Postfix でマルチドメイン（SNI）

v=spf1 +ip4:123.123.123.123 a:auth.gate-on.net a mx -all
※IPアドレスは適当。

$ sudo apt install qemu-guest-agent

$ sudo apt install -y language-pack-ja
$ sudo localectl set-locale 'LANG=ja_JP.utf8'
$ sudo apt install -y manpages-ja manpages-ja-dev
$ sudo timedatectl set-timezone Asia/Tokyo

$ sudo apt install certbot

$ sudo certbot certonly --standalone -d mail.jisaba.life
※運用するドメインの数だけ実行する。

$ sudo apt install postfix

$ sudo apt install python3-spf-engine 
$ sudo apt install pyspf-milter

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.

###　コメントを外す　###
myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 3.6 on
# fresh installs.
compatibility_level = 3.6


smtp_tls_CApath=/etc/ssl/certs
smtp_tls_security_level=may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache


smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.jisaba.life

###　追加　###
mydomain = jisaba.life

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname

###　$mydomainを追加　###
mydestination = $myhostname, mail.jisaba.life, mail, localhost.localdomain, localhost, $mydomain

relayhost = 

###　変更　###
mynetworks = 192.168.1.0/24 127.0.0.0/8

###　追加　###
home_mailbox = Maildir/

mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

###　変更　###
inet_protocols = ipv4

###　以下追加　###
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_client_restrictions = reject_rbl_client bl.spamcop.net,
                            reject_rbl_client cbl.abuseat.org,
                            reject_rbl_client zen.spamhaus.org,
                            permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_recipient_restrictions = permit_mynetworks,
                               permit_sasl_authenticated,
                               check_relay_domains,
                               reject
debugger_command =
    PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
    ddd $daemon_directory/$process_name $process_id & sleep 5
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.jisaba.life/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.jisaba.life/privkey.pem
smtpd_tls_received_header = yes
smtpd_tls_loglevel = 1

smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_note_starttls_offer = yes

mua_client_restrictions =
mua_helo_restrictions =
mua_sender_restrictions =

###　Proxmox Mail Gateway にリレー　###
relayhost = [192.168.1.109]:26

26      inet  n       -       y       -       -       smtpd
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=$mua_client_restrictions
  -o smtpd_helo_restrictions=$mua_helo_restrictions
  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

###　以下変更なし　###
pickup    unix  n       -       y       60      1       pickup
cleanup   unix  n       -       y       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       y       1000?   1       tlsmgr
rewrite   unix  -       -       y       -       -       trivial-rewrite
bounce    unix  -       -       y       -       0       bounce
defer     unix  -       -       y       -       0       bounce
trace     unix  -       -       y       -       0       bounce
verify    unix  -       -       y       -       1       verify
flush     unix  n       -       y       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp
        -o syslog_name=postfix/$service_name
showq     unix  n       -       y       -       -       showq
error     unix  -       -       y       -       -       error
retry     unix  -       -       y       -       -       error
discard   unix  -       -       y       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       y       -       -       lmtp
anvil     unix  -       -       y       -       1       anvil
scache    unix  -       -       y       -       1       scache
postlog   unix-dgram n  -       n       -       1       postlogd
maildrop  unix  -       n       n       -       -       pipe
  flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix -       n       n       -       2       pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}

$ sudo apt install dovecot-imapd

mail_location = maildir:~/Maildir
namespace inbox {
 inbox = yes
}
mail_privileged_group = mail
protocol !indexer-worker {
}

service imap-login {
  inet_listener imap {
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service pop3-login {
  inet_listener pop3 {
  }
  inet_listener pop3s {
  }
}
service submission-login {
  inet_listener submission {
  }
}
service lmtp {
  unix_listener lmtp {
  }
}
service imap {
}
service pop3 {
}
service submission {
}
service auth {
  unix_listener auth-userdb {
  }
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
    group = postfix
  }
}
service auth-worker {
}
service dict {
  unix_listener dict {
  }
}

auth_mechanisms = plain
include auth-system.conf.ext

ssl = yes
ssl_cert = </etc/letsencrypt/live/mail.jisaba.life/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.jisaba.life/privkey.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = </usr/share/dovecot/dh.pem

###　削除（コメントアウト）　###
# mydomain = jisaba.life

###　$mydomainの修正　###
mydestination = $myhostname, localhost.$mydomain, localhost

###　追加　###
tls_server_sni_maps=hash:/etc/postfix/tls_server_sni_maps
virtual_transport = virtual
virtual_mailbox_domains = /etc/postfix/virtual_mailbox_domains
virtual_mailbox_maps = hash:/etc/postfix/virtual_mailbox_maps
virtual_mailbox_base = /var/spool/virtual
virtual_alias_maps = hash:/etc/postfix/virtual_aliases
virtual_uid_maps = static:10000
virtual_gid_maps = static:10000

$ sudo vi /etc/postfix/tls_server_sni_maps


jisaba.life /etc/letsencrypt/live/mail.jisaba.life/privkey.pem /etc/letsencrypt/live/mail.jisaba.life/fullchain.pem
example.com /etc/letsencrypt/live/mail.example.com/privkey.pem /etc/letsencrypt/live/mail.example.com/fullchain.pem

$ sudo postmap -F /etc/postfix/tls_server_sni_maps

$ sudo vi /etc/postfix/virtual_mailbox_domains


jisaba.life
example.com

$ sudo vi /etc/postfix/virtual_mailbox_maps


support@jisaba.life	  jisaba.life/support/Maildir/
support@example.com   example.com/support/Maildir/
info@example.com      example.com/info/Maildir/

sudo postmap /etc/postfix/virtual_mailbox_maps

$ sudo vi /etc/postfix/virtual_aliases


support@jisaba.life	support@jisaba.life
info@example.com		info@example.com

sudo postmap /etc/postfix/virtual_aliases

sudo vi /etc/dovecot/conf.d/10-auth.conf


auth_mechanisms = plain login
!include auth-system.conf.ext
#!include auth-sql.conf.ext
#!include auth-ldap.conf.ext
!include auth-passwdfile.conf.ext
#!include auth-checkpassword.conf.ext
#!include auth-vpopmail.conf.ext
!include auth-static.conf.ext

sudo vi /etc/dovecot/conf.d/auth-passwdfile.conf.ext


passdb {
  driver = passwd-file
  args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users
}

$ sudo doveadm pw
Enter new password: 
Retype new password: 
{CRYPT}$2y$05$./W9lSrjDYOMwqI9cCCkUe99Ym9PKjN2SoyjIQTjGrQZUfB3h/aaA

$ sudo vi /etc/dovecot/users


suppport@jisaba.life:{CRYPT}$2y$05$./W9lSrjDYOMwqI9cCCkUe99Ym9PKjN2SoyjIQTjGrQZUfB3h/aaA
support@example.com:{CRYPT}$2y$05$8nYUkYsRCtkCbXUrlDCEG.N9iY3Y6iaUNGZZ/O99y.3lqcjt/NOxu

$ sudo vi /etc/dovecot/conf.d/auth-static.conf.ext


userdb {
  driver = static
  args = uid=vmail gid=vmail home=/var/spool/virtual/%d/%n
}

ssl_cert = </etc/letsencrypt/live/mail.jisaba.life/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.jisaba.life/privkey.pem

###　以下を追加　###
local_name mail.jisaba.life {
    ssl_cert = </etc/letsencrypt/live/mail.jisaba.life/fullchain.pem
    ssl_key = </etc/letsencrypt/live/mail.jisaba.life/privkey.pem
}

local_name mail.example.com {
    ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
    ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem
}

##
## Mailbox definitions
##

# Each mailbox is specified in a separate mailbox section. The section name
# specifies the mailbox name. If it has spaces, you can put the name
# "in quotes". These sections can contain the following mailbox settings:
#
# auto:
#   Indicates whether the mailbox with this name is automatically created
#   implicitly when it is first accessed. The user can also be automatically
#   subscribed to the mailbox after creation. The following values are
#   defined for this setting:
# 
#     no        - Never created automatically.
#     create    - Automatically created, but no automatic subscription.
#     subscribe - Automatically created and subscribed.
#  
# special_use:
#   A space-separated list of SPECIAL-USE flags (RFC 6154) to use for the
#   mailbox. There are no validity checks, so you could specify anything
#   you want in here, but it's not a good idea to use flags other than the
#   standard ones specified in the RFC:
#
#     \All       - This (virtual) mailbox presents all messages in the
#                  user's message store.
#     \Archive   - This mailbox is used to archive messages.
#     \Drafts    - This mailbox is used to hold draft messages.
#     \Flagged   - This (virtual) mailbox presents all messages in the
#                  user's message store marked with the IMAP \Flagged flag.
#     \Important - This (virtual) mailbox presents all messages in the
#                  user's message store deemed important to user.
#     \Junk      - This mailbox is where messages deemed to be junk mail
#                  are held.
#     \Sent      - This mailbox is used to hold copies of messages that
#                  have been sent.
#     \Trash     - This mailbox is used to hold messages that have been
#                  deleted.
#
# comment:
#   Defines a default comment or note associated with the mailbox. This
#   value is accessible through the IMAP METADATA mailbox entries
#   "/shared/comment" and "/private/comment". Users with sufficient
#   privileges can override the default value for entries with a custom
#   value.

# NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf.
namespace inbox {
  # These mailboxes are widely used and could perhaps be created automatically:
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Trash {
    special_use = \Trash
  }

  # For \Sent mailboxes there are two widely used names. We'll mark both of
  # them as \Sent. User typically deletes one of them if duplicates are created.
  mailbox Sent {
    special_use = \Sent
    auto = subscribe
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }

  # If you have a virtual "All messages" mailbox:
  #mailbox virtual/All {
  #  special_use = \All
  #  comment = All my messages
  #}

  # If you have a virtual "Flagged" mailbox:
  #mailbox virtual/Flagged {
  #  special_use = \Flagged
  #  comment = All my flagged messages
  #}

  # If you have a virtual "Important" mailbox:
  #mailbox virtual/Important {
  #  special_use = \Important
  #  comment = All my important messages
  #}
}