Email system on Postfix - encrypted mail for a management infrastructure

Between 2017 and 2019 I designed, built and ran the email system of the management infrastructure of a network service provider. Its users were mostly not people. Servers, applications and appliances sent alerts and notifications through it, and what they sent described the inside of the infrastructure, so a message was not allowed to leave unless the sender was known, was allowed to write to that destination, and the content was encrypted for the person who would read it.

This Solution is the whole of that system. In each of two sites: a pair of Postfix servers behind one Keepalived address, Dovecot as their authentication back end, senders authorized by Active Directory groups over LDAPS, a content filter written in Bash that encrypts every message with S/MIME or PGP/MIME, two relay servers that deliver to the internet through NAT, and a third internal server with the mailboxes and Roundcube webmail. It started in 2017 as one internal server and one relay; the highly available design is from 2019.

The system in one picture

flowchart TB
  clients["Mail clients: servers, applications, appliances"]
  users["Administrators and operators"]
  subgraph site["Site 2, DC2"]
    vip["VIP DC2-S-XCMSX001, SMTP 25 with STARTTLS and SMTPS 465"]
    subgraph pair["Internal pair, Keepalived"]
      x1["DC2-A-VCMSX001: Postfix, Dovecot SASL, encryption filter"]
      x2["DC2-B-VCMSX001: Postfix, Dovecot SASL, encryption filter"]
      x1 <-. "keys and certificates, rsync" .-> x2
    end
    ad["Active Directory, LDAPS"]
    x3["DC2-A-VCMSX002: mailboxes, Dovecot, Roundcube"]
    r1["DC2-A-VCMSR001: relay, primary"]
    r2["DC2-B-VCMSR001: relay, fallback"]
  end
  inet["Mail servers on the internet"]
  clients --> vip
  vip --> x1
  vip -.-> x2
  x1 --> ad
  x1 -- "own domain" --> x3
  x1 -- "other domains" --> r1
  x1 -.-> r2
  r1 -- "NAT" --> inet
  r2 -- "NAT" --> inet
  users -- "HTTPS" --> x3

The fictional environment

Every Article and every Config document uses the same names and addresses.

Site 2 is the worked example throughout, because the archived configuration is that of its five servers. Site 1 is described from the design. People in mail addresses are user01 and up, partner organisations in group names are PARTNER1 and PARTNER2, and the marks CFG-ON and CFG-OFF in the comments of a file are mine: this setting was turned on, or off, by me.

Articles

Read in this order; it goes from why, through how it was built, to how it was run.

Configuration

Each document holds one file as it ran, with comments, the differences between the hosts that carry it, and a check against the current release. Files that are mostly the distribution's own comments are shown with every active line and without those comments.

Postfix, internal pair

Postfix, LDAP maps against Active Directory

Dovecot

Encryption filter

High availability and synchronization

Relay servers

Mailbox server

Webmail

Operating system

What the write-up found

Reading the archived configuration against the design, seven years later, turned up things the design does not say. Each is told in its Article.