apiVersion: v1
kind: Namespace
metadata:
name: "mailserver"
---
apiVersion: "v1"
kind: "PersistentVolumeClaim"
metadata:
name: "mailserver-pvc"
namespace: "mailserver"
labels:
app: mailserver
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 15Gi
---
apiVersion: "v1"
kind: "PersistentVolumeClaim"
metadata:
name: "mailserver-data-pvc"
namespace: "mailserver"
labels:
app: mailserver
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 15Gi
---
kind: Service
apiVersion: v1
metadata:
name: mailserver
namespace: mailserver
labels:
app: mailserver
annotations:
metallb.universe.tf/address-pool: bgp-range
spec:
selector:
app: mailserver
ports:
- name: smtp
port: 25
targetPort: smtp
- name: smtp-auth
port: 587
targetPort: smtp-auth
- name: imap-secure
port: 993
targetPort: imap-secure
type: LoadBalancer
externalTrafficPolicy: Local
loadBalancerIP: 192.168.4.2
---
kind: ConfigMap
apiVersion: v1
metadata:
name: mailserver.config
namespace: mailserver
labels:
app: mailserver
data:
postfix-receive-access.cf: |
blacklisted@recipient.example REJECT
postfix-send-access.cf: |
blacklisted-sender REJECT
postfix-accounts.cf: |
user1@example.com|{SHA512-CRYPT}$6$2YpW1nYtPBs2yLYS$z.5PGH1OEzsHHNhl3gJrc3D.YMZkvKw/vp.r5WIiwya6z7P/CQ9GDEJDr2G2V0cAfjDFeAQPUoopsuWPXLk3u1
postfix-virtual.cf: |
@example.org user1@example.com
SigningTable: |
*@example.org my._domainkey.example.org
*@example.com my._domainkey.example.com
KeyTable: |
my._domainkey.example.org example.org:my:/etc/opendkim/keys/example.org-mail.key
my._domainkey.example.com example.com:my:/etc/opendkim/keys/example.com-mail.key
TrustedHosts: |
127.0.0.1
localhost
spamassassin-rules.cf: |
header SPAMMER_1 From =~ / a-z » +d{2,4}.com/i
score SPAMMER_1 5.0
sa-cron: |
# This assumes you're having `environment: ONE_DIR=1` in the docker-compose.yml,
# with a consolidated config in `/var/mail-state`
#
# m h dom mon dow user command
#
# Everyday 2:00AM, learn spam from a specific user
# spam: junk directory
0 2 * * * root sa-learn --spam /var/mail/*/*/.Junk --dbpath /var/mail-state/lib-amavis/.spamassassin
# ham: archive directories
15 2 * * * root sa-learn --ham /var/mail/*/*/.Archive* --dbpath /var/mail-state/lib-amavis/.spamassassin
# ham: inbox subdirectories
30 2 * * * root sa-learn --ham /var/mail/*/*/cur* --dbpath /var/mail-state/lib-amavis/.spamassassin
---
kind: Secret
apiVersion: v1
metadata:
name: mailserver.opendkim.keys
namespace: mailserver
labels:
app: mailserver
type: Opaque
data:
example.org-mail.key: "key here"
example.com-mail.key: "key here"
---
kind: Deployment
apiVersion: apps/v1
metadata:
name: mailserver
namespace: mailserver
labels:
app: mailserver
spec:
selector:
matchLabels:
app: mailserver
strategy:
type: Recreate
template:
metadata:
labels:
app: mailserver
spec:
nodeSelector:
has/mail-server: "true"
subdomain: mailserver
containers:
- name: mailserver
image: radicand/docker-mailserver:gha
# image: radicand/docker-mailserver:b9f43ab
resources:
requests:
memory: "500Mi"
cpu: "750m"
limits:
memory: "1500Mi"
cpu: "900m"
imagePullPolicy: Always
securityContext: {}
ports:
- name: smtp
containerPort: 25
- name: smtp-auth
containerPort: 587
- name: imap-secure
containerPort: 993
env:
- name: DOMAINNAME
value: "example.com"
- name: ONE_DIR
value: "1"
- name: SMTP_ONLY
value: "0"
- name: ENABLE_SRS
value: "0"
- name: ENABLE_SPAMASSASSIN
value: "1"
- name: SA_SPAM_SUBJECT
value: " SPAM » "
- name: ENABLE_FAIL2BAN
value: "0"
- name: ENABLE_POSTGREY
value: "0"
- name: ENABLE_CLAMAV
value: "0"
- name: ENABLE_SASLAUTHD
value: "0"
- name: SRS_EXCLUDE_DOMAINS
value: example.com
- name: POSTMASTER_ADDRESS
value: "postmaster@example.com"
- name: POSTFIX_MESSAGE_SIZE_LIMIT
value: "25000000"
- name: SSL_TYPE
value: "manual"
- name: SSL_CERT_PATH
value: "/etc/ssl/mailserver/tls.crt"
- name: SSL_KEY_PATH
value: "/etc/ssl/mailserver/tls.key"
- name: OVERRIDE_HOSTNAME
value: "mail.example.com"
- name: REPORT_RECIPIENT
value: "postmaster@example.com"
volumeMounts:
- name: config
subPath: postfix-accounts.cf
mountPath: /tmp/docker-mailserver/postfix-accounts.cf
readOnly: true
- name: config
subPath: postfix-main.cf
mountPath: /tmp/docker-mailserver/postfix-main.cf
readOnly: true
- name: config
subPath: postfix-receive-access.cf
mountPath: /tmp/docker-mailserver/postfix-receive-access.cf
readOnly: true
- name: config
subPath: postfix-virtual.cf
mountPath: /tmp/docker-mailserver/postfix-virtual.cf
readOnly: true
- name: config
subPath: postfix-send-access.cf
mountPath: /tmp/docker-mailserver/postfix-send-access.cf
readOnly: true
- name: config
subPath: spamassassin-rules.cf
mountPath: /tmp/docker-mailserver/spamassassin-rules.cf
readOnly: true
- name: config
subPath: sa-cron
mountPath: /etc/cron.d/sa-learn
readOnly: true
# mode: 0644
- name: config
subPath: SigningTable
mountPath: /tmp/docker-mailserver/opendkim/SigningTable
readOnly: true
- name: config
subPath: KeyTable
mountPath: /tmp/docker-mailserver/opendkim/KeyTable
readOnly: true
- name: config
subPath: TrustedHosts
mountPath: /tmp/docker-mailserver/opendkim/TrustedHosts
readOnly: true
- name: opendkim-keys
mountPath: /tmp/docker-mailserver/opendkim/keys
readOnly: true
- name: state
mountPath: /var/mail-state
- name: data
mountPath: /var/mail
- name: tls
mountPath: /etc/ssl/mailserver
readOnly: true
volumes:
- name: config
configMap:
name: mailserver.config
# items:
# - key: sa-cron
# path: /etc/cron.d
# mode: 0644
- name: opendkim-keys
secret:
secretName: mailserver.opendkim.keys
- name: state
persistentVolumeClaim:
claimName: "mailserver-pvc"
- name: data
persistentVolumeClaim:
claimName: "mailserver-data-pvc"
- name: tls
secret:
secretName: mail-example-com-tls
kind: Namespace
metadata:
name: "mailserver"
---
apiVersion: "v1"
kind: "PersistentVolumeClaim"
metadata:
name: "mailserver-pvc"
namespace: "mailserver"
labels:
app: mailserver
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 15Gi
---
apiVersion: "v1"
kind: "PersistentVolumeClaim"
metadata:
name: "mailserver-data-pvc"
namespace: "mailserver"
labels:
app: mailserver
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 15Gi
---
kind: Service
apiVersion: v1
metadata:
name: mailserver
namespace: mailserver
labels:
app: mailserver
annotations:
metallb.universe.tf/address-pool: bgp-range
spec:
selector:
app: mailserver
ports:
- name: smtp
port: 25
targetPort: smtp
- name: smtp-auth
port: 587
targetPort: smtp-auth
- name: imap-secure
port: 993
targetPort: imap-secure
type: LoadBalancer
externalTrafficPolicy: Local
loadBalancerIP: 192.168.4.2
---
kind: ConfigMap
apiVersion: v1
metadata:
name: mailserver.config
namespace: mailserver
labels:
app: mailserver
data:
postfix-receive-access.cf: |
blacklisted@recipient.example REJECT
postfix-send-access.cf: |
blacklisted-sender REJECT
postfix-accounts.cf: |
user1@example.com|{SHA512-CRYPT}$6$2YpW1nYtPBs2yLYS$z.5PGH1OEzsHHNhl3gJrc3D.YMZkvKw/vp.r5WIiwya6z7P/CQ9GDEJDr2G2V0cAfjDFeAQPUoopsuWPXLk3u1
postfix-virtual.cf: |
@example.org user1@example.com
SigningTable: |
*@example.org my._domainkey.example.org
*@example.com my._domainkey.example.com
KeyTable: |
my._domainkey.example.org example.org:my:/etc/opendkim/keys/example.org-mail.key
my._domainkey.example.com example.com:my:/etc/opendkim/keys/example.com-mail.key
TrustedHosts: |
127.0.0.1
localhost
spamassassin-rules.cf: |
header SPAMMER_1 From =~ / a-z » +d{2,4}.com/i
score SPAMMER_1 5.0
sa-cron: |
# This assumes you're having `environment: ONE_DIR=1` in the docker-compose.yml,
# with a consolidated config in `/var/mail-state`
#
# m h dom mon dow user command
#
# Everyday 2:00AM, learn spam from a specific user
# spam: junk directory
0 2 * * * root sa-learn --spam /var/mail/*/*/.Junk --dbpath /var/mail-state/lib-amavis/.spamassassin
# ham: archive directories
15 2 * * * root sa-learn --ham /var/mail/*/*/.Archive* --dbpath /var/mail-state/lib-amavis/.spamassassin
# ham: inbox subdirectories
30 2 * * * root sa-learn --ham /var/mail/*/*/cur* --dbpath /var/mail-state/lib-amavis/.spamassassin
---
kind: Secret
apiVersion: v1
metadata:
name: mailserver.opendkim.keys
namespace: mailserver
labels:
app: mailserver
type: Opaque
data:
example.org-mail.key: "key here"
example.com-mail.key: "key here"
---
kind: Deployment
apiVersion: apps/v1
metadata:
name: mailserver
namespace: mailserver
labels:
app: mailserver
spec:
selector:
matchLabels:
app: mailserver
strategy:
type: Recreate
template:
metadata:
labels:
app: mailserver
spec:
nodeSelector:
has/mail-server: "true"
subdomain: mailserver
containers:
- name: mailserver
image: radicand/docker-mailserver:gha
# image: radicand/docker-mailserver:b9f43ab
resources:
requests:
memory: "500Mi"
cpu: "750m"
limits:
memory: "1500Mi"
cpu: "900m"
imagePullPolicy: Always
securityContext: {}
ports:
- name: smtp
containerPort: 25
- name: smtp-auth
containerPort: 587
- name: imap-secure
containerPort: 993
env:
- name: DOMAINNAME
value: "example.com"
- name: ONE_DIR
value: "1"
- name: SMTP_ONLY
value: "0"
- name: ENABLE_SRS
value: "0"
- name: ENABLE_SPAMASSASSIN
value: "1"
- name: SA_SPAM_SUBJECT
value: " SPAM » "
- name: ENABLE_FAIL2BAN
value: "0"
- name: ENABLE_POSTGREY
value: "0"
- name: ENABLE_CLAMAV
value: "0"
- name: ENABLE_SASLAUTHD
value: "0"
- name: SRS_EXCLUDE_DOMAINS
value: example.com
- name: POSTMASTER_ADDRESS
value: "postmaster@example.com"
- name: POSTFIX_MESSAGE_SIZE_LIMIT
value: "25000000"
- name: SSL_TYPE
value: "manual"
- name: SSL_CERT_PATH
value: "/etc/ssl/mailserver/tls.crt"
- name: SSL_KEY_PATH
value: "/etc/ssl/mailserver/tls.key"
- name: OVERRIDE_HOSTNAME
value: "mail.example.com"
- name: REPORT_RECIPIENT
value: "postmaster@example.com"
volumeMounts:
- name: config
subPath: postfix-accounts.cf
mountPath: /tmp/docker-mailserver/postfix-accounts.cf
readOnly: true
- name: config
subPath: postfix-main.cf
mountPath: /tmp/docker-mailserver/postfix-main.cf
readOnly: true
- name: config
subPath: postfix-receive-access.cf
mountPath: /tmp/docker-mailserver/postfix-receive-access.cf
readOnly: true
- name: config
subPath: postfix-virtual.cf
mountPath: /tmp/docker-mailserver/postfix-virtual.cf
readOnly: true
- name: config
subPath: postfix-send-access.cf
mountPath: /tmp/docker-mailserver/postfix-send-access.cf
readOnly: true
- name: config
subPath: spamassassin-rules.cf
mountPath: /tmp/docker-mailserver/spamassassin-rules.cf
readOnly: true
- name: config
subPath: sa-cron
mountPath: /etc/cron.d/sa-learn
readOnly: true
# mode: 0644
- name: config
subPath: SigningTable
mountPath: /tmp/docker-mailserver/opendkim/SigningTable
readOnly: true
- name: config
subPath: KeyTable
mountPath: /tmp/docker-mailserver/opendkim/KeyTable
readOnly: true
- name: config
subPath: TrustedHosts
mountPath: /tmp/docker-mailserver/opendkim/TrustedHosts
readOnly: true
- name: opendkim-keys
mountPath: /tmp/docker-mailserver/opendkim/keys
readOnly: true
- name: state
mountPath: /var/mail-state
- name: data
mountPath: /var/mail
- name: tls
mountPath: /etc/ssl/mailserver
readOnly: true
volumes:
- name: config
configMap:
name: mailserver.config
# items:
# - key: sa-cron
# path: /etc/cron.d
# mode: 0644
- name: opendkim-keys
secret:
secretName: mailserver.opendkim.keys
- name: state
persistentVolumeClaim:
claimName: "mailserver-pvc"
- name: data
persistentVolumeClaim:
claimName: "mailserver-data-pvc"
- name: tls
secret:
secretName: mail-example-com-tls
