Postern

[!WARNING] Alpha warning: This software is in an experimental state. Do not use in production or for any important emails while we work towards v1.0.

Postern is a modern all-in-one mail delivery agent. It combines IMAP (IMAP4rev2), SMTP Submission and SMTP delivery.

We have EU Sovereignity at our core values. We welcome users and contributions from around the world and will keep service providers such as server hosting and DNS registrars EU based.

Overview

What makes Postern special is its policy engine. Imagine it as a modern Sieve based on Starlark, which uses Python syntax. The policy.star file has an example how new senders end up in a “Gatekeeper” mailbox. Simply moving a message from one folder to another updates how the policy engine reacts to this sender for future messages.

Reacting on side effects such as database state or network calls is probably the biggest advantage of the policy engine over Sieve when it comes to modern email management.

Postern has secure defaults, stores emails encrypted at rest and runs as a single binary with an SQLite backend.

You can subscribe to announcements by sending an email to postern+subscribe@lists.p25.dev. The mailing list server runs on Postern and mlmmj.

Architecture

Postern was developed for easy email self-hosting while not fighting email deliverability or a multitude of DNS records.

Postern is designed to sit behind an email relay and MX backup like p25.dev. With just 3 DNS records (DKIM, MX and domain verification) you are ready for sending and receiving emails. Postern can run behind other services such as Postfix too, as it is fully standards compliant. The main use case will be the operation behind p25.dev though just for its simplicity and to support more inexperienced admins in self-hosting email.

Your emails are stored encrypted in Data At Rest Encryption (DARE) format. Note that the SQLite database stores email metadata such as To and From addresses and Subjects in plain text to support fast IMAP search requests.

All networking is secure by default. IMAP and SMTP Submission run on implicit TLS. SMTP Delivery requires STARTTLS and authentication. Passwords are generated by Postern to avoid weak choices.

DKIM key management is designed for easy key rotation.

Quickstart

Postern is in alpha state. You might experience some trial and error to arrive at a working solution. This quickstart tutorial assumes you work on a modern Linux installation. Because you read this Readme, it looks like you have access to the rest of the source code and can compile it with go build -o postern ..

Install the postern.service file under /etc/systemd/system/postern.service.
Place policy.star under /etc/postern/policy.star and adjust to your requirements.
For secure storage of the masterkey, run systemd-ask-password -n | systemd-creds encrypt - /etc/credstore/masterkey
Retrieve a TLS certificate, for example with acme.sh. Make sure the systemd service can access the certificates (/etc/postern/).
Enable and start Postern systemctl enable postern and systemctl start postern
Use the Postern CLI to add configuration. Based on the systemd integration, this is admittedly clunky and will be improved soon.

# The masterkey file is only decrypted with a running postern service and only accessible by root.
# (this needs to be changed soon)
CONFIGURATION_DIRECTORY=/etc/postern POSTERN_PERSISTENCE_DIR=/var/lib/postern POSTERN_MASTERKEY_FILE=/run/credentials/postern.service/masterkey /usr/local/bin/postern

You will need to create a user, a backup-mx user for email delivery and a DKIM key.

postern user add testuser
postern user add-address testuser user@example.com
postern backup-mx add p25dev
postern dkim add selector example.com # Don't forget to enable the key with 'dkim enable selector example.com'

If you want a smooth start for sending and receiving emails, make an account at p25.dev to integrate Postern with it.

Contributing via Mailing List

We manage development via plain-text email patches rather than web-based pull requests.

Mailing list: postern-dev@lists.p25.dev (subscribe with an email to postern-dev+subscribe@lists.p25.dev)

Use git send-email to contribute your patch. For a tutorial see https://git-send-email.io. It is okay to use the mailing list as a chat rather than a formalized procedure. Just say ‘hi’!

[!TIP] You can integrate git send-email with Postern too!

Security

Please do not disclose security vulnerabilities via the public mailing list. Instead, use https://p25.dev/.well-known/security.txt