misc_nixos-mailserver/README.md

362 lines
11 KiB
Markdown
Raw Normal View History

2017-09-13 12:03:04 +00:00
# ![Simple Nixos MailServer][logo]
2016-07-21 16:55:01 +00:00
![license](https://img.shields.io/badge/license-GPL3-brightgreen.svg)
2017-09-21 14:32:01 +00:00
![status](https://travis-ci.org/r-raymond/nixos-mailserver.svg?branch=master)
2016-07-21 16:11:43 +00:00
2017-09-13 12:03:04 +00:00
2017-09-13 11:16:17 +00:00
## Stable Releases
2017-11-20 06:27:28 +00:00
* [SNM v2.0](https://github.com/r-raymond/nixos-mailserver/releases/v2.0)
2017-09-13 11:16:17 +00:00
2017-11-20 06:27:28 +00:00
[Latest Release (Candidate)](https://github.com/r-raymond/nixos-mailserver/releases/latest)
2017-09-20 14:27:52 +00:00
2017-09-13 11:16:17 +00:00
## Features
2017-11-11 15:15:30 +00:00
### v2.0
2017-11-21 07:52:54 +00:00
* [x] Continous Integration Testing
2017-11-11 15:15:30 +00:00
* [x] Multiple Domains
2017-09-13 11:16:17 +00:00
* Postfix MTA
- [x] smtp on port 25
- [x] submission port 587
2017-08-13 10:58:00 +00:00
- [x] lmtp with dovecot
* Dovecot
2017-09-13 11:16:17 +00:00
- [x] maildir folders
- [x] imap starttls on port 143
- [x] pop3 starttls on port 110
2017-08-13 10:58:00 +00:00
* Certificates
- [x] manual certificates
- [x] on the fly creation
2017-11-11 15:15:30 +00:00
- [x] Let's Encrypt
2017-08-13 10:58:00 +00:00
* Spam Filtering
2017-09-13 11:16:17 +00:00
- [x] via rspamd
2017-08-13 10:58:00 +00:00
* Virus Scanning
2017-09-13 11:16:17 +00:00
- [x] via clamav
2017-08-13 10:58:00 +00:00
* DKIM Signing
2017-09-13 11:16:17 +00:00
- [x] via opendkim
2017-08-13 10:58:00 +00:00
* User Management
2017-09-13 11:16:17 +00:00
- [x] declarative user management
- [x] declarative password management
2017-11-20 06:16:08 +00:00
* Sieves
- [x] A simple standard script that moves spam
- [x] Allow user defined sieve scripts
2017-09-13 11:16:17 +00:00
2017-11-11 15:15:30 +00:00
### In the future
2017-11-20 06:16:08 +00:00
2017-09-13 11:16:17 +00:00
* User Aliases
- [ ] More complete alias support
2017-11-11 15:15:30 +00:00
* DKIM Signing
- [ ] Allow a per domain selector
2017-09-13 08:17:04 +00:00
### Changelog
#### v1.0 -> v1.1
* Changed structure to Nix Modules
2017-09-13 11:16:17 +00:00
* Adds Sieve support
2017-08-13 10:58:00 +00:00
2017-11-11 15:15:30 +00:00
#### v1.1 -> v2.0
* rename domain to fqdn, seperate fqdn from domains
* multi domain support
2017-11-13 13:59:25 +00:00
### Quick Start
2017-10-17 09:52:47 +00:00
2017-10-17 09:53:53 +00:00
```nix
2017-10-17 09:52:47 +00:00
{ config, pkgs, ... }:
{
imports = [
2017-11-20 06:27:28 +00:00
(builtins.fetchTarball "https://github.com/r-raymond/nixos-mailserver/releases/tag/v2.0")
2017-10-17 09:52:47 +00:00
];
2017-11-05 09:57:26 +00:00
2017-10-17 09:52:47 +00:00
mailserver = {
enable = true;
2017-11-11 15:15:30 +00:00
fqdn = "mail.example.com";
domains = [ "example.com" "example2.com" ];
loginAccounts = {
"user1@example.com" = {
hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/";
};
2017-10-17 09:52:47 +00:00
};
2017-10-17 15:29:07 +00:00
virtualAliases = {
2017-11-11 15:15:30 +00:00
# address = forward address;
"info@example.com" = "user1@example.com";
"postmaster@example.com" = "user1@example.com";
"abuse@example.com" = "user1@example.com";
"user1@example2.com" = "user1@example.com";
"info@example2.com" = "user1@example.com";
"postmaster@example2.com" = "user1@example.com";
"abuse@example2.com" = "user1@example.com";
2017-10-17 09:52:47 +00:00
};
};
}
```
For a complete list of options, see `default.nix`.
2017-08-12 09:52:01 +00:00
2017-11-13 13:59:25 +00:00
## How to Set Up a 10/10 Mail Server Guide
Mail servers can be a tricky thing to set up. This guide is supposed to run you
through the most important steps to achieve a 10/10 score on `mail-tester.com`.
2017-08-12 09:52:01 +00:00
2017-11-13 13:59:25 +00:00
What you need:
* A server with a public IP (referred to as `server-IP`)
* A Fully Qualified Domain Name (`FQDN`) where your server is reachable. Note
so that other servers can find yours. Common FQDN include `mx.example.com`
(where `example.com` is a domain you own) or `mail.example.com`. The domain
is referred to as `server-domain` (`example.com` in the above example) and
the `FQDN` is referred to by `server-FQDN` (`mx.example.com` above).
* A list of domains you want to your email server to serve. (Note that this
does not have to include `server-domain`, but may of course). These will be
referred to as `domains`. As an example, `domains = [ example1.com,
example2.com ]`.
### A) Setup server
The following describes a server setup that is fairly complete. Even though
there are more possible options (see `default.nix`), these should be the most
common ones.
```nix
{ config, pkgs, ... }:
{
imports = [
2017-11-20 06:27:28 +00:00
(builtins.fetchTarball "https://github.com/r-raymond/nixos-mailserver/releases/tag/v2.0")
2017-11-13 13:59:25 +00:00
];
mailserver = {
enable = true;
fqdn = <server-FQDN>;
domains = [ <domains> ];
# A list of all login accounts. To create the password hashes, use
# mkpasswd -m sha-512 "super secret password"
loginAccounts = {
"user1@example.com" = {
hashedPassword = "$6$/z4n8AQl6K$kiOkBTWlZfBd7PvF5GsJ8PmPgdZsFGN1jPGZufxxr60PoR0oUsrvzm2oQiflyz5ir9fFJ.d/zKm/NgLXNUsNX/";
};
"user2@example.com" = { ... };
};
# Virtual aliases. These are email addresses that are forwarded to
# loginAccounts addresses.
virtualAliases = {
# address = forward address;
"info@example.com" = "user1@example.com";
"postmaster@example.com" = "user1@example.com";
"abuse@example.com" = "user1@example.com";
"user1@example2.com" = "user1@example.com";
};
};
2017-11-15 20:50:48 +00:00
# Use Let's Encrypt certificates
2017-11-13 13:59:25 +00:00
certificateScheme = 3;
# Enable IMAP and POP3
enableImap = true;
enablePop3 = true;
enableImapSsl = true;
enablePop3Ssl = true;
# whether to scan inbound emails for viruses (note that this requires at least
# 1 Gb RAM for the server. Without virus scanning 256 MB RAM should be plenty)
virusScanning = false;
}
2017-08-12 09:52:01 +00:00
```
2017-11-13 13:59:25 +00:00
After a `nixos-rebuild switch --upgrade` your sever should be good to go. If
you want to use `nixops` to deploy the server, look in the subfolder `nixops`
for some inspiration.
### B) Setup everything else
#### Step 1: Set DNS entry for server
Add a DNS record to the domain `server-domain` with the following entries
| Name (Subdomain) | TTL | Type | Priority | Value |
| ---------------- | ----- | ---- | -------- | ----------------- |
| `server-FQDN` | 10800 | A | | `server-IP` |
This resolved DNS equries for `server-FQDN` to `server-IP`. You can test if your
setting is correct by
2017-08-12 09:52:01 +00:00
```
2017-11-13 13:59:25 +00:00
ping <server-FQDN>
64 bytes from <server-FQDN> (<server-IP>): icmp_seq=1 ttl=46 time=21.3 ms
...
2017-08-12 09:52:01 +00:00
```
2017-11-13 13:59:25 +00:00
Note that it can take a while until a DNS entry is propagated.
#### Step 2: Set rDNS (reverse DNS) entry for server
Wherever you have rented your server, you should be able to set reverse DNS
entries for the IP's you own. Add an entry resolving `server-IP` to
`server-FQDN`
You can test if your setting is correct by
2017-09-13 11:16:17 +00:00
```
2017-11-13 13:59:25 +00:00
host <server-IP>
<server-IP>.in-addr.arpa domain name pointer <server-FQDN>.
2017-09-13 11:16:17 +00:00
```
2017-11-13 13:59:25 +00:00
Note that it can take a while until a DNS entry is propagated.
2017-09-13 08:17:04 +00:00
2017-11-13 13:59:25 +00:00
#### Step 3: Set `MX` Records
2017-11-13 13:59:25 +00:00
For all `domain` in `domains` do:
* Add a `MX` record to the domain `domain`
| Name (Subdomain) | TTL | Type | Priority | Value |
| ---------------- | ----- | ---- | -------- | ----------------- |
2017-11-13 13:59:25 +00:00
| `domain` | | MX | 10 | `server-FQDN` |
2017-11-13 13:59:25 +00:00
You can test this via
```
dig -t TXT <domain>
2017-11-13 13:59:25 +00:00
...
;; ANSWER SECTION:
<domain> 10800 IN MX 10 <server-FQDN>
...
```
2017-11-13 13:59:25 +00:00
Note that it can take a while until a DNS entry is propagated.
2017-11-13 13:59:25 +00:00
#### Step 4: Set `SPF` Records
2017-11-10 15:58:52 +00:00
2017-11-13 13:59:25 +00:00
For all `domain` in `domains` do:
* Add a `SPF` record to the domain `domain`
| Name (Subdomain) | TTL | Type | Priority | Value |
| ---------------- | ----- | ---- | -------- | ----------------- |
| `domain` | 10800 | TXT | | `v=spf1 ip4:<server-IP> -all` |
You can check this with `dig -t TXT <domain>` similar to the last section.
Note that it can take a while until a DNS entry is propagated. If you want to
use multiple servers for your email handling, don't forget to add all server
IP's to this list.
#### Step 5: Set `DKIM` signature
For all `domain` in `domains` do:
* Go to your server and navigate to the dkim key directory (by default
`/var/dkim`. There you will find a public key for any domain in the
`domain.txt` file. It will look like
```
2017-11-15 20:50:48 +00:00
mail._domainkey IN TXT "v=DKIM1; r=postmaster; g=*; k=rsa; p=<really-long-key>" ; ----- DKIM mail for domain.tld
2017-11-13 13:59:25 +00:00
```
* Add a `DKIM` record to the domain `domain`
| Name (Subdomain) | TTL | Type | Priority | Value |
| ---------------- | ----- | ---- | -------- | ----------------- |
| mail._domainkey.`domain` | 10800 | TXT | | `v=DKIM1; p=<really-long-key>` |
You can check this with `dig -t TXT <domain>` similar to the last section.
Note that it can take a while until a DNS entry is propagated.
### C) Test your Setup
2017-11-10 15:58:52 +00:00
2017-11-13 13:59:25 +00:00
Write an email to your aunt (who has been waiting for your reply far too long),
and sign up for some of the finest newsletters the Internet has.
2017-11-13 13:59:25 +00:00
Besides that, you can send an email to `mail-tester.com` and see how you score,
and let `http://mxtoolbox.com/` take a look at your setup, but if you followed
the steps closely then everything should be awesome!
2017-11-13 13:59:25 +00:00
## How to Backup
This is really easy. First off you should have a backup of your
`configuration.nix` file where you have the server config (but that is already
in a git repository right?)
Next you need to backup `/var/vmail` or whatever you have specified for the
option `mailDirectory`. This is where all the mails reside. Good options are a
cron job with `rsync` or `scp`. But really anything works, as it is simply a
folder with plenty of files in it. If your backup solution does not preserve the
owner of the files don't forget to `chown` them to `virtualMail:virtualMail` if you copy
them back (or whatever you specified as `vmailUserName`, and `vmailGoupName`).
Finally you can (optionally) make a backup of `/var/dkim` (or whatever you
specified as `dkimKeyDirectory`). If you should lose those don't worry, new ones
will be created on the fly. But you will need to repeat step `B)5` and correct
all the `dkim` keys.
## How to Test for Development
You can test the setup via `nixops`. After installation, do
```
nixops create nixops/single-server.nix nixops/vbox.nix -d mail
nixops deploy -d mail
nixops info -d mail
```
You can then test the server via e.g. `telnet`. To log into it, use
```
nixops ssh -d mail mailserver
```
To test imap manually use
```
openssl s_client -host mail.example.com -port 143 -starttls imap
```
2017-11-10 16:16:21 +00:00
2016-07-21 16:11:43 +00:00
## A Complete Mail Server Without Moving Parts
### Used Technologies
2017-08-12 09:37:54 +00:00
* Nixos
* Nixpkgs
* Dovecot
* Postfix
* Rmilter
* Rspamd
* Clamav
* Opendkim
* Pam
2016-07-21 16:20:56 +00:00
### Features
2017-11-11 15:15:30 +00:00
* unlimited domain
* unlimited mail accounts
2016-07-21 16:20:56 +00:00
* unlimited aliases for every mail account
* spam and virus checking
* dkim signing of outgoing emails
2016-07-21 16:42:14 +00:00
* imap (optionally pop3)
* startTLS
2016-07-21 16:20:56 +00:00
### Nonfeatures
* moving parts
* SQL databases
* configurations that need to be made after `nixos-rebuild switch`
* complicated storage schemes
* webclients / http-servers
2017-08-13 12:05:40 +00:00
2017-09-03 13:43:37 +00:00
## Contributors
* Special thanks to @Infinisil for the module rewrite
2017-11-11 15:15:30 +00:00
* Special thanks to @jbboehr for multidomain implementation
2017-09-03 13:43:37 +00:00
* @danbst
2017-09-13 08:17:04 +00:00
* @phdoerfler
2017-11-05 09:57:26 +00:00
* @eqyiel
2017-11-21 08:45:59 +00:00
### Alternative Implementations
* [NixCloud Webservices](https://github.com/nixcloud/nixcloud-webservices)
2017-09-13 12:03:04 +00:00
### Credits
* send mail graphic by [tnp_dreamingmao](https://thenounproject.com/dreamingmao)
from [TheNounProject](https://thenounproject.com/) is licensed under
[CC BY 3.0](http://creativecommons.org/~/3.0/)
* Logo made with [Logomakr.com](https://logomakr.com)
2017-11-21 08:45:59 +00:00
2017-11-21 08:44:42 +00:00
2017-09-13 12:03:04 +00:00
[logo]: logo/logo.png