
|
-ldflags "-X codeberg.org/mix/selfpost/internal/buildinfo.Version=${VERSION}" \
|
|
-o /out/selfpost-backup ./cmd/selfpost-backup
|
|
|
|
# ---- runtime stage -----------------------------------------------------------
|
|
FROM debian:bookworm-slim AS runtime
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Preseed Postfix so its install is non-interactive and yields a working
|
|
# main.cf. The real relay configuration is generated by the panel in Phase 5.
|
|
RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
|
|
&& echo "postfix postfix/main_mailer_type string Internet Site" | debconf-set-selections \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
postfix \
|
|
opendkim \
|
|
opendkim-tools \
|
|
sasl2-bin \
|
|
libsasl2-modules \
|
|
supervisor \
|
|
logrotate \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Unprivileged user for the panel process (spec 7.6.8).
|
|
RUN useradd --system --no-create-home --shell /usr/sbin/nologin panel
|
|
|
|
# Shared group bridging the unprivileged services (spec 5.1, 6): the panel
|
|
# generates per-domain DKIM keys, application SASL accounts (sasldb2) and the
|
|
# Postfix sender map, while OpenDKIM and Postfix (different users) must read
|
|
# them. Membership in this group — plus setgid dirs under /data (set up in
|
|
# entrypoint.sh) — lets OpenDKIM read the panel-owned keys and lets Postfix read
|
|
# the sasldb2/sender map, and lets the panel reach the supervisor control socket
|
|
# to signal OpenDKIM/Postfix reloads without any process running as root.
|
|
RUN groupadd --system selfpost \
|
|
&& usermod -aG selfpost panel \
|
|
&& usermod -aG selfpost opendkim \
|
|
&& usermod -aG selfpost postfix
|
|
|
|
# Runtime directories: milter sockets and the consolidated persistent root.
|
|
RUN mkdir -p /run/opendkim /run/selfpost /data \
|
|
&& chown opendkim:opendkim /run/opendkim \
|
|
&& chown panel:panel /run/selfpost /data
|
|
|
|
COPY --from=build /out/panel /usr/local/bin/panel
|
|
COPY --from=build /out/selfpost-backup /usr/local/bin/selfpost-backup
|
|
|
|
COPY build/opendkim.conf /etc/opendkim.conf
|
|
COPY build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
|
|
COPY build/postfix-config.sh /usr/local/bin/postfix-config.sh
|
|
COPY build/postfix-cert-reload.sh /usr/local/bin/postfix-cert-reload.sh
|
|
COPY build/crashexit.py /usr/local/bin/crashexit.py
|
|
COPY build/entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
COPY build/supervisord.conf /etc/supervisor/supervisord.conf
|
|
RUN chmod +x /usr/local/bin/postfix-wrapper.sh /usr/local/bin/postfix-config.sh \
|
|
/usr/local/bin/postfix-cert-reload.sh /usr/local/bin/crashexit.py \
|
|
/usr/local/bin/entrypoint.sh
|
|
|
|
# Published submission ports: 465 (smtps, primary) and 587 (submission, optional)
|
|
# plus the panel on 8080. Outbound delivery dials remote MXs on 25 as a client,
|
|
# which needs no inbound listener or EXPOSE.
|
|
EXPOSE 8080 465 587
|
|
|
|
# The entrypoint fixes /data ownership (bind mount) as root, then execs
|
|
# supervisord, which becomes PID 1 and owns process supervision (spec 4).
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|