217 lines
8.4 KiB
Bash
217 lines
8.4 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
# Misc default variables.
|
|
: "${POSTFIX_SMTPD_BANNER:=\$myhostname ESMTP \$mail_name (\$mail_version)}"
|
|
: "${POSTFIX_BIFF:=no}"
|
|
: "${POSTFIX_MAILLOG_FILE:=/dev/stdout}"
|
|
: "${POSTFIX_DEBUG_PEER_LEVEL:=1}"
|
|
: "${POSTFIX_COMPATIBILITY_LEVEL:=3.6}"
|
|
: "${POSTFIX_APPEND_DOT_MYDOMAIN:=no}"
|
|
: "${POSTFIX_README_DIRECTORY:=no}"
|
|
: "${POSTFIX_MAILBOX_COMMAND:=procmail -a \"\$EXTENSION\"}"
|
|
: "${POSTFIX_MAILBOX_SIZE_LIMIT:=0}"
|
|
: "${POSTFIX_RECIPIENT_DELIMITER:=+}"
|
|
|
|
# Service default variables.
|
|
: "${POSTFIX_SUBMISSION_ENABLED:=yes}"
|
|
: "${POSTFIX_SMTP_ENABLED:=yes}"
|
|
: "${POSTFIX_SMTPS_ENABLED:=yes}"
|
|
: "${POSTFIX_SUBMISSION_TLS_SECURITY_LEVEL:=encrypt}"
|
|
: "${POSTFIX_SMTPS_TLS_WRAPPERMODE:=yes}"
|
|
|
|
# TLS default variables.
|
|
: "${POSTFIX_SMTPD_TLS_SECURITY_LEVEL:=may}"
|
|
: "${POSTFIX_SMTPD_TLS_AUTH_ONLY:=yes}"
|
|
: "${POSTFIX_SMTPD_TLS_CERT_FILE:=/etc/ssl/certs/ssl-cert-snakeoil.pem}"
|
|
: "${POSTFIX_SMTPD_TLS_KEY_FILE:=/etc/ssl/private/ssl-cert-snakeoil.key}"
|
|
|
|
: "${POSTFIX_SMTP_TLS_CAPATH:=/etc/ssl/certs}"
|
|
: "${POSTFIX_SMTP_TLS_SECURITY_LEVEL:=encrypt}"
|
|
: "${POSTFIX_SMTP_TLS_SESSION_CACHE_DATABASE:=btree:\$data_directory/smtp_scache}"
|
|
|
|
# Hostname default variables.
|
|
: "${POSTFIX_MYHOSTNAME:=$(hostname --fqdn 2>/dev/null || hostname)}"
|
|
: "${POSTFIX_MYDOMAIN:=${POSTFIX_MYHOSTNAME}}"
|
|
|
|
# Allowed networks default variables.
|
|
: "${POSTFIX_MYNETWORKS:=127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8}"
|
|
|
|
# Network configuration default variables.
|
|
: "${POSTFIX_INET_INTERFACES:=all}"
|
|
: "${POSTFIX_INET_PROTOCOLS:=all}"
|
|
|
|
# Restrictions default variables.
|
|
: "${POSTFIX_SMTPD_RELAY_RESTRICTIONS:=permit_mynetworks, defer_unauth_destination}"
|
|
: "${POSTFIX_SMTPD_RECIPIENT_RESTRICTIONS:=permit_mynetworks, reject_unauth_destination}"
|
|
|
|
# Other default variables.
|
|
: "${POSTFIX_RELAYHOST:=}"
|
|
: "${POSTFIX_MYDESTINATION:=\$myhostname, localhost.\$mydomain, localhost, \$mydomain}"
|
|
: "${POSTFIX_MILTER_PROTOCOL:=6}"
|
|
: "${POSTFIX_MILTER_DEFAULT_ACTION:=accept}"
|
|
: "${POSTFIX_RELAY_SMTP_HELO_TIMEOUT:=5}"
|
|
: "${POSTFIX_RELAY_SMTP_CONNECT_TIMEOUT:=5}"
|
|
|
|
# DKIM milters default variables.
|
|
: "${POSTFIX_SMTPD_MILTERS:=}"
|
|
: "${POSTFIX_NON_SMTPD_MILTERS:=}"
|
|
|
|
# Create necessary directories.
|
|
mkdir -p \
|
|
/var/spool/postfix \
|
|
/var/spool/postfix/pid \
|
|
/var/spool/postfix/public \
|
|
/var/spool/postfix/maildrop \
|
|
/var/spool/postfix/etc \
|
|
/var/lib/postfix \
|
|
/var/mail \
|
|
/etc/postfix
|
|
|
|
cat > /etc/postfix/master.cf <<'EOF'
|
|
# ==========================================================================
|
|
# service type private unpriv chroot wakeup maxproc command + args
|
|
# (yes) (yes) (no) (never) (100)
|
|
# ==========================================================================
|
|
|
|
EOF
|
|
|
|
# SMTP configuration.
|
|
if [ "${POSTFIX_SMTP_ENABLED}" = "yes" ]; then
|
|
cat >> /etc/postfix/master.cf <<'EOF'
|
|
smtp inet n - y - - smtpd
|
|
-o syslog_name=postfix/smtp
|
|
|
|
EOF
|
|
fi
|
|
|
|
# Submission configuration.
|
|
if [ "${POSTFIX_SUBMISSION_ENABLED}" = "yes" ]; then
|
|
cat >> /etc/postfix/master.cf <<EOF
|
|
submission inet n - y - - smtpd
|
|
-o syslog_name=postfix/submission
|
|
-o smtpd_tls_security_level=${POSTFIX_SUBMISSION_TLS_SECURITY_LEVEL}
|
|
|
|
EOF
|
|
fi
|
|
|
|
# SSL encrypted SMTP configuration.
|
|
if [ "${POSTFIX_SMTPS_ENABLED}" = "yes" ]; then
|
|
cat >> /etc/postfix/master.cf <<EOF
|
|
smtps inet n - y - - smtpd
|
|
-o syslog_name=postfix/smtps
|
|
-o smtpd_tls_wrappermode=${POSTFIX_SMTPS_TLS_WRAPPERMODE}
|
|
|
|
EOF
|
|
fi
|
|
|
|
# Other internal services.
|
|
cat >> /etc/postfix/master.cf <<EOF
|
|
pickup unix n - y 60 1 pickup
|
|
cleanup unix n - y - 0 cleanup
|
|
qmgr unix n - n 300 1 qmgr
|
|
tlsmgr unix - - y 1000? 1 tlsmgr
|
|
rewrite unix - - y - - trivial-rewrite
|
|
bounce unix - - y - 0 bounce
|
|
defer unix - - y - 0 bounce
|
|
trace unix - - y - 0 bounce
|
|
verify unix - - y - 1 verify
|
|
flush unix n - y 1000? 0 flush
|
|
proxymap unix - - n - - proxymap
|
|
proxywrite unix - - n - 1 proxymap
|
|
smtp unix - - y - - smtp
|
|
relay unix - - y - - smtp
|
|
-o smtp_helo_timeout=${POSTFIX_RELAY_SMTP_HELO_TIMEOUT} -o smtp_connect_timeout=${POSTFIX_RELAY_SMTP_CONNECT_TIMEOUT}
|
|
showq unix n - y - - showq
|
|
error unix - - y - - error
|
|
retry unix - - y - - error
|
|
discard unix - - y - - discard
|
|
local unix - n n - - local
|
|
virtual unix - n n - - virtual
|
|
lmtp unix - - y - - lmtp
|
|
anvil unix - - y - 1 anvil
|
|
scache unix - - y - 1 scache
|
|
maildrop unix - n n - - pipe
|
|
flags=DRhu user=vmail argv=/usr/bin/maildrop -d \${recipient}
|
|
uucp unix - n n - - pipe
|
|
flags=Fqhu user=uucp argv=uux -r -n -z -a\$sender - \$nexthop!rmail (\$recipient)
|
|
ifmail unix - n n - - pipe
|
|
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r \$nexthop (\$recipient)
|
|
bsmtp unix - n n - - pipe
|
|
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t\$nexthop -f\$sender \$recipient
|
|
scalemail-backend unix - n n - 2 pipe
|
|
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store \${nexthop} \${user} \${extension}
|
|
mailman unix - n n - - pipe
|
|
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
|
|
\${nexthop} \${user}
|
|
postlog unix-dgram n - n - 1 postlogd
|
|
EOF
|
|
|
|
# Move resolv.conf to postfix spool in order to make postfix DNS lookups work.
|
|
cp /etc/resolv.conf /var/spool/postfix/etc/resolv.conf
|
|
|
|
# Fix permissions.
|
|
/usr/sbin/postfix set-permissions
|
|
|
|
# Ensure aliases database exists
|
|
if [ ! -f /etc/aliases ]; then
|
|
touch /etc/aliases
|
|
fi
|
|
|
|
newaliases
|
|
|
|
# main.cf configuration.
|
|
postconf -e "biff = ${POSTFIX_BIFF}"
|
|
postconf -e "maillog_file = ${POSTFIX_MAILLOG_FILE}"
|
|
postconf -e "debug_peer_level = ${POSTFIX_DEBUG_PEER_LEVEL}"
|
|
postconf -e "compatibility_level = ${POSTFIX_COMPATIBILITY_LEVEL}"
|
|
postconf -e "append_dot_mydomain = ${POSTFIX_APPEND_DOT_MYDOMAIN}"
|
|
postconf -e "readme_directory = ${POSTFIX_README_DIRECTORY}"
|
|
postconf -e "mailbox_command = ${POSTFIX_MAILBOX_COMMAND}"
|
|
postconf -e "mailbox_size_limit = ${POSTFIX_MAILBOX_SIZE_LIMIT}"
|
|
postconf -e "recipient_delimiter = ${POSTFIX_RECIPIENT_DELIMITER}"
|
|
|
|
postconf -e "smtpd_banner = ${POSTFIX_SMTPD_BANNER}"
|
|
|
|
postconf -e "smtpd_relay_restrictions = ${POSTFIX_SMTPD_RELAY_RESTRICTIONS}"
|
|
postconf -e "smtpd_recipient_restrictions = ${POSTFIX_SMTPD_RECIPIENT_RESTRICTIONS}"
|
|
|
|
postconf -e "smtpd_tls_auth_only = ${POSTFIX_SMTPD_TLS_AUTH_ONLY}"
|
|
postconf -e "smtpd_tls_cert_file = ${POSTFIX_SMTPD_TLS_CERT_FILE}"
|
|
postconf -e "smtpd_tls_key_file = ${POSTFIX_SMTPD_TLS_KEY_FILE}"
|
|
postconf -e "smtpd_tls_security_level = ${POSTFIX_SMTPD_TLS_SECURITY_LEVEL}"
|
|
|
|
postconf -e "smtp_tls_CApath = ${POSTFIX_SMTP_TLS_CAPATH}"
|
|
postconf -e "smtp_tls_security_level = ${POSTFIX_SMTP_TLS_SECURITY_LEVEL}"
|
|
postconf -e "smtp_tls_session_cache_database = ${POSTFIX_SMTP_TLS_SESSION_CACHE_DATABASE}"
|
|
|
|
postconf -e "myhostname = ${POSTFIX_MYHOSTNAME}"
|
|
postconf -e "mydomain = ${POSTFIX_MYDOMAIN}"
|
|
postconf -e "mynetworks = ${POSTFIX_MYNETWORKS}"
|
|
postconf -e "mydestination = ${POSTFIX_MYDESTINATION}"
|
|
|
|
postconf -e "inet_interfaces = ${POSTFIX_INET_INTERFACES}"
|
|
postconf -e "inet_protocols = ${POSTFIX_INET_PROTOCOLS}"
|
|
|
|
postconf -e "milter_protocol = ${POSTFIX_MILTER_PROTOCOL}"
|
|
postconf -e "milter_default_action = ${POSTFIX_MILTER_DEFAULT_ACTION}"
|
|
|
|
if [ -n "${POSTFIX_SMTPD_MILTERS}" ]; then
|
|
postconf -e "smtpd_milters = inet:${POSTFIX_SMTPD_MILTERS}"
|
|
else
|
|
postconf -X smtpd_milters || true
|
|
fi
|
|
|
|
if [ -n "${POSTFIX_NON_SMTPD_MILTERS}" ]; then
|
|
postconf -e "non_smtpd_milters = inet:${POSTFIX_NON_SMTPD_MILTERS}"
|
|
else
|
|
postconf -X non_smtpd_milters || true
|
|
fi
|
|
|
|
if [ -n "${POSTFIX_RELAYHOST}" ]; then
|
|
postconf -e "relayhost = ${POSTFIX_RELAYHOST}"
|
|
else
|
|
postconf -X relayhost || true
|
|
fi
|
|
|
|
exec /usr/sbin/postfix start-fg |