Table of Contents

← Back  
 Next →
, , , , , , , , ,

Docker mailserver

This mailserver setup follows Workaround's SPmail guide for Debian 12 “Bookworm”. Key changes are that instead of installing on Debian 11 virtual machine1, with a Maria mysql database2, this setup is for installation on latest Alpine linux Docker image with s6-rc init using maria database. I toyed with sqlite and basically got it functional, however the support apps do not function with sqlite.

As this follows Workaround's SPmail guide for Debian 12 “Bookworm”, significant amounts of text have been copied and generally modified from there. I hereby credit Workaround's author Christoph Haas. Furthermore Christoph's guide is very descriptive and should be referenced to get a better understanding of how to put together a mailserver.

  1. Use of virtual machines is much more common these days than base metal for applications. However Workarounds Debian email server could be loaded on base metal.
  2. The database requirements for a small mailserver with a few dozen domains, with each domain having hundreds of emails and aliases is well within the capacity of the sqlite database. The use of a full multi user server / client relational database is not necessary, particularly for a Docker based server implementation. See SQLite vs MySQL vs PostgreSQL: A Comparison Of Relational Database Management Systems

I got the Docker emailer server functional mid 2023. It still needs some more work. I recently went through and clean up some non-fatal errors in the configuration that were showing in the logs, mid 2024. Currently I run the mail server 2 containers, I would rather have it all in one container. The email server could also have some more optimisations performed.

Dockerfile

I go annoyed with the messy UID and GID and found this reference to attempt to standardise upon. Sadly there seems to be no comprehensive standard!

References

packages

working

Required for server:

To assist with working in container:

alias

I could not get the alias command to work in Alpine shell. I tried /etc/profile and /etc/profile.d to no avail. So the following seems to meet my needs:

sqlite

sqlite commands

virtual_domains

This table just holds the list of domains that you will use as virtual_mailbox_domains in Postfix.

Column Purpose
id A unique number identifying each row. It is added by the database automatically.
name The name of the domain you want to receive email for.

This SQL statement creates a table like that:

sql code

CREATE TABLE IF NOT EXISTS `virtual_domains` (
 `id` INT(11) NOT NULL AUTO_INCREMENT,
 `name` VARCHAR(50) NOT NULL,
 PRIMARY KEY (`id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

sqlite code

CREATE TABLE IF NOT EXISTS 'virtual_domains' (
  id INTEGER PRIMARY KEY,
  name TEXT NOT NULL UNIQUE
  );

DROP TABLE IF EXISTS virtual_domains; will delete the table.

virtual_users

The next table contains information about your users. Every mail account takes up one row.

Column Purpose
id A unique number identifying each row. It is added by the database automatically.
domain_id Contains the number of the domain’s id in the virtual_domains table. This is called a foreign key. A “delete cascade” makes sure that if a domain is deleted that all user accounts in that domain are also deleted to avoid orphaned rows.
email The email address of the mail account.
password The hashed password of the mail account. It is prepended by the password scheme. By default it is {BLF-CRYPT} also known as bcrypt which is considered very secure. Previous ISPmail guides used {SHA256-CRYPT} or even older crypt schemes. Prepending the password field the hashing algorithm in curly brackets allows you to have different kinds of hashes. So you can easily migrate your old passwords without locking out users. Users with older schemes should get a new password if possible to increase security.
quota The number of bytes that this mailbox can store. You can use this value to limit how much space a mailbox can take up. The default value is 0 which means that there is no limit.

This is the appropriate SQL query to create that table:

sql code

CREATE TABLE IF NOT EXISTS `virtual_users` (
 `id` INT(11) NOT NULL AUTO_INCREMENT,
 `domain_id` INT(11) NOT NULL,
 `email` VARCHAR(100) NOT NULL,
 `password` VARCHAR(150) NOT NULL,
 `quota` BIGINT(11) NOT NULL DEFAULT 0,
 PRIMARY KEY (`id`),
 UNIQUE KEY `email` (`email`),
 FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

sqlite code

CREATE TABLE IF NOT EXISTS `virtual_users` (
 `id` INTEGER PRIMARY KEY,
 `domain_id` INTEGER NOT NULL,
 `email` TEXT NOT NULL UNIQUE,
 `password` TEXT NOT NULL,
 `quota` INTEGER NOT NULL DEFAULT 0,
 FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
 );

virtual_aliases

The last table contains forwardings from an email address to other email addresses.

Field Purpose
id A unique number identifying each row. It is added by the database automatically.
domain_id Contains the number of the domain’s id in the virtual_domains table again.
source The email address that the email was actually sent to. In case of catch-all addresses (that accept any address in a domain) the source looks like “@example.org”.
destination The email address that the email should instead be sent to.

This is the required SQL query you need to run:

sql

CREATE TABLE IF NOT EXISTS `main.virtual_aliases` (
 `id` INT(11) NOT NULL AUTO_INCREMENT,
 `domain_id` INT(11) NOT NULL,
 `source` VARCHAR(100) NOT NULL,
 `destination` VARCHAR(100) NOT NULL,
 PRIMARY KEY (`id`),
 FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

sqlite

CREATE TABLE IF NOT EXISTS `virtual_aliases` (
 `id` INTEGER PRIMARY KEY,
 `domain_id` INTEGER NOT NULL,
 `source` TEXT NOT NULL,
 `destination` TEXT NOT NULL,
 FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
 );

sqlite example test data

The following test dat acan be used to test the data returns from postfix. 

REPLACE INTO virtual_domains (id,name) VALUES ('1','example.org');
 
REPLACE INTO virtual_users (id,domain_id,password,email)
 VALUES ('1', '1', '{BLF-CRYPT}$2y$05$.WedBCNZiwxY1CG3aleIleu6lYjup2CIg0BP4M4YCZsO204Czz07W', 'john@example.org');
 
REPLACE INTO virtual_aliases (id,domain_id,SOURCE,destination)
 VALUES ('1', '1', 'jack@example.org', 'john@example.org');

This sample data should be deleted before using the mailserver live. 

DELETE FROM mailserver.virtual_domains WHERE name='example.org';

references

mariadb

I am not sure if all these modules are required. Those with # are not required for Adminer. ISPMailAdmin requires bcmath. Adminer seemed to work without mysqli and mysqlnd.

mariadb sql commands

Many of the problems that I had trying to get Adminer and ISPMailAdmin operation related to access privileges on the Mariadb. I should have read and understood the ISPMail Preparing the database section more carefully. Some keypoints:

adminer

I will setup DNS and Traefik for this to be mailsql.local.kptree.net. This will only be accessible on the LAN.

ISPmail Admin

I will setup DNS and Traefik for this to be mailadmin.local.kptree.net. This will only be accessible on the LAN. Admin user is mailserver with associated password.

adminer

phpMyAdmin is a web based mysql management interface.

adminer is a web based single php file database manager, that is suitable for many type of databases, including sqlite and being only a single file is easier to implement. Copy the latest version of adminer to .config/adminer

To test: 

192.168.1.14:8910
database: SQLite 3
user: 
password: standard
database: /app/mailserver.db

There is another program call SQLiteStudio. This look looks like a full GUI program, that will probably not be suitable for installation on a Docker mailserver. Noted.

Adminer needs a few php modules to run, session and pdo_sqlite, apk packages: php$phpverx-session, php$phpverx-pdo_sqlite, php$phpverx-sqlite3. Also Adminer does not like working with Sqlite without forcing some kind of password protect. Hence the Adminer plugin module and password-less plugin need to be used.

It seems that Apache2 php runs more efficiently if the php-fpm module is used and setup. See Alpine Apache with php-fpm

postfix

/etc/postfix 

/ # postconf mail_version
mail_version = 3.7.4

Making Postfix get its information from the sqlite database

virtual_mailbox_domains

A mapping in Postfix is just a table that contains a left-hand side (LHS) and a right-hand side (RHS). To make Postfix get information about virtual domains from the database we need to create a ‘cf’ file (configuration file). Start by creating a file called /etc/postfix/sqlite-virtual-mailbox-domains.cf for the virtual_mailbox_domains mapping that contains: 

dbpath = /app/mailserver.db
query = SELECT 1 FROM virtual_domains WHERE name='%s'

Imagine that Postfix receives an email for somebody@example.org and wants to find out if example.org is a virtual mailbox domain. It will run the above SQL query and replace ‘%s’ by ‘example.org’. If it finds such a row in the virtual_domains table it will return a ‘1’. Actually it does not matter what exactly is returns as long as there is a result.

Now you need to make Postfix use this database mapping: postconf virtual_mailbox_domains=sqlite:/etc/postfix/sqlite-virtual-mailbox-domains.cf

The “postconf” command conveniently adds configuration lines to your /etc/postfix/main.cf file. It also activates the new setting instantly so you do not have to reload the Postfix process.

The test data you created earlier added the domain “example.org” as one of your mailbox domains. Let’s ask Postfix if it recognizes that domain: postmap -q example.org sqlite:/etc/postfix/sqlite-virtual-mailbox-domains.cf

You should get ‘1’ as a result. That means your first mapping is working. Feel free to try that with other domains after the -q in that line. You should not get a response

virtual_mailbox_maps

The virtual_mailbox_maps which is mapping email addresses (left-hand side) to the location of the user’s mailbox on your hard disk (right-hand side). Postfix has a built-in transport service called “virtual” that can receive the email and store it into the recipient’s email directory. But we will not make Postfix save the email to disk. We will delegate that to Dovecot as it allows us better control.

All that Postfix needs to know is whether an email address belongs to a valid mailbox. That simplifies things a bit because we just need the left-hand side of the mapping.

Similar to the above virtual_domains mapping you need an SQL query that searches for an email address and returns “1” if it is found.

To accomplish that please create another configuration file at /etc/postfix/sqlite-virtual-mailbox-maps.cf: 

dbpath = /app/mailserver.db
query = SELECT 1 FROM virtual_users WHERE email='%s'

Tell Postfix that this mapping file is supposed to be used for the virtual_mailbox_maps mapping: postconf virtual_mailbox_maps=sqlite:/etc/postfix/sqlite-virtual-mailbox-maps.cf

Test if Postfix is happy with this mapping by asking it where the mailbox directory of our john@example.org user would be: postmap -q john@example.org sqlite:/etc/postfix/sqlite-virtual-mailbox-maps.cf

Again you should get “1” back which means that john@example.org is an existing virtual mailbox user on your server. Very good. Later when we deal with the Dovecot configuration we will also use the password field but Postfix does not need it right here.

virtual_alias_maps

The virtual_alias_maps mapping is used for forwarding emails from one email address to one or more others. In the database multiple targets are achieved by using multiple rows.

Create another “.cf” file at /etc/postfix/sqlite-virtual-alias-maps.cf: 

dbpath = /app/mailserver.db
query = SELECT destination FROM virtual_aliases WHERE SOURCE='%s'

Make Postfix use this database mapping: postconf virtual_alias_maps=sqlite:/etc/postfix/sqlite-virtual-alias-maps.cf

Test if the mapping file works as expected: postmap -q jack@example.org sqlite:/etc/postfix/sqlite-virtual-alias-maps.cf

You should see the expected destination: john@example.org

So if Postfix receives an email for jack@example.org it will redirect it to john@example.org.

postfix start/stop

Basic postfix control are:

It looks a shell script is used to control Postfix, in Alpine is is located here

systemd

The systemd service script is a hoot!, it seems to do nothing meaningful.

/lib/systemd/system/postfix.service

Look like postfix is started from /etc/init.d/postfix. This script notes the following options, “Usage: /etc/init.d/postfix {start|stop|restart|reload|flush|check|abort|force-reload|status}”

Alpine

s6 setup

The s6 rc run file:

run

Postfix logging

Alpine posfix would seem to be setup to use postlogd, as master.cf has the following line already configured: postlog unix-dgram n - n - 1 postlogd. Hence the following does not need to be used: /bin/echo 'postlog unix-dgram n - n - 1 postlogd' >> '/etc/postfix/master.cf'

The postfix.log warning “postfix/postfix-script[228]: warning: group or other writable: /etc/postfix/./master.cf” is probably as the noted file has been setup using a symlink. As it is a warning only no further concern.

/etc/postfix/aliases

I get an error when recreating the container; “error: open database /etc/postfix/aliases.lmdb: No such file or directory” The postfix command recreates the missing/corupt aliases.lmdb file; newaliases.I added this to my Docker container startup script. This solved the problem, but not sure if this is the right way to do this.

Postfix References

dovecot

/etc/dovecot/conf.d 

/ # dovecot --version
2.3.20 (80a5ac675d)

dovecot database configuration and testing

database setup: /etc/dovecot/dovecot-sql.conf.ext

See Dovecot howto on sqlite setup Dovecot configuration sqlite, linked from Dovecot HOWTOs / Examples / Tutorials

You will find this file well documented although all configuration directives are commented out. Add these lines at the bottom of the file: 

driver = sqlite
CONNECT = /app/mailserver.db
user_query = SELECT email AS USER, \
  '*:bytes=' || quota AS quota_rule, \
  '/var/vmail/%d/%n' AS home, \
  5000 AS uid, 5000 AS gid \
  FROM virtual_users WHERE email='%u'
password_query = SELECT password FROM virtual_users WHERE email='%u'
iterate_query = SELECT email AS USER FROM virtual_users

Notes:

Dovecot database testing

Testing directly within sqlite3:
Testing with openssl

openssl s_client -servername mail.kptree.net -connect mail.kptree.net:pop3s

Testing with doveadmin

doveadm auth test doveadm auth test john@example.org, you will be prompted for password. A successful response looks like: 

passdb: john@example.org auth succeeded
extra fields:
  user=john@example.org

doveadm user doveadm user john@example.org will give output: 

field	value
uid	5000
gid	5000
home	/var/vmail/example.org/john
mail	maildir:~/Maildir
quota_rule	*:bytes=0

whereas doveadm user *example.org will give a list of users: 

john@example.org

dovecot start / stop

systemd

The debian 10 systemctl dovecot.service:

/lib/systemd/system/dovecot.service

dovecot testing with mutt

Workaround suggests the following command to be used to test: mutt -f imaps://john@example.org@webmail.example.org The webmail.example.org simple made no sense to me and did not function with error Could not find the host “webmail.example.org”. As I am creating this in Docker and separately taking the certificates from Traefik, this mailserver simple is not linked in a anyway with a webserver! The webservers for the database access and webmail are totally separate containers. The “simple” solution was to use “localhost” from within the mailserver docker container, e.g. mutt -f imaps://john@example.org@localhost.

dovecot ssl_dh

I was getting the following error coming up occasionally in my Dovecot log file, “May 25 12:16:05 imap-login: Error: Diffie-Hellman key exchange requested, but no DH parameters provided. Set ssl_dh=</path/to/dh.pem”. To help resolve this error I set up the ssl_dh parameter in 10-ssl.conf, see Dovecot SSL configuration for instructions. The creation of the dh.pem was taking so long on the server that I stopped and created on the desktop, it was much faster. I then simply text copied to the server.

dovecot logging

Dovecot References

Certificates SSL/TSL

Early on, before 2015 there were not many free SSL certificate providers. I used StartSSL for a free certificate. They would purchased by a company that managed to get their certificate deregister…… So StartSSL basically became non-usable circa 2017. Fourtunately a better solution came about a year or 2 earlier called LetsEncrypt. This could be used with certbot to get free certificates and eventually free wildcard certificates. Then came Traefik which handled certificates.

apache2

Alpine apk apache2 distribution seems to follow the Red Hat setup style. The daemon is httpd instead of apache2. So I need to learn a new setup. Keep features:

apache2.4 remote php-fpm proxy configuration

There are a number of ways to configure apache 2.4 to access remote server, see Apache module mod_proxy_fcgi for details. I used the following commands.

vim .config/apache2/mail.kptree.net-443.conf

apache2.4 local php-fpm configuration

vim .config/apache2/mail.local.kptree.net-8080.conf

nginx and php-fpm

I though I should give nginx a try as I was having linted success with Apache and remote php-fpm.

The Apline package locations as of php version 8.2 are as follows. This may vary with version and also definitely varies with different distributions and their package managers.

Places to change php version number:

Reference

php and php-fpm

I decided to setup php-fpm [fpm = FastCGI Process Manager, and CGI = Common Gateway Interface, reputedly more performant than the builtin Apache php module. Amazing an acronym in acronym, some people are so smart they are dumb!]. I basically followed Alpine Linux instructions Apache with php-fpm

php-fpm acts like a php server and can be setup to allow remote connections from clients, usually web pages. The server is normally setup to listen on port 9000. Additional servers can be setup using other ports. This allows servers per app and different server php configuration, e.g. amount of memory and number of process, etc. This is performed by defining additional php-fpm server configuration pools that are differentiated by ip address and port, or socket file. If the client and servers are on the same machine they can communicate via local host and port or via socket file. If remotely hosted they communicate via ip address and port number. The pool definition only allows referencing via discrete ip address and port numbers, where as the web browsers can use name resolution of ip addresses adding flexibility.

Alpine Docker php-fpm

An annoying problem is the php-fpm version is carried on through the file system. The Alpine Docker stable version at writing is 8.1 (called 81). So the following 3 locations need to be considered when updating. This also means that the latest version can not simply be used.

As php-fpm automatically runs in daemon mode, when using s6-rc init as a longrun it needs to be run in foreground mode, /usr/sbin/php-fpm82 -F, as per the -F option. In daemon mode, s6-rc thinks php-fpm has failed and attempts to restart. As the original program is running, the subsequent repeated attempts to run, give the noted repeated error message. (I believe there is a method in s6-rc to stop after a defined number of failed attempts. I have not looked into this yet.)

php-fpm pool

references

Roundcube WebMail

I decided to use the Roundcube Docker official image and followed the instructions to setup. As usual I decided to go with the Alpine Linux image option.

My final Docker compose file, docker-compose.yml

file

See:

docker compose

file structure

Some links:

Traefik Routing

Looks like Traefik can not handle routing of STARTTLS. At least as of 2023-12-02.

My LAN DNS points to the one common IP address for the mail server. DNS does not differentiate the services via port numbers. As noted I can not use Traefik to perform this routing if the STARTTLS protocol is used. I could possibly use my router, but this is getting too complex.

To allow operation of a Docker Web browser based mail client with my existing VM mail server I used a slightly different URL to help with routing, e.g. webmail.kptree.net versus mail.kptree.net for mail server. The webmail.kptree.net successfully used Traefik router and successfully operated with the mailserver on mail.kptree.net.

References

dmarc

How to read a DMARC report—and actually understand it!

rspamd

rspamd -u rspamd -g rspamd

Help from rspamd:

rspamd -h

Rspamd quick start

redis

Some reference links:

nftables

rspamd requires netfilter chains to functions. So a nftables needs to be available and a basic input chain setup to function. See netfilter use within containers that describe why care must be taken no to interfere with existing netfilter nat chains required for container DNS function.

Mailserver testing from CLI

The mailserver exit control character is '^]' or control key ]. The SMTP and mailserver exit control character is '^]' or control key ].

Errors

Temporary lookup failure.
Please check the message recipient "admin@kptree.net" and try again.

https://serverfault.com/questions/506347/postfix-temporary-lookup-failure https://serverfault.com/questions/745545/postfix-rcpt-to-temporary-lookup-failure

References

← Back  
Start page  
 Next →