I'm having difficulty figuring out how to create a particular Postfix configuration for a Postfix instance that will be running inside a container.
Here are my requirements:
- Disallow relaying unless sender is from one of a small set of IP addresses or the sender is a local program (though how to allow a program outside the container to queue up mail for the Postfix running in the container is an interesting conundrum).
- Run every piece of incoming mail from non-relay IP addresses through a small set of checks and refuse delivery if it doesn't pass them all:
- If sender IP is in a specified RBL, reject it.
- Greylist incoming IPs I haven't accepted mail from before.
- If the user portion of the destination address doesn't match any of a small set of regexps, reject it.
- If the mail doesn't pass a few simple and fast spamassassin checks, reject it.
- For all local delivery, use a program to determine final disposition. This program will have one of four results.
- Deliver to a different local address (Delivered-To will be updated to provide looping protection and the local delivery program will be run again).
- Forward to a remote address (like a gmail account or something).
- Deliver to a local Maildir directory owned by a particular user (always the same user for now).
I only need to handle mail addressed to one domain. At some point I would like to add a new domain in which all mail is handled by Mailman, though it would again be nice to reject any mail for a non-existent list address before delivery.
Are there any pointers to documents that specify how to achieve one or more of these goals? The Postfix manual for local and transport are too obtuse to really be helpful. It would be nice to have a document specifying the flow of mail through the system and how it can be altered at various points.
Also, while I can write my own program to deliver to a Maildir mailbox, doing so perfectly correctly is rather tricky, and I'd like to avoid it if at all possible and have the part of Postfix that already knows how to do this handle it.
Postfix will be running in a container. The queue directory and the Maildir directories will be persistent filesystems that are mounted inside the container. I presume that all the programs needed to implement the stuff I talked about before (postgrey, spamassassin, the thing that determines how local mail will be disposed of) will also run in the same container. I may have to arrange for the state that postgrey and spamassassin keep to also be persistent across container invocations.
I will be using mutt to read the mail. Currently, I will be the only person for whom mail will be delivered locally, though I will have several different Maildir directories that things will be delivered to. I will likely be running Dovecot on the same system (perhaps containerized in a different container) to do this.
Also, I have a few hundred local recipient addresses, most of which I wish to treat in an identical way. They all fit a pattern, but some that fit this pattern need to be treated differently from others. I know which beforehand without reference to the contents of the email, so I can create more specific patterns for those.