Haraka VS pfelk

postale.io has an MX record that points to mail.postale.io, which resolves to an AWS IP address (probably an EC2 instance) and has Haraka listening on port 25 (if its SMTP banner can be believed)

I found that Zerodha uses Haraka and Karan–their DevOps guy, mentioned it is easy-setup and performant.

The next time this happens i'll move to a self hosted solution, like haraka or anonaddy

Haraka Like: Simple to hook into the processing pipeline Dislike: Node.js and had some issues with stability when I last tried it

Having another SMTP as a choice is cool but not as fun as something that is way more configurable (ex. Haraka), or API driven (a la Postal).

Look at Haraka: http://haraka.github.io/

For the record, I'm using dovecot (https://www.dovecot.org/) for IMAP and Haraka (https://haraka.github.io/) for SMTP.

I run my own mail servers for small projects, though for my main email I've actually switched to ProtonMail.

It's never been easier to self host your email with projects like the following around:

- https://foxcpp.dev/maddy/

- https://github.com/albertito/chasquid

- https://github.com/haraka/haraka

Of course the usual dovecot + postfix setup is great for learning even if a bit complicated.

Haraka (https://haraka.github.io/) is a plugin-based mailserver written in JavaScript. I've messed with postfix before but found Haraka easier because instead of arcane configuration files I can just read, copy, and tweak a plugin to suit my needs. Policies for receiving, storing, forwarding, and ignoring mail can be arbitrarily complex.

I understood that OPNsense runs fine with 8GB RAM and a relatively weak CPU, but then I saw this, which provides extended search and visualisation features to help you use the data created by OPNsense, and it recommends 32GB. pfelk/pfelk: pfSense/OPNsense + Elastic Stack (github.com)

I've carefully followed the manual Ubuntu setup of pfelk from https://github.com/pfelk/pfelk/tree/main, the instructions are pretty good. I did everything manually except for the dashboards, used the handy script. I've also configured syslog to remote log everything to it, plus unbound data.

I've been using pfElk. You could probably use some of the parsers from there to parse things yourself in Splunk.

On the left is a Kibana dashboard, showing information from the firewall (blocks/passes, connection type, etc). I use pfelk and customised the dashboard and the indexing a bit to suit my needs.

> So many chinese and russians IPs...

And Korean, and Dutch, I recall significant from Central America.

For anyone interested in what Geo's appear to be attacking you, and is a noob like me: https://github.com/pfelk/pfelk is really cool.