Replace postfix + postfix_milters with unified container

[nesono]

Summary

• Migrate from two-container setup (postfix 2026-02-16.1 + postfix-milters 2023-01-22.1) to single unified container (postfix_for_postfixadmin 2026-04-04.1)
• Remove postfix_milters and postfix_staging services
• Add milter env vars, opendkim_key secret, and spamass_vhome volume to postfix service
• Net result: -73 lines, +9 lines

Behavior changes

• POSTGREY_SOCKET_PATH and SPAMASS_SOCKET_PATH are now set on the postfix container, activating postgrey greylisting and spamassassin policy checks in smtpd_recipient_restrictions (these milters were running before but not wired into postfix)

Deployment

ansible-playbook -i production/hosts green_nesono.yml --tags hot_compose

The --remove-orphans in the compose task will automatically stop the old postfix_milters and postfix_staging containers.

Validated on staging

All checks passed on postfix_staging container on production server:

• 9/9 supervisor services RUNNING
• PostSRSd responding on ports 10001/10002
• Socket permissions: postfix:opendkim 775
• DKIM KeyTable/SigningTable generated for all 5 domains
• DMARC config patched correctly
• SMTP responding with STARTTLS
• Entrypoint idempotent on restart

Test plan

• Deploy via Ansible
• Verify all 9 services RUNNING: docker exec postfix supervisorctl status
• Verify SMTP on port 25: echo QUIT | nc localhost 25
• Send test email, verify DKIM signature in headers
• Monitor Grafana for delivery metrics
• Verify fail2ban still detects postfix auth failures

🤖 Generated with Claude Code