Unable to start Maddy without root

[darthdubu]

Hi I've been trying all day to get maddy working without root but i've had no luck. I'm trying to set it up on a fresh debian bullseye vps. I'm using the latest maddy binaries and created the maddy user as specified in the tutorial. No matter what I do even if I chmod 777 the directories maddy needs access to it returns the following. I'm only able to successfully start and use maddy with "sudo maddy" or "maddy" logged in under the root user. I cannot start it with systemd. Even changing the systemd files user to root does not allow it to start.

aoba@ichiko:~$ maddy
open /var/lib/maddy/writeable-test: permission denied

Configuration file

## Maddy Mail Server - default configuration file (2021-03-07)
# Suitable for small-scale deployments. Uses its own format for local users DB,
# should be managed via maddyctl utility.
#
# See tutorials at https://maddy.email for guidance on typical
# configuration changes.
#
# See manual pages (also available at https://maddy.email) for reference
# documentation.

# ----------------------------------------------------------------------------
# Base variables

$(hostname) = m1.example.org
$(primary_domain) = example.org
$(local_domains) = $(primary_domain) cooldomain.pm cooldomain2.casa

#log _file path_ /var/log/maddy.log

tls file /etc/maddy/certs/$(hostname)/fullchain.pem /etc/maddy/certs/$(hostname)/privkey.pem

# ----------------------------------------------------------------------------
# Local storage & authentication

# pass_table provides local hashed passwords storage for authentication of
# users. It can be configured to use any "table" module, in default
# configuration a table in SQLite DB is used.
# Table can be replaced to use e.g. a file for passwords. Or pass_table module
# can be replaced altogether to use some external source of credentials (e.g.
# PAM, /etc/shadow file).
#
# If table module supports it (sql_table does) - credentials can be managed
# using 'maddyctl creds' command.

auth.pass_table local_authdb {
    table sql_table {
        driver sqlite3
        dsn credentials.db
        table_name passwords
    }
}

# imapsql module stores all indexes and metadata necessary for IMAP using a
# relational database. It is used by IMAP endpoint for mailbox access and
# also by SMTP & Submission endpoints for delivery of local messages.
#
# IMAP accounts, mailboxes and all message metadata can be inspected using
# imap-* subcommands of maddyctl utility.

storage.imapsql local_mailboxes {
    driver sqlite3
    dsn imapsql.db
}

# ----------------------------------------------------------------------------
# SMTP endpoints + message routing

hostname $(hostname)

table.chain local_rewrites {
    optional_step regexp "(.+)\+(.+)@(.+)" "$1@$3"
    optional_step file /etc/maddy/aliases
}

msgpipeline local_routing {
    # Insert handling for special-purpose local domains here.
    # e.g.
    # destination lists.example.org {
    #     deliver_to lmtp tcp://127.0.0.1:8024
    # }

    destination postmaster $(local_domains) {
        modify {
            replace_rcpt &local_rewrites
        }

        deliver_to &local_mailboxes
    }

    default_destination {
        reject 550 5.1.1 "User doesn't exist"
    }
}

smtp tcp://0.0.0.0:25 {
    limits {
        # Up to 20 msgs/sec across max. 10 SMTP connections.
        all rate 20 1s
        all concurrency 10
    }

    dmarc yes
    check {
        require_mx_record
        dkim
        spf
    }

    source $(local_domains) {
        reject 501 5.1.8 "Use Submission for outgoing SMTP"
    }
    default_source {
        destination postmaster $(local_domains) {
            deliver_to &local_routing
        }
        default_destination {
            reject 550 5.1.1 "User doesn't exist"
        }
    }
}

submission tls://0.0.0.0:465 tcp://0.0.0.0:587 {
    limits {
        # Up to 50 msgs/sec across any amount of SMTP connections.
        all rate 50 1s
    }

    auth &local_authdb

    source $(local_domains) {
        check {
            authorize_sender {
                prepare_email &local_rewrites
                user_to_email identity
            }
        }

        destination postmaster $(local_domains) {
            deliver_to &local_routing
        }
        default_destination {
            modify {
                dkim $(primary_domain) $(local_domains) default
            }
            deliver_to &remote_queue
        }
    }
    default_source {
        reject 501 5.1.8 "Non-local sender domain"
    }
}

target.remote outbound_delivery {
    limits {
        # Up to 20 msgs/sec across max. 10 SMTP connections
        # for each recipient domain.
        destination rate 20 1s
        destination concurrency 10
    }
    mx_auth {
        dane
        mtasts {
            cache fs
            fs_dir mtasts_cache/
        }
        local_policy {
            min_tls_level encrypted
            min_mx_level none
        }
    }
}

target.queue remote_queue {
    target &outbound_delivery

    autogenerated_msg_domain $(primary_domain)
    bounce {
        destination postmaster $(local_domains) {
            deliver_to &local_routing
        }
        default_destination {
            reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
        }
    }
}

# ----------------------------------------------------------------------------
# IMAP endpoints

imap tls://0.0.0.0:993 tcp://0.0.0.0:143 {
    auth &local_authdb
    storage &local_mailboxes
}

[darthdubu]

Want to mention that its fully setup and functioning(SPF, DKIM, DMARC, DNSSEC, DANE, MTA-STS) otherwise once I sudo it. I've sent and received emails and even imported 6000 emails into it and score a 10/10 on mail-tester. The only problem is running it with systemd.

[darthdubu]

Just going to run it in docker instead. It works correctly there.

[zhangkaizhao]

Hello. I had maddy running without systemd a few days ago in my Gentoo Linux box. I fellow the instructions in https://maddy.email/tutorials/setting-up/ and at last I got a working OpenRC service script like this:

#!/sbin/openrc-run

depend() {
    after net
}

description="maddy mail server"
command="/usr/local/bin/maddy"
command_args="-config /etc/maddy/maddy.conf"
command_user="maddy:maddy"
# https://wiki.gentoo.org/wiki/OpenRC/supervise-daemon
supervisor="supervise-daemon"
supervise_daemon_args="-d /var/lib/maddy"

start_pre() {
    # default runtime_dir. see `man 5 maddy`
    install -d -o maddy -g maddy /run/maddy
}

Hope it can help people who want to run maddy without systemd specially on Gentoo Linux.

Note there is an extra instruction for non-root process maddy to bind priviledged ports:

sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/maddy

which has the same effect as the configuration CapabilityBoundingSet=CAP_NET_BIND_SERVICE in systemd.

[foxcpp]

@Ducky710 it might do something to do with pedantic sandboxing configuration applied in the systemd unit. Could you check if there are any errors related to unit file parsing in the journal (should appear after systemctl daemon-reload)?