mix
656c4d4d7f
Optional inbound relay (backup-MX / forwarder) on port 25, off by default. Mail is accepted only for domains configured in the panel and forwarded to an upstream; there are still no mailboxes. A dedicated security review of the inbound path is still open on the plan (Fable). Added: - `INBOUND_RELAY_ENABLE` (default `false`): when true, Postfix listens on - Panel **Inbound** pages (global administrator): domains, upstream host/port - Optional `INBOUND_ANTISPAM_MILTER` on the inbound listener only, plus - Inbound rate limit (`INBOUND_RATE_LIMIT_MESSAGES_PER_IP`, default 20) and Changed: - Compose publishes host port 25 even when the flag is off (nothing listens - Full-backup restore Resync also rebuilds inbound maps when the flag is on. Full detail: CHANGELOG.md (1.4.0).
30 lines
1.2 KiB
YAML
30 lines
1.2 KiB
YAML
# Optional anti-spam sidecar for inbound relay (docs/plans/inbound-relay.md).
|
|
#
|
|
# SelfPost does not ship or start an anti-spam engine. This fragment brings up
|
|
# rspamd next to SelfPost and points the inbound smtpd milter at it. Merge it
|
|
# only when you want filtering on port 25:
|
|
#
|
|
# docker compose -f docker-compose.yml -f antispam/docker-compose.antispam.yml up -d
|
|
#
|
|
# Requires INBOUND_RELAY_ENABLE=true in .env. The milter sees the real client
|
|
# IP, HELO and PTR — unlike the upstream, which only sees SelfPost's address.
|
|
#
|
|
# Pin the rspamd tag the same way the SelfPost image is pinned; bump it
|
|
# deliberately. Default milter action is fail-open (accept) so a down sidecar
|
|
# does not block backup-MX. Set INBOUND_ANTISPAM_MILTER_ACTION=tempfail to
|
|
# defer instead.
|
|
|
|
services:
|
|
selfpost:
|
|
environment:
|
|
INBOUND_RELAY_ENABLE: "${INBOUND_RELAY_ENABLE:-true}"
|
|
INBOUND_ANTISPAM_MILTER: "${INBOUND_ANTISPAM_MILTER:-inet:antispam:11332}"
|
|
INBOUND_ANTISPAM_MILTER_ACTION: "${INBOUND_ANTISPAM_MILTER_ACTION:-accept}"
|
|
depends_on:
|
|
- antispam
|
|
|
|
antispam:
|
|
image: rspamd/rspamd:3.11
|
|
restart: unless-stopped
|
|
# No host ports: only SelfPost talks to the milter on the compose network.
|