add sender restrictions

README.md

@@ -1,5 +1,23 @@
 [Postfix](http://www.postfix.org/) with dovecot authentication and [rspamd](https://rspamd.com/) using postgres.
 
+# Database
+```
+create table if not exists virtual_domains (
+	name text primary key
+);
+
+create table if not exists virtual_users (
+	email text primary key,
+	domain_name text not null references virtual_domains(name)
+);
+
+create table if not exists virtual_aliases (
+	domain_name text not null references virtual_domains(name),
+	source text not null,
+	destination text not null
+);
+```
+
 # Volumes
 - `/etc/ssl/mail:ro`: certificates have to be here.
 

rootfs/etc/confd/conf.d/pgsql-login-maps.cf.toml

@@ -0,0 +1,3 @@
+[template]
+src = "pgsql-login-maps.cf.tmpl"
+dest = "/etc/postfix/pgsql-login-maps.cf"

rootfs/etc/confd/templates/main.cf.tmpl

@@ -62,6 +62,9 @@ smtpd_sasl_tls_security_options = noanonymous
 smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination
 smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination, reject_unverified_recipient
 
+smtpd_sender_restrictions = reject_sender_login_mismatch
+smtpd_sender_login_maps = pgsql:/etc/postfix/pgsql-login-maps.cf
+
 smtpd_milters={{getenv "RSPAMD_ADDRESS" "inet:127.0.0.1:11332"}}
 non_smtpd_milters=$smtpd_milters
 milter_mail_macros="i {mail_addr} {client_addr} {client_name} {auth_authen}"

rootfs/etc/confd/templates/pgsql-login-maps.cf.tmpl

@@ -0,0 +1,5 @@
+hosts = {{ getenv "DB_HOST" }}
+user = {{ getenv "DB_USER" "email" }}
+password = {{ getenv "DB_PASSWORD" }}
+dbname = {{ getenv "DB_NAME" "email" }}
+query = SELECT source FROM virtual_aliases WHERE destination='%s'

rootfs/etc/confd/templates/pgsql-virtual-mailbox-domains.cf.tmpl

@@ -2,4 +2,4 @@ hosts = {{ getenv "DB_HOST" }}
 user = {{ getenv "DB_USER" "email" }}
 password = {{ getenv "DB_PASSWORD" }}
 dbname = {{ getenv "DB_NAME" "email" }}
-query = SELECT 1 FROM virtual_domains WHERE name='%s'
+query = SELECT name FROM virtual_domains WHERE name='%s'

rootfs/etc/confd/templates/pgsql-virtual-mailbox-maps.cf.tmpl

@@ -2,4 +2,4 @@ hosts = {{ getenv "DB_HOST" }}
 user = {{ getenv "DB_USER" "email" }}
 password = {{ getenv "DB_PASSWORD" }}
 dbname = {{ getenv "DB_NAME" "email" }}
-query = SELECT 1 FROM virtual_users WHERE email ='%s'
+query = SELECT email FROM virtual_users WHERE email ='%s'