Skip to content

Commit ccbe121

Browse files
DougReederDougReeder
committed
Uses sed to copy and modify ports to create PROXY Protocol ports
1 parent 4370105 commit ccbe121

3 files changed

Lines changed: 30 additions & 90 deletions

File tree

‎charts/docker-mailserver/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,13 +197,13 @@ This can get a bit complicated, as explained in the `docker-mailserver` [documen
197197

198198
One approach to preserving the client IP address is to use the PROXY protocol, which is explained in the [documentation](https://docker-mailserver.github.io/docker-mailserver/latest/config/advanced/kubernetes/#proxy-port-to-service-via-proxy-protocol).
199199

200-
The Helm chart supports the use of the proxy protocol via the `proxyProtocol` key. To enable it set the `proxyProtocol.enable` key to true. You will also want to set the `trustedNetworks` key.
200+
The Helm chart supports the use of the proxy protocol via the `proxyProtocol` key. By default `proxyProtocol.enable` is true, and `trustedNetworks` is set to the private IP network ranges, as are typically used inside a cluster.
201201

202202
```yaml
203203
proxyProtocol:
204204
enabled: true
205205
# List of sources (in CIDR format, space-separated) to permit PROXY protocol from
206-
trustedNetworks: "10.0.0.0/8 192.168.0.0/16 172.16.0.0/16"
206+
trustedNetworks: "10.0.0.0/8 192.168.0.0/16 172.16.0.0/12"
207207
```
208208

209209
Enabling the PROXY protocol will create an additional port for each protocol (by adding 10,000 to the standard port value) that is configured to understand the PROXY protocol. Thus:

‎charts/docker-mailserver/tests/__snapshot__/configmap_test.yaml.snap‎

Lines changed: 12 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ manifest should match snapshot:
1414
ssl = yes
1515
}
1616

17-
inet_listener imap_proxy {
17+
inet_listener imap_proxyprotocol {
1818
haproxy = yes
1919
port = 10143
2020
ssl = no
2121
}
2222

23-
inet_listener imaps_proxy {
23+
inet_listener imaps_proxyprotocol {
2424
haproxy = yes
2525
port = 10993
2626
ssl = yes
@@ -51,47 +51,17 @@ manifest should match snapshot:
5151
data:
5252
user-patches.sh: |
5353
#!/bin/bash
54-
# Make sure to keep this file in sync with https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!
55-
cat <<EOS >> /etc/postfix/master.cf
54+
# Duplicate the config for the submission(s) service ports (587 / 465) with adjustments for the PROXY ports (10587 / 10465) and `syslog_name` setting:
55+
postconf -Mf submission/inet | sed -e s/^submission/10587/ -e 's/submission/submission-proxyprotocol/' >> /etc/postfix/master.cf
56+
postconf -Mf submissions/inet | sed -e s/^submissions/10465/ -e 's/submissions/submissions-proxyprotocol/' >> /etc/postfix/master.cf
57+
# Enable PROXY Protocol support for these new service variants:
58+
postconf -P 10587/inet/smtpd_upstream_proxy_protocol=haproxy
59+
postconf -P 10465/inet/smtpd_upstream_proxy_protocol=haproxy
5660

57-
# Submission with proxy
58-
10587 inet n - n - - smtpd
59-
-o syslog_name=postfix/submission
60-
-o smtpd_tls_security_level=encrypt
61-
-o smtpd_sasl_auth_enable=yes
62-
-o smtpd_sasl_type=dovecot
63-
-o smtpd_reject_unlisted_recipient=no
64-
-o smtpd_sasl_authenticated_header=yes
65-
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
66-
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
67-
-o smtpd_sender_restrictions=\$mua_sender_restrictions
68-
-o smtpd_discard_ehlo_keywords=
69-
-o milter_macro_daemon_name=ORIGINATING
70-
-o cleanup_service_name=sender-cleanup
71-
-o smtpd_upstream_proxy_protocol=haproxy
72-
73-
# Submissions with proxy
74-
10465 inet n - n - - smtpd
75-
-o syslog_name=postfix/submissions
76-
-o smtpd_tls_wrappermode=yes
77-
-o smtpd_sasl_auth_enable=yes
78-
-o smtpd_sasl_type=dovecot
79-
-o smtpd_reject_unlisted_recipient=no
80-
-o smtpd_sasl_authenticated_header=yes
81-
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
82-
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
83-
-o smtpd_sender_restrictions=\$mua_sender_restrictions
84-
-o smtpd_discard_ehlo_keywords=
85-
-o milter_macro_daemon_name=ORIGINATING
86-
-o cleanup_service_name=sender-cleanup
87-
-o smtpd_upstream_proxy_protocol=haproxy
88-
89-
# Smtp with proxy
90-
12525 inet n - n - 1 postscreen
91-
-o syslog_name=postfix/smtpd-proxy
92-
-o postscreen_upstream_proxy_protocol=haproxy
93-
-o postscreen_cache_map=btree:$data_directory/postscreen_10025_cache
94-
EOS
61+
# Create a variant for port 25 too (NOTE: Port 10025 is already assigned in DMS to Amavis):
62+
postconf -Mf smtp/inet | sed -e s/^smtp/12525/ >> /etc/postfix/master.cf
63+
# Enable PROXY Protocol support (different setting as port 25 is handled via postscreen), optionally configure a `syslog_name` to distinguish in logs:
64+
postconf -P 12525/inet/postscreen_upstream_proxy_protocol=haproxy 12525/inet/postscreen_cache_map=proxy:btree:$data_directory/postscreen_12525_cache 12525/inet/syslog_name=postfix/smtp-proxyprotocol
9565
kind: ConfigMap
9666
metadata:
9767
labels:

‎charts/docker-mailserver/values.yaml‎

Lines changed: 16 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -495,13 +495,13 @@ configMaps:
495495
ssl = yes
496496
}
497497
498-
inet_listener imap_proxy {
498+
inet_listener imap_proxyprotocol {
499499
haproxy = yes
500500
port = 10143
501501
ssl = no
502502
}
503503
504-
inet_listener imaps_proxy {
504+
inet_listener imaps_proxyprotocol {
505505
haproxy = yes
506506
port = 10993
507507
ssl = yes
@@ -520,13 +520,13 @@ configMaps:
520520
ssl = yes
521521
}
522522
523-
inet_listener pop3_proxy {
523+
inet_listener pop3_proxyprotocol {
524524
haproxy = yes
525525
port = 10110
526526
ssl = no
527527
}
528528
529-
inet_listener pop3s_proxy {
529+
inet_listener pop3s_proxyprotocol {
530530
haproxy = yes
531531
port = 10995
532532
ssl = yes
@@ -540,7 +540,7 @@ configMaps:
540540
port = 4190
541541
}
542542
543-
inet_listener sieve_proxy {
543+
inet_listener sieve_proxyprotocol {
544544
port = 14190
545545
}
546546
}
@@ -578,47 +578,17 @@ configMaps:
578578
#!/bin/bash
579579
580580
{{- if .Values.proxyProtocol.enabled }}
581-
# Make sure to keep this file in sync with https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!
582-
cat <<EOS >> /etc/postfix/master.cf
583-
584-
# Submission with proxy
585-
10587 inet n - n - - smtpd
586-
-o syslog_name=postfix/submission
587-
-o smtpd_tls_security_level=encrypt
588-
-o smtpd_sasl_auth_enable=yes
589-
-o smtpd_sasl_type=dovecot
590-
-o smtpd_reject_unlisted_recipient=no
591-
-o smtpd_sasl_authenticated_header=yes
592-
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
593-
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
594-
-o smtpd_sender_restrictions=\$mua_sender_restrictions
595-
-o smtpd_discard_ehlo_keywords=
596-
-o milter_macro_daemon_name=ORIGINATING
597-
-o cleanup_service_name=sender-cleanup
598-
-o smtpd_upstream_proxy_protocol=haproxy
599-
600-
# Submissions with proxy
601-
10465 inet n - n - - smtpd
602-
-o syslog_name=postfix/submissions
603-
-o smtpd_tls_wrappermode=yes
604-
-o smtpd_sasl_auth_enable=yes
605-
-o smtpd_sasl_type=dovecot
606-
-o smtpd_reject_unlisted_recipient=no
607-
-o smtpd_sasl_authenticated_header=yes
608-
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
609-
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
610-
-o smtpd_sender_restrictions=\$mua_sender_restrictions
611-
-o smtpd_discard_ehlo_keywords=
612-
-o milter_macro_daemon_name=ORIGINATING
613-
-o cleanup_service_name=sender-cleanup
614-
-o smtpd_upstream_proxy_protocol=haproxy
615-
616-
# Smtp with proxy
617-
12525 inet n - n - 1 postscreen
618-
-o syslog_name=postfix/smtpd-proxy
619-
-o postscreen_upstream_proxy_protocol=haproxy
620-
-o postscreen_cache_map=btree:$data_directory/postscreen_10025_cache
621-
EOS
581+
# Duplicate the config for the submission(s) service ports (587 / 465) with adjustments for the PROXY ports (10587 / 10465) and `syslog_name` setting:
582+
postconf -Mf submission/inet | sed -e s/^submission/10587/ -e 's/submission/submission-proxyprotocol/' >> /etc/postfix/master.cf
583+
postconf -Mf submissions/inet | sed -e s/^submissions/10465/ -e 's/submissions/submissions-proxyprotocol/' >> /etc/postfix/master.cf
584+
# Enable PROXY Protocol support for these new service variants:
585+
postconf -P 10587/inet/smtpd_upstream_proxy_protocol=haproxy
586+
postconf -P 10465/inet/smtpd_upstream_proxy_protocol=haproxy
587+
588+
# Create a variant for port 25 too (NOTE: Port 10025 is already assigned in DMS to Amavis):
589+
postconf -Mf smtp/inet | sed -e s/^smtp/12525/ >> /etc/postfix/master.cf
590+
# Enable PROXY Protocol support (different setting as port 25 is handled via postscreen), optionally configure a `syslog_name` to distinguish in logs:
591+
postconf -P 12525/inet/postscreen_upstream_proxy_protocol=haproxy 12525/inet/postscreen_cache_map=proxy:btree:$data_directory/postscreen_12525_cache 12525/inet/syslog_name=postfix/smtp-proxyprotocol
622592
{{- end }}
623593
624594
## The secrets key works the same way as the configs key. Use secrets to store sensitive information,

0 commit comments

Comments
 (0)