Skip to content

Mail Platform

Self-hosted mail on the cluster: docker-mailserver (Postfix + Dovecot + rspamd) in the mail namespace, LoadBalancer 192.168.1.48, fronted at the edge like every other public service, plus Roundcube webmail (webmail.mdapi.ch) for browser-based access.

flowchart LR
    inet["Internet"] -->|"25/465/587\n143/993"| edge["BPI-R4 edge\n(v4 DNAT · v6 NAT64)\n+ haproxy PROXY paths"]
    edge --> dms["docker-mailserver\nPostfix · Dovecot · rspamd"]
    dms --> ldap["OpenLDAP\naccounts + aliases"]
    autoconfig["autoconfig service\nThunderbird/Outlook\nautodiscovery"] -.-> clients["Mail clients"]
    dms --> clients
    webmail["Roundcube\nwebmail.mdapi.ch"] --> dms
    clients -.-> webmail

Shape

  • Postfix for SMTP (25 inbound, 465/587 submission), Dovecot for IMAP (143/993) and Sieve (4190), rspamd for filtering — one hardened container, configuration in git like everything else.
  • Roundcube provides a browser-based webmail UI at webmail.mdapi.ch, talking IMAP/SMTP to docker-mailserver like any other mail client — no desktop client required.
  • Accounts and aliases resolve against OpenLDAP — the same identity plane the rest of the estate uses (Authentication & Identity).
  • A parallel set of PROXY-protocol listeners exists for the haproxy-fronted edge path, so the mail stack sees real client addresses on proxied connections — the same client-address-preservation principle used for public DNS.
  • An autoconfig/autodiscover service serves Thunderbird- and Outlook-style client provisioning XML, so adding an account needs only the address and password.

Deliverability

Running a mail server is mostly running its reputation:

  • SPF, DKIM and DMARC on every outbound domain; PTR alignment on the egress address.
  • Outbound reputation is monitored, not assumed — a scheduled probe (f/probe/snds_outlook_audit) checks Microsoft SNDS every 6h, alerting on any reputation deterioration.
  • rspamd's signals feed the same severity-tiered notification policy as the rest of the platform.

Provisioned addresses

Mailboxes and aliases are not hand-edited: the members portal provisions them through Windmill flows (LDAP entry + mailbox + autoconfig in one transaction), which is also how project-specific address systems (e.g. the En Vuassu resident mail flows) create addresses with approval steps.