bleala/postfix repository overview

docker run -d --name postfix -p "25:25"  \
        -e SMTP_SERVER=your.mail.server \
        -e SERVER_HOSTNAME=your.mail.server \
        bleala/postfix:latest

---
networks:
  postfix:
    name: postfix
    driver: bridge

secrets:
  smtp_password:
    file: $SECRETSDIR/smtp_password

services:
  # Postfix SMTP Relay - Simple Postfix SMTP TLS relay docker alpine based image with multiple (possible) use cases.
  # https://hub.docker.com/r/bleala/postfix/
  # https://github.com/Bleala/Postfix-DOCKERIZED
  postfix:
    image: bleala/postfix:latest
    container_name: postfix
    hostname: postfix
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    env_file:
      - path: .env
        required: false
    environment:
      SERVER_HOSTNAME: mail.example.com
      SMTP_SERVER: mail.example.com
      SMTP_PORT: 465
      SMTP_USERNAME: user
      SMTP_PASSWORD_FILE: /run/secrets/smtp_password
      SMTP_NETWORKS: 192.168.0.1/24
      LOG_SUBJECT: yes
    networks:
      postfix: {}
    ports:
      - target: 25
        published: 25
        protocol: tcp
        mode: host
    volumes:
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: true
    secrets:
      - source: smtp_password

---
networks:
  postfix:
    name: postfix
    driver: bridge

secrets:
  smtp_password:
    file: /path/to/your/secret/file/smtp_password
  smtp_username:
    file: /path/to/your/secret/file/smtp_username
  smtpd_auth_users:
    file: /path/to/your/secret/file/sasl_users.txt
  # Can be removed if you use the multiple users method
  smtpd_auth_password:
    file: /path/to/your/secret/file/smtpd_auth_password
  smtpd_auth_username:
    file: /path/to/your/secret/file/smtpd_auth_username

services:
  # Postfix SMTP Relay - Simple Postfix SMTP TLS relay docker alpine based image with multiple (possible) use cases.
  # https://hub.docker.com/r/bleala/postfix
  # https://github.com/Bleala/Postfix-DOCKERIZED
  postfix:
    image: bleala/postfix:latest
    container_name: postfix
    hostname: postfix
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    env_file:
      - path: .env
        required: false
    environment:
      ### Outbound Relay Configuration ###
      # Mandatory: Server hostname for the Postfix container. Emails will appear to come from the hostname's domain.
      SERVER_HOSTNAME: 'mail.example.com'
      # Mandatory: Server address of the SMTP server to use.
      SMTP_SERVER: 'mail.example.com'
      # Optional: (Default value: 587) Port address of the SMTP server to use.
      SMTP_PORT: '25'
      # Optional: Username to authenticate with. (Not needed if SMTP_USERNAME_FILE is used)
      SMTP_USERNAME: 'my_user'
      # Optional (Mandatory if SMTP_USERNAME is set): Password of the SMTP user. (Not needed if SMTP_PASSWORD_FILE is used)
      SMTP_PASSWORD: 'my_password'
      # Optional: Set this to a mounted file containing the username, to avoid usernames in env variables.
      SMTP_USERNAME_FILE: '/run/secrets/smtp_username'
      # Optional: Set this to a mounted file containing the password, to avoid passwords in env variables.
      SMTP_PASSWORD_FILE: '/run/secrets/smtp_password'
      # Optional: Path to a file (PEM) containing trusted CAs for verifying the OUTBOUND server (SMTP_SERVER).
      # Use either SMTP_TLS_CA_FILE or SMTP_TLS_CA_PATH.
      SMTP_TLS_CA_FILE: '/etc/postfix/certs/my-homelab-ca.crt'
      # Optional: Path to a directory containing trusted CAs (PEM) for verifying the OUTBOUND server (SMTP_SERVER).
      # Use either SMTP_TLS_CA_FILE or SMTP_TLS_CA_PATH.
      SMTP_TLS_CA_PATH: '/etc/postfix/certs/ca-directory'

      ### IP & SASL Authentication Configuration ###
      # Optional: Setting this will allow you to add additional, comma seperated, subnets to use the relay. Used like SMTP_NETWORKS='xxx.xxx.xxx.xxx/xx,xxx.xxx.xxx.xxx/xx'.
      SMTP_NETWORKS: ''
      # Optional: Set the security mode for inbound relaying.
      # 'mynetworks_only': (Default) Only clients from SMTP_NETWORKS can relay. SASL is disabled.
      # 'sasl_only': Only authenticated SASL users can relay. Client IP is ignored.
      # 'ip_or_sasl': Clients from SMTP_NETWORKS OR authenticated SASL users can relay.
      # 'ip_and_sasl': Clients must be from SMTP_NETWORKS AND be authenticated SASL users.
      # 'mtls_only': Only clients with a valid, trusted certificate (via SMTPD_TLS_CA_FILE/PATH) can relay.
      # 'ip_and_mtls': Clients must be from SMTP_NETWORKS AND have a valid, trusted certificate.
      SMTPD_AUTH_MODE: 'mynetworks_only'
      # Optional: Path to the secret file containing SASL users (format: user:pass, one per line)
      # This takes priority over SMTPD_AUTH_USERS.
      SMTPD_AUTH_USERS_FILE: '/run/secrets/smtpd_auth_users'
      # Optional: Alternative to file, provide users as a multi-line environment variable.
      # Example: SMTPD_AUTH_USERS="user1:pass1\nuser2:pass2"
      SMTPD_AUTH_USERS: |
        user1:pass1
        user2:pass2
      # Optional: (Default: yes) Set to 'no' to create the SASL user without appending the domain (e.g., 'user' instead of '[email protected]').
      SMTPD_AUTH_APPEND_DOMAIN: 'yes'
      # The following are ignored if SMTPD_AUTH_USERS_FILE or SMTPD_AUTH_USERS is set.
      # Optional: (Mandatory for SASL modes) Username for inbound SASL authentication. (Not needed if SMTPD_AUTH_USERNAME_FILE is used)
      # Set without FQDN, as DOMAIN is appended automatically from SERVER_HOSTNAME.
      SMTPD_AUTH_USERNAME: 'my_user'
      # Optional: (Mandatory for SASL modes) Password for inbound SASL authentication. (Not needed if SMTPD_AUTH_PASSWORD_FILE is used)
      SMTPD_AUTH_PASSWORD: 'my_password'
      # Optional: Set this to a mounted file containing the inbound auth username, to avoid usernames in env variables.
      # Set without FQDN, as DOMAIN is appended automatically from SERVER_HOSTNAME.
      SMTPD_AUTH_USERNAME_FILE: '/run/secrets/smtpd_auth_username'
      # Optional: Set this to a mounted file containing the inbound auth password, to avoid passwords in env variables.
      SMTPD_AUTH_PASSWORD_FILE: '/run/secrets/smtpd_auth_password'

      ### Inbound TLS Configuration ###
      # Optional: (Default: no) Set to 'yes' to enable inbound STARTTLS (Port 25) and SMTPS (Port 465) and Submission (Port 587).
      SMTPD_TLS_ENABLED: 'yes'
      # Optional: (Default: no) Set to 'yes' to force *global* TLS encryption (smtpd_tls_security_level=encrypt).
      # This will break clients on Port 25 that do not support STARTTLS. Only use in controlled environments.
      SMTPD_TLS_FORCED: 'no'
      # Optional (Mandatory if SMTPD_TLS_ENABLED is 'yes'): (Default: /etc/postfix/certs/chain.pem) Path inside the container to your combined TLS chain file.
      # This file MUST contain (in this order): 1. Private Key, 2. Server Certificate, 3. Intermediate CA(s)
      # Example: cat privkey.pem fullchain.pem > /path/to/your/certs/chain.pem
      # Can be multiple keys/certs combined in one file.
      SMTPD_TLS_CHAIN_FILE: '/etc/postfix/certs/chain.pem'
      # Optional: Path to a file containing trusted CAs (PEM format) for verifying client certificates (mTLS) (Required for 'mtls_only' or 'ip_and_mtls' modes).
      # Use either SMTPD_TLS_CA_FILE or SMTPD_TLS_CA_PATH.
      SMTPD_TLS_CA_FILE: '/etc/postfix/certs/my-homelab-ca.crt'
      # Optional: Path to a directory containing trusted CAs (PEM format) for verifying client certificates (mTLS) (Required for 'mtls_only' or 'ip_and_mtls' modes).
      # Use either SMTPD_TLS_CA_FILE or SMTPD_TLS_CA_PATH.
      SMTPD_TLS_CA_PATH: '/etc/postfix/certs/ca-directory'
      # Optional: (Default: no) Set to 'yes' to enable modern TLS hardening (force TLSv1.2+, high ciphers, server preference, authentication only over TLS).
      TLS_HARDENING_ENABLED: 'yes'

      ### Rate Limiting Options ###
      # Optional: (Default: unset) Max connections per minute from the same client.
      SMTPD_CLIENT_CONN_RATE_LIMIT: '20'
      # Optional: (Default: unset) Max messages per minute from the same client.
      SMTPD_CLIENT_MSG_RATE_LIMIT: '50'
      # Optional: (Default: unset) Max recipients per minute from the same client.
      SMTPD_CLIENT_RCPT_RATE_LIMIT: '100'

      ### Misc. Options ###
      # Optional: (Default: no) Set to 'yes' to enable debug logging.
      DEBUG: 'yes'
      # Optional: This will add a header for tracking messages upstream. Helpful for spam filters. Will appear as "RelayTag: ${SMTP_HEADER_TAG}" in the email headers.
      SMTP_HEADER_TAG: ''
      # Optional: Set this to yes to always add missing From:, To:, Date: or Message-ID: headers.
      ALWAYS_ADD_MISSING_HEADERS: 'yes'
      # Optional: This will rewrite the from address overwriting it with the specified address for all email being relayed.
      OVERWRITE_FROM: "Your Name <[email protected]>"
      # Optional: This will allow you to set a custom $mydestination value. Default is localhost.
      DESTINATION: ''
      # Optional: This will output the subject line of messages in the log.
      LOG_SUBJECT: 'yes'
      # Optional: This will disable (no) or enable (yes) the use of SMTPUTF8
      SMTPUTF8_ENABLE: 'no'
      # Optional: This will allow you to set a custom $message_size_limit value. Default is 10240000.
      MESSAGE_SIZE_LIMIT: ''
    networks:
      postfix: {}
    ports:
      # SMTP (Port 25) (Normal)
      - target: 25
        published: 25
        protocol: tcp
        mode: host
      # SMTPS (Port 465) (Implicit TLS)
      - target: 465
        published: 465
        protocol: tcp
        mode: host
      # Submission (Port 587) (STARTTLS)
      - target: 587
        published: 587
        protocol: tcp
        mode: host
    secrets:
      - source: smtp_password
      - source: smtp_username
      - source: smtpd_auth_users
      - source: smtpd_auth_password
      - source: smtpd_auth_username
    volumes:
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: true
      - type: bind
        source: /path/to/your/certs
        target: /etc/postfix/certs
        read_only: true

docker compose up -d

docker compose logs -f

docker logs -f postfix