arugifa/simplelogin-postfix-docker

The missing Docker image for SimpleLogin Postfix

Docker Image for SimpleLogin Postfix

No official Postfix image, tailor-made for SimpleLogin, currently exists.

Let's fix that, by providing to the community something very lightweight, secure* (with Let's Encrypt support) and simple to use 💖

Compatibility: this image has been tested in a production environment with SimpleLogin 3.1.0

* if a TLS certificate cannot be automatically generated when starting the container, Postfix will run without TLS activated, until the next attempt (happens every hour)

Can be configured with the following environment variables:

Setting	Description
ALIASES_DEFAULT_DOMAIN	Default domain to use for your aliases.
DB_HOST	Where is hosted your SimpleLogin PostgreSQL database.
DB_USER	User to connect to the database.
DB_PASSWORD	User's password to connect to the database.
DB_NAME	Name of the database.
EMAIL_HANDLER_HOST	Where is hosted your SimpleLogin email handler instance.
LETSENCRYPT_EMAIL	Email address used by Let's Encrypt, to send you expiry notices*.
POSTFIX_FQDN	Fully Qualified Domain Name of your Postfix instance (i.e., the MX server address you configured in your DNS zone for your ALIASES_DEFAULT_DOMAIN).
RELAY_HOST	If your Postfix instance's IP address is blacklisted (e.g., because it is not a static address), you must use your Internet Service Provider's mail server as a relay, to be able to send emails to the outer world.

* automatic renewal is managed with Certbot and shouldn't fail, unless you have reached Let's Encrypt rate limits

Used by and made for Kloügle, the Google alternative automated with Terraform.

Troubleshooting

If you don't receive emails from SimpleLogin, have a look to Postfix logs:

docker logs -f <POSTFIX_CONTAINER>

If Postfix doesn't seem to use TLS, have a look to Certbot logs:

docker exec -ti <POSTFIX_CONTAINER> cat /var/log/letsencrypt/letsencrypt.log

simplelogin-postfix-docker's Issues

Cert renewal job fails

The certbot -n renew fails with

Currently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command instead. The renew verb may provide other options for selecting certificates to renew in the future.

The problem is in cli.ini, where 'domain' should really be 'domains' certbot/certbot#4774 (comment)

Also, because I saw hourly failures trying to email to root in the log, I was curious why that was happening so I set up a root alias in simplelogin and it was the cron job. Because cron will email any output, success or error to root and because certbot -n is too chatty, it would email me hourly that

Cert not yet due for renewal

From cert bot docs https://certbot.eff.org/docs/using.html:

If you’re sure that this command executes successfully without human intervention, you can add the command to crontab (since certificates are only renewed when they’re determined to be near expiry, the command can run on a regular basis, like every week or every day). In that case, you are likely to want to use the -q or --quiet quiet flag to silence all output except errors.

I can create a pull request this evening to address these fixes if you want me to.

Let's Encrypt SSL certifcates

Question

The docker container seems to want to request an SSL certificate from Let's Encrypt, but it is not entirely clear to me what these are used for and which domain I should request them for. Are these certificates for your "email" domain or the domain from which you serve the web interface?

Example

If your standard emails are send from example.com and your Simplelogin app runs on app.example.com (like described in the SL documentation). Is this certificate meant for example.com or app.example.com?

usage without let's encrypt and using smtp in container

hi!
i have another program handling certificates, can i use this image with pre made certs ?

also can i use smtp to send emails for other services in the server ?

relayhost Postfix parameter

Hi Arugifa
It may be usefull to have relayhost. So here is a pull request. There should be absolutly no change to current deployment if RELAY_HOST variable parameter is not set in docker-compose.
This is my first pull request to Github, and also never used Python, so not sure if I have done everything correctly ;)

Typo in certbot-renew-crontab.sh

Line 8 has cerbot instead of certbot

TLS issues (+ fixes)

Hello,

First of all, thanks for the great image!
With a few tweaks i got it working perfectly.

At first i had trouble sending encrypted mails.
To get TLS working properly i had to add these lines to the main.cf file:

• smtp_tls_security_level = may
• smtp_tls_loglevel = 1

I also added the ca-certification package together with this main.cf line, to get rid of 'untrusted TLS' log lines

• smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

This isn't really an issue, but i still wanted to write it down somewhere so people could find it if they run into the same problems.

Clarification of steup instructions

I was following the documentation to set up SimpleLogin on my Raspberry Pi but, since it's just a test and I'm planning to install it on my home server along with other apps, I liked your idea to containerize postfix too.
So I opted for your postfix docker image, but I got stuck following the instructions inside the README (probably because I'm not so expert in these self-hosting things), here are my questions:

1. What should I put as DB_HOST? The name of the PostgreSQL container? Or maybe the path to its volume?
2. What do you mean as EMAIL_HANDLER_HOST? Is it the container with SimpleLogin app installed? Because I was following the official README, and I haven't already created it since it's written after postfix installation
3. In the RELAY_HOST field, I should put the SMTP server of my real email? Or what?

Thank you in advance and sorry if the questions are dumb :)