1mkdir mail/
2cd mail/
3nano docker-compose.yml

 1services:
 2
 3  maddy:
 4    image: foxcpp/maddy:latest
 5    container_name: maddy
 6    restart: unless-stopped
 7    volumes: #mount point
 8      - ./maddy:/data 
 9      - /etc/letsencrypt/live/mail.example.com/fullchain.pem:/data/local_certs/cert.pem:ro #邮箱域名的证书挂载到docker内
10      - /etc/letsencrypt/live/mail.example.com/privkey.pem:/data/local_certs/key.pem:ro #邮箱域名的密钥挂载docker内
11    ports:
12      - 25:25/tcp
13      - 465:465/tcp
14      - 993:993/tcp
15
16  rainloop:
17    image: php:fpm-alpine3.15
18    container_name: rainloop
19    restart: unless-stopped
20    volumes:
21      - ./rainloop:/var/www/html
22    ports:
23      - 127.0.0.1:9000:9000
24    logging:
25      driver: json-file
26      options:
27        max-size: "1m"
28        max-file: "10"

1cd ~/mail/
2mkdir rainloop/
3wget https://www.rainloop.net/repository/webmail/rainloop-latest.zip
4unzip rainloop-latest.zip

 1server {
 2    server_name mail.example.com;
 3    listen 443 ssl http2;
 4    listen [::]:443 ssl http2;
 5    ssl_certificate /data/certs/fullchain.pem; #邮箱域名的证书
 6    ssl_certificate_key /data/certs/cert.pem;  #邮箱域名的密钥
 7
 8    access_log  /var/log/nginx/access_mail.log;
 9    error_log   /var/log/nginx/error_mail.log;
10
11    root /data/rainloop/;
12    index  index.php;
13
14    location ~ \.php$ {
15        root           /var/www/html;
16        fastcgi_pass   127.0.0.1:9000;
17        fastcgi_index  index.php;
18        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
19        include        fastcgi_params;
20    }
21
22    location ^~ /data {
23                       deny all; #用户无法通过 Internet 直接访问rainloop目录
24    }
25}

1cd ~/mail/
2mkdir maddy/
3nano maddy.conf

  1# 预设了三个变量，方便后续使用
  2$(hostname) = mail.example.com #外界通过这个域名找到你的邮件服务器。
  3$(primary_domain) = example.com #你的邮箱 @后面的域名
  4$(local_domains) = $(primary_domain)
  5
  6# 如果要使用 nginx 反代，这里可以选择 tls off，但如此一来没法生成 dkim 密钥对
  7# 在之后检查时日志内会有安全警告，故推荐直接用 maddy 管理
  8# tls off
  9#tls file /etc/letsencrypt/live/$(local_domains)/fullchain.pem /etc/letsencrypt/live/$(local_domains)/privkey.pem
 10tls file /data/local_certs/cert.pem /data/local_certs/key.pem 
 11
 12# 数据用 SQLite3 存储较为简单、轻量
 13auth.pass_table local_authdb {
 14    table sql_table {
 15        driver sqlite3
 16        dsn credentials.db
 17        table_name passwords
 18    }
 19}
 20
 21storage.imapsql local_mailboxes {
 22    driver sqlite3
 23    dsn imapsql.db
 24}
 25
 26# ----------------------------------------------------------------------------
 27# SMTP endpoints + message routing
 28
 29hostname $(hostname)
 30
 31table.chain local_rewrites {
 32    optional_step regexp "(.+)\+(.+)@(.+)" "$1@$3"
 33    optional_step static {
 34        entry postmaster postmaster@$(primary_domain)
 35    }
 36    optional_step file /data/aliases
 37}
 38
 39msgpipeline local_routing {
 40    destination postmaster $(local_domains) {
 41        modify {
 42            replace_rcpt &local_rewrites
 43        }
 44
 45        deliver_to &local_mailboxes
 46    }
 47
 48    default_destination {
 49        reject 550 5.1.1 "User doesn't exist"
 50    }
 51}
 52
 53# smtp 使用 25 号端口发送邮件
 54smtp tcp://[::]:25 {
 55    # tls self_signed
 56    limits {
 57        # Up to 20 msgs/sec across max. 10 SMTP connections.
 58        all rate 20 1s
 59        all concurrency 10
 60    }
 61
 62    dmarc yes
 63    check {
 64        require_mx_record
 65        dkim # 若无则不检查
 66        spf
 67    }
 68
 69    source $(local_domains) {
 70        reject 501 5.1.8 "Use Submission for outgoing SMTP"
 71    }
 72    default_source {
 73        destination postmaster $(local_domains) {
 74            deliver_to &local_routing
 75        }
 76        default_destination {
 77            reject 550 5.1.1 "User doesn't exist"
 78        }
 79    }
 80}
 81
 82# 如果使用 nginx 反代则这里监听到本地端口即可 tcp://127.0.0.1:587
 83# 不使用则邮件客户端以 SSL/TLS 方式直接访问该地址
 84submission tls://[::]:465 {
 85    limits {
 86        # Up to 50 msgs/sec across any amount of SMTP connections.
 87        all rate 50 1s
 88    }
 89
 90    auth &local_authdb
 91
 92    source $(local_domains) {
 93        check {
 94            authorize_sender {
 95                prepare_email &local_rewrites
 96                user_to_email identity
 97            }
 98        }
 99
100        destination postmaster $(local_domains) {
101            deliver_to &local_routing
102        }
103        default_destination {
104            modify {
105                dkim $(primary_domain) $(local_domains) default
106            }
107            deliver_to &remote_queue
108        }
109    }
110    default_source {
111        reject 501 5.1.8 "Non-local sender domain"
112    }
113}
114
115target.remote outbound_delivery {
116    limits {
117        # Up to 20 msgs/sec across max. 10 SMTP connections
118        # for each recipient domain.
119        destination rate 20 1s
120        destination concurrency 10
121    }
122    mx_auth {
123        dane
124        mtasts {
125            cache fs
126            fs_dir mtasts_cache/
127        }
128        local_policy {
129            min_tls_level encrypted
130            min_mx_level none
131        }
132    }
133}
134
135target.queue remote_queue {
136    target &outbound_delivery
137
138    autogenerated_msg_domain $(primary_domain)
139    bounce {
140        destination postmaster $(local_domains) {
141            deliver_to &local_routing
142        }
143        default_destination {
144            reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
145        }
146    }
147}
148
149# ----------------------------------------------------------------------------
150# IMAP endpoints
151# 同上，使用 nginx 反代则改为监听本地端口 tcp://127.0.0.1:143
152imap tls://[::]:993 {
153    auth &local_authdb
154    storage &local_mailboxes
155}

1cd ~/mail
2docker compose upgrade -d

1docker exec -it maddy sh
2maddy creds create [email protected] #创建邮箱
3maddy imap-acct create [email protected]

1cat data/dkim_keys/*.dns