From ff90cb596626601692927a76d86e31c9081e7977 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Nov 2026 13:59:39 -0500 Subject: [PATCH] mail: stop treating member email domains as local; pin DMS 15.1.0 The LDAP domain filter matched every entry with a mail attribute, so membership accounts with external addresses (e.g. @gmail.com) made those domains local and outbound mail to them bounced with 550 5.1.1. Restrict the filter to the Postfix Users group, like the user filter. Pin docker-mailserver to 15.1.0: v17 renamed the LDAP_QUERY_FILTER_* variables and chowns /var/mail to 5000:5000 at startup, which breaks this LDAP uid-per-mailbox setup. Co-Authored-By: Claude Opus 5.5 --- tasks/mail.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tasks/mail.yaml b/tasks/mail.yaml index e5ed3a8..a3df119 100644 --- a/tasks/mail.yaml +++ b/tasks/mail.yaml @@ -142,7 +142,7 @@ spec: containers: - name: mail - image: mailserver/docker-mailserver + image: mailserver/docker-mailserver:15.1.0 # pinned: v17 renamed LDAP env vars and breaks this config securityContext: # `allowPrivilegeEscalation: true` is required to support SGID via the `postdrop` # executable in `/var/mail-state` for Postfix (maildrop + public dirs): @@ -212,7 +212,8 @@ - name: LDAP_BIND_PW value: "{{ openldap_readonly_password }}" - name: LDAP_QUERY_FILTER_DOMAIN - value: "(mail=*@%s)" + # Only mailbox users define local domains; member accounts carry external addresses (e.g. @gmail.com). + value: "(&(mail=*@%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))" - name: LDAP_QUERY_FILTER_USER value: "(&(mail=%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))" - name: LDAP_QUERY_FILTER_ALIAS