diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-06-01 21:42:57 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-06-01 21:42:57 +0900 |
| commit | 1b3eded34ae693b8662487b9c54a21e4fec1b07f (patch) | |
| tree | 382097b01569dce3b45d7a7fcb2a67968c7a5f64 | |
| parent | 72799dd59da44269107fe3e651e7566042002709 (diff) | |
Configure Amazon SES relay for Postfix (port 25 blocked by Hetzner)
SES credentials are injected via .env file (not committed). entrypoint.sh
creates sasl_passwd at runtime from SES_ACCESS_KEY_ID / SES_SMTP_PASSWORD.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | mail/docker-compose.yml | 1 | ||||
| -rwxr-xr-x | mail/entrypoint.sh | 7 | ||||
| -rw-r--r-- | mail/postfix/main.cf | 8 |
3 files changed, 14 insertions, 2 deletions
diff --git a/mail/docker-compose.yml b/mail/docker-compose.yml index b137c06..021e142 100644 --- a/mail/docker-compose.yml +++ b/mail/docker-compose.yml @@ -3,6 +3,7 @@ services: build: . container_name: mail hostname: hetzner.yyamashita.com + env_file: .env volumes: - /etc/opendkim:/etc/opendkim:ro - mail_queue:/var/spool/postfix diff --git a/mail/entrypoint.sh b/mail/entrypoint.sh index 9ba6655..45798fe 100755 --- a/mail/entrypoint.sh +++ b/mail/entrypoint.sh @@ -35,6 +35,13 @@ cp -f /etc/hosts /var/spool/postfix/etc/hosts 2>/dev/null || true cp -f /etc/services /var/spool/postfix/etc/services 2>/dev/null || true cp -f /etc/nsswitch.conf /var/spool/postfix/etc/nsswitch.conf 2>/dev/null || true +# Create sasl_passwd for SES relay from environment variables +if [[ -n "${SES_ACCESS_KEY_ID:-}" && -n "${SES_SMTP_PASSWORD:-}" ]]; then + echo "[email-smtp.us-east-1.amazonaws.com]:587 ${SES_ACCESS_KEY_ID}:${SES_SMTP_PASSWORD}" > /etc/postfix/sasl_passwd + chmod 600 /etc/postfix/sasl_passwd + postmap /etc/postfix/sasl_passwd +fi + # Start Postfix postfix start diff --git a/mail/postfix/main.cf b/mail/postfix/main.cf index 36d0e35..4066839 100644 --- a/mail/postfix/main.cf +++ b/mail/postfix/main.cf @@ -19,8 +19,12 @@ local_transport = error:local delivery disabled smtpd_relay_restrictions = permit_mynetworks, reject smtpd_recipient_restrictions = permit_mynetworks, reject -# Opportunistic TLS on outbound SMTP -smtp_tls_security_level = may +# Relay via Amazon SES (port 25 outbound is blocked by Hetzner) +relayhost = [email-smtp.us-east-1.amazonaws.com]:587 +smtp_sasl_auth_enable = yes +smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd +smtp_sasl_security_options = noanonymous +smtp_tls_security_level = encrypt smtp_tls_loglevel = 1 # DKIM signing via OpenDKIM milter on localhost:8891 |