From fa5a42d548d8ef9257571562b0764fe2e7f919e0 Mon Sep 17 00:00:00 2001 From: Rehan Mahmood Date: Wed, 3 Jun 2026 13:33:17 -0400 Subject: [PATCH] Fix for relay host related issues. --- .github/workflows/main.yml | 12 ++++++------ .hadolint.yaml | 2 +- Dockerfile | 11 ++++++----- templates/postfix/main.cf | 27 +++++++++++++++++---------- 4 files changed, 30 insertions(+), 22 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 14bbea1..72b68a3 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -18,11 +18,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@v6 - name: Docker meta id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: # list of Docker images to use as base name for tags images: | @@ -38,20 +38,20 @@ jobs: type=sha - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Login to DockerHub if: github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . platforms: linux/amd64,linux/arm64 diff --git a/.hadolint.yaml b/.hadolint.yaml index 5aaae2e..0464523 100644 --- a/.hadolint.yaml +++ b/.hadolint.yaml @@ -1,2 +1,2 @@ ignored: - - DL3018 \ No newline at end of file + - DL3018 diff --git a/Dockerfile b/Dockerfile index 8d56931..66b59b0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,9 @@ FROM alpine:3 -ARG CERTBOT_VERSION=5.1.0 +ARG CERTBOT_VERSION=5.6 ARG PYTHON_VERSION=3.14 -ARG POSTFIX_VERSION=3.10.5 -ARG DCRON_VERSION=4.5 +ARG POSTFIX_VERSION=3.11 +ARG DCRON_VERSION=4.6 # set version label ARG BUILD_DATE @@ -16,8 +16,10 @@ VOLUME /etc/letsencrypt # Install system dependencies. RUN apk add --update --no-cache \ - # Postfix itself: + # Postfix itself and database engines: postfix>=${POSTFIX_VERSION} postfix-pgsql>=${POSTFIX_VERSION} \ + # CRITICAL FIX: Required for outward SASL relay authentication + cyrus-sasl cyrus-sasl-login \ # To generate Postfix config files: python3>=${PYTHON_VERSION} \ # To generate and renew Postfix TLS certificate: @@ -42,4 +44,3 @@ WORKDIR /src HEALTHCHECK --start-period=350s CMD /usr/sbin/postfix status CMD ["./docker-entrypoint.sh"] - diff --git a/templates/postfix/main.cf b/templates/postfix/main.cf index ad4e151..ae5f9da 100644 --- a/templates/postfix/main.cf +++ b/templates/postfix/main.cf @@ -20,7 +20,7 @@ compatibility_level = 3.6 # TLS parameters for SMTP (outgoing mail) smtp_tls_security_level = may -# TLS parameters for SMPTD (incoming mail) +# TLS parameters for SMTPD (incoming mail) {% if tls %} smtpd_tls_security_level = may smtpd_tls_cert_file = {{ tls_cert }} @@ -107,7 +107,7 @@ smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1 smtp_tls_mandatory_ciphers = high smtpd_tls_mandatory_ciphers = high -# Disable depricated encryption ciphers +# Disable deprecated encryption ciphers smtpd_tls_mandatory_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL smtpd_tls_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL smtp_tls_mandatory_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL @@ -118,27 +118,34 @@ tls_preempt_cipherlist = yes tls_ssl_options = NO_RENEGOTIATION {% if relay_host_port %} -# Set email relay host with port: -relayhost = {{ env['RELAY_HOST'] }}:{{ env['RELAY_PORT'] }} +# Set email relay host with port (using brackets to prevent MX loop lookups): +relayhost = [{{ env['RELAY_HOST'] }}]:{{ env['RELAY_PORT'] }} {% endif %} {% if relay_host_only %} -# Set email relay host: -relayhost = {{ env['RELAY_HOST'] }} +# Set email relay host (using brackets to prevent MX loop lookups): +relayhost = [{{ env['RELAY_HOST'] }}] {% endif %} {% if relay_creds %} # Enable auth smtp_sasl_auth_enable = yes -# Set username and password -smtp_sasl_password_maps = static:{{ env['RELAY_HOST_USERNAME'] }}:{{ env['RELAY_HOST_PASSWORD'] }} -smtp_sasl_security_options = noanonymous + +# Set username and password using inline maps to protect the @ symbol and colons from splitting bugs +{% if relay_host_port %} +smtp_sasl_password_maps = inline:{ [{{ env['RELAY_HOST'] }}]:{{ env['RELAY_PORT'] }}={{ env['RELAY_HOST_USERNAME'] }}:{{ env['RELAY_HOST_PASSWORD'] }} } +{% else %} +smtp_sasl_password_maps = inline:{ [{{ env['RELAY_HOST'] }}]={{ env['RELAY_HOST_USERNAME'] }}:{{ env['RELAY_HOST_PASSWORD'] }} } +{% endif %} + +smtp_sasl_security_options = noanonymous, noplaintext +smtp_sasl_tls_security_options = noanonymous # Turn on tls encryption #smtp_tls_security_level = encrypt #header_size_limit = 4096000 {% endif %} {% if proxy_protocol %} -# Enable Proxy Protocal if postfix is behind a reverse proxy that can use Proxy Protocol like trafik or haproxy. +# Enable Proxy Protocol if postfix is behind a reverse proxy that can use Proxy Protocol like traefik or haproxy. smtpd_upstream_proxy_protocol = haproxy {% endif %}