diff --git a/Makefile b/Makefile index c996e09..8da5087 100644 --- a/Makefile +++ b/Makefile @@ -39,7 +39,7 @@ endef all: $(ENV_RULES) $(MAKE_RULES) $(BUILD_RULES) $(PUSH_RULES) $(foreach module,$(ALL_MODULES),$(eval $(call make_module_rule))) -$(foreach module,$(ALL_MODULES),$(if $(shell test -d $(module) && echo 1),$(eval $(call module_env_rule)))) +$(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule))) .PHONY: install install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab diff --git a/README.md b/README.md index 1f1ab14..c7faac2 100644 --- a/README.md +++ b/README.md @@ -7,3 +7,98 @@ To install: ```sh wget -O- https://git.joeac.net/joeac/joeac.net/raw/branch/main/install.sh | sh ``` + +## DNS setup + +A/AAAA DNS records are added automatically by `make install`, but in order to +get `mox` working as an email server, you'll have to manually add the following +DNS records. + +Deliver mail for mail.joeac.net to mail.joeac.net: + +``` +mail.joeac.net. MX 10 mail.joeac.net. +``` + +All emails from the email server will be signed with two DKIM keys. So that +clients can verify the authenticity of the messages, provide these keys as TXT +records: + +``` +2026a._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvYfjrzmYgBtYofzBwI80aiW98+M2g6z+gd1Iwz9g0y30rPFNTctFn9GwBNuYBgZiZxB+sqjEbPMbr3li/R7i0A9t/KbNNJhkNC+4IjKJjk+jw1CXm4vXOUa4YSYWwy7NVYTH/QwZGz6fwjVM7YvDnnE4gG2NwrVx+AXlONt2R1G+qgV6HAIIvVi8T0yCjjqEc5B5bKlqk0XU9vSyUFJhhKnR/KNRe79C+H9GWJzcU7HUCmIHX04Xi0JeB/wm3weF1xjtGTsWyy5BmHHsfWGqSr2Dbg5o6AI5W0h4VkQ4QzdEYGVQ9ZBDyqFQwQFXLn0oHZjCD/vFzPOPdM5pxF/OgwIDAQAB +2026b._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzcrk9FUt6AdrvnAP3KawuOTLw7uL5SJ+ZYmShuz41zwM6bPQteGSSwddFXIxcqVlJrdFahrK4KvHX/sw/hWVfZoPLDdwsGN5eI8cqQjNDE+JDu9BbPlTituva4Hkve0hbAKDqA8jmbcZg6aU7b44Kzq8UpWAlPO273Rq2tsbCBcITt8B3NFoeY9CSsZU1LqGl855GUtaNyhlPaAvfab3Q9/4wyusPhCHlBYaRK+ZzuSMs5KEOG6n4kbZfMVi2+4c/bPU5PdTuyvbSIEqjNH4TpfatE0I9ubGv0WbAzr5EZbv5+xtukZ/dIisPPMjn1AbjpSJYNYr2OYgey6+WvzRmQIDAQAB +``` + +Specify the MX host is allowed to send for our domain and for itself (for DSNs). +~all means softfail for anything else, which is done instead of -all to prevent +older mail servers from rejecting the message because they never get to looking +for a dkim/dmarc pass. + +``` +mail.joeac.net. TXT v=spf1 ip4:217.155.190.42 ip6:fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 mx ~all +``` + +Emails that fail the DMARC check (without aligned DKIM and without aligned SPF) +should be rejected, and request reports. If you email through mailing lists that +strip DKIM-Signature headers and don't rewrite the From header, you may want to +set the policy to p=none. + +``` +_dmarc.mail.joeac.net. TXT v=DMARC1;p=reject;rua=mailto:dmarcreports@mail.joeac.net!10m +``` + +Remote servers can use MTA-STS to verify our TLS certificate with the WebPKI +pool of CA's (certificate authorities) when delivering over SMTP with +STARTTLSTLS. + +``` +mta-sts.mail.joeac.net. CNAME mail.joeac.net. +_mta-sts.mail.joeac.net. TXT v=STSv1; id=20260705T153220 +``` + +Request reporting about TLS failures. + +``` +_smtp._tls.mail.joeac.net. TXT v=TLSRPTv1; rua=mailto:tlsreports@mail.joeac.net +``` + +Client settings will reference a subdomain of the hosted domain, making it +easier to migrate to a different server in the future by not requiring settings +in all clients to be updated. + +``` +clientsettings.mail.joeac.net. CNAME mail.joeac.net. +``` + +Autoconfig is used by Thunderbird. Autodiscover is (in theory) used by +Microsoft. + +``` +autoconfig.mail.joeac.net. CNAME mail.joeac.net. +_autodiscover._tcp.mail.joeac.net. SRV 0 1 443 mail.joeac.net. +``` + +For secure IMAP and submission autoconfig, point to mail host. + +``` +_imaps._tcp.mail.joeac.net. SRV 0 1 993 mail.joeac.net. +_submissions._tcp.mail.joeac.net. SRV 0 1 465 mail.joeac.net. +``` + +Next records specify POP3 and non-TLS ports are not to be used. These are +optional and safe to leave out (e.g. if you have to click a lot in a DNS admin +web interface). + +``` +_imap._tcp.mail.joeac.net. SRV 0 0 0 . +_submission._tcp.mail.joeac.net. SRV 0 0 0 . +_pop3._tcp.mail.joeac.net. SRV 0 0 0 . +_pop3s._tcp.mail.joeac.net. SRV 0 0 0 . +``` + +Optional: You could mark Let's Encrypt as the only Certificate Authority allowed +to sign TLS certificates for your domain. + +``` +mail.joeac.net. CAA 0 issue "letsencrypt.org" +``` diff --git a/mox/.gitignore b/mox/.gitignore new file mode 100644 index 0000000..b5c26c3 --- /dev/null +++ b/mox/.gitignore @@ -0,0 +1,2 @@ +config/dkim +config/adminpasswd diff --git a/mox/README.md b/mox/README.md new file mode 100644 index 0000000..86a609c --- /dev/null +++ b/mox/README.md @@ -0,0 +1,6 @@ +# mox + +There are three secrets required for mox. One is the admin password, which +should be stored in config/adminpasswd. The other two are DKIM private keys, +which should be stored in the config/dkim directory. The public parts of these +keys should be exposed in DNS TXT records. diff --git a/mox/config/domains.conf b/mox/config/domains.conf new file mode 100644 index 0000000..7901311 --- /dev/null +++ b/mox/config/domains.conf @@ -0,0 +1,52 @@ +Domains: + mail.joeac.net: + ClientSettingsDomain: clientsettings.mail.joeac.net + LocalpartCatchallSeparator: + + DKIM: + Selectors: + 2026a: + Expiration: 72h + PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + 2026b: + Expiration: 72h + PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + Sign: + - 2026a + DMARC: + Localpart: dmarcreports + Account: me + Mailbox: DMARC + MTASTS: + PolicyID: 20260705T153220 + Mode: enforce + MaxAge: 24h0m0s + MX: + - mail.joeac.net + TLSRPT: + Localpart: tlsreports + Account: me + Mailbox: TLSRPT +Accounts: + me: + Domain: mail.joeac.net + Destinations: + me@mail.joeac.net: nil + SubjectPass: + Period: 12h0m0s + RejectsMailbox: Rejects + AutomaticJunkFlags: + Enabled: true + JunkMailboxRegexp: ^(junk|spam) + NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects) + JunkFilter: + Threshold: 0.950000 + Params: + Onegrams: true + MaxPower: 0.010000 + TopWords: 10 + IgnoreWords: 0.100000 + RareWords: 2 + NoCustomPassword: true +MonitorDNSBLs: + - sbl.spamhaus.org + - bl.spamcop.net diff --git a/mox/config/mox.conf b/mox/config/mox.conf new file mode 100644 index 0000000..1ca60ff --- /dev/null +++ b/mox/config/mox.conf @@ -0,0 +1,74 @@ +DataDir: ../data +LogLevel: debug +User: mox +Hostname: mail.joeac.net +AdminPasswordFile: adminpasswd +Listeners: + internal: + IPs: + - 127.0.0.1 + - ::1 + Hostname: localhost + AccountHTTP: + Enabled: true + Port: 1080 + Forwarded: true + AdminHTTP: + Enabled: true + Port: 1080 + Forwarded: true + WebmailHTTP: + Enabled: true + Port: 1080 + Forwarded: true + WebAPIHTTP: + Enabled: true + Port: 1080 + Forwarded: true + MetricsHTTP: + Enabled: true + AutoconfigHTTPS: + Enabled: true + Port: 81 + NonTLS: true + MTASTSHTTPS: + Enabled: true + Port: 81 + NonTLS: true + WebserverHTTP: + Enabled: true + Port: 81 + public: + IPs: + - 192.168.178.75 + - fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 + NATIPs: + - 217.155.190.42 + - fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 + TLS: + KeyCerts: + - + CertFile: path/to/mail.joeac.net-chain.crt.pem + KeyFile: path/to/mail.joeac.net.key.pem + - + CertFile: path/to/mta-sts.mail.joeac.net-chain.crt.pem + KeyFile: path/to/mta-sts.mail.joeac.net.key.pem + - + CertFile: path/to/autoconfig.mail.joeac.net-chain.crt.pem + KeyFile: path/to/autoconfig.mail.joeac.net.key.pem + - + CertFile: path/to/clientsettings.mail.joeac.net-chain.crt.pem + KeyFile: path/to/clientsettings.mail.joeac.net.key.pem + SMTP: + Enabled: true + Submissions: + Enabled: true + IMAPS: + Enabled: true +Postmaster: + Account: me + Mailbox: Postmaster +HostTLSRPT: + Account: me + Mailbox: TLSRPT + Localpart: tlsreports diff --git a/mox/install.mk b/mox/install.mk index 8f0c7dd..f175812 100644 --- a/mox/install.mk +++ b/mox/install.mk @@ -33,8 +33,11 @@ install_unbound_anchor_crontab: /etc/unbound/unbound.conf.d/dnssec.conf: dnssec.conf sudo mkdir -p $(dir $@) && sudo cp $< $@ +DKIM_PRIVATE_KEY_A := ~/mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem +DKIM_PRIVATE_KEY_B := ~/mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem +DKIM_PRIVATE_KEYS := $(DKIM_PRIVATE_KEY_A) $(DKIM_PRIVATE_KEY_B) .PHONY: install_mox -install_mox: /usr/local/bin/mox /home/mox/config/domains.conf +install_mox: /usr/local/bin/mox ~/mox/config/adminpasswd $(DKIM_PRIVATE_KEYS) MOX_PLATFORM := $(if $(filter armv7% arm32%,$(CPU_ARCH)),arm,amd64) MOX_VERSION := 0.0.15 @@ -49,5 +52,5 @@ MOX_URL := $(MOX_URL_BASE)@v$(MOX_VERSION)/linux-$(MOX_PLATFORM)-go$(MOX_GO_VERS chmod +x mox sudo mv mox /usr/local/bin/mox -/home/mox/config/domains.conf: - $(error Now configure mox for mail.joeac.net. To get started, create a user 'mox' if there isn't one already, cd to /home/mox, and run 'mox -hostname mail.joeac.net -existing-webserver quickstart me@mail.joeac.net'. See https://www.xmox.nl for more information on how to configure mox.) +~/mox/config/%: config/% + mkdir -p $(dir $@) && cp $< $@