main.cf.j2 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106
  1. {% if ansible_prolog -%}
  2. {% from 'templates/ansible/prolog.j2' import prolog with context %}
  3. {{ prolog() }}
  4. {% endif -%}
  5. # See /usr/share/postfix/main.cf.dist for a commented, more complete version
  6. # Debian specific: Specifying a file name will cause the first
  7. # line of that file to be used as the name. The Debian default
  8. # is /etc/mailname.
  9. smtpd_banner = $myhostname ESMTP $mail_name
  10. biff = no
  11. # appending .domain is the MUA's job.
  12. append_dot_mydomain = no
  13. # Uncomment the next line to generate "delayed mail" warnings
  14. #delay_warning_time = 4h
  15. readme_directory = no
  16. # TLS parameters
  17. smtpd_tls_security_level = may
  18. smtpd_tls_loglevel = 1
  19. smtpd_tls_received_header = yes
  20. smtpd_tls_ask_ccert = yes
  21. smtpd_tls_req_ccert = no
  22. smtpd_tls_auth_only = yes
  23. smtpd_tls_mandatory_ciphers = high
  24. smtpd_tls_mandatory_exclude_ciphers = aNULL, RC4, MD5
  25. smtpd_tls_protocols = !SSLv2, !SSLv3
  26. smtpd_tls_dh1024_param_file = /etc/ssl/private/dh2048.pem
  27. smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
  28. smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
  29. smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
  30. smtpd_tls_session_cache_timeout = 3600
  31. smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
  32. smtp_tls_security_level = may
  33. smtp_tls_loglevel = 1
  34. smtp_tls_note_starttls_offer = yes
  35. smtp_tls_cert_file = $smtpd_tls_cert_file
  36. smtp_tls_key_file = $smtpd_tls_key_file
  37. smtp_tls_mandatory_ciphers = $smtpd_tls_mandatory_ciphers
  38. smtp_tls_mandatory_exclude_ciphers = $smtpd_tls_mandatory_exclude_ciphers
  39. smtp_tls_protocols = $smtpd_tls_protocols
  40. smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
  41. smtp_tls_session_cache_timeout = 3600
  42. smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  43. myhostname = {{ ansible_fqdn }}
  44. myorigin = $myhostname
  45. mydomain = $myhostname
  46. mydestination = {{ ansible_fqdn }} {{ ansible_hostname }}
  47. alias_maps = hash:/etc/aliases
  48. alias_database = $alias_maps
  49. {% if smtp_relay_host is defined -%}
  50. relayhost = {{ smtp_relay_host }}
  51. {%- endif %}
  52. {% if smtp_relay_domains is defined %}
  53. relay_domains =
  54. {% for domain in smtp_relay_domains %}
  55. {{ domain}}
  56. {% endfor %}
  57. {% endif %}
  58. mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 {% if postfix_mynetworks is defined %}{{ postfix_mynetworks }}{% endif %}
  59. mailbox_command = procmail -a "$EXTENSION"
  60. mailbox_size_limit = 0
  61. message_size_limit = 0
  62. recipient_delimiter = +
  63. inet_interfaces = all
  64. disable_vrfy_command = yes
  65. smtpd_recipient_restrictions =
  66. permit_mynetworks,
  67. reject_non_fqdn_sender,
  68. reject_non_fqdn_recipient,
  69. reject_unknown_sender_domain,
  70. reject_unauth_destination,
  71. reject_unknown_recipient_domain,
  72. permit
  73. smtpd_client_restrictions =
  74. permit_mynetworks,
  75. reject_unauth_pipelining,
  76. reject_unauth_destination
  77. smtpd_helo_required = yes
  78. smtpd_helo_restrictions =
  79. permit_mynetworks,
  80. reject_non_fqdn_helo_hostname,
  81. reject_invalid_helo_hostname
  82. smtpd_sender_restrictions =
  83. permit_mynetworks,
  84. reject_non_fqdn_sender,
  85. reject_unknown_sender_domain