Multiple fixes

mail_system/templates/postfix/main.cf

@@ -18,29 +18,33 @@ append_dot_mydomain = no
 # Uncomment the next line to generate "delayed mail" warnings
 #delay_warning_time = 4h
 
-readme_directory = no
+readme_directory = /usr/share/doc/postfix
 
 # See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
 # fresh installs.
 compatibility_level = 2
 
 
-
-# TLS parameters
+# TLS
 smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
 smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
-smtpd_use_tls=yes
+smtpd_tls_security_level = may
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
+smtpd_tls_auth_only=yes
+smtpd_tls_received_header = yes
+smtp_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
+smtp_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
+smtp_tls_security_level=may
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+smtp_tls_note_starttls_offer = yes
 
-# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
-# information on enabling SSL in the smtp client.
 
+# Host names, aliases, networks
 myhostname = {{ ansible_fqdn }}
 alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases
 mydestination = $myhostname, {{ ansible_hostname }}, {{ ansible_fqdn }}, localhost.{{ ansible_domain }}, localhost
-relayhost = 
+relayhost =
 mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 {{ mailserver.postfix.mynetworks }}
 mailbox_size_limit = 0
 recipient_delimiter = +
@@ -48,7 +52,7 @@ inet_interfaces = all
 inet_protocols = all
 
 
-
+# Virtual mailboxes
 virtual_mailbox_domains = pgsql:/etc/postfix/domains.cf
 virtual_mailbox_maps = pgsql:/etc/postfix/mailboxes.cf
 virtual_alias_maps = pgsql:/etc/postfix/aliases.cf
@@ -57,14 +61,13 @@ virtual_minimum_uid = 5000
 virtual_uid_maps = static:5000
 virtual_gid_maps = static:5000
 
-virtual_transport=lmtp:unix:private/dovecot-lmtp
 
+# Interaction with dovecot
+virtual_transport=lmtp:unix:private/dovecot-lmtp
 smtpd_sasl_type=dovecot
 smtpd_sasl_path=private/auth
 smtpd_sasl_auth_enable=yes
 
-smtpd_tls_auth_only=yes
-smtp_tls_security_level=may
 
 
 
@@ -83,7 +86,8 @@ smtpd_recipient_restrictions =
   reject_non_fqdn_recipient
   reject_unknown_recipient_domain
   reject_unauth_destination
-  check_policy_service inet:127.0.0.1:12480  # user quota
+  check_policy_service inet:127.0.0.1:12480
+  # 12480: user quota
 
 smtpd_relay_restrictions =
   permit_mynetworks
@@ -94,9 +98,13 @@ smtpd_relay_restrictions =
 
 
 # rspamd
+smtpd_milters=inet:127.0.0.1:11332
+non_smtpd_milters=inet:127.0.0.1:11332
+milter_protocol=6
+milter_mail_macros=i {mail_addr} {client_addr} {client_name} {auth_authen}
 
 
-# VERP marking
+# VERP marking and SRS (sender rewriting scheme)
 # Envelope sender addresses matching mydomains are marked.
 # The marker is removed from envelope recipient addresses.
 canonical_classes = envelope_sender, envelope_recipient, header_recipient
@@ -111,7 +119,7 @@ enable_long_queue_ids = yes
 
 
 # convenience settings
-maximal_queue_lifetime = 6w  # default is 5d
+maximal_queue_lifetime = 6w
 bounce_queue_lifetime = 6w
 message_size_limit = 20800000
 
@@ -119,3 +127,4 @@ message_size_limit = 20800000
 # debugging options (see also http://www.postfix.org/DEBUG_README.html):
 #debug_peer_list = 127.0.0.1
 #smtpd_tls_loglevel = 3
+#smtd_tls_loglevel = 3