release.yaml (14913B)
1 apiVersion: helm.toolkit.fluxcd.io/v2 2 kind: HelmRelease 3 metadata: 4 name: mailserver 5 namespace: mailserver 6 spec: 7 releaseName: mailserver 8 interval: 60m 9 chart: 10 spec: 11 version: "5.x.x" 12 chart: docker-mailserver 13 sourceRef: 14 kind: HelmRepository 15 name: mailserver 16 values: 17 certificate: mail.midnightthoughts.space-tls 18 deployment: 19 env: 20 OVERRIDE_HOSTNAME: mail.midnightthoughts.space 21 # ----------------------------------------------- 22 # --- General Section --------------------------- 23 # ----------------------------------------------- 24 LOG_LEVEL: info 25 SUPERVISOR_LOGLEVEL: 26 DMS_VMAIL_UID: 27 DMS_VMAIL_GID: 28 ACCOUNT_PROVISIONER: 29 POSTMASTER_ADDRESS: postmaster@midnightthoughts.space 30 ENABLE_UPDATE_CHECK: 1 31 UPDATE_CHECK_INTERVAL: 1d 32 PERMIT_DOCKER: none 33 TZ: Europe/Berlin 34 NETWORK_INTERFACE: 35 TLS_LEVEL: 36 SPOOF_PROTECTION: 37 ENABLE_MTA_STS: 1 38 ENABLE_SRS: 0 39 ENABLE_OPENDKIM: 0 40 ENABLE_OPENDMARC: 0 41 ENABLE_POLICYD_SPF: 0 42 ENABLE_POP3: 0 43 ENABLE_IMAP: 1 44 ENABLE_CLAMAV: 0 45 ENABLE_RSPAMD: 1 46 ENABLE_RSPAMD_REDIS: 1 47 RSPAMD_LEARN: 1 48 RSPAMD_CHECK_AUTHENTICATED: 1 49 RSPAMD_GREYLISTING: 1 50 RSPAMD_HFILTER: 1 51 RSPAMD_HFILTER_HOSTNAME_UNKNOWN_SCORE: 3 52 RSPAMD_NEURAL: 0 53 ENABLE_AMAVIS: 0 54 AMAVIS_LOGLEVEL: 0 55 ENABLE_DNSBL: 0 56 # TODO: Setup proxy protocol in postfix and dovecot and envoy (See also https://docker-mailserver.github.io/docker-mailserver/latest/examples/tutorials/mailserver-behind-proxy/) 57 ENABLE_FAIL2BAN: 0 58 FAIL2BAN_BLOCKTYPE: drop 59 ENABLE_MANAGESIEVE: 60 POSTSCREEN_ACTION: enforce 61 SMTP_ONLY: 62 # These values are automatically set by the chart based on the certificate key 63 # SSL_TYPE: 64 # SSL_CERT_PATH: 65 # SSL_KEY_PATH: 66 SSL_ALT_CERT_PATH: 67 SSL_ALT_KEY_PATH: 68 VIRUSMAILS_DELETE_DELAY: 69 POSTFIX_DAGENT: 70 POSTFIX_MAILBOX_SIZE_LIMIT: 71 ENABLE_QUOTAS: 1 72 POSTFIX_MESSAGE_SIZE_LIMIT: 73 CLAMAV_MESSAGE_SIZE_LIMIT: 74 PFLOGSUMM_TRIGGER: 75 PFLOGSUMM_RECIPIENT: 76 PFLOGSUMM_SENDER: 77 LOGWATCH_INTERVAL: 78 LOGWATCH_RECIPIENT: 79 LOGWATCH_SENDER: 80 REPORT_RECIPIENT: 81 REPORT_SENDER: 82 LOGROTATE_COUNT: 7 83 LOGROTATE_INTERVAL: daily 84 POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME: 0 85 POSTFIX_INET_PROTOCOLS: all 86 DOVECOT_INET_PROTOCOLS: all 87 # ----------------------------------------------- 88 # --- SpamAssassin Section ---------------------- 89 # ----------------------------------------------- 90 ENABLE_SPAMASSASSIN: 0 91 ENABLE_SPAMASSASSIN_KAM: 0 92 SPAMASSASSIN_SPAM_TO_INBOX: 1 93 MOVE_SPAM_TO_JUNK: 1 94 MARK_SPAM_AS_READ: 0 95 SA_TAG: 2.0 96 SA_TAG2: 6.31 97 SA_KILL: 10.0 98 SPAM_SUBJECT: "***SPAM*** " 99 # ----------------------------------------------- 100 # --- Fetchmail Section ------------------------- 101 # ----------------------------------------------- 102 ENABLE_FETCHMAIL: 0 103 FETCHMAIL_POLL: 300 104 FETCHMAIL_PARALLEL: 0 105 ENABLE_GETMAIL: 0 106 GETMAIL_POLL: 5 107 # ----------------------------------------------- 108 # --- LDAP Section ------------------------------ 109 # ----------------------------------------------- 110 LDAP_START_TLS: 111 LDAP_SERVER_HOST: 112 LDAP_SEARCH_BASE: 113 LDAP_BIND_DN: 114 LDAP_BIND_PW: 115 LDAP_QUERY_FILTER_USER: 116 LDAP_QUERY_FILTER_GROUP: 117 LDAP_QUERY_FILTER_ALIAS: 118 LDAP_QUERY_FILTER_DOMAIN: 119 # ----------------------------------------------- 120 # --- Dovecot Section --------------------------- 121 # ----------------------------------------------- 122 DOVECOT_TLS: 123 DOVECOT_USER_FILTER: 124 DOVECOT_PASS_FILTER: 125 DOVECOT_MAILBOX_FORMAT: maildir 126 DOVECOT_AUTH_BIND: 127 # ----------------------------------------------- 128 # --- Postgrey Section -------------------------- 129 # ----------------------------------------------- 130 ENABLE_POSTGREY: 0 131 POSTGREY_DELAY: 300 132 POSTGREY_MAX_AGE: 35 133 POSTGREY_TEXT: "Delayed by Postgrey" 134 POSTGREY_AUTO_WHITELIST_CLIENTS: 5 135 # ----------------------------------------------- 136 # --- SASL Section ------------------------------ 137 # ----------------------------------------------- 138 ENABLE_SASLAUTHD: 0 139 SASLAUTHD_MECHANISMS: 140 SASLAUTHD_MECH_OPTIONS: 141 SASLAUTHD_LDAP_SERVER: 142 SASLAUTHD_LDAP_BIND_DN: 143 SASLAUTHD_LDAP_PASSWORD: 144 SASLAUTHD_LDAP_SEARCH_BASE: 145 SASLAUTHD_LDAP_FILTER: 146 SASLAUTHD_LDAP_START_TLS: 147 SASLAUTHD_LDAP_TLS_CHECK_PEER: 148 SASLAUTHD_LDAP_TLS_CACERT_FILE: 149 SASLAUTHD_LDAP_TLS_CACERT_DIR: 150 SASLAUTHD_LDAP_PASSWORD_ATTR: 151 SASLAUTHD_LDAP_AUTH_METHOD: 152 SASLAUTHD_LDAP_MECH: 153 # ----------------------------------------------- 154 # --- SRS Section ------------------------------- 155 # ----------------------------------------------- 156 SRS_SENDER_CLASSES: envelope_sender 157 SRS_EXCLUDE_DOMAINS: 158 SRS_SECRET: 159 # ----------------------------------------------- 160 # --- Default Relay Host Section ---------------- 161 # ----------------------------------------------- 162 DEFAULT_RELAY_HOST: 163 # ----------------------------------------------- 164 # --- Multi-Domain Relay Section ---------------- 165 # ----------------------------------------------- 166 RELAY_HOST: 167 RELAY_PORT: 25 168 RELAY_USER: 169 RELAY_PASSWORD: 170 resources: 171 requests: 172 cpu: 249m 173 memory: 294Mi 174 limits: 175 ephemeral-storage: 2Gi 176 extraVolumeMounts: 177 - name: mailman-opt 178 mountPath: /etc/postfix/mailman 179 subPath: var/data 180 readOnly: true 181 extraVolumes: 182 - name: mailman-opt 183 persistentVolumeClaim: 184 claimName: mailman-opt-mailman-0 185 - name: mail-log 186 emptyDir: {} 187 service: 188 #annotations: 189 # external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space 190 type: ClusterIP 191 # nodePort: 192 # smtp: 25 193 # smtps: 465 194 # submission: 587 195 # imap: 143 196 # imaps: 993 197 persistent_volume_claims: 198 mail-config: 199 accessModes: 200 - ReadWriteOnce 201 storageClass: longhorn 202 existingClaim: "mailserver-docker-mailserver-mail-config" 203 mail-data: 204 accessModes: 205 - ReadWriteOnce 206 storageClass: longhorn 207 existingClaim: "mailserver-docker-mailserver-mail-data" 208 mail-state: 209 accessModes: 210 - ReadWriteOnce 211 storageClass: longhorn 212 existingClaim: "mailserver-docker-mailserver-mail-state" 213 mail-log: 214 enabled: false 215 persistence: 216 # Stores generated configuration files 217 # https://docker-mailserver.github.io/docker-mailserver/edge/faq/#what-about-the-docker-datadmsconfig-directory 218 mail-config: 219 volumeName: mail-config 220 mountPath: /tmp/docker-mailserver 221 subPath: 222 223 # Stores emails 224 mail-data: 225 volumeName: mail-data 226 mountPath: /var/mail 227 subPath: 228 229 # Stores state for Postfix, Dovecot, Fail2Ban, Amavis, PostGrey, ClamAV, SpamAssassin, Rspamd & Redis 230 # https://docker-mailserver.github.io/docker-mailserver/edge/faq/#what-about-the-docker-datadmsmail-state-directory 231 mail-state: 232 volumeName: mail-state 233 mountPath: /var/mail-state 234 subPath: 235 236 # Store mail logs 237 mail-log: 238 volumeName: mail-log 239 mountPath: /var/log/mail 240 subPath: 241 242 rspamd: 243 ingress: 244 enabled: false 245 ingressClassName: traefik 246 annotations: 247 cert-manager.io/cluster-issuer: letsencrypt-dns 248 external-dns.alpha.kubernetes.io/hostname: midnightthoughts.space 249 host: rspamd.midnightthoughts.space 250 tls: 251 enabled: true 252 secret: rspamd.midnightthoughts.space-tls 253 proxyProtocol: 254 enabled: true 255 trustedNetworks: "10.0.0.0/8" 256 configMaps: 257 dovecot.cf: 258 create: true 259 path: dovecot.cf 260 data: | 261 {{- if .Values.proxyProtocol.enabled }} 262 haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks }} 263 264 {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }} 265 service imap-login { 266 inet_listener imap { 267 port = 143 268 } 269 270 inet_listener imaps { 271 port = 993 272 ssl = yes 273 } 274 275 inet_listener imap_proxyprotocol { 276 haproxy = yes 277 port = 10143 278 ssl = no 279 } 280 281 inet_listener imaps_proxyprotocol { 282 haproxy = yes 283 port = 10993 284 ssl = yes 285 } 286 } 287 {{- end -}} 288 289 {{- if and (.Values.deployment.env.ENABLE_POP3) (not .Values.deployment.env.SMTP_ONLY) }} 290 service pop3-login { 291 inet_listener pop3 { 292 port = 110 293 } 294 295 inet_listener pop3s { 296 port = 995 297 ssl = yes 298 } 299 300 inet_listener pop3_proxyprotocol { 301 haproxy = yes 302 port = 10110 303 ssl = no 304 } 305 306 inet_listener pop3s_proxyprotocol { 307 haproxy = yes 308 port = 10995 309 ssl = yes 310 } 311 } 312 {{- end -}} 313 314 {{- if and (.Values.deployment.env.ENABLE_MANAGESIEVE) (not .Values.deployment.env.SMTP_ONLY) }} 315 service managesieve-login { 316 inet_listener sieve { 317 port = 4190 318 } 319 320 inet_listener sieve_proxyprotocol { 321 haproxy = yes 322 port = 14190 323 } 324 } 325 {{- end -}} 326 {{- end -}} 327 fts-xapian-plugin.conf: 328 create: true 329 path: /etc/dovecot/conf.d/10-plugin.conf 330 data: | 331 {{- if .Values.dovecot.fullTextSearch.enabled }} 332 mail_plugins = $mail_plugins fts fts_xapian 333 334 plugin { 335 fts = xapian 336 fts_xapian = partial=3 full=20 verbose={{ .Values.dovecot.fullTextSearch.verbose }} 337 338 fts_autoindex = yes 339 fts_enforced = yes 340 341 # Index attachements 342 fts_decoder = decode2text 343 } 344 345 service indexer-worker { 346 # limit size of indexer-worker RAM usage, ex: 512MB, 1GB, 2GB 347 vsz_limit = {{ .Values.dovecot.fullTextSearch.resources.memory }} 348 } 349 {{- end -}} 350 postfix-main.cf: 351 create: true 352 path: postfix-main.cf 353 data: | 354 {{- if .Values.proxyProtocol.enabled }} 355 postscreen_cache_map = proxy:btree:$data_directory/postscreen_12525_cache 356 {{- end }} 357 recipient_delimiter = + 358 unknown_local_recipient_reject_code = 550 359 owner_request_special = no 360 transport_maps = hash:/etc/postfix/phorge_transport regexp:/etc/postfix/mailman/postfix_lmtp 361 local_recipient_maps = $alias_maps regexp:/etc/postfix/mailman/postfix_lmtp 362 virtual_mailbox_domains = texthash:/etc/postfix/vmailbox regexp:/etc/postfix/mailman/postfix_lmtp 363 relay_domains = phorge.mtrnord.blog {{`${{$compatibility_level} < {2} ? {$mydestination} : {}}`}} regexp:/etc/postfix/mailman/postfix_domains 364 user-patches.sh: 365 create: true 366 path: user-patches.sh 367 data: | 368 #!/bin/bash 369 370 {{- if .Values.proxyProtocol.enabled }} 371 # NOTE: Keep in sync with upstream advice: 372 # https://github.com/docker-mailserver/docker-mailserver/blob/v15.0.0/docs/content/examples/tutorials/mailserver-behind-proxy.md?plain=1#L238-L268 373 374 # Duplicate the config for the submission(s) service ports (587 / 465) with adjustments for the PROXY ports (10587 / 10465) and `syslog_name` setting: 375 postconf -Mf submission/inet | sed -e s/^submission/10587/ -e 's/submission/submission-proxyprotocol/' >> /etc/postfix/master.cf 376 postconf -Mf submissions/inet | sed -e s/^submissions/10465/ -e 's/submissions/submissions-proxyprotocol/' >> /etc/postfix/master.cf 377 # Enable PROXY Protocol support for these new service variants: 378 postconf -P 10587/inet/smtpd_upstream_proxy_protocol=haproxy 379 postconf -P 10465/inet/smtpd_upstream_proxy_protocol=haproxy 380 381 # Create a variant for port 25 too (NOTE: Port 10025 is already assigned in DMS to Amavis): 382 postconf -Mf smtp/inet | sed -e s/^smtp/12525/ >> /etc/postfix/master.cf 383 # Enable PROXY Protocol support (different setting as port 25 is handled via postscreen), optionally configure a `syslog_name` to distinguish in logs: 384 postconf -P 12525/inet/postscreen_upstream_proxy_protocol=haproxy 12525/inet/postscreen_cache_map=proxy:btree:\$data_directory/postscreen_12525_cache 12525/inet/syslog_name=postfix/smtpd-proxyprotocol 385 {{- end }} 386 387 # Relay transport for phorge.mtrnord.blog → dns-a (10.0.64.129) on Hetzner private network 388 printf 'phorge.mtrnord.blog\tsmtp:[10.0.64.129]:25\n' > /etc/postfix/phorge_transport 389 postmap /etc/postfix/phorge_transport 390 custom-commands.conf: 391 create: true 392 path: rspamd/custom-commands.conf 393 data: | 394 set-option-for-controller password "$2$za4wi4q5hwmypty9oe65xzhgonxwe5cx$wfqdx11iozg5cs9gnni3zfmopqqhqtmh75xw3848twrhw8f1eyiy" 395 arc.conf: 396 create: true 397 path: rspamd/override.d/arc.conf 398 data: | 399 sign_local = true; 400 sign_authenticated = true; 401 402 domain { 403 mail.midnightthoughts.space { 404 path = "/tmp/docker-mailserver/rspamd/dkim/rsa-2048-mail-mail.midnightthoughts.space.private.txt"; 405 selector = "mail"; 406 }, 407 midnightthoughts.space { 408 path = "/tmp/docker-mailserver/rspamd/dkim/rsa-2048-mail-midnightthoughts.space.private.txt"; 409 selector = "mail"; 410 } 411 }