Fix for relay host related issues.

.github/workflows/main.yml

@@ -18,11 +18,11 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           # list of Docker images to use as base name for tags
           images: |
@@ -38,20 +38,20 @@ jobs:
             type=sha
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
             username: ${{ secrets.DOCKER_USERNAME }}
             password: ${{ secrets.DOCKER_PASSWORD }}
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
             context: .
             platforms: linux/amd64,linux/arm64

.hadolint.yaml

@@ -1,2 +1,2 @@
 ignored:
-  - DL3018
+  - DL3018

Dockerfile

@@ -1,9 +1,9 @@
 FROM alpine:3
 
-ARG CERTBOT_VERSION=5.1.0
+ARG CERTBOT_VERSION=5.6
 ARG PYTHON_VERSION=3.14
-ARG POSTFIX_VERSION=3.10.5
-ARG DCRON_VERSION=4.5
+ARG POSTFIX_VERSION=3.11
+ARG DCRON_VERSION=4.6
 
 # set version label
 ARG BUILD_DATE
@@ -16,8 +16,10 @@ VOLUME /etc/letsencrypt
 
 # Install system dependencies.
 RUN apk add --update --no-cache \
-    # Postfix itself:
+    # Postfix itself and database engines:
     postfix>=${POSTFIX_VERSION} postfix-pgsql>=${POSTFIX_VERSION} \
+    # CRITICAL FIX: Required for outward SASL relay authentication
+    cyrus-sasl cyrus-sasl-login \
     # To generate Postfix config files:
     python3>=${PYTHON_VERSION} \
     # To generate and renew Postfix TLS certificate:
@@ -42,4 +44,3 @@ WORKDIR /src
 HEALTHCHECK --start-period=350s CMD /usr/sbin/postfix status
 
 CMD ["./docker-entrypoint.sh"]
-

templates/postfix/main.cf

@@ -20,7 +20,7 @@ compatibility_level = 3.6
 # TLS parameters for SMTP (outgoing mail)
 smtp_tls_security_level = may
 
-# TLS parameters for SMPTD (incoming mail)
+# TLS parameters for SMTPD (incoming mail)
 {% if tls %}
 smtpd_tls_security_level = may
 smtpd_tls_cert_file = {{ tls_cert }}
@@ -107,7 +107,7 @@ smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
 smtp_tls_mandatory_ciphers = high
 smtpd_tls_mandatory_ciphers = high
 
-# Disable depricated encryption ciphers
+# Disable deprecated encryption ciphers
 smtpd_tls_mandatory_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL
 smtpd_tls_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL
 smtp_tls_mandatory_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL
@@ -118,27 +118,34 @@ tls_preempt_cipherlist = yes
 tls_ssl_options = NO_RENEGOTIATION
 
 {% if relay_host_port %}
-# Set email relay host with port:
-relayhost = {{ env['RELAY_HOST'] }}:{{ env['RELAY_PORT'] }}
+# Set email relay host with port (using brackets to prevent MX loop lookups):
+relayhost = [{{ env['RELAY_HOST'] }}]:{{ env['RELAY_PORT'] }}
 {% endif %}
 
 {% if relay_host_only %}
-# Set email relay host:
-relayhost = {{ env['RELAY_HOST'] }}
+# Set email relay host (using brackets to prevent MX loop lookups):
+relayhost = [{{ env['RELAY_HOST'] }}]
 {% endif %}
 
 {% if relay_creds %}
 # Enable auth
 smtp_sasl_auth_enable = yes
-# Set username and password
-smtp_sasl_password_maps = static:{{ env['RELAY_HOST_USERNAME'] }}:{{ env['RELAY_HOST_PASSWORD'] }}
-smtp_sasl_security_options = noanonymous
+
+# Set username and password using inline maps to protect the @ symbol and colons from splitting bugs
+{% if relay_host_port %}
+smtp_sasl_password_maps = inline:{ [{{ env['RELAY_HOST'] }}]:{{ env['RELAY_PORT'] }}={{ env['RELAY_HOST_USERNAME'] }}:{{ env['RELAY_HOST_PASSWORD'] }} }
+{% else %}
+smtp_sasl_password_maps = inline:{ [{{ env['RELAY_HOST'] }}]={{ env['RELAY_HOST_USERNAME'] }}:{{ env['RELAY_HOST_PASSWORD'] }} }
+{% endif %}
+
+smtp_sasl_security_options = noanonymous, noplaintext
+smtp_sasl_tls_security_options = noanonymous
 # Turn on tls encryption
 #smtp_tls_security_level = encrypt
 #header_size_limit = 4096000
 {% endif %}
 
 {% if proxy_protocol %}
-# Enable Proxy Protocal if postfix is behind a reverse proxy that can use Proxy Protocol like trafik or haproxy.
+# Enable Proxy Protocol if postfix is behind a reverse proxy that can use Proxy Protocol like traefik or haproxy.
 smtpd_upstream_proxy_protocol = haproxy
 {% endif %}