v12.0.0

[georglauterbach]

Please refer to the CHANGELOG to get the complete and comprehensive overview of this release.

Summary

v12.0.0 is our biggest release yet, with over 100 merged pull requests and closed issues, this release packs a ton of changes & updates. Make sure to thoroughly read the CHANGELOG! We will list the most notable changes now.

Rspamd Support

v12.0.0 is the first release to feature Rspamd. Support for this feature is expected to stabilize with v12.1.0 - we encourage all users to give it a try though, as we feel like support is mature enough to run it on production systems. There will be a dedicated page in our documentation about Rspamd!

We plan on making Rspamd the default anti-spam engine in DMS. For the time being, Rspamd is an opt-in and you'll most likely want to disable Amavis & SA when using Rspamd.

Dropping ARMv7

Support for the already deprecated ARMv7 platform was dropped.

Disabling chroot

We do not use chroot environments anymore. These environments caused trouble in the past and did not bring an advantage.

Bumping the Minimum TLS Version & Disabling SMTP Authentication on Port 25

The minimum supported protocol is now TLSv1.2. Moreover, we disabled SMTP authentication on the unencrypted port 25.

Fail2Ban Major Version Bump

We now ship Fail2Ban version 1.0.2, which is one major version ahead of DMS v11.3.1 and the latest version for Debian 11.

Heavily Updated Unit & Integration Tests

While you may not notice this in the final image, we are working hard behind the scenes to further improve our CI. With v12.0.0, almost all of our tests have been migrated to a new format in which tests can now run in parallel, decreasing the time it takes to test new changes. The code quality was also improved, a ton of comments were added to the helper code and many new helpers now assist in tests.

Miscellaneous

• ping & dig are now shipped with the image
• many minor bugfixes
• added vulnerability scanning workflow to GH Actions
• better default for SA_KILL
• added check for improper restarts so users directly see when they did a not-supported restart
• the Dovecot community repository is now the default
• removed DNSBLs from Postfix's recipient checks
• removed all wrapper scripts, cleaning up the code

Merged Pull Requests

[Excluding PRs by @dependabot & @github-actions.]

• chore: Update changelog and version by @casperklein in chore: Update changelog and version #2944
• ci: Drop support for ARM v7 platform by @polarathene in ci: Drop support for ARM v7 platform #2943
• chore: Remove legacy ENV SASL_PASSWD by @polarathene in chore: Remove legacy ENV SASL_PASSWD #2946
• fix(changedetector): Use service reload commands instead of supervisorctl restart <service> by @polarathene in fix(changedetector): Use service reload commands instead of supervisorctl restart <service> #2947
• chore: Drop support for deprecated TLS versions by @polarathene in chore: Drop support for deprecated TLS versions #2945
• docs(fix): README - Update CI status badge URL by @polarathene in docs(fix): README - Update CI status badge URL #2951
• fix: Ensure relay host properly handles credentials check by @reneploetz in fix: Ensure relay host properly handles credentials check #2965
• update: make the Dovecot community repository the default by @georglauterbach in update: make the Dovecot community repository the default #2901
• tests(fix): wait_until_change_detection_event_completes to count by @polarathene in tests(fix): wait_until_change_detection_event_completes to count #2974
• tests: Use mail.example.test as common container hostname by @polarathene in tests: Use mail.example.test as common container hostname #2975
• update: bump Fail2Ban version to v1.0.2 by @georglauterbach in update: bump Fail2Ban version to v1.0.2 #2959
• fix: regex in quota activation code by @Marsu31 in fix: regex in quota activation code #2958
• feature: provide initial Rspamd support by @georglauterbach in feature: provide initial Rspamd support #2902
• ci: more parallel tests by @georglauterbach in ci: more parallel tests #2938
• Add docker-data/ to .gitignore by @casperklein in Add docker-data/ to .gitignore #2982
• tests: Extract some test cases out from tests.bats by @polarathene in tests: Extract some test cases out from tests.bats #2980
• docs: Provision a cert with the ACME DNS-01 challenge via Certbot + Cloudflare by @ShiriNmi1520 in docs: Provision a cert with the ACME DNS-01 challenge via Certbot + Cloudflare #2968
• chore(housekeeping): Cleaning up broken links by @polarathene in chore(housekeeping): Cleaning up broken links #2667
• update BATS & helper + minor updates to BATS variables by @georglauterbach in update BATS & helper + minor updates to BATS variables #2988
• Add tools (ping & dig) to the image by @casperklein in Add tools (ping & dig) to the image #2989
• Fix several typos by @casperklein in Fix several typos #2990
• Fix several typos by @casperklein in Fix several typos #2993
• docs: FAQ - Add note for devnull alias gotcha when using a catchall rule by @worldworm in docs: FAQ - Add note for devnull alias gotcha when using a catchall rule #2949
• tests(refactor): Adjust mail_tls_dhparams.bats by @polarathene in tests(refactor): Adjust mail_tls_dhparams.bats #2994
• fix: Workaround postconf write settling logic by @polarathene in fix: Workaround postconf write settling logic #2998
• chore: Remove the Makefile backup target by @polarathene in chore: Remove the Makefile backup target #3000
• tests(refactor): mail_lmtp_ip.bats by @polarathene in tests(refactor): mail_lmtp_ip.bats #3004
• Fix SRS link in README.md by @Jeidnx in Fix SRS link in README.md #3005
• tests(refactor): Adjust mail_changedetector + change detection helpers by @polarathene in tests(refactor): Adjust mail_changedetector + change detection helpers #2997
• tests(refactor): mail_fetchmail.bats + co-locate test cases for processes by @polarathene in tests(refactor): mail_fetchmail.bats + co-locate test cases for processes #3010
• tests(refactor): Improve consistency and documentation for test helpers by @georglauterbach in tests(refactor): Improve consistency and documentation for test helpers #3012
• chore(Makefile): Ensure targets are always run by @polarathene in chore(Makefile): Ensure targets are always run #3013
• tests(refactor): Migrate mail_privacy.bats to new format and helpers by @polarathene in tests(refactor): Migrate mail_privacy.bats to new format and helpers #3014
• docs: clarification of description of explicit TLS by @i-C-o-d-e-r in docs: clarification of description of explicit TLS #3017
• tests: refactor 4 more tests by @georglauterbach in tests: refactor 4 more tests #3018
• docs: add a dedicated page for tests with more information by @georglauterbach in docs: add a dedicated page for tests with more information #3019
• fix: Ensure state persisted to /var/mail-state retains correct group by @polarathene in fix: Ensure state persisted to /var/mail-state retains correct group #3011
• quality-of-life: improve the clean recipe (don't require sudo anymore) by @georglauterbach in quality-of-life: improve the clean recipe (don't require sudo anymore) #3020
• feature: provide better rspamd suppport by @georglauterbach in feature: provide better rspamd suppport #3016
• ci: update & streamline GH Actions runner images by @georglauterbach in ci: update & streamline GH Actions runner images #3025
• tests(refactor): Amavis spam_junk_folder.bats + spam_bounced.bats by @polarathene in tests(refactor): Amavis spam_junk_folder.bats + spam_bounced.bats #3036
• tests(refactor): mail_hostname.bats by @polarathene in tests(refactor): mail_hostname.bats #3027
• chore: Remove wrapper script for fail2ban service by @polarathene in chore: Remove wrapper script for fail2ban service #3032
• chore: Remove package gamin by @polarathene in chore: Remove package gamin #3030
• tests: tls_cipherlists should configure testssl.sh to use CA cert by @polarathene in tests: tls_cipherlists should configure testssl.sh to use CA cert #3037
• test helpers: add functionality for sending emails by @georglauterbach in test helpers: add functionality for sending emails #3026
• chore: Remove the wrapper script for Postfix (and disable chroot in master.cf) by @polarathene in chore: Remove the wrapper script for Postfix (and disable chroot in master.cf) #3033
• rspamd: follow-up of feature: provide better rspamd suppport #3016 by @georglauterbach in rspamd: follow-up of #3016 #3039
• postfix header filter: correct the casing for Mime vs. MIME by @georglauterbach in postfix header filter: correct the casing for Mime vs. MIME #3040
• ci: move tests than can be run in parallel now by @georglauterbach in ci: move tests than can be run in parallel now #3038
• Linting: bump shellcheck version to 0.9.0 by @casperklein in Linting: bump shellcheck version to 0.9.0 #3041
• tests: Reduce time taken by a third for testing cipher suites by @polarathene in tests: Reduce time taken by a third for testing cipher suites #3050
• tests: Migrate Dovecot DBox tests (sdbox + mdbox) by @polarathene in tests: Migrate Dovecot DBox tests (sdbox + mdbox) #3051
• tests: Migrate and combine ENV tests for *_INET_PROTOCOLS by @polarathene in tests: Migrate and combine ENV tests for *_INET_PROTOCOLS #3052
• chore(Amavis): only add configuration to Postfix when enabled by @georglauterbach in chore(Amavis): only add configuration to Postfix when enabled #3046
• tests(refactor): Extract mail account management tests from tests.bats by @polarathene in tests(refactor): Extract mail account management tests from tests.bats #3055
• fix: Only listen on 127.0.0.1 for the Dovecot quota-status service by @yogo1212 in fix: Only listen on 127.0.0.1 for the Dovecot quota-status service #3057
• removal: configomat (submodule) by @georglauterbach in removal: configomat (submodule) #3045
• ci: remove CI ENV & disable fail-fast by @georglauterbach in ci: remove CI ENV & disable fail-fast #3065
• tests: refactor POP3, IMAP (actually SASLauthd + RIMAP) & relay by @georglauterbach in tests: refactor POP3, IMAP (actually SASLauthd + RIMAP) & relay #3062
• Better default value for SA_KILL variable by @casperklein in Better default value for SA_KILL variable #3058
• ci(fix): Switch test workflows to also use the buildx docker-container driver by @polarathene in ci(fix): Switch test workflows to also use the buildx docker-container driver #3072
• tests(refactor): open_dkim.bats by @polarathene in tests(refactor): open_dkim.bats #3060
• Fix: Make logrotate state persistant by @casperklein in Fix: Make logrotate state persistant #3077
• improve bug report template by @georglauterbach in improve bug report template #3080
• chore(Postfix): disable DNSBLs by @georglauterbach in chore(Postfix): disable DNSBLs #3069
• fix: order of DKIM/DMARC milters matters by @casperklein in fix: order of DKIM/DMARC milters matters #3082
• chore: Remove delay starting the change detection service by @polarathene in chore: Remove delay starting the change detection service #3064
• fix: add information to Logwatch's mailer so Envelope From is properly set by @georglauterbach in fix: add information to Logwatch's mailer so Envelope From is properly set #3081
• fix: restrict-access avoid inserting duplicates by @georglauterbach in fix: restrict-access avoid inserting duplicates #3067
• setup: improve Amavis setup routine by @georglauterbach in setup: improve Amavis setup routine #3079
• rspamd: add feature for adjusting options with a file parsed by DMS by @georglauterbach in rspamd: add feature for adjusting options with a file parsed by DMS #3059
• completely refactor README & parts of docs by @georglauterbach in completely refactor README & parts of docs #3097
• ci: refactored sedfile & used _send_mail where possible by @georglauterbach in ci: refactored sedfile & used _send_mail where possible #3103
• docs: add docs about Abusix integration into Rspamd by @georglauterbach in docs: add docs about Abusix integration into Rspamd #3104
• ci/docs: add vulnerability scanning workflow & security policy by @georglauterbach in ci/docs: add vulnerability scanning workflow & security policy #3106
• config: disable SMTP authentication on port 25 by @mazzz1y in config: disable SMTP authentication on port 25 #3006
• tests: improve _send_email by @georglauterbach in tests: improve _send_email #3105
• fix: Postfix service should proxy signals received by @polarathene in fix: Postfix service should proxy signals received #3118
• scripts: split setup-stack.sh by @georglauterbach in scripts: split setup-stack.sh #3115
• scripts: housekeeping & cleanup setup (1/2) by @georglauterbach in scripts: housekeeping & cleanup setup (1/2) #3121
• scripts: follow up of scripts: split setup-stack.sh #3115 (feedback) by @georglauterbach in scripts: follow up of #3115 (feedback) #3124
• scripts: housekeeping & cleanup setup (2/2) by @georglauterbach in scripts: housekeeping & cleanup setup (2/2) #3123
• scripts/ENV: make disabling Redis possible by @georglauterbach in scripts/ENV: make disabling Redis possible #3132
• scripts: issue warning in case of improper restart by @georglauterbach in scripts: issue warning in case of improper restart #3129
• scripts: remove PostSRSD wrapper by @georglauterbach in scripts: remove PostSRSD wrapper #3128
• ci(fix): Only apply permissions at the job level by @polarathene in ci(fix): Only apply permissions at the job level #3142
• config/ENV: improve Postfix config for spoof protection by @georglauterbach in config/ENV: improve Postfix config for spoof protection #3127
• fix: Avoid creating an unnecessary syslog socket for Postfix by @polarathene in fix: Avoid creating an unnecessary syslog socket for Postfix #3134
• config: ensure SASL socket file is not inside a volume mount by @georglauterbach in config: ensure SASL socket file is not inside a volume mount #3131
• rspamd: rename ENABLE_REDIS & add persistence for Redis by @georglauterbach in rspamd: rename ENABLE_REDIS & add persistence for Redis #3143
• scripts: touchups for v12.0.0 by @georglauterbach in scripts: touchups for v12.0.0 #3144
• docs: improve Rspamd docs by @georglauterbach in docs: improve Rspamd docs #3147
• bugfix: special bits for maildrop and public directory by @georglauterbach in bugfix: special bits for maildrop and public directory #3149
• DRY: Replace path with variable in mail_state.sh by @casperklein in DRY: Replace path with variable in mail_state.sh #3153
• fix: regression introduced in DRY: Replace path with variable in mail_state.sh #3153 by @georglauterbach in fix: regression introduced in #3153 #3157
• scripts: improve panic helpers by @georglauterbach in scripts: improve panic helpers #3155
• fix: TLS setup (self-signed) error message should include SS_CA_CERT by @jrpear in fix: TLS setup (self-signed) error message should include SS_CA_CERT #3168
• fix: SRS setup by @casperklein in fix: SRS setup #3158
• doc: a ip -> an ip by @linhandev in doc: a ip -> an ip #3175
• fix: postsrsd restart loop by @casperklein in fix: postsrsd restart loop #3160
• Rspamd: more features by @georglauterbach in Rspamd: more features #3159
• ci(docs): Update latest symlink via docs-production-deploy workflow by @jrpear in ci(docs): Update latest symlink via docs-production-deploy workflow #3183
• docs: Add FAQ entry for troubleshooting delivery by @jrpear in docs: Add FAQ entry for troubleshooting delivery #3192
• docs: move make build instruction from paragraph into list by @jrpear in docs: move make build instruction from paragraph into list #3193
• docs: Change edge version links to latest + fix links intended as relative not absolute by @jrpear in docs: Change edge version links to latest + fix links intended as relative not absolute #3190
• Fix: only chmod when there are files by @casperklein in Fix: only chmod when there are files #3203
• Update SA_KILL values; follow up to Better default value for SA_KILL variable #3058 by @casperklein in Update SA_KILL values; follow up to #3058 #3204
• config: remove chroot for Dovecot & PostSRSd by @georglauterbach in config: remove chroot for Dovecot & PostSRSd #3208

New Contributors

• @reneploetz made their first contribution in fix: Ensure relay host properly handles credentials check #2965
• @Marsu31 made their first contribution in fix: regex in quota activation code #2958
• @ShiriNmi1520 made their first contribution in docs: Provision a cert with the ACME DNS-01 challenge via Certbot + Cloudflare #2968
• @worldworm made their first contribution in docs: FAQ - Add note for devnull alias gotcha when using a catchall rule #2949
• @Jeidnx made their first contribution in Fix SRS link in README.md #3005
• @i-C-o-d-e-r made their first contribution in docs: clarification of description of explicit TLS #3017
• @mazzz1y made their first contribution in config: disable SMTP authentication on port 25 #3006
• @linhandev made their first contribution in doc: a ip -> an ip #3175

Full Changelog: v11.3.1...v12.0.0

---

This discussion was created from the release v12.0.0.

[tomav]

Congrats for this major milestone, big shout out to all contributors, and to you @georglauterbach for successfully taking this project over and making it what it is today! 👏