docker-mailserver

A fullstack but simple mail server (smtp, imap, antispam, antivirus...). Only configuration files, no SQL database. Keep it simple and versioned. Easy to deploy and upgrade.

Includes:

• postfix with smtp auth
• dovecot for sasl, imap (and optional pop3) with ssl support
• amavis
• spamassasin supporting custom rules
• clamav with automatic updates
• opendkim
• opendmarc
• fail2ban
• fetchmail
• saslauthd
• saslauthd ldap support
• postfix ldap support
• kopano support
• basic sieve support using dovecot
• LetsEncrypt and self-signed certificates
• integration tests
• automated builds on docker hub

Why I created this image: Simple mail server with Docker

Before you open an issue, please have a look this README, the Wiki and Postfix/Dovecot documentation.

Usage

Get latest image

docker pull tvial/docker-mailserver:latest

Create a docker-compose.yml

Adapt this file with your FQDN. Install docker-compose in the version 1.6 or higher.

version: '2'

services:
  mail:
    image: tvial/docker-mailserver:latest
    # build: .
    hostname: mail
    domainname: domain.com
    container_name: mail
    ports:
      - "25:25"
      - "143:143"
      - "587:587"
      - "993:993"
    volumes:
      - maildata:/var/mail
      - ./config/:/tmp/docker-mailserver/

volumes:
  maildata:
    driver: local

Create your mail accounts

Don't forget to adapt MAIL_USER and MAIL_PASS to your needs

mkdir -p config
touch config/postfix-accounts.cf
docker run --rm \
  -e MAIL_USER=user1@domain.tld \
  -e MAIL_PASS=mypassword \
  -ti tvial/docker-mailserver:latest \
  /bin/sh -c 'echo "$MAIL_USER|$(doveadm pw -s SHA512-CRYPT -u $MAIL_USER -p $MAIL_PASS)"' >> config/postfix-accounts.cf

Generate DKIM keys

docker run --rm \
  -v "$(pwd)/config":/tmp/docker-mailserver \
  -ti tvial/docker-mailserver:latest generate-dkim-config

Now the keys are generated, you can configure your DNS server by just pasting the content of config/opendkim/keys/domain.tld/mail.txt in your domain.tld.hosts zone.

Start the container

docker-compose up -d mail

You're done!

Environment variables

Please check how the container starts to understand what's expected.

Value in bold is the default value.

ENABLE_POP3

• empty => POP3 service disabled
• 1 => Enables POP3 service

ENABLE_FAIL2BAN

• empty => fail2ban service disabled
• 1 => Enables fail2ban service

If you enable Fail2Ban, don't forget to add the following lines to your docker-compose.yml:

cap_add:
  - NET_ADMIN

Otherwise, iptables won't be able to ban IPs.

ENABLE_MANAGESIEVE

• empty => Managesieve service disabled
• 1 => Enables Managesieve on port 4190

ENABLE_FETCHMAIL

• empty => fetchmail disabled
• 1 => fetchmail enabled

SA_TAG

• 2.0 => add spam info headers if at, or above that level

SA_TAG2

• 6.31 => add 'spam detected' headers at that level

SA_KILL

• 6.31 => triggers spam evasive actions

SASL_PASSWD

• empty => No sasl_passwd will be created
• string => /etc/postfix/sasl_passwd will be created with the string as password

SMTP_ONLY

• empty => all daemons start
• 1 => only launch postfix smtp

SSL_TYPE

• empty => SSL disabled
• letsencrypt => Enables Let's Encrypt certificates
• custom => Enables custom certificates
• manual => Let's you manually specify locations of your SSL certificates for non-standard cases
• self-signed => Enables self-signed certificates Please read the SSL page in the wiki for more information.

PERMIT_DOCKER

Set different options for mynetworks option (can be overwrite in postfix-main.cf)

• empty => localhost only
• host => Add docker host (ipv4 only)
• network => Add all docker containers (ipv4 only)

SASL_MECHANISMS

• empty => pam
• ldap => authenticate against ldap server
• shadow => authenticate against local user db
• mysql => authenticate against mysql db
• rimap => authenticate against imap server
• NOTE: can be a list of mechanisms like pam ldap shadow

SASL_MECH_OPTIONS

• empty => None
• e.g. with sasl_mechanism rimap you need to specify the ip-address/servername of the imap server ==> xxx.xxx.xxx.xxx

SASL_LDAP_SERVER

• empty => localhost

SASL_LDAP_PROTO

• empty => ldap://
• 1 => ldaps://

SASL_LDAP_BIND_DN

• empty => anonymous bind
• specify an object with priviliges to search the directory tree
• e.g. active directory: SASL_BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=net
• e.g. openldap: SASL_BIND_DN=cn=admin,dc=mydomain,dc=net

SASL_LDAP_PASSWORD

• empty => anonymous bind

SASL_LDAP_SEARCH_BASE

• empty => Reverting to SASL_MECHANISM pam
• specify the search base

SASL_LDAP_FILTER

• empty => default filter (uid=%u)
• e.g. for active directory: (&(sAMAccountName=%U)(objectClass=person))
• e.g. for openldap: (&(uid=%U)(objectClass=person))

LDAP

• empty => LDAP support disabled
• 1 => set virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf and virtual_alias_maps = ldap:/etc//postfix/ldap-aliases.cf
• $SMTP_ONLY must be set to 1

LDAP_SERVER_HOST

• => Specify the dns-name/ip-address where the ldap-server
• NOTE: If you going to use the mailserver in combination with docker-compose you can set the service name here

LDAP_SEARCH_BASE

• => e.g. LDAP_SEARCH_BASE=dc=mydomain,dc=loc

LDAP_BIND_DN

• => take a look at examples of SASL_LDAP_BIND_DN

LDAP_BIND_PW

• => Specify the password to bind against ldap

KOPANO

• empty => LDAP support disabled disabled
• 1 => set virtual_transport = ltmp:${KOPANO_DAGENT}:2003

KOPANO_DAGENT

• => Specify the dns-name/ip-address where the kopano-dagent can be reached

VIRUSMAILS_DELETE_DELAY

Set how many days a virusmail will stay on the server before being deleted

• empty => 7 days