#!/bin/sh
set -eu

# Misc default variables.
: "${POSTFIX_SMTPD_BANNER:=\$myhostname ESMTP \$mail_name (\$mail_version)}"
: "${POSTFIX_BIFF:=no}"
: "${POSTFIX_MAILLOG_FILE:=/dev/stdout}"
: "${POSTFIX_DEBUG_PEER_LEVEL:=1}"
: "${POSTFIX_COMPATIBILITY_LEVEL:=3.6}"
: "${POSTFIX_APPEND_DOT_MYDOMAIN:=no}"
: "${POSTFIX_README_DIRECTORY:=no}"
: "${POSTFIX_MAILBOX_COMMAND:=procmail -a \"\$EXTENSION\"}"
: "${POSTFIX_MAILBOX_SIZE_LIMIT:=0}"
: "${POSTFIX_RECIPIENT_DELIMITER:=+}"

# Service default variables.
: "${POSTFIX_SUBMISSION_ENABLED:=yes}"
: "${POSTFIX_SMTP_ENABLED:=yes}"
: "${POSTFIX_SMTPS_ENABLED:=yes}"
: "${POSTFIX_SUBMISSION_TLS_SECURITY_LEVEL:=encrypt}"
: "${POSTFIX_SMTPS_TLS_WRAPPERMODE:=yes}"

# TLS default variables.
: "${POSTFIX_SMTPD_TLS_SECURITY_LEVEL:=may}"
: "${POSTFIX_SMTPD_TLS_AUTH_ONLY:=yes}"
: "${POSTFIX_SMTPD_TLS_CERT_FILE:=/etc/ssl/certs/ssl-cert-snakeoil.pem}"
: "${POSTFIX_SMTPD_TLS_KEY_FILE:=/etc/ssl/private/ssl-cert-snakeoil.key}"

: "${POSTFIX_SMTP_TLS_CAPATH:=/etc/ssl/certs}"
: "${POSTFIX_SMTP_TLS_SECURITY_LEVEL:=encrypt}"
: "${POSTFIX_SMTP_TLS_SESSION_CACHE_DATABASE:=btree:\$data_directory/smtp_scache}"

# Hostname default variables.
: "${POSTFIX_MYHOSTNAME:=$(hostname --fqdn 2>/dev/null || hostname)}"
: "${POSTFIX_MYDOMAIN:=${POSTFIX_MYHOSTNAME}}"

# Allowed networks default variables.
: "${POSTFIX_MYNETWORKS:=127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8}"

# Network configuration default variables.
: "${POSTFIX_INET_INTERFACES:=all}"
: "${POSTFIX_INET_PROTOCOLS:=all}"

# Restrictions default variables.
: "${POSTFIX_SMTPD_RELAY_RESTRICTIONS:=permit_mynetworks, defer_unauth_destination}"
: "${POSTFIX_SMTPD_RECIPIENT_RESTRICTIONS:=permit_mynetworks, reject_unauth_destination}"

# Other default variables.
: "${POSTFIX_RELAYHOST:=}"
: "${POSTFIX_MYDESTINATION:=\$myhostname, localhost.\$mydomain, localhost, \$mydomain}"
: "${POSTFIX_MILTER_PROTOCOL:=6}"
: "${POSTFIX_MILTER_DEFAULT_ACTION:=accept}"
: "${POSTFIX_RELAY_SMTP_HELO_TIMEOUT:=5}"
: "${POSTFIX_RELAY_SMTP_CONNECT_TIMEOUT:=5}"

# DKIM milters default variables.
: "${POSTFIX_SMTPD_MILTERS:=}"
: "${POSTFIX_NON_SMTPD_MILTERS:=}"

# Create necessary directories.
mkdir -p \
  /var/spool/postfix \
  /var/spool/postfix/pid \
  /var/spool/postfix/public \
  /var/spool/postfix/maildrop \
  /var/spool/postfix/etc \
  /var/lib/postfix \
  /var/mail \
  /etc/postfix

cat > /etc/postfix/master.cf <<'EOF'
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
# ==========================================================================

EOF

# SMTP configuration.
if [ "${POSTFIX_SMTP_ENABLED}" = "yes" ]; then
  cat >> /etc/postfix/master.cf <<'EOF'
smtp      inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtp

EOF
fi

# Submission configuration.
if [ "${POSTFIX_SUBMISSION_ENABLED}" = "yes" ]; then
  cat >> /etc/postfix/master.cf <<EOF
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=${POSTFIX_SUBMISSION_TLS_SECURITY_LEVEL}

EOF
fi

# SSL encrypted SMTP configuration.
if [ "${POSTFIX_SMTPS_ENABLED}" = "yes" ]; then
  cat >> /etc/postfix/master.cf <<EOF
smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=${POSTFIX_SMTPS_TLS_WRAPPERMODE}

EOF
fi

# Other internal services.
cat >> /etc/postfix/master.cf <<EOF
pickup    unix  n       -       y       60      1       pickup
cleanup   unix  n       -       y       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       y       1000?   1       tlsmgr
rewrite   unix  -       -       y       -       -       trivial-rewrite
bounce    unix  -       -       y       -       0       bounce
defer     unix  -       -       y       -       0       bounce
trace     unix  -       -       y       -       0       bounce
verify    unix  -       -       y       -       1       verify
flush     unix  n       -       y       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp
  -o smtp_helo_timeout=${POSTFIX_RELAY_SMTP_HELO_TIMEOUT} -o smtp_connect_timeout=${POSTFIX_RELAY_SMTP_CONNECT_TIMEOUT}
showq     unix  n       -       y       -       -       showq
error     unix  -       -       y       -       -       error
retry     unix  -       -       y       -       -       error
discard   unix  -       -       y       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       y       -       -       lmtp
anvil     unix  -       -       y       -       1       anvil
scache    unix  -       -       y       -       1       scache
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d \${recipient}
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a\$sender - \$nexthop!rmail (\$recipient)
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r \$nexthop (\$recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t\$nexthop -f\$sender \$recipient
scalemail-backend unix  -       n       n       -       2       pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store \${nexthop} \${user} \${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  \${nexthop} \${user}
postlog   unix-dgram n  -       n       -       1       postlogd
EOF

# Move resolv.conf to postfix spool in order to make postfix DNS lookups work.
cp /etc/resolv.conf /var/spool/postfix/etc/resolv.conf

# Fix permissions.
/usr/sbin/postfix set-permissions

# Ensure aliases database exists
if [ ! -f /etc/aliases ]; then
  touch /etc/aliases
fi

newaliases

# main.cf configuration.
postconf -e "biff = ${POSTFIX_BIFF}"
postconf -e "maillog_file = ${POSTFIX_MAILLOG_FILE}"
postconf -e "debug_peer_level = ${POSTFIX_DEBUG_PEER_LEVEL}"
postconf -e "compatibility_level = ${POSTFIX_COMPATIBILITY_LEVEL}"
postconf -e "append_dot_mydomain = ${POSTFIX_APPEND_DOT_MYDOMAIN}"
postconf -e "readme_directory = ${POSTFIX_README_DIRECTORY}"
postconf -e "mailbox_command = ${POSTFIX_MAILBOX_COMMAND}"
postconf -e "mailbox_size_limit = ${POSTFIX_MAILBOX_SIZE_LIMIT}"
postconf -e "recipient_delimiter = ${POSTFIX_RECIPIENT_DELIMITER}"

postconf -e "smtpd_banner = ${POSTFIX_SMTPD_BANNER}"

postconf -e "smtpd_relay_restrictions = ${POSTFIX_SMTPD_RELAY_RESTRICTIONS}"
postconf -e "smtpd_recipient_restrictions = ${POSTFIX_SMTPD_RECIPIENT_RESTRICTIONS}"

postconf -e "smtpd_tls_auth_only = ${POSTFIX_SMTPD_TLS_AUTH_ONLY}"
postconf -e "smtpd_tls_cert_file = ${POSTFIX_SMTPD_TLS_CERT_FILE}"
postconf -e "smtpd_tls_key_file = ${POSTFIX_SMTPD_TLS_KEY_FILE}"
postconf -e "smtpd_tls_security_level = ${POSTFIX_SMTPD_TLS_SECURITY_LEVEL}"

postconf -e "smtp_tls_CApath = ${POSTFIX_SMTP_TLS_CAPATH}"
postconf -e "smtp_tls_security_level = ${POSTFIX_SMTP_TLS_SECURITY_LEVEL}"
postconf -e "smtp_tls_session_cache_database = ${POSTFIX_SMTP_TLS_SESSION_CACHE_DATABASE}"

postconf -e "myhostname = ${POSTFIX_MYHOSTNAME}"
postconf -e "mydomain = ${POSTFIX_MYDOMAIN}"
postconf -e "mynetworks = ${POSTFIX_MYNETWORKS}"
postconf -e "mydestination = ${POSTFIX_MYDESTINATION}"

postconf -e "inet_interfaces = ${POSTFIX_INET_INTERFACES}"
postconf -e "inet_protocols = ${POSTFIX_INET_PROTOCOLS}"

postconf -e "milter_protocol = ${POSTFIX_MILTER_PROTOCOL}"
postconf -e "milter_default_action = ${POSTFIX_MILTER_DEFAULT_ACTION}"

if [ -n "${POSTFIX_SMTPD_MILTERS}" ]; then
  postconf -e "smtpd_milters = inet:${POSTFIX_SMTPD_MILTERS}"
else
  postconf -X smtpd_milters || true
fi

if [ -n "${POSTFIX_NON_SMTPD_MILTERS}" ]; then
  postconf -e "non_smtpd_milters = inet:${POSTFIX_NON_SMTPD_MILTERS}"
else
  postconf -X non_smtpd_milters || true
fi

if [ -n "${POSTFIX_RELAYHOST}" ]; then
  postconf -e "relayhost = ${POSTFIX_RELAYHOST}"
else
  postconf -X relayhost || true
fi

exec /usr/sbin/postfix start-fg