Skip to main content
emisar

Postfix mail server

v0.1.19

Queue inspection, config dump, log tailing, plus narrow operator actions (flush, requeue, delete-by-queue-id). These mutators are high- or critical-risk; the reversible hold/release pause is medium. All are audited. Queue inspection and mutation run as root because the runner's no-new-privileges boundary prevents Postfix helpers from elevating.

8 allowed by default 5 need approval by default 1 denied by default
Pack ID
postfix
Vendor
emisar
OS
linux
Actions
14
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
mailq postcat postconf postfix postqueue postsuper qshape

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install postfix --hash sha256:afcf06f6d828162f81b092a5332a1c8f2f292808642d4acf30fb3af15748ac33

Setup

Operates on the local Postfix instance on the runner host — no credentials needed. Uses the standard binaries (postqueue, postconf, mailq, postsuper) and reads the queue under /var/spool/postfix .

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Read protected queue files and mail logs, or validate and mutate Postfix state, as root.

postfix.mailqpostfix.qshapepostfix.queue_countspostfix.postcat_qidpostfix.flush_queuepostfix.delete_qidpostfix.check_configpostfix.reloadpostfix.postsuper_holdpostfix.postsuper_releasepostfix.postsuper_requeue

Run the Emisar service as root

Grant access 
sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-postfix-root.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar
Verify access 
test "$(systemctl show emisar --property=User --value)" = root

Impact: Every Emisar action on this runner executes as root. Postfix actions can remove, inspect, flush, requeue, hold, or release messages and reload the mail service.

Read Postfix logs through the Debian or Ubuntu system log-reader group.

postfix.maillog_tailpostfix.maillog_grep

Add the default Emisar service user to adm

Grant access 
sudo usermod -aG adm emisar
sudo systemctl restart emisar
Verify access 
id -nG emisar | tr ' ' '\n' | grep -Fx adm
sudo -u emisar test -r /var/log/mail.log

Impact: Every process running as emisar can read every host log granted to adm, not only Postfix logs. RHEL-family paths need an equivalent persistent log-reader grant.

Notes

  • maillog actions read /var/log/mail.log , falling back to /var/log/maillog (RHEL-family).

Verify it works

Runs postfix.mailq, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify postfix

Install and configure a pack walks through the whole sequence on a host.

Actions 14 total

View on GitHub
  • postfix.check_config exec low Low — read-only or trivially reversible

    postfix check

    Validate Postfix configuration files.

    View source on GitHub
  • postfix.delete_qid exec critical Critical — data loss or irreversible

    postsuper -d <queue-id>

    Delete one queued message. Permanent — message is lost.

    View source on GitHub
  • postfix.flush_queue exec high High — service-affecting

    postqueue -f (retry all deferred)

    Force retry of every deferred message. Can cause a thundering-herd toward downstream SMTP.

    View source on GitHub
  • postfix.maillog_grep exec medium Medium — changes state, easily reversible

    grep mail.log for queue-id / address

    List all mail-log entries matching a string.

    View source on GitHub
  • postfix.maillog_tail exec medium Medium — changes state, easily reversible

    tail mail.log

    Tail the last N lines of the mail log.

    View source on GitHub
  • postfix.mailq exec low Low — read-only or trivially reversible

    mailq (current queue)

    Show the Postfix mail queue — pending, deferred, hold counts.

    View source on GitHub
  • postfix.postcat_qid exec high High — service-affecting

    postcat -q <queue-id>

    Decode one queued message — headers + body. Message content is inherently sensitive (user PII, and bodies routinely carry password resets, tokens, and other credentials). The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret whose name and value match no rule.

    View source on GitHub
  • postfix.postconf exec high High — service-affecting

    postconf -n

    Show non-default Postfix config (`postconf -n`). A full parameter dump: `smtp_sasl_password_maps`-style parameters can inline `static:` credentials, so this can surface secrets. The runner's redaction is a pattern-bound backstop, not a guarantee.

    View source on GitHub
  • postfix.postsuper_hold exec medium Medium — changes state, easily reversible

    postsuper -h <qid>

    Move one message into the hold queue. The message is not delivered until released with postsuper_release. Used when a message needs to be inspected without redelivering on every queue tick.

    View source on GitHub
  • postfix.postsuper_release exec medium Medium — changes state, easily reversible

    postsuper -H <qid>

    Release one held message back to active. Postfix will attempt delivery on the next queue scan.

    View source on GitHub
  • postfix.postsuper_requeue exec high High — service-affecting

    postsuper -r <qid|ALL>

    Re-queue one message (or ALL deferred). The message is re-classified from the deferred queue back to active, retrying delivery.

    View source on GitHub
  • postfix.qshape exec low Low — read-only or trivially reversible

    qshape (queue by domain x age)

    Show bucketed queue counts by destination + age.

    View source on GitHub
  • postfix.queue_counts exec low Low — read-only or trivially reversible

    Per-queue message counts

    Count messages in incoming/active/deferred/hold queues.

    View source on GitHub
  • postfix.reload exec high High — service-affecting

    postfix reload

    Tell Postfix to re-read main.cf and master.cf. Existing deliveries finish on the old config; new ones use the new. No downtime.

    View source on GitHub
← Back to registry
Pack reference  Publish your own