Email configuration #23

New issue

Open

opened 2024-07-05 09:51:37 +00:00 by raito · 4 comments

raito commented

2024-07-05 09:51:37 +00:00

Owner

We need a mailserver to send transactional email about our services.

I can host something on my mailserver, but question is what are reasonable options regarding this?

We need a mailserver to send transactional email about our services. I can host something on my mailserver, but question is what are reasonable options regarding this?

raito commented

2024-07-05 10:04:55 +00:00

Author

Owner

@hexchen proposed a postfix per host, @hexa suggested https://github.com/NixOS/infra/blob/master/non-critical-infra/modules/postfix.nix and @lukegb agreed.

irenes commented

2024-07-05 21:08:41 +00:00

Member

I feel like the ideal setup would be a single postfix that the other hosts route to, so that we can do rate limiting in a single place. the big risk with managing our own outbound email is we need to make sure a single compromised box can't be used to send unbounded amounts of spam, since the consequences would fall on us not on the spammer.

oh!!!!! I had just assumed we'd use one of the cloud providers like Mailgun or Amazon SES, but since we're going to have actual commercial access, our outbound port 25 won't be blocked so we can use a postfix. neat!!!!! I feel like the ideal setup would be a single postfix that the other hosts route to, so that we can do rate limiting in a single place. the big risk with managing our own outbound email is we need to make sure a single compromised box can't be used to send unbounded amounts of spam, since the consequences would fall on us not on the spammer.

janik commented

2024-07-13 21:17:49 +00:00

Owner

but since we're going to have actual commercial access, our outbound port 25 won't be blocked so we can use a postfix.

I mean in most cases you can just ask your provider to unblock the port, e.g. hetzner blocks it by default but the unblock it if you write a ticket. But that's not the problem here

I feel like the ideal setup would be a single postfix that the other hosts route to, so that we can do rate limiting in a single place.

@irenes would you mind setting this up?

the big risk with managing our own outbound email is we need to make sure a single compromised box can't be used to send unbounded amounts of spam, since the consequences would fall on us not on the spammer.

Do you have some suggestions?
If I'm reading this correctly:

We need a mailserver to send transactional email about our services.

Then it should be good enough to hard code the ips of hosts who can connect for sending and the receivers to the email addresses who actually need to receive mail.

> but since we're going to have actual commercial access, our outbound port 25 won't be blocked so we can use a postfix. I mean in most cases you can just ask your provider to unblock the port, e.g. hetzner blocks it by default but the unblock it if you write a ticket. But that's not the problem here > I feel like the ideal setup would be a single postfix that the other hosts route to, so that we can do rate limiting in a single place. @irenes would you mind setting this up? > the big risk with managing our own outbound email is we need to make sure a single compromised box can't be used to send unbounded amounts of spam, since the consequences would fall on us not on the spammer. Do you have some suggestions? If I'm reading this correctly: > We need a mailserver to send transactional email about our services. Then it should be good enough to hard code the ips of hosts who can connect for sending and the receivers to the email addresses who actually need to receive mail.

irenes commented

2024-07-13 23:36:27 +00:00

Member

I'm glad to hear that Hetzner unblocks it; AWS hard-refuses to, and DigitalOcean only unblocks it for very large and well-established customers

I'll get back to you on the rest, I think I can take that action item but I'm going to need to get oriented in some stuff first to make sure I am filling a need that actually exists and not duplicating anyone else's work

I'm glad to hear that Hetzner unblocks it; AWS hard-refuses to, and DigitalOcean only unblocks it for very large and well-established customers I'll get back to you on the rest, I think I can take that action item but I'm going to need to get oriented in some stuff first to make sure I am filling a need that actually exists and not duplicating anyone else's work

❤️ 2