Operations grimoire/Mail - Revision history

Dereckson: /* SPF and DKIM records */

2025-02-03T17:22:58Z

SPF and DKIM records

← Older revision		Revision as of 17:22, 3 February 2025
Line 77:		Line 77:
	\|-		\|-
	! Server !! IPs !! Description !! Use cases		! Server !! IPs !! Description !! Use cases
			\|-
			\| hervil \|\| n/a, <code>+mx</code> \|\| SMTP \|\| Users and applications mailboxes
	\|-		\|-
	\| web-001 \|\| 51.255.124.10/30 2001:41d0:303:d971::517e:c0de/56 \|\| PHP applications \|\| MediaWiki SaaS		\| web-001 \|\| 51.255.124.10/30 2001:41d0:303:d971::517e:c0de/56 \|\| PHP applications \|\| MediaWiki SaaS

Dereckson at 17:20, 3 February 2025

2025-02-03T17:20:17Z

← Older revision		Revision as of 17:20, 3 February 2025
Line 65:		Line 65:
	51.255.124.8/30 172.27.27.1 UGS vmx0		51.255.124.8/30 172.27.27.1 UGS vmx0

	For SPF record we need to make the mail go out from the ~~ip :~~ 51.210.99.254		For SPF record we need to make the mail go out from the IP 51.210.99.254.
	To permit acme.sh we make a route ~~thrugh~~ router.~~OO1~~		To permit acme.sh we make a route through router-OO1.

			== SPF and DKIM records ==
			=== SPF ===

			Mails are currently sent from:

			{\| class="wikitable"
			\|+ Sources for @nasqueron.org
			\|-
			! Server !! IPs !! Description !! Use cases
			\|-
			\| web-001 \|\| 51.255.124.10/30 2001:41d0:303:d971::517e:c0de/56 \|\| PHP applications \|\| MediaWiki SaaS
			\|}

	== Troubleshoot ==		== Troubleshoot ==

Dereckson: +snappymail

2024-11-02T06:36:46Z

+snappymail

← Older revision		Revision as of 06:36, 2 November 2024
Line 34:		Line 34:

	Sympa manages the mailing lists.		Sympa manages the mailing lists.

			=== Webmail ===
			==== Snappymail ====

			There is only one account supported for administration:

			* URL: https://mail.nasqueron.org/snappymail/?admin
			* Credentials: stored in Vault at ops/infra/mailserver/snappymail

			If a plugin uses a third-party service, [[Privacy/Mail]] needs to be updated.

	=== Add a domain ===		=== Add a domain ===

Dereckson at 21:33, 24 October 2024

2024-10-24T21:33:30Z

← Older revision		Revision as of 21:33, 24 October 2024
Line 96:		Line 96:

	You can block individual IP or a range with pf, see [[Operations grimoire/Firewall]].		You can block individual IP or a range with pf, see [[Operations grimoire/Firewall]].

			[[Category:Mail]]

Dereckson at 00:32, 21 October 2024

2024-10-21T00:32:36Z

← Older revision		Revision as of 00:32, 21 October 2024
Line 91:		Line 91:
	If you got a 403 by running acme.sh (only visible in --debug mode), the IP of the server isn't in geo_nasqueron.		If you got a 403 by running acme.sh (only visible in --debug mode), the IP of the server isn't in geo_nasqueron.

	Add a route to use router-001 gateway: <code>route add 51.255.124.8/30 172.27.27.1<code>		Add a route to use router-001 gateway: <code>route add 51.255.124.8/30 172.27.27.1</code>

	=== Brute-force attacks ===		=== Brute-force attacks ===

	You can block individual IP or a range with pf, see [[Operations grimoire/Firewall]].		You can block individual IP or a range with pf, see [[Operations grimoire/Firewall]].

Dereckson: /* Troubleshoot */

2024-10-21T00:32:22Z

Troubleshoot

← Older revision		Revision as of 00:32, 21 October 2024
Line 92:		Line 92:

	Add a route to use router-001 gateway: <code>route add 51.255.124.8/30 172.27.27.1<code>		Add a route to use router-001 gateway: <code>route add 51.255.124.8/30 172.27.27.1<code>

			=== Brute-force attacks ===

			You can block individual IP or a range with pf, see [[Operations grimoire/Firewall]].

Dereckson: /* New deploy thinking */ Moved to Operations grimoire/Mail/Implementation discussions

2024-10-20T13:25:19Z

New deploy thinking: Moved to Operations grimoire/Mail/Implementation discussions

← Older revision		Revision as of 13:25, 20 October 2024
Line 43:		Line 43:

	You can also be willing to declare the domain to autoconfig/autodiscover, but that's blocked by https://devcentral.nasqueron.org/T1116.		You can also be willing to declare the domain to autoconfig/autodiscover, but that's blocked by https://devcentral.nasqueron.org/T1116.

	~~== New deploy thinking ==~~

	~~{\| class="wikitable"~~
	~~\|+ pour ou contre~~
	\|-
	~~! ViMbAdmin aventage~~
	~~! ViMbAdmin inconvenient~~
	~~! Salt pillar aventage~~
	~~! Salt pillar inconvenient~~
	\|-
	~~\| Ediatable interface~~
	~~\| Configuration splited~~
	~~\| Unified configuration~~
	~~\| Private salt repository needed for privacy~~
	\|-
	~~\| Easy to use interface~~
	~~\| Should be installed on the same server as the mailserver~~
	\|
	\|
	\|-
	~~\| Easy solution for users to changes their passwords~~
	\|
	\|
	\|
	\|-
	~~\| An administrator of an external domain for hosting of other open source project~~
	\|
	\|
	\|
	\|-
	\|
	\|
	\|
	\|
	\|}

	== Hervil ==		== Hervil ==

Dereckson: /* Nasqueron mail services */

2024-10-20T13:13:54Z

Nasqueron mail services

← Older revision		Revision as of 13:13, 20 October 2024
Line 12:		Line 12:

	== Nasqueron mail services ==		== Nasqueron mail services ==

	~~''This information belongs to the OLD mail services and need to be refreshed to the new installation.''~~

	=== Architecture ===		=== Architecture ===
	We use the following servers:		We use the following servers:
	* Postfix		* Postfix
	** 25 is for mail servers		** 25 is for mail servers
	** 587 is for STARTTLS + user auth		** 587 is for STARTTLS + user auth
	* dovecot for IMAP / POP		* dovecot for IMAP / POP ✅
	* SpamAssassin, OpenDKIM (see [[/DKIM]])		* SpamAssassin, OpenDKIM (see [[/DKIM]]) 🚧🔨⏳
	* Sympa for the mailing lists		* Sympa for the mailing lists 🚧🔨⏳
	* ~~MySQL~~ to store user accounts mailboxes ~~and~~ sympa data		* PostgreSQL on cluster db-A to store user accounts mailboxes ✅
	* nginx to serve web applications		* MariaDB on cluster db-B to store sympa data 🚧🔨⏳
			* nginx to serve web applications ✅
	~~/etc/postfix and /etc/dovecot are Git repositories, so commit your configuration changes.~~

	~~User accounts~~ are ~~stored in a MySQL database. They are managed by ViMbAdmin (~~on ~~https://vma.nasqueron.org)~~.		When not specified otherwise, the services are located on Hervil.

	~~Sympa manages~~ the ~~mailing lists~~.		The services with ✅ belong to the new installation and works correctly.

	~~A nginx server serves vma~~ as ~~vma.nasqinternal, Roundcube as mail.nasqinternal and Sympa.~~		The services with 🚧🔨⏳ belong to the old installation and are being reinstalled as part of the Mail project on DevCentral.
	~~On Dwellers, nginx assumes SSL termination and~~ the ~~relevant vhosts like mail.nasqueron.org, mail.wolfplex.be, etc~~.

	~~All that should be migrated to configuration as code to be~~ managed ~~through Salt~~.		User accounts are stored in a database. They are managed by ViMbAdmin (on https://admin.mail.nasqueron.org).

	~~A lxc container has been chosen for more stability: Docker assumes we can respin containers, host OS can change. The lxc container is isolated, stable and lxc doesn't ask restarts~~.		Sympa manages the mailing lists.

	=== Add a domain ===		=== Add a domain ===

	# Add it to https://~~vma~~.nasqueron.org		# Add it to https://admin.mail.nasqueron.org
	# Follow [[/DKIM]] procedure		# Follow [[/DKIM]] procedure

Dereckson: /* Log in to the server */ -1

2024-10-03T21:24:09Z

← Older revision		Revision as of 21:24, 3 October 2024
Line 38:		Line 38:

	A lxc container has been chosen for more stability: Docker assumes we can respin containers, host OS can change. The lxc container is isolated, stable and lxc doesn't ask restarts.		A lxc container has been chosen for more stability: Docker assumes we can respin containers, host OS can change. The lxc container is isolated, stable and lxc doesn't ask restarts.

	~~=== Log in to the server ===~~
	~~Mail server lives on the lxc container <code>mailserver</code> on [[Dwellers]].~~

	~~To access it, you must so:~~
	* ssh dwellers
	* attach to the container (<code>lxc-attach -n mailserver [tcsh]</code>)

	~~If you need to access a lxc container, you can script something do to:~~
	~~<code>$SSH $LXC_SERVER $LXC_EXEC $CONTAINER_NAME $LXC_COMMAND</code>~~

	~~Here, it would be <code>ssh -t dwellers.nasqueron.org sudo lxc-attach -n mailserver tcsh</code>.~~

	~~To be able to use sudo for lxc-attach, you must belong to the `ops` group.~~

	=== Add a domain ===		=== Add a domain ===

Dereckson: /* Nasqueron mail services */

2024-10-03T21:23:54Z

Nasqueron mail services

← Older revision		Revision as of 21:23, 3 October 2024
Line 12:		Line 12:

	== Nasqueron mail services ==		== Nasqueron mail services ==

			''This information belongs to the OLD mail services and need to be refreshed to the new installation.''

	=== Architecture ===		=== Architecture ===
	We use the following servers:		We use the following servers: