From 1b3eded34ae693b8662487b9c54a21e4fec1b07f Mon Sep 17 00:00:00 2001 From: yyamashita Date: Mon, 1 Jun 2026 21:42:57 +0900 Subject: Configure Amazon SES relay for Postfix (port 25 blocked by Hetzner) SES credentials are injected via .env file (not committed). entrypoint.sh creates sasl_passwd at runtime from SES_ACCESS_KEY_ID / SES_SMTP_PASSWORD. Co-Authored-By: Claude Sonnet 4.6 --- mail/docker-compose.yml | 1 + mail/entrypoint.sh | 7 +++++++ mail/postfix/main.cf | 8 ++++++-- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/mail/docker-compose.yml b/mail/docker-compose.yml index b137c06..021e142 100644 --- a/mail/docker-compose.yml +++ b/mail/docker-compose.yml @@ -3,6 +3,7 @@ services: build: . container_name: mail hostname: hetzner.yyamashita.com + env_file: .env volumes: - /etc/opendkim:/etc/opendkim:ro - mail_queue:/var/spool/postfix diff --git a/mail/entrypoint.sh b/mail/entrypoint.sh index 9ba6655..45798fe 100755 --- a/mail/entrypoint.sh +++ b/mail/entrypoint.sh @@ -35,6 +35,13 @@ cp -f /etc/hosts /var/spool/postfix/etc/hosts 2>/dev/null || true cp -f /etc/services /var/spool/postfix/etc/services 2>/dev/null || true cp -f /etc/nsswitch.conf /var/spool/postfix/etc/nsswitch.conf 2>/dev/null || true +# Create sasl_passwd for SES relay from environment variables +if [[ -n "${SES_ACCESS_KEY_ID:-}" && -n "${SES_SMTP_PASSWORD:-}" ]]; then + echo "[email-smtp.us-east-1.amazonaws.com]:587 ${SES_ACCESS_KEY_ID}:${SES_SMTP_PASSWORD}" > /etc/postfix/sasl_passwd + chmod 600 /etc/postfix/sasl_passwd + postmap /etc/postfix/sasl_passwd +fi + # Start Postfix postfix start diff --git a/mail/postfix/main.cf b/mail/postfix/main.cf index 36d0e35..4066839 100644 --- a/mail/postfix/main.cf +++ b/mail/postfix/main.cf @@ -19,8 +19,12 @@ local_transport = error:local delivery disabled smtpd_relay_restrictions = permit_mynetworks, reject smtpd_recipient_restrictions = permit_mynetworks, reject -# Opportunistic TLS on outbound SMTP -smtp_tls_security_level = may +# Relay via Amazon SES (port 25 outbound is blocked by Hetzner) +relayhost = [email-smtp.us-east-1.amazonaws.com]:587 +smtp_sasl_auth_enable = yes +smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd +smtp_sasl_security_options = noanonymous +smtp_tls_security_level = encrypt smtp_tls_loglevel = 1 # DKIM signing via OpenDKIM milter on localhost:8891 -- cgit v1.2.3