Postfix - Revision history

Tie-ling: add category

2025-09-19T08:51:28Z

add category

← Older revision		Revision as of 08:51, 19 September 2025
Line 113:		Line 113:
	};		};
	</syntaxhighlight>		</syntaxhighlight>


			[[Category:Mail Server]]
			[[Category:Server]]

Tie-ling: /* Domain and SSL setup */ add tip on cert permissions

2025-09-19T08:13:12Z

Domain and SSL setup: add tip on cert permissions

← Older revision		Revision as of 08:13, 19 September 2025
Line 61:		Line 61:
	};		};
	</syntaxhighlight>		</syntaxhighlight>

			You also need to set proper file permissions on the cert directory and key files.
			See [[ACME#Integration_with_service_modules]].

	= Setup virtual map with regex =		= Setup virtual map with regex =

Tie-ling: /* Domain and SSL setup */ use domain name

2025-09-19T08:02:39Z

Domain and SSL setup: use domain name

← Older revision		Revision as of 08:02, 19 September 2025
Line 53:		Line 53:
	# hostname of mail server, should be fqdn		# hostname of mail server, should be fqdn
	hostname = "mail.${domainName}";		hostname = "mail.${domainName}";

			# domain of the email address that this postfix is hosting
			domain = "${domainName}";

	sslCert = "${sslCertDir}/fullchain.pem";		sslCert = "${sslCertDir}/fullchain.pem";

Tie-ling: outgoing traffic on port 25

2025-09-19T07:57:20Z

outgoing traffic on port 25

← Older revision		Revision as of 07:57, 19 September 2025
Line 10:		Line 10:

	Warning: this Postfix configuration is a minimal working example and		Warning: this Postfix configuration is a minimal working example and
	not hardened. That means, if port 25 is not blocked, spammers might		not hardened. That means, if outgoing traffic on port 25 is not blocked, spammers might hijack your Postfix instance for spamming activities. Refer to
	hijack your Postfix instance for spamming activities. Refer to
	internet literature for hardening tips.		internet literature for hardening tips.

Tie-ling: /* Map email addresses to mail boxes */ fix local file

2025-09-19T07:54:28Z

Map email addresses to mail boxes: fix local file

← Older revision		Revision as of 07:54, 19 September 2025
Line 78:		Line 78:
	# Example line: maps you@example.com to mailbox path		# Example line: maps you@example.com to mailbox path
	# you@example.com example.com/you/Maildir/		# you@example.com example.com/you/Maildir/
	virtual_mailbox_maps = "./virtual_mailbox_maps";		virtual_mailbox_maps = ./virtual_mailbox_maps;
	};		};

Tie-ling: init

2025-09-19T07:53:37Z

init

New page

Postfix is mail transfer agent (MTA) that routes and delivers
electronic mail. It accepts email from other email servers and relays
sent email from a email client.

This page describes a basic virtual user setup with [[Dovecot]]. User
authentication is configured in a separate passwd-file and thus
decoupled from system users. Authentication is handled by
[[Dovecot]]. Refer to that article for details.

Warning: this Postfix configuration is a minimal working example and
not hardened. That means, if port 25 is not blocked, spammers might
hijack your Postfix instance for spamming activities. Refer to
internet literature for hardening tips.

= SSL Certificate with ACME =

This article assumes a working [[ACME]] configuration for certificate
renewal.

<syntaxhighlight lang="nix">
{
config,
...
}:
let
sslCertDir = config.security.acme.certs."example.org".directory;
domainName = "example.org";
in
{
# further postfix configuration goes here
...
}
</syntaxhighlight>

= Open firewall ports =

Open firewall ports for SMTP and SMTPS traffic.

<syntaxhighlight lang="nix">
networking.firewall.allowedTCPPorts = [
25 # smtp
465 # smtps
];
</syntaxhighlight>

= Domain and SSL setup =
<syntaxhighlight lang="nix">
services.postfix = {
enable = true;
enableSubmission = true;
enableSubmissions = true;

# hostname of mail server, should be fqdn
hostname = "mail.${domainName}";

sslCert = "${sslCertDir}/fullchain.pem";
sslKey = "${sslCertDir}/key.pem";
};
</syntaxhighlight>

= Setup virtual map with regex =
<syntaxhighlight lang="nix">
services.postfix = {
# regexp wildcard: redirect every mail to @example.org to my account
virtualMapType = "regexp";
virtual = ''/.*@example.org/ admin@example.org'';
};
</syntaxhighlight>

= Map email addresses to mail boxes =
<syntaxhighlight lang="nix">
services.postfix = {
# mapFiles listed here will be processed and hashed, ready for use
# with postfix. specify hashed maps in "config" section below
mapFiles = {
# Maildir/ MUST have trailing slash
# Example line: maps you@example.com to mailbox path
# you@example.com example.com/you/Maildir/
virtual_mailbox_maps = "./virtual_mailbox_maps";
};

config = {
# details see https://www.postfix.org/VIRTUAL_README.html
# and example etc files below
virtual_mailbox_base = "/var/spool/mail/vmail/";
virtual_mailbox_maps = "hash:/etc/postfix/virtual_mailbox_maps";

# list of all domains configured
virtual_mailbox_domains = "${domainName}";

# let postfix use vmail user for accessing virtual_mail_base
# hardcoded below in users.user option
virtual_uid_maps = "static:994";
virtual_gid_maps = "static:993";
};
};

# /var/spool/mail/vmail needs to be created and owned by vmail
# vmail user is created in dovecot config file
users.users."vmail" = {
# used by postfix config virtual uid maps
uid = 994;
};
users.groups."vmail" = {
# used by postfix config virtual gid maps
gid = 993;
};
</syntaxhighlight>