<file name="Makefile">
##
##  @l_prefix@/etc/postfix/Makefile -- maintainance procedures
##

#   path configuration
PREFIX       = @l_prefix@
SBINDIR      = $(PREFIX)/sbin
ETCDIR       = $(PREFIX)/etc

#   program configuration
RC           = $(ETCDIR)/rc
POSTALIAS    = $(SBINDIR)/postalias
POSTMAP      = $(SBINDIR)/postmap
POSTFIX      = $(SBINDIR)/postfix

#   table filename configuration
T_ACCESS     = access
T_CANONICAL  = canonical
T_GENERIC    = generic
T_VIRTUAL    = virtual
T_RELOCATED  = relocated
T_TRANSPORT  = transport
T_ALIASES    = aliases
T_RECIPIENT  = recipient
T_RELAY      = relay

#   dependency tracking
TIMESTAMP    = .up-to-date
DEPENDENCIES = Makefile master.cf main.cf $(TABLES)

#   managed tables:
#   - use extension ".db" for hash tables ("hash")
#   - use no extension for regex tables ("pcre")
TABLES = \
    $(T_ACCESS).db    \
    $(T_CANONICAL).db \
    $(T_GENERIC).db   \
    $(T_VIRTUAL).db   \
    $(T_RELOCATED).db \
    $(T_TRANSPORT).db \
    $(T_ALIASES).db   \
    $(T_RECIPIENT).db \
    $(T_RELAY).db

#   default target
all: $(TABLES) $(TIMESTAMP)

#   implicit checking and reloading
$(TIMESTAMP): $(DEPENDENCIES)
	$(POSTFIX) check
	$(POSTFIX) reload >/dev/null 2>&1 || true
	touch $(TIMESTAMP) && chmod 600 $(TIMESTAMP)

#   explicit checking
check:
	$(POSTFIX) check

#   hash table update targets
$(T_ACCESS).db: $(T_ACCESS) $(MAKEFILE)
	$(POSTMAP) hash:$(T_ACCESS)
$(T_CANONICAL).db: $(T_CANONICAL) $(MAKEFILE)
	$(POSTMAP) hash:$(T_CANONICAL)
$(T_GENERIC).db: $(T_GENERIC) $(MAKEFILE)
	$(POSTMAP) hash:$(T_GENERIC)
$(T_VIRTUAL).db: $(T_VIRTUAL) $(MAKEFILE)
	$(POSTMAP) hash:$(T_VIRTUAL)
$(T_RELOCATED).db: $(T_RELOCATED) $(MAKEFILE)
	$(POSTMAP) hash:$(T_RELOCATED)
$(T_TRANSPORT).db: $(T_TRANSPORT) $(MAKEFILE)
	$(POSTMAP) hash:$(T_TRANSPORT)
$(T_ALIASES).db: $(T_ALIASES) $(MAKEFILE)
	$(POSTALIAS) hash:$(T_ALIASES)
$(T_RECIPIENT).db: $(T_RECIPIENT) $(MAKEFILE)
	$(POSTMAP) hash:$(T_RECIPIENT)
$(T_RELAY).db: $(T_RELAY) $(MAKEFILE)
	$(POSTMAP) hash:$(T_RELAY)

#   cleanup target
clean:
	-rm -f $(TABLES)
	-rm -f $(TIMESTAMP)

#   process management
start:
	$(RC) postfix start
reload:
	$(RC) postfix reload
stop:
	$(RC) postfix stop

</file>
<file name="master.cf">
##
##  @l_prefix@/etc/postfix/master.cf -- Postfix master process table
##
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp       inet  n       -       n       -       -       smtpd
#smtp      inet  n       -       n       -       1       postscreen
#smtpd     pass  -       -       n       -       -       smtpd
#dnsblog   unix  -       -       n       -       0       dnsblog
#tlsproxy  unix  -       -       n       -       0       tlsproxy
#628       inet  n       -       n       -       -       qmqpd
pickup     unix  n       -       n       60      1       pickup
cleanup    unix  n       -       n       -       0       cleanup
qmgr       unix  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       n       1000?   1       tlsmgr
rewrite    unix  -       -       n       -       -       trivial-rewrite
bounce     unix  -       -       n       -       0       bounce
defer      unix  -       -       n       -       0       bounce
trace      unix  -       -       n       -       0       bounce
verify     unix  -       -       n       -       1       verify
flush      unix  n       -       n       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       -       proxymap
smtp       unix  -       -       n       -       -       smtp
relay      unix  -       -       n       -       -       smtp -o fallback_relay=
showq      unix  n       -       n       -       -       showq
error      unix  -       -       n       -       -       error
retry      unix  -       -       n       -       -       error
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       n       -       -       lmtp
anvil      unix  -       -       n       -       1       anvil
scache     unix  -       -       n       -       1       scache
#maildrop  unix  -       n       n       -       -       pipe flags=DRhu user=@l_nusr@ argv=@l_prefix@/bin/maildrop -d ${recipient}
#cyrus     unix  -       n       n       -       -       pipe user=@l_nusr@ argv=@l_prefix@/bin/cyrdeliver -e -r ${sender} -m ${extension} ${user}
#uucp      unix  -       n       n       -       -       pipe flags=Fqhu user=@l_nusr@ argv=@l_prefix@/bin/uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#ifmail    unix  -       n       n       -       -       pipe flags=F user=@l_nusr@ argv=@l_prefix@/bin/ifmail -r $nexthop ($recipient)
#bsmtp     unix  -       n       n       -       -       pipe flags=Fq. user=@l_nusr@ argv=@l_prefix@/bin/bsmtp -f $sender $nexthop $recipient
</file>
<file name="main.cf">
##
##  @l_prefix@/etc/postfix/main.cf -- Postfix main configuration
##
##  Run "@l_prefix@/sbin/postconf -n" to see all parameters overriding
##  defaults, run "@l_prefix@/sbin/postconf -d" to see all possible
##  parameters and their defaults and read the following manual
##  pages for description of each parameter: bounce(8), cleanup(8),
##  defer(8), error(8), flush(8), lmtp(8), local(8), master(8),
##  pickup(8), pipe(8), qmgr(8), showq(8), smtp(8), smtpd(8), spawn(8),
##  trivial-rewrite(8).
##

#   users
mail_owner                    = @l_musr@
setgid_group                  = @l_rgrp@
default_privs                 = @l_nusr@

#   local host
myhostname                    = mail.example.com
mydomain                      = example.com
myorigin                      = $myhostname

#   smtp daemon
smtpd_banner                  = $myhostname ESMTP $mail_name
inet_interfaces               = 127.0.0.1
inet_protocols                = ipv4

#   smtp client
smtp_bind_address             = 127.0.0.1
smtputf8_enable               = no

SSL:#   SSL/TLS support
SSL:smtpd_tls_CAfile             = @l_prefix@/etc/x509/example-ca.crt.pem
SSL:smtpd_tls_cert_file          = @l_prefix@/etc/x509/example-server.crt.pem
SSL:smtpd_tls_key_file           = @l_prefix@/etc/x509/example-server.key.pem
SSL:smtpd_tls_fingerprint_digest = sha1
SSL:smtpd_tls_security_level     = may
SSL:smtpd_tls_ask_ccert          = no
SSL:smtpd_tls_auth_only          = yes
SSL:
SASL:#   SASL AUTH support
SASL:smtpd_sasl_auth_enable       = yes
SASL:smtpd_sasl_type              = dovecot
SASL:smtpd_sasl_path              = @l_prefix@/var/dovecot/run/auth-client
SASL:smtpd_sasl_local_domain      = $myhostname
SASL:smtpd_sasl_security_options  = noanonymous
SASL:
#   smtp standard restrictions
strict_rfc821_envelopes       = yes
disable_vrfy_command          = yes
smtpd_client_restrictions     = permit_mynetworks,
SSL:                                permit_tls_clientcerts,
SASL:                                permit_sasl_authenticated,
                                check_client_access hash:@l_prefix@/etc/postfix/access,
                                reject_unknown_reverse_client_hostname,
                                sleep 1, reject_unauth_pipelining,
                                permit
smtpd_helo_required           = yes
smtpd_helo_restrictions       = permit_mynetworks,
SSL:                                permit_tls_clientcerts,
SASL:                                permit_sasl_authenticated,
                                check_client_access hash:@l_prefix@/etc/postfix/access,
                                reject_invalid_helo_hostname,
                                reject_non_fqdn_helo_hostname,
                                reject_unknown_helo_hostname,
                                permit
smtpd_sender_restrictions     = permit_mynetworks,
SSL:                                permit_tls_clientcerts,
SASL:                                permit_sasl_authenticated,
                                check_client_access hash:@l_prefix@/etc/postfix/access,
                                check_sender_access hash:@l_prefix@/etc/postfix/access,
                                reject_unknown_sender_domain,
                                permit
smtpd_relay_restrictions      = permit_mynetworks,
SSL:                                permit_tls_clientcerts,
SASL:                                permit_sasl_authenticated,
                                check_client_access hash:@l_prefix@/etc/postfix/access,
                                reject_unauth_destination,
                                permit
smtpd_recipient_restrictions  = permit_mynetworks,
SSL:                                permit_tls_clientcerts,
SASL:                                permit_sasl_authenticated,
                                check_client_access hash:@l_prefix@/etc/postfix/access,
                                check_recipient_access hash:@l_prefix@/etc/postfix/recipient,
                                reject_unauth_destination,
                                permit
smtpd_data_restrictions       = permit_mynetworks,
SSL:                                permit_tls_clientcerts,
SASL:                                permit_sasl_authenticated,
                                check_client_access hash:@l_prefix@/etc/postfix/access,
                                permit

#   smtp custom restrictions
#   (optionally used from within "recipient" map)
#smtpd_restriction_classes    = RESTRICT_GREY RESTRICT_RBL
#RESTRICT_GREY                = check_policy_service unix:@l_prefix@/var/postgrey/postgrey.socket
#RESTRICT_RBL                 = reject_rbl_client dul.dnsbl.sorbs.net,
#                               reject_rbl_client smtp.dnsbl.sorbs.net,
#                               reject_rbl_client spam.dnsbl.sorbs.net,
#                               reject_rbl_client noserver.dnsbl.sorbs.net,
#                               reject_rbl_client nomail.rhsbl.sorbs.net,
#                               reject_rbl_client dialups.mail-abuse.org,
#                               reject_rbl_client relays.mail-abuse.org,
#                               reject_rbl_client sbl.spamhaus.org,
#                               reject_rbl_client pbl.spamhaus.org,
#                               reject_rbl_client xbl.spamhaus.org,
#                               reject_rbl_client bl.spamcop.net

#   receiving and relaying
mynetworks                    = 127.0.0.0/8
mydestination                 = $myhostname, localhost.$mydomain
relay_domains                 = $mydestination,
                                hash:@l_prefix@/etc/postfix/relay

#   mapping
canonical_maps                = hash:@l_prefix@/etc/postfix/canonical
smtp_generic_maps             = hash:@l_prefix@/etc/postfix/generic
virtual_alias_maps            = hash:@l_prefix@/etc/postfix/virtual
relocated_maps                = hash:@l_prefix@/etc/postfix/relocated
transport_maps                = hash:@l_prefix@/etc/postfix/transport
alias_maps                    = hash:@l_prefix@/etc/postfix/aliases
alias_database                = hash:@l_prefix@/etc/postfix/aliases

#   local delivery
local_recipient_maps          = proxy:unix:passwd.byname $alias_maps
recipient_delimiter           = +
mailbox_command               = @l_prefix@/bin/procmail -a "$EXTENSION"
message_size_limit            = 32000000

</file>
<file name="access">
##
##  @l_prefix@/etc/postfix/access -- client list to short-circuit access restrictions
##
##  Searched for the client (hostname, parent domains, IP address,
##  networks obtained by stripping least significant octets from IP
##  address) in order to short-circuit various restriction. Rejects
##  the request if the result is REJECT or "[45]XX text". Permits the
##  request if the result is OK or RELAY or all-numerical.
##

#   Syntax (see access(5)):
#   | user@domain        action
#   | domain             action
#   | user@              action
#   | net.work.addr.ess  action
#   | net.work.addr      action
#   | net.work           action
#   | net                action
#   where "action" is one of:
#   "[45]NN text", "REJECT", "OK", "restriction..."
#
#   Examples:
#   | mail.example.com OK
#   | example.com      REJECT
#   | 192.168.0.1      OK
#   | 192.168          REJECT
#   | postmaster@      OK

</file>
<file name="recipient">
##
##  @l_prefix@/etc/postfix/recipient -- recipient list to apply custom restrictions
##
##  Searched for the recipient (SMTP "RCPT TO") (address, domain, parent
##  domains, or user) in order to apply additional recipient-specific
##  custom SMTP restrictions like RESTRICT_RBL or RESTRICT_GREY.
##

#   Syntax (see access(5)):
#   | user@domain        action
#   | domain             action
#   | user@              action
#   where "action" is one of:
#   "[45]NN text", "REJECT", "OK", "RESTRICT_XXX"
#
#   Examples:
#   | postmaster@example.com  OK
#   | example.com             RESTRICT_RBL RESTRICT_GREY

</file>
<file name="relay">
##
##  @l_prefix@/etc/postfix/relay -- recipient domain list to allow relaying
##
##  Searched for recipient domains which are allowed to be relayed.
##

#   Syntax (see postconf(5) "relay_domains"):
#   | domain OK
#
#   Examples:
#   | example.com OK

</file>
<file name="virtual">
##
##  @l_prefix@/etc/postfix/virtual -- virtual address translation
##
##  Searched for virtual addresses user@domain, user and @domain
##  (in this order). It redirect mail for all recipients, local or
##  remote. The mapping affects only envelope recipients.
##

#   Syntax (see virtual(5)):
#   | user@domain  address, address, ...
#   | user         address, address, ...
#   | @domain      address, address, ...
#
#   Examples:
#   | @example.com               john@example.com
#   | postmaster@example.com     postmaster
#   | john@example1.com          john1
#   | john@example2.com          john2

</file>
<file name="aliases">
##
##  @l_prefix@/etc/postfix/aliases -- local mailbox aliases
##
##  Searched for virtual addresses user@domain, user and @domain
##  (in this order). It redirect mail for all recipients, local or
##  remote. The mapping affects only envelope recipients.
##

#   Syntax (see aliases(5)):
#   | name:         value, value, ...
#   where value is one of:
#   "address", "/file/name", "|command", ":include:/file/name"
#
#   Examples:
#   | john.doe:     john, doe
#   | robot:        |/path/to/robot
#   | archive:      /path/to/archive
#   | users:        :include:/path/to/users.list
#   | owner-users:  john.doe

#   standard mail targets
nobody:                /dev/null
MAILER-DAEMON:         postmaster

#   mailbox names for common services, roles and functions
#   (see RFC2142 for more details and expanded list of names)
postmaster:            root
hostmaster:            root
security:              root
abuse:                 root

#   save unprivileged user storage of careless admins
root:                  /dev/null

</file>
<file name="canonical">
##
##  @l_prefix@/etc/postfix/canonical -- address canonification on mail receiving
##
##  Searched for canonical addresses for user@domain, user and @domain
##  (in this order).
##

#   Syntax (see canonical(5)):
#   | user@domain  address
#   | user         address
#   | @domain      address
#
#   Examples:
#   | postmaster@mail.example.com postmaster@example.com
#   | john                        John.Doe
#   | @example.com                @example.com

</file>
<file name="relocated">
##
##  @l_prefix@/etc/postfix/relocated -- relocate obsolete addresses
##
##  Searched for relocated addresses user@domain, user and @domain
##  (in this order). It bounces mail for all recipients.
##

#   Syntax (see relocated(5)):
#   | user@domain     address
#   | user            address
#   | @domain         address
#
#   Examples:
#   | john@invalid    john@example.com
#   | john            john@example.com
#   | @invalid        john@example.com

</file>
<file name="generic">
##
##  @l_prefix@/etc/postfix/generic -- address canonification on mail sending
##
##  Searched for canonical addresses for user@domain, user and @domain
##  (in this order).
##

#   Syntax (see generic(5)):
#   | user@domain  address
#   | user         address
#   | @domain      address
#
#   Examples:
#   | postmaster@mail.example.com postmaster@example.com
#   | john                        John.Doe
#   | @example.com                @example.com

</file>
<file name="transport">
##
##  @l_prefix@/etc/postfix/transport -- transport selection
##
##  Searched for domain and .domain (in this order). It selects the
##  specified transport facility for delivery.
##

#   Syntax (see transport(5)):
#   | domain  transport:nexthop
#   | .domain transport:nexthop
#
#   Examples:
#   | me.example.com             local:
#   | you.example.com            smtp:mail.example.com:2525
#   | example.com                smtp:mail.example.com
#   | .example.com               smtp:mail.example.com

</file>
