Mailu

From Leo's Notes
This page was last edited on 27 January 2020, at 18:29.

Mailu is a fully-featured mail server solution that runs under Docker Swarm or with Docker Compose. It automatically integrates all opensource software and includes Postfix, Dovecot, and RSpamd.

Project website is at https://mailu.io/1.7/

Installation

Installation is as simple as obtaining a docker-compose configuration file and starting the stack. Obtain a docker-compose config from: https://setup.mailu.io/1.7/

Ensure that all domains used in the configuration are properly resolving to your server. The config also assumes that you do not have any custom reverse proxy set up (such as with Traefik) as it bundles its own 'front' proxy.

Bring up the containers, then create a new admin account: 

# docker-compose up -d
# docker-compose exec admin flask mailu admin admin steamr.com password

Once the containers have started, you should be able to navigate to the admin console under /admin.

Amazon Web Services

Running mailu on a EC2 instance is identical. However, there are some caveats:

  • IPs assigned from AWS's ElasticIP pool have a low reputation. Some are even blacklisted by SpamHaus
  • AWS limits SMTP traffic unless you ask for an exception
  • Using AWS SES as a mail relay works except for forwarded messages

You can try obtaining various Elastic IP addresses until you get one that is clean. However, mail sent is really unreliable since gmail sometimes just refuses the email from being accepted completely.

Using SES as a mail relay gets around the unreliable delivery issue, but emails that are forwarded won't be delivered since the sender isn't recognized by SES.

See:

Troubleshooting

Periodic 'Authentication Failed' Errors

Looking at the logs, you see: 

front_1     | 2019/11/24 22:34:26 [info] 10#10: *216931 client login failed: "Authentication rate limit from one source exceeded" while in http auth state, client: 192.168.203.8, server: 0.0.0.0:10143, login: "user@domain.com"

It looks like rainloop is causing a bunch of authentication requests for each HTTP request that is served. This then causes the authentication rate limit to hit.

The 'fix' is to just raise the limits. This however defeats the whole point of a rate limit (ie. to prevent brute force attacks).