postfix/README.md

[Postfix](http://www.postfix.org/) with ldap authentication and [spamassassin](http://spamassassin.apache.org/) + [OpenDKIM](http://www.opendkim.org/) in ldap.

# Volumes
- `/etc/ssl/mail:ro`: certificates have to be here.

# Environment Variables
## MYHOSTNAME
Fully qualified hostname.

## MYDOMAIN
The internet domain name of the mail system.

## SMTP_BANNER
Text prepended to `$myhostname ESMTP $mail_name` for the smtp banner.

## SPAMASSASSIN_HOST
Hostname for the spamassassin host.

## DOVECOT_HOST
Hostname for the dovecot host.

## DOVECOT_AUTH_PORT
Port for the dovecot host.

## DKIM_HOST
Hostname for the OpenDkim host.

## DKIM_PORT
Port for the OpenDkim host.

## LMTP_HOST
Hostname for the lmtp host (probably dovecot).

## LMTP_PORT
Port for the lmtp host.

## LDAP_URI
Complete uri for the authentication ldap host.

## LDAP_BIND_DN
DN used to authenticate against ldap.

## LDAP_BIND_PASSWORD
Password used to authenticate against ldap.

## LDAP_ALIAS_QUERY_FILTER
Ldap filter for mail aliases.

## LDAP_DOMAIN_QUERY_FILTER
Ldap filter for domains.

## LDAP_MAILBOX_QUERY_FILTER
Ldap filter for mailboxes.

## LDAP_MAILBOX_SEARCH_BASE
Base DN to look for mailboxes on the ldap host.

## LDAP_DOMAIN_SEARCH_BASE
Base DN to look for valid domains on the ldap host.

## LDAP_DOMAIN_RESULT_ATTRIBUTE
- default: dc

Ldap attribute that is fetched in the domain query.

## LDAP_MAILBOX_RESULT_ATTRIBUTE
- default: cn

Ldap attribute that is fetched in the mailbox query.

## LDAP_STARTTLS
- default: yes

Whether to use tls when connecting to the ldap host.

## CERT_DOMAIN
Name of the certificate domain.

Name of the key file.

## MESSAGE_SIZELIMIT
- default: 20000000

Message size limit in bytes.

## MAILBOX_SIZELIMIT
- default: 0

Mailbox size limit in bytes. `0` disables the limit.

## TLS_SECURITY_LEVEL
- default: may

One of:
- none: TLS will not be used.
- may: Opportunistic TLS: announce STARTTLS support to remote SMTP clients, but do not require that clients use TLS encryption.
- encrypt: Mandatory TLS encryption: announce STARTTLS support to remote SMTP clients, and require that clients use TLS encryption.
  According to [RFC 2487](http://tools.ietf.org/html/rfc2487) this MUST NOT be applied in case of a publicly-referenced SMTP server.

## TLS_PROTOCOLS
- default: !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

Comma seperated list of accepted TLS protocols.

## TLS_CIPHERS
- default: high

The minimum TLS cipher grade that the Postfix SMTP server will use with opportunistic TLS encryption.

## TLS_EXCLUDE_CIPHERS
- default: aNULL, MD5, 3DES

Comma seperated list of ciphers or cipher types to exclude from the SMTP server cipher list at all TLS security levels.

# Ports
- 25
- 587

# Capabilities
- DAC_OVERRIDE
- NET_BIND_SERVICE
- SETGID
- SETUID
Create README.md 2016-10-28 11:05:33 +00:00			`[Postfix](http://www.postfix.org/) with ldap authentication and [spamassassin](http://spamassassin.apache.org/) + [OpenDKIM](http://www.opendkim.org/) in ldap.`

Update README.md 2016-10-31 10:14:36 +00:00			`# Volumes`
Create README.md 2016-10-28 11:05:33 +00:00			- `/etc/ssl/mail:ro`: certificates have to be here.

Update README.md 2016-10-31 10:14:36 +00:00			`# Environment Variables`
			`## MYHOSTNAME`
Create README.md 2016-10-28 11:05:33 +00:00			`Fully qualified hostname.`

Update README.md 2016-10-31 10:14:36 +00:00			`## MYDOMAIN`
Create README.md 2016-10-28 11:05:33 +00:00			`The internet domain name of the mail system.`

Update README.md 2016-10-31 10:14:36 +00:00			`## SMTP_BANNER`
Create README.md 2016-10-28 11:05:33 +00:00			Text prepended to `$myhostname ESMTP $mail_name` for the smtp banner.

Update README.md [skip ci] 2017-01-04 15:01:33 +00:00			`## SPAMASSASSIN_HOST`
			`Hostname for the spamassassin host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## DOVECOT_HOST`
Create README.md 2016-10-28 11:05:33 +00:00			`Hostname for the dovecot host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## DOVECOT_AUTH_PORT`
Create README.md 2016-10-28 11:05:33 +00:00			`Port for the dovecot host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## DKIM_HOST`
Create README.md 2016-10-28 11:05:33 +00:00			`Hostname for the OpenDkim host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## DKIM_PORT`
Create README.md 2016-10-28 11:05:33 +00:00			`Port for the OpenDkim host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LMTP_HOST`
Create README.md 2016-10-28 11:05:33 +00:00			`Hostname for the lmtp host (probably dovecot).`

Update README.md 2016-10-31 10:14:36 +00:00			`## LMTP_PORT`
Create README.md 2016-10-28 11:05:33 +00:00			`Port for the lmtp host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_URI`
Create README.md 2016-10-28 11:05:33 +00:00			`Complete uri for the authentication ldap host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_BIND_DN`
Create README.md 2016-10-28 11:05:33 +00:00			`DN used to authenticate against ldap.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_BIND_PASSWORD`
Create README.md 2016-10-28 11:05:33 +00:00			`Password used to authenticate against ldap.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_ALIAS_QUERY_FILTER`
Create README.md 2016-10-28 11:05:33 +00:00			`Ldap filter for mail aliases.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_DOMAIN_QUERY_FILTER`
Create README.md 2016-10-28 11:05:33 +00:00			`Ldap filter for domains.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_MAILBOX_QUERY_FILTER`
Create README.md 2016-10-28 11:05:33 +00:00			`Ldap filter for mailboxes.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_MAILBOX_SEARCH_BASE`
Create README.md 2016-10-28 11:05:33 +00:00			`Base DN to look for mailboxes on the ldap host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_DOMAIN_SEARCH_BASE`
Create README.md 2016-10-28 11:05:33 +00:00			`Base DN to look for valid domains on the ldap host.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_DOMAIN_RESULT_ATTRIBUTE`
Create README.md 2016-10-28 11:05:33 +00:00			`- default: dc`

			`Ldap attribute that is fetched in the domain query.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_MAILBOX_RESULT_ATTRIBUTE`
Create README.md 2016-10-28 11:05:33 +00:00			`- default: cn`

			`Ldap attribute that is fetched in the mailbox query.`

Update README.md 2016-10-31 10:14:36 +00:00			`## LDAP_STARTTLS`
Create README.md 2016-10-28 11:05:33 +00:00			`- default: yes`

			`Whether to use tls when connecting to the ldap host.`

add use gitlab docker registry 2017-09-22 12:32:42 +00:00			`## CERT_DOMAIN`
			`Name of the certificate domain.`
Create README.md 2016-10-28 11:05:33 +00:00
			`Name of the key file.`

Update README.md 2016-10-31 10:14:36 +00:00			`## MESSAGE_SIZELIMIT`
Create README.md 2016-10-28 11:05:33 +00:00			`- default: 20000000`

			`Message size limit in bytes.`

Update README.md 2016-10-31 10:14:36 +00:00			`## MAILBOX_SIZELIMIT`
Create README.md 2016-10-28 11:05:33 +00:00			`- default: 0`

			Mailbox size limit in bytes. `0` disables the limit.

Update README.md 2016-10-31 10:14:36 +00:00			`## TLS_SECURITY_LEVEL`
update readme 2019-02-18 13:48:56 +00:00			`- default: may`
Create README.md 2016-10-28 11:05:33 +00:00
			`One of:`
add use gitlab docker registry 2017-09-22 12:32:42 +00:00			`- none: TLS will not be used.`
			`- may: Opportunistic TLS: announce STARTTLS support to remote SMTP clients, but do not require that clients use TLS encryption.`
			`- encrypt: Mandatory TLS encryption: announce STARTTLS support to remote SMTP clients, and require that clients use TLS encryption.`
Create README.md 2016-10-28 11:05:33 +00:00			`According to [RFC 2487](http://tools.ietf.org/html/rfc2487) this MUST NOT be applied in case of a publicly-referenced SMTP server.`

Update README.md 2016-10-31 10:14:36 +00:00			`## TLS_PROTOCOLS`
use multistage docker build 2019-02-18 13:48:21 +00:00			`- default: !SSLv2, !SSLv3, !TLSv1, !TLSv1.1`
Create README.md 2016-10-28 11:05:33 +00:00
			`Comma seperated list of accepted TLS protocols.`

Update README.md 2016-10-31 10:14:36 +00:00			`## TLS_CIPHERS`
Create README.md 2016-10-28 11:05:33 +00:00			`- default: high`

			`The minimum TLS cipher grade that the Postfix SMTP server will use with opportunistic TLS encryption.`

Update README.md 2016-10-31 10:14:36 +00:00			`## TLS_EXCLUDE_CIPHERS`
Create README.md 2016-10-28 11:05:33 +00:00			`- default: aNULL, MD5, 3DES`

			`Comma seperated list of ciphers or cipher types to exclude from the SMTP server cipher list at all TLS security levels.`

Update README.md 2016-10-31 10:14:36 +00:00			`# Ports`
Create README.md 2016-10-28 11:05:33 +00:00			`- 25`
			`- 587`

Update README.md 2016-10-31 10:14:36 +00:00			`# Capabilities`
Create README.md 2016-10-28 11:05:33 +00:00			`- DAC_OVERRIDE`
			`- NET_BIND_SERVICE`
			`- SETGID`
			`- SETUID`