Skip to content

Commit 90b9a27

Browse files
cfiscfis
authored
Merge pull request #174 from DougReeder/sed-copy-modify
Uses sed to copy and modify ports to create PROXY Protocol ports
2 parents 4370105 + 1a4479f commit 90b9a27

3 files changed

Lines changed: 49 additions & 97 deletions

File tree

‎charts/docker-mailserver/README.md‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@ cat /tmp/docker-mailserver/postfix-accounts.cf
117117

118118
This path is [mapped](#persistence) to a Kubernetes Volume.
119119

120+
Optionally (but reccomended), create a [`NetworkPolicy`](https://kubernetes.io/docs/concepts/services-networking/network-policies/) that only allows appropriate pods to connect to the DMS pod.
121+
120122
## Configuration
121123

122124
Assuming you still have a command prompt [open](#getting-started) in the running container, run the setup command to see additional configuration options:
@@ -197,25 +199,29 @@ This can get a bit complicated, as explained in the `docker-mailserver` [documen
197199

198200
One approach to preserving the client IP address is to use the PROXY protocol, which is explained in the [documentation](https://docker-mailserver.github.io/docker-mailserver/latest/config/advanced/kubernetes/#proxy-port-to-service-via-proxy-protocol).
199201

200-
The Helm chart supports the use of the proxy protocol via the `proxyProtocol` key. To enable it set the `proxyProtocol.enable` key to true. You will also want to set the `trustedNetworks` key.
202+
The Helm chart supports the use of the proxy protocol via the `proxyProtocol` key. By default `proxyProtocol.enable` is true, and `trustedNetworks` is set to the private IP network ranges, as are typically used inside a cluster.
201203

202204
```yaml
203205
proxyProtocol:
204206
enabled: true
205207
# List of sources (in CIDR format, space-separated) to permit PROXY protocol from
206-
trustedNetworks: "10.0.0.0/8 192.168.0.0/16 172.16.0.0/16"
208+
trustedNetworks: "10.0.0.0/8 192.168.0.0/16 172.16.0.0/12"
207209
```
208210

211+
For security, you should narrow this to the actual range of IP addresses used by your ingress controller pods, and be certain to exclude any IP ranges gatewayed from IPv6 to v4 or vice versa.
212+
Also note that any compromised container in the cluster could use the PROXY protocol to evade some security measures, so set a `NetworkPolicy` that only allows the appropriate pods to connect to the DMS pod.
213+
209214
Enabling the PROXY protocol will create an additional port for each protocol (by adding 10,000 to the standard port value) that is configured to understand the PROXY protocol. Thus:
210215

211-
| Protocol | Port | PROXY Port |
212-
| ---------- | ------- | ----------- |
213-
| submissions | 465 | 10465 |
214-
| submission | 587 | 10587 |
215-
| imap | 143 | 10143 |
216-
| imaps | 993 | 10993 |
217-
| pop3 | 110 | 10110 |
218-
| pop3s | 995 | 10995 |
216+
| Protocol | Regular Port | PROXY Protocol Port |
217+
| ---------- |--------------|---------------------|
218+
| smtp | 25 | 12525 |
219+
| submissions | 465 | 10465 |
220+
| submission | 587 | 10587 |
221+
| imap | 143 | 10143 |
222+
| imaps | 993 | 10993 |
223+
| pop3 | 110 | 10110 |
224+
| pop3s | 995 | 10995 |
219225

220226
If you do not enable the PROXY protocol and your mail server is not exposed using a load-balancer service with an external traffic policy in "Local" mode, then all incoming mail traffic will look like it comes from a local Kubernetes cluster IP.
221227

‎charts/docker-mailserver/tests/__snapshot__/configmap_test.yaml.snap‎

Lines changed: 14 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ manifest should match snapshot:
1414
ssl = yes
1515
}
1616

17-
inet_listener imap_proxy {
17+
inet_listener imap_proxyprotocol {
1818
haproxy = yes
1919
port = 10143
2020
ssl = no
2121
}
2222

23-
inet_listener imaps_proxy {
23+
inet_listener imaps_proxyprotocol {
2424
haproxy = yes
2525
port = 10993
2626
ssl = yes
@@ -51,47 +51,20 @@ manifest should match snapshot:
5151
data:
5252
user-patches.sh: |
5353
#!/bin/bash
54-
# Make sure to keep this file in sync with https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!
55-
cat <<EOS >> /etc/postfix/master.cf
54+
# NOTE: Keep in sync with upstream advice:
55+
# https://github.com/docker-mailserver/docker-mailserver/blob/v15.0.0/docs/content/examples/tutorials/mailserver-behind-proxy.md?plain=1#L238-L268
5656

57-
# Submission with proxy
58-
10587 inet n - n - - smtpd
59-
-o syslog_name=postfix/submission
60-
-o smtpd_tls_security_level=encrypt
61-
-o smtpd_sasl_auth_enable=yes
62-
-o smtpd_sasl_type=dovecot
63-
-o smtpd_reject_unlisted_recipient=no
64-
-o smtpd_sasl_authenticated_header=yes
65-
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
66-
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
67-
-o smtpd_sender_restrictions=\$mua_sender_restrictions
68-
-o smtpd_discard_ehlo_keywords=
69-
-o milter_macro_daemon_name=ORIGINATING
70-
-o cleanup_service_name=sender-cleanup
71-
-o smtpd_upstream_proxy_protocol=haproxy
57+
# Duplicate the config for the submission(s) service ports (587 / 465) with adjustments for the PROXY ports (10587 / 10465) and `syslog_name` setting:
58+
postconf -Mf submission/inet | sed -e s/^submission/10587/ -e 's/submission/submission-proxyprotocol/' >> /etc/postfix/master.cf
59+
postconf -Mf submissions/inet | sed -e s/^submissions/10465/ -e 's/submissions/submissions-proxyprotocol/' >> /etc/postfix/master.cf
60+
# Enable PROXY Protocol support for these new service variants:
61+
postconf -P 10587/inet/smtpd_upstream_proxy_protocol=haproxy
62+
postconf -P 10465/inet/smtpd_upstream_proxy_protocol=haproxy
7263

73-
# Submissions with proxy
74-
10465 inet n - n - - smtpd
75-
-o syslog_name=postfix/submissions
76-
-o smtpd_tls_wrappermode=yes
77-
-o smtpd_sasl_auth_enable=yes
78-
-o smtpd_sasl_type=dovecot
79-
-o smtpd_reject_unlisted_recipient=no
80-
-o smtpd_sasl_authenticated_header=yes
81-
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
82-
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
83-
-o smtpd_sender_restrictions=\$mua_sender_restrictions
84-
-o smtpd_discard_ehlo_keywords=
85-
-o milter_macro_daemon_name=ORIGINATING
86-
-o cleanup_service_name=sender-cleanup
87-
-o smtpd_upstream_proxy_protocol=haproxy
88-
89-
# Smtp with proxy
90-
12525 inet n - n - 1 postscreen
91-
-o syslog_name=postfix/smtpd-proxy
92-
-o postscreen_upstream_proxy_protocol=haproxy
93-
-o postscreen_cache_map=btree:$data_directory/postscreen_10025_cache
94-
EOS
64+
# Create a variant for port 25 too (NOTE: Port 10025 is already assigned in DMS to Amavis):
65+
postconf -Mf smtp/inet | sed -e s/^smtp/12525/ >> /etc/postfix/master.cf
66+
# Enable PROXY Protocol support (different setting as port 25 is handled via postscreen), optionally configure a `syslog_name` to distinguish in logs:
67+
postconf -P 12525/inet/postscreen_upstream_proxy_protocol=haproxy 12525/inet/postscreen_cache_map=proxy:btree:\$data_directory/postscreen_12525_cache 12525/inet/syslog_name=postfix/smtpd-proxyprotocol
9568
kind: ConfigMap
9669
metadata:
9770
labels:

‎charts/docker-mailserver/values.yaml‎

Lines changed: 19 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -495,13 +495,13 @@ configMaps:
495495
ssl = yes
496496
}
497497
498-
inet_listener imap_proxy {
498+
inet_listener imap_proxyprotocol {
499499
haproxy = yes
500500
port = 10143
501501
ssl = no
502502
}
503503
504-
inet_listener imaps_proxy {
504+
inet_listener imaps_proxyprotocol {
505505
haproxy = yes
506506
port = 10993
507507
ssl = yes
@@ -520,13 +520,13 @@ configMaps:
520520
ssl = yes
521521
}
522522
523-
inet_listener pop3_proxy {
523+
inet_listener pop3_proxyprotocol {
524524
haproxy = yes
525525
port = 10110
526526
ssl = no
527527
}
528528
529-
inet_listener pop3s_proxy {
529+
inet_listener pop3s_proxyprotocol {
530530
haproxy = yes
531531
port = 10995
532532
ssl = yes
@@ -540,7 +540,7 @@ configMaps:
540540
port = 4190
541541
}
542542
543-
inet_listener sieve_proxy {
543+
inet_listener sieve_proxyprotocol {
544544
port = 14190
545545
}
546546
}
@@ -578,47 +578,20 @@ configMaps:
578578
#!/bin/bash
579579
580580
{{- if .Values.proxyProtocol.enabled }}
581-
# Make sure to keep this file in sync with https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!
582-
cat <<EOS >> /etc/postfix/master.cf
583-
584-
# Submission with proxy
585-
10587 inet n - n - - smtpd
586-
-o syslog_name=postfix/submission
587-
-o smtpd_tls_security_level=encrypt
588-
-o smtpd_sasl_auth_enable=yes
589-
-o smtpd_sasl_type=dovecot
590-
-o smtpd_reject_unlisted_recipient=no
591-
-o smtpd_sasl_authenticated_header=yes
592-
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
593-
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
594-
-o smtpd_sender_restrictions=\$mua_sender_restrictions
595-
-o smtpd_discard_ehlo_keywords=
596-
-o milter_macro_daemon_name=ORIGINATING
597-
-o cleanup_service_name=sender-cleanup
598-
-o smtpd_upstream_proxy_protocol=haproxy
599-
600-
# Submissions with proxy
601-
10465 inet n - n - - smtpd
602-
-o syslog_name=postfix/submissions
603-
-o smtpd_tls_wrappermode=yes
604-
-o smtpd_sasl_auth_enable=yes
605-
-o smtpd_sasl_type=dovecot
606-
-o smtpd_reject_unlisted_recipient=no
607-
-o smtpd_sasl_authenticated_header=yes
608-
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
609-
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
610-
-o smtpd_sender_restrictions=\$mua_sender_restrictions
611-
-o smtpd_discard_ehlo_keywords=
612-
-o milter_macro_daemon_name=ORIGINATING
613-
-o cleanup_service_name=sender-cleanup
614-
-o smtpd_upstream_proxy_protocol=haproxy
615-
616-
# Smtp with proxy
617-
12525 inet n - n - 1 postscreen
618-
-o syslog_name=postfix/smtpd-proxy
619-
-o postscreen_upstream_proxy_protocol=haproxy
620-
-o postscreen_cache_map=btree:$data_directory/postscreen_10025_cache
621-
EOS
581+
# NOTE: Keep in sync with upstream advice:
582+
# https://github.com/docker-mailserver/docker-mailserver/blob/v15.0.0/docs/content/examples/tutorials/mailserver-behind-proxy.md?plain=1#L238-L268
583+
584+
# Duplicate the config for the submission(s) service ports (587 / 465) with adjustments for the PROXY ports (10587 / 10465) and `syslog_name` setting:
585+
postconf -Mf submission/inet | sed -e s/^submission/10587/ -e 's/submission/submission-proxyprotocol/' >> /etc/postfix/master.cf
586+
postconf -Mf submissions/inet | sed -e s/^submissions/10465/ -e 's/submissions/submissions-proxyprotocol/' >> /etc/postfix/master.cf
587+
# Enable PROXY Protocol support for these new service variants:
588+
postconf -P 10587/inet/smtpd_upstream_proxy_protocol=haproxy
589+
postconf -P 10465/inet/smtpd_upstream_proxy_protocol=haproxy
590+
591+
# Create a variant for port 25 too (NOTE: Port 10025 is already assigned in DMS to Amavis):
592+
postconf -Mf smtp/inet | sed -e s/^smtp/12525/ >> /etc/postfix/master.cf
593+
# Enable PROXY Protocol support (different setting as port 25 is handled via postscreen), optionally configure a `syslog_name` to distinguish in logs:
594+
postconf -P 12525/inet/postscreen_upstream_proxy_protocol=haproxy 12525/inet/postscreen_cache_map=proxy:btree:\$data_directory/postscreen_12525_cache 12525/inet/syslog_name=postfix/smtpd-proxyprotocol
622595
{{- end }}
623596
624597
## The secrets key works the same way as the configs key. Use secrets to store sensitive information,

0 commit comments

Comments
 (0)