install mox config
This commit is contained in:
@@ -39,7 +39,7 @@ endef
|
||||
all: $(ENV_RULES) $(MAKE_RULES) $(BUILD_RULES) $(PUSH_RULES)
|
||||
|
||||
$(foreach module,$(ALL_MODULES),$(eval $(call make_module_rule)))
|
||||
$(foreach module,$(ALL_MODULES),$(if $(shell test -d $(module) && echo 1),$(eval $(call module_env_rule))))
|
||||
$(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule)))
|
||||
|
||||
.PHONY: install
|
||||
install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab
|
||||
|
||||
@@ -7,3 +7,98 @@ To install:
|
||||
```sh
|
||||
wget -O- https://git.joeac.net/joeac/joeac.net/raw/branch/main/install.sh | sh
|
||||
```
|
||||
|
||||
## DNS setup
|
||||
|
||||
A/AAAA DNS records are added automatically by `make install`, but in order to
|
||||
get `mox` working as an email server, you'll have to manually add the following
|
||||
DNS records.
|
||||
|
||||
Deliver mail for mail.joeac.net to mail.joeac.net:
|
||||
|
||||
```
|
||||
mail.joeac.net. MX 10 mail.joeac.net.
|
||||
```
|
||||
|
||||
All emails from the email server will be signed with two DKIM keys. So that
|
||||
clients can verify the authenticity of the messages, provide these keys as TXT
|
||||
records:
|
||||
|
||||
```
|
||||
2026a._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvYfjrzmYgBtYofzBwI80aiW98+M2g6z+gd1Iwz9g0y30rPFNTctFn9GwBNuYBgZiZxB+sqjEbPMbr3li/R7i0A9t/KbNNJhkNC+4IjKJjk+jw1CXm4vXOUa4YSYWwy7NVYTH/QwZGz6fwjVM7YvDnnE4gG2NwrVx+AXlONt2R1G+qgV6HAIIvVi8T0yCjjqEc5B5bKlqk0XU9vSyUFJhhKnR/KNRe79C+H9GWJzcU7HUCmIHX04Xi0JeB/wm3weF1xjtGTsWyy5BmHHsfWGqSr2Dbg5o6AI5W0h4VkQ4QzdEYGVQ9ZBDyqFQwQFXLn0oHZjCD/vFzPOPdM5pxF/OgwIDAQAB
|
||||
2026b._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzcrk9FUt6AdrvnAP3KawuOTLw7uL5SJ+ZYmShuz41zwM6bPQteGSSwddFXIxcqVlJrdFahrK4KvHX/sw/hWVfZoPLDdwsGN5eI8cqQjNDE+JDu9BbPlTituva4Hkve0hbAKDqA8jmbcZg6aU7b44Kzq8UpWAlPO273Rq2tsbCBcITt8B3NFoeY9CSsZU1LqGl855GUtaNyhlPaAvfab3Q9/4wyusPhCHlBYaRK+ZzuSMs5KEOG6n4kbZfMVi2+4c/bPU5PdTuyvbSIEqjNH4TpfatE0I9ubGv0WbAzr5EZbv5+xtukZ/dIisPPMjn1AbjpSJYNYr2OYgey6+WvzRmQIDAQAB
|
||||
```
|
||||
|
||||
Specify the MX host is allowed to send for our domain and for itself (for DSNs).
|
||||
~all means softfail for anything else, which is done instead of -all to prevent
|
||||
older mail servers from rejecting the message because they never get to looking
|
||||
for a dkim/dmarc pass.
|
||||
|
||||
```
|
||||
mail.joeac.net. TXT v=spf1 ip4:217.155.190.42 ip6:fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 mx ~all
|
||||
```
|
||||
|
||||
Emails that fail the DMARC check (without aligned DKIM and without aligned SPF)
|
||||
should be rejected, and request reports. If you email through mailing lists that
|
||||
strip DKIM-Signature headers and don't rewrite the From header, you may want to
|
||||
set the policy to p=none.
|
||||
|
||||
```
|
||||
_dmarc.mail.joeac.net. TXT v=DMARC1;p=reject;rua=mailto:dmarcreports@mail.joeac.net!10m
|
||||
```
|
||||
|
||||
Remote servers can use MTA-STS to verify our TLS certificate with the WebPKI
|
||||
pool of CA's (certificate authorities) when delivering over SMTP with
|
||||
STARTTLSTLS.
|
||||
|
||||
```
|
||||
mta-sts.mail.joeac.net. CNAME mail.joeac.net.
|
||||
_mta-sts.mail.joeac.net. TXT v=STSv1; id=20260705T153220
|
||||
```
|
||||
|
||||
Request reporting about TLS failures.
|
||||
|
||||
```
|
||||
_smtp._tls.mail.joeac.net. TXT v=TLSRPTv1; rua=mailto:tlsreports@mail.joeac.net
|
||||
```
|
||||
|
||||
Client settings will reference a subdomain of the hosted domain, making it
|
||||
easier to migrate to a different server in the future by not requiring settings
|
||||
in all clients to be updated.
|
||||
|
||||
```
|
||||
clientsettings.mail.joeac.net. CNAME mail.joeac.net.
|
||||
```
|
||||
|
||||
Autoconfig is used by Thunderbird. Autodiscover is (in theory) used by
|
||||
Microsoft.
|
||||
|
||||
```
|
||||
autoconfig.mail.joeac.net. CNAME mail.joeac.net.
|
||||
_autodiscover._tcp.mail.joeac.net. SRV 0 1 443 mail.joeac.net.
|
||||
```
|
||||
|
||||
For secure IMAP and submission autoconfig, point to mail host.
|
||||
|
||||
```
|
||||
_imaps._tcp.mail.joeac.net. SRV 0 1 993 mail.joeac.net.
|
||||
_submissions._tcp.mail.joeac.net. SRV 0 1 465 mail.joeac.net.
|
||||
```
|
||||
|
||||
Next records specify POP3 and non-TLS ports are not to be used. These are
|
||||
optional and safe to leave out (e.g. if you have to click a lot in a DNS admin
|
||||
web interface).
|
||||
|
||||
```
|
||||
_imap._tcp.mail.joeac.net. SRV 0 0 0 .
|
||||
_submission._tcp.mail.joeac.net. SRV 0 0 0 .
|
||||
_pop3._tcp.mail.joeac.net. SRV 0 0 0 .
|
||||
_pop3s._tcp.mail.joeac.net. SRV 0 0 0 .
|
||||
```
|
||||
|
||||
Optional: You could mark Let's Encrypt as the only Certificate Authority allowed
|
||||
to sign TLS certificates for your domain.
|
||||
|
||||
```
|
||||
mail.joeac.net. CAA 0 issue "letsencrypt.org"
|
||||
```
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
config/dkim
|
||||
config/adminpasswd
|
||||
@@ -0,0 +1,6 @@
|
||||
# mox
|
||||
|
||||
There are three secrets required for mox. One is the admin password, which
|
||||
should be stored in config/adminpasswd. The other two are DKIM private keys,
|
||||
which should be stored in the config/dkim directory. The public parts of these
|
||||
keys should be exposed in DNS TXT records.
|
||||
@@ -0,0 +1,52 @@
|
||||
Domains:
|
||||
mail.joeac.net:
|
||||
ClientSettingsDomain: clientsettings.mail.joeac.net
|
||||
LocalpartCatchallSeparator: +
|
||||
DKIM:
|
||||
Selectors:
|
||||
2026a:
|
||||
Expiration: 72h
|
||||
PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
|
||||
2026b:
|
||||
Expiration: 72h
|
||||
PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
|
||||
Sign:
|
||||
- 2026a
|
||||
DMARC:
|
||||
Localpart: dmarcreports
|
||||
Account: me
|
||||
Mailbox: DMARC
|
||||
MTASTS:
|
||||
PolicyID: 20260705T153220
|
||||
Mode: enforce
|
||||
MaxAge: 24h0m0s
|
||||
MX:
|
||||
- mail.joeac.net
|
||||
TLSRPT:
|
||||
Localpart: tlsreports
|
||||
Account: me
|
||||
Mailbox: TLSRPT
|
||||
Accounts:
|
||||
me:
|
||||
Domain: mail.joeac.net
|
||||
Destinations:
|
||||
me@mail.joeac.net: nil
|
||||
SubjectPass:
|
||||
Period: 12h0m0s
|
||||
RejectsMailbox: Rejects
|
||||
AutomaticJunkFlags:
|
||||
Enabled: true
|
||||
JunkMailboxRegexp: ^(junk|spam)
|
||||
NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects)
|
||||
JunkFilter:
|
||||
Threshold: 0.950000
|
||||
Params:
|
||||
Onegrams: true
|
||||
MaxPower: 0.010000
|
||||
TopWords: 10
|
||||
IgnoreWords: 0.100000
|
||||
RareWords: 2
|
||||
NoCustomPassword: true
|
||||
MonitorDNSBLs:
|
||||
- sbl.spamhaus.org
|
||||
- bl.spamcop.net
|
||||
@@ -0,0 +1,74 @@
|
||||
DataDir: ../data
|
||||
LogLevel: debug
|
||||
User: mox
|
||||
Hostname: mail.joeac.net
|
||||
AdminPasswordFile: adminpasswd
|
||||
Listeners:
|
||||
internal:
|
||||
IPs:
|
||||
- 127.0.0.1
|
||||
- ::1
|
||||
Hostname: localhost
|
||||
AccountHTTP:
|
||||
Enabled: true
|
||||
Port: 1080
|
||||
Forwarded: true
|
||||
AdminHTTP:
|
||||
Enabled: true
|
||||
Port: 1080
|
||||
Forwarded: true
|
||||
WebmailHTTP:
|
||||
Enabled: true
|
||||
Port: 1080
|
||||
Forwarded: true
|
||||
WebAPIHTTP:
|
||||
Enabled: true
|
||||
Port: 1080
|
||||
Forwarded: true
|
||||
MetricsHTTP:
|
||||
Enabled: true
|
||||
AutoconfigHTTPS:
|
||||
Enabled: true
|
||||
Port: 81
|
||||
NonTLS: true
|
||||
MTASTSHTTPS:
|
||||
Enabled: true
|
||||
Port: 81
|
||||
NonTLS: true
|
||||
WebserverHTTP:
|
||||
Enabled: true
|
||||
Port: 81
|
||||
public:
|
||||
IPs:
|
||||
- 192.168.178.75
|
||||
- fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17
|
||||
NATIPs:
|
||||
- 217.155.190.42
|
||||
- fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17
|
||||
TLS:
|
||||
KeyCerts:
|
||||
-
|
||||
CertFile: path/to/mail.joeac.net-chain.crt.pem
|
||||
KeyFile: path/to/mail.joeac.net.key.pem
|
||||
-
|
||||
CertFile: path/to/mta-sts.mail.joeac.net-chain.crt.pem
|
||||
KeyFile: path/to/mta-sts.mail.joeac.net.key.pem
|
||||
-
|
||||
CertFile: path/to/autoconfig.mail.joeac.net-chain.crt.pem
|
||||
KeyFile: path/to/autoconfig.mail.joeac.net.key.pem
|
||||
-
|
||||
CertFile: path/to/clientsettings.mail.joeac.net-chain.crt.pem
|
||||
KeyFile: path/to/clientsettings.mail.joeac.net.key.pem
|
||||
SMTP:
|
||||
Enabled: true
|
||||
Submissions:
|
||||
Enabled: true
|
||||
IMAPS:
|
||||
Enabled: true
|
||||
Postmaster:
|
||||
Account: me
|
||||
Mailbox: Postmaster
|
||||
HostTLSRPT:
|
||||
Account: me
|
||||
Mailbox: TLSRPT
|
||||
Localpart: tlsreports
|
||||
+6
-3
@@ -33,8 +33,11 @@ install_unbound_anchor_crontab:
|
||||
/etc/unbound/unbound.conf.d/dnssec.conf: dnssec.conf
|
||||
sudo mkdir -p $(dir $@) && sudo cp $< $@
|
||||
|
||||
DKIM_PRIVATE_KEY_A := ~/mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
|
||||
DKIM_PRIVATE_KEY_B := ~/mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
|
||||
DKIM_PRIVATE_KEYS := $(DKIM_PRIVATE_KEY_A) $(DKIM_PRIVATE_KEY_B)
|
||||
.PHONY: install_mox
|
||||
install_mox: /usr/local/bin/mox /home/mox/config/domains.conf
|
||||
install_mox: /usr/local/bin/mox ~/mox/config/adminpasswd $(DKIM_PRIVATE_KEYS)
|
||||
|
||||
MOX_PLATFORM := $(if $(filter armv7% arm32%,$(CPU_ARCH)),arm,amd64)
|
||||
MOX_VERSION := 0.0.15
|
||||
@@ -49,5 +52,5 @@ MOX_URL := $(MOX_URL_BASE)@v$(MOX_VERSION)/linux-$(MOX_PLATFORM)-go$(MOX_GO_VERS
|
||||
chmod +x mox
|
||||
sudo mv mox /usr/local/bin/mox
|
||||
|
||||
/home/mox/config/domains.conf:
|
||||
$(error Now configure mox for mail.joeac.net. To get started, create a user 'mox' if there isn't one already, cd to /home/mox, and run 'mox -hostname mail.joeac.net -existing-webserver quickstart me@mail.joeac.net'. See https://www.xmox.nl for more information on how to configure mox.)
|
||||
~/mox/config/%: config/%
|
||||
mkdir -p $(dir $@) && cp $< $@
|
||||
|
||||
Reference in New Issue
Block a user