From 09416c743c38dc99bc162020fba559f75e22eb82 Mon Sep 17 00:00:00 2001 From: Mauro Torrez Date: Sun, 18 Jan 2026 03:51:53 +0000 Subject: [PATCH] Refactor: gomplate + debian 13 (#1) Co-authored-by: Mauro Torrez Reviewed-on: https://git.mau.ro/mauro/docker-image-postfix/pulls/1 --- .gitea/workflows/build.yml | 2 +- .gitignore | 1 + Dockerfile | 17 ++-- confd/conf.d/noreply.toml.disabled | 7 -- confd/conf.d/setup_main.toml | 35 --------- confd/conf.d/setup_milter.toml | 10 --- confd/conf.d/setup_postscreen.toml | 16 ---- confd/conf.d/setup_relayhost.toml | 16 ---- confd/conf.d/setup_submission.toml | 7 -- confd/conf.d/spamfilter.toml | 8 -- confd/templates/noreply.tmpl | 10 --- confd/templates/setup_main.tmpl | 77 ------------------- confd/templates/setup_milter.tmpl | 6 -- confd/templates/setup_relayhost.tmpl | 14 ---- confd/templates/spamfilter.tmpl | 6 -- entrypoint.sh | 5 ++ templates/start.d/setup_main | 77 +++++++++++++++++++ templates/start.d/setup_milter | 6 ++ .../start.d/setup_postscreen | 36 ++++----- templates/start.d/setup_relayhost | 14 ++++ .../start.d/setup_submission | 6 +- templates/start.d/spamfilter | 6 ++ 22 files changed, 143 insertions(+), 239 deletions(-) delete mode 100644 confd/conf.d/noreply.toml.disabled delete mode 100644 confd/conf.d/setup_main.toml delete mode 100644 confd/conf.d/setup_milter.toml delete mode 100644 confd/conf.d/setup_postscreen.toml delete mode 100644 confd/conf.d/setup_relayhost.toml delete mode 100644 confd/conf.d/setup_submission.toml delete mode 100644 confd/conf.d/spamfilter.toml delete mode 100644 confd/templates/noreply.tmpl delete mode 100644 confd/templates/setup_main.tmpl delete mode 100644 confd/templates/setup_milter.tmpl delete mode 100644 confd/templates/setup_relayhost.tmpl delete mode 100755 confd/templates/spamfilter.tmpl create mode 100755 entrypoint.sh create mode 100755 templates/start.d/setup_main create mode 100755 templates/start.d/setup_milter rename confd/templates/setup_postscreen.tmpl => templates/start.d/setup_postscreen (75%) mode change 100644 => 100755 create mode 100755 templates/start.d/setup_relayhost rename confd/templates/setup_submission.tmpl => templates/start.d/setup_submission (93%) mode change 100644 => 100755 create mode 100755 templates/start.d/spamfilter diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 80df679..e2f1ffd 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -15,7 +15,7 @@ jobs: repo: - eumau/postfix tag: - - "5" + - "6" steps: - name: Set up QEMU diff --git a/.gitignore b/.gitignore index adac7f9..655a164 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ *~ \#* .#* +.DS_Store diff --git a/Dockerfile b/Dockerfile index 9d55ee7..ad16fc9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,9 @@ -FROM eumau/debian:bookworm-slim -LABEL maintainer "Mauro Torrez " +FROM debian:trixie-slim +LABEL maintainer="Mauro Torrez " ARG DEBIAN_FRONTEND=noninteractive -ENV LC_ALL C +ARG TARGETARCH +ARG GOMPLATE_VERSION=4.3.0 +ENV LC_ALL=C ENV BIFF=no ENV BOGOFILTER_ENABLE="yes" @@ -73,6 +75,9 @@ RUN echo "_dev_null: /dev/null" > /etc/aliases \ ssl-cert \ ca-certificates \ bogofilter-sqlite \ + curl \ + && curl -o /usr/local/bin/gomplate -sSL "https://github.com/hairyhenderson/gomplate/releases/download/v${GOMPLATE_VERSION}/gomplate_linux-${TARGETARCH}" \ + && chmod 755 /usr/local/bin/gomplate \ && rm -rf /var/lib/apt/lists/* \ && cp /usr/share/postfix/main.cf.debian /etc/postfix/main.cf \ && mkdir -p /etc/postfix/rules \ @@ -110,10 +115,12 @@ RUN echo "_dev_null: /dev/null" > /etc/aliases \ anvil/unix/chroot=n \ scache/unix/chroot=n -ADD confd /etc/confd/ -ADD postmap_all /usr/local/bin/ +COPY --chmod=0755 entrypoint.sh /usr/local/bin/ +COPY templates /etc/templates +COPY postmap_all /usr/local/bin/ VOLUME ["/ssl","/var/spool/postfix"] EXPOSE 25/tcp 587/tcp +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] CMD ["postfix","start-fg"] diff --git a/confd/conf.d/noreply.toml.disabled b/confd/conf.d/noreply.toml.disabled deleted file mode 100644 index 8379c88..0000000 --- a/confd/conf.d/noreply.toml.disabled +++ /dev/null @@ -1,7 +0,0 @@ -[template] -src = "noreply.tmpl" -dest = "/etc/postfix/noreply" -keys = [ -"/noreply/aliases", -"/virtual/mailbox/domains", -] diff --git a/confd/conf.d/setup_main.toml b/confd/conf.d/setup_main.toml deleted file mode 100644 index 2da8566..0000000 --- a/confd/conf.d/setup_main.toml +++ /dev/null @@ -1,35 +0,0 @@ -[template] -src = "setup_main.tmpl" -dest = "/start.d/99_main" -mode = "0755" -keys = [ -"/biff", -"/message/size/limit", -"/mydestination", -"/mydomain", -"/myhostname", -"/mynetworks", -"/mynetworks/style", -"/propagate/unmatched/extensions", -"/recipient/delimiter", -"/smtp/tls/security/level", -"/smtpd/client/restrictions", -"/smtpd/data/restrictions", -"/smtpd/helo/required", -"/smtpd/helo/restrictions", -"/smtpd/recipient/restrictions", -"/smtpd/relay/restrictions", -"/smtpd/sasl/auth/enable", -"/smtpd/sasl/path", -"/smtpd/sasl/type", -"/smtpd/tls/auth/only", -"/smtpd/tls/cert/file", -"/smtpd/tls/key/file", -"/smtpd/tls/security/level", -"/smtpd/tls/session/cache/database", -"/smtputf8/enable", -"/virtual/alias/maps", -"/virtual/mailbox/domains", -"/virtual/mailbox/maps", -"/virtual/transport", -] diff --git a/confd/conf.d/setup_milter.toml b/confd/conf.d/setup_milter.toml deleted file mode 100644 index 1b01366..0000000 --- a/confd/conf.d/setup_milter.toml +++ /dev/null @@ -1,10 +0,0 @@ -[template] -src = "setup_milter.tmpl" -dest = "/start.d/10_milter" -mode = "0755" -keys = [ -"/internal/mail/filter/classes", -"/milter/default/action", -"/non/smtpd/milters", -"/smtpd/milters", -] diff --git a/confd/conf.d/setup_postscreen.toml b/confd/conf.d/setup_postscreen.toml deleted file mode 100644 index e5b15f6..0000000 --- a/confd/conf.d/setup_postscreen.toml +++ /dev/null @@ -1,16 +0,0 @@ -[template] -src = "setup_postscreen.tmpl" -dest = "/start.d/89_postscreen" -mode = "0755" -keys = [ -"/bogofilter/enable", -"/postscreen/access/list", -"/postscreen/blacklist/action", -"/postscreen/dnsbl/action", -"/postscreen/dnsbl/reply/map", -"/postscreen/dnsbl/sites", -"/postscreen/dnsbl/threshold", -"/postscreen/dnsbl/whitelist/threshold", -"/postscreen/enable", -"/postscreen/greet/action", -] diff --git a/confd/conf.d/setup_relayhost.toml b/confd/conf.d/setup_relayhost.toml deleted file mode 100644 index b4e5eef..0000000 --- a/confd/conf.d/setup_relayhost.toml +++ /dev/null @@ -1,16 +0,0 @@ -[template] -src = "setup_relayhost.tmpl" -dest = "/start.d/88_relayhost" -mode = "0755" -keys = [ -"/relayhost", -"/smtp/fallback/relay", -"/smtp/sasl/auth/enable", -"/smtp/sasl/password/maps", -"/smtp/sasl/security/options", -"/smtp/tls/cafile", -"/smtp/tls/mandatory/protocols", -"/smtp/tls/note/starttls/offer", -"/smtp/tls/security/level", -"/smtp/tls/session/cache/database" -] diff --git a/confd/conf.d/setup_submission.toml b/confd/conf.d/setup_submission.toml deleted file mode 100644 index 9ac5937..0000000 --- a/confd/conf.d/setup_submission.toml +++ /dev/null @@ -1,7 +0,0 @@ -[template] -src = "setup_submission.tmpl" -dest = "/start.d/11_submission" -mode = "0755" -keys = [ -"/submission/enable", -] diff --git a/confd/conf.d/spamfilter.toml b/confd/conf.d/spamfilter.toml deleted file mode 100644 index 38ce3c4..0000000 --- a/confd/conf.d/spamfilter.toml +++ /dev/null @@ -1,8 +0,0 @@ -[template] -src = "spamfilter.tmpl" -dest = "/usr/local/bin/spamfilter" -mode = "0755" -keys = [ -"/bogofilter/ham/cutoff", -"/bogofilter/spam/cutoff", -] diff --git a/confd/templates/noreply.tmpl b/confd/templates/noreply.tmpl deleted file mode 100644 index fcbf725..0000000 --- a/confd/templates/noreply.tmpl +++ /dev/null @@ -1,10 +0,0 @@ -# "no-reply" mail aliases. -# DO NOT edit this file, it will be overwritten. -# Instead, set the variable NOREPLY_ALIASES -{{ range split (getv "/noreply/aliases") " " }} -{{ if (strings.Contains . "@") }} -{{.}} _dev_null -{{ else }} -{{.}}@{{ index (split (getv "/virtual/mailbox/domains") " ") 0 }} _dev_null -{{ end }} -{{ end }} diff --git a/confd/templates/setup_main.tmpl b/confd/templates/setup_main.tmpl deleted file mode 100644 index 201d605..0000000 --- a/confd/templates/setup_main.tmpl +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/bash - -# Managing main.cf: -# postconf [-dfhHnopvx] [-c config_dir] [-C class,...] [parameter ...] -# postconf [-epv] [-c config_dir] parameter=value ... -# postconf -# [-pv] [-c config_dir] parameter ... -# postconf -X [-pv] [-c config_dir] parameter ... - -# Managing master.cf service entries: -# postconf -M [-fovx] [-c config_dir] [service[/type] ...] -# postconf -M [-ev] [-c config_dir] service/type=value ... -# postconf -M# [-v] [-c config_dir] service/type ... -# postconf -MX [-v] [-c config_dir] service/type ... - -# Managing master.cf service fields: -# postconf -F [-fhHovx] [-c config_dir] [service[/type[/field]] ...] -# postconf -F [-ev] [-c config_dir] service/type/field=value ... - -# Managing master.cf service parameters: -# postconf -P [-fhHovx] [-c config_dir] [service[/type[/parameter]] ...] -# postconf -P [-ev] [-c config_dir] service/type/parameter=value ... -# postconf -PX [-v] [-c config_dir] service/type/parameter ... - -# Managing bounce message templates: -# postconf -b [-v] [-c config_dir] [template_file] -# postconf -t [-v] [-c config_dir] [template_file] - -# Managing TLS features: -# postconf -T mode [-v] [-c config_dir] - -# Managing other configuration: -# postconf -a|-A|-l|-m [-v] [-c config_dir] - -postconf maillog_file=/dev/stdout -postconf alias_maps=hash:/etc/aliases -{{ with getv "/biff" }}postconf biff='{{.}}'{{ end }} -{{ with getv "/message/size/limit" }}postconf message_size_limit='{{.}}'{{ end }} -{{ with getv "/mydestination" }}postconf mydestination='{{.}}'{{ end }} -{{ with getv "/mydomain" }}postconf mydomain='{{.}}'{{ end }} -{{ with getv "/myhostname" }}postconf myhostname='{{.}}'{{ end }} -{{ with getv "/mynetworks" }}postconf mynetworks='{{.}}'{{ end }} -{{ with getv "/mynetworks/style" }}postconf mynetworks_style='{{.}}'{{ end }} -{{ with getv "/propagate/unmatched/extensions" }}postconf propagate_unmatched_extensions='{{.}}'{{ end }} -{{ with getv "/recipient/delimiter" }}postconf recipient_delimiter='{{.}}'{{ end }} -{{ with getv "/smtp/tls/security/level" }}postconf smtp_tls_security_level='{{.}}'{{ end }} -{{ with getv "/smtpd/client/restrictions" }}postconf smtpd_client_restrictions='{{.}}'{{ end }} -{{ with getv "/smtpd/data/restrictions" }}postconf smtpd_data_restrictions='{{.}}'{{ end }} -{{ with getv "/smtpd/helo/required" }}postconf smtpd_helo_required='{{.}}'{{ end }} -{{ with getv "/smtpd/helo/restrictions" }}postconf smtpd_helo_restrictions='{{.}}'{{ end }} -{{ with getv "/smtpd/recipient/restrictions" }}postconf smtpd_recipient_restrictions='{{.}}'{{ end }} -{{ with getv "/smtpd/relay/restrictions" }}postconf smtpd_relay_restrictions='{{.}}'{{ end }} -{{ with getv "/smtpd/sasl/auth/enable" }}postconf smtpd_sasl_auth_enable='{{.}}'{{ end }} -{{ with getv "/smtpd/sasl/path" }}postconf smtpd_sasl_path='{{.}}'{{ end }} -{{ with getv "/smtpd/sasl/type" }}postconf smtpd_sasl_type='{{.}}'{{ end }} -{{ with getv "/smtpd/tls/auth/only" }}postconf smtpd_tls_auth_only='{{.}}'{{ end }} -{{ with getv "/smtpd/tls/cert/file" }}postconf smtpd_tls_cert_file='{{.}}'{{ end }} -{{ with getv "/smtpd/tls/key/file" }}postconf smtpd_tls_key_file='{{.}}'{{ end }} -{{ with getv "/smtpd/tls/security/level" }}postconf smtpd_tls_security_level='{{.}}'{{ end }} -{{ with getv "/smtpd/tls/session/cache/database" }}postconf smtpd_tls_session_cache_database='{{.}}'{{ end }} -{{ with getv "/smtputf8/enable" }}postconf smtputf8_enable='{{.}}'{{ end }} -{{ with getv "/virtual/alias/maps" }}postconf virtual_alias_maps='{{.}}'{{ end }} -{{ with getv "/virtual/mailbox/domains" }}postconf virtual_mailbox_domains='{{.}}'{{ end }} -{{ with getv "/virtual/mailbox/maps" }}postconf virtual_mailbox_maps='{{.}}'{{ end }} -{{ with getv "/virtual/transport" }}postconf virtual_transport='{{.}}'{{ end }} - -postconf -M spamfilter/unix | grep -q spamfilter || { - postconf -M spamfilter/unix="spamfilter unix - n n - - pipe" -} -postconf -F spamfilter/unix/private=- \ - spamfilter/unix/unprivileged=n \ - spamfilter/unix/chroot=n \ - spamfilter/unix/wakeup=- \ - spamfilter/unix/process_limit=- \ - spamfilter/unix/command='pipe flags=Rq user=vmail argv=/usr/local/bin/spamfilter -oi -f ${sender} ${recipient}' - -# run postmap for all lookup tables -postmap_all diff --git a/confd/templates/setup_milter.tmpl b/confd/templates/setup_milter.tmpl deleted file mode 100644 index 7b3765c..0000000 --- a/confd/templates/setup_milter.tmpl +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash - -{{ with getv "/internal/mail/filter/classes" }}postconf internal_mail_filter_classes='{{.}}'{{ end }} -{{ with getv "/milter/default/action" }}postconf milter_default_action='{{.}}'{{ end }} -{{ with getv "/non/smtpd/milters" }}postconf non_smtpd_milters='{{.}}'{{ end }} -{{ with getv "/smtpd/milters" }}postconf smtpd_milters='{{.}}'{{ end }} diff --git a/confd/templates/setup_relayhost.tmpl b/confd/templates/setup_relayhost.tmpl deleted file mode 100644 index b3a025b..0000000 --- a/confd/templates/setup_relayhost.tmpl +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/bash - -# These postfix settings allow for sending all mail through a relay host. - -{{ with getv "/relayhost" }}postconf relayhost='{{.}}'{{ end }} -{{ with getv "/smtp/fallback/relay" }}postconf smtp_fallback_relay='{{.}}'{{ end }} -{{ with getv "/smtp/sasl/auth/enable" }}postconf smtp_sasl_auth_enable='{{.}}'{{ end }} -{{ with getv "/smtp/sasl/password/maps" }}postconf smtp_sasl_password_maps='{{.}}'{{ end }} -{{ with getv "/smtp/sasl/security/options" }}postconf smtp_sasl_security_options='{{.}}'{{ end }} -{{ with getv "/smtp/tls/cafile" }}postconf smtp_tls_CAfile='{{.}}'{{ end }} -{{ with getv "/smtp/tls/mandatory/protocols" }}postconf smtp_tls_mandatory_protocols='{{.}}'{{ end }} -{{ with getv "/smtp/tls/note/starttls/offer" }}postconf smtp_tls_note_starttls_offer='{{.}}'{{ end }} -{{ with getv "/smtp/tls/security/level" }}postconf smtp_tls_security_level='{{.}}'{{ end }} -{{ with getv "/smtp/tls/session/cache/database" }}postconf smtp_tls_session_cache_database='{{.}}'{{ end }} diff --git a/confd/templates/spamfilter.tmpl b/confd/templates/spamfilter.tmpl deleted file mode 100755 index 89b0b14..0000000 --- a/confd/templates/spamfilter.tmpl +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash - -# pass mail through spam filter Bogofilter -# arguments are passed on to sendmail - -/usr/bin/bogofilter -d /vmail/bogofilter -p {{ with getv "/bogofilter/ham/cutoff" }}--ham-cutoff '{{.}}'{{ end }} {{ with getv "/bogofilter/spam/cutoff" }}--spam-cutoff '{{.}}'{{ end }} | /usr/sbin/sendmail "$@" diff --git a/entrypoint.sh b/entrypoint.sh new file mode 100755 index 0000000..2161e3f --- /dev/null +++ b/entrypoint.sh @@ -0,0 +1,5 @@ +#!/bin/bash +set -e +gomplate --input-dir=/etc/templates --output-dir=/ +run-parts -v --exit-on-error /start.d +exec "$@" diff --git a/templates/start.d/setup_main b/templates/start.d/setup_main new file mode 100755 index 0000000..5979a14 --- /dev/null +++ b/templates/start.d/setup_main @@ -0,0 +1,77 @@ +#!/bin/bash + +# Managing main.cf: +# postconf [-dfhHnopvx] [-c config_dir] [-C class,...] [parameter ...] +# postconf [-epv] [-c config_dir] parameter=value ... +# postconf -# [-pv] [-c config_dir] parameter ... +# postconf -X [-pv] [-c config_dir] parameter ... + +# Managing master.cf service entries: +# postconf -M [-fovx] [-c config_dir] [service[/type] ...] +# postconf -M [-ev] [-c config_dir] service/type=value ... +# postconf -M# [-v] [-c config_dir] service/type ... +# postconf -MX [-v] [-c config_dir] service/type ... + +# Managing master.cf service fields: +# postconf -F [-fhHovx] [-c config_dir] [service[/type[/field]] ...] +# postconf -F [-ev] [-c config_dir] service/type/field=value ... + +# Managing master.cf service parameters: +# postconf -P [-fhHovx] [-c config_dir] [service[/type[/parameter]] ...] +# postconf -P [-ev] [-c config_dir] service/type/parameter=value ... +# postconf -PX [-v] [-c config_dir] service/type/parameter ... + +# Managing bounce message templates: +# postconf -b [-v] [-c config_dir] [template_file] +# postconf -t [-v] [-c config_dir] [template_file] + +# Managing TLS features: +# postconf -T mode [-v] [-c config_dir] + +# Managing other configuration: +# postconf -a|-A|-l|-m [-v] [-c config_dir] + +postconf maillog_file=/dev/stdout +postconf alias_maps=hash:/etc/aliases +{{ with getenv "BIFF" }}postconf biff='{{.}}'{{ end }} +{{ with getenv "MESSAGE_SIZE_LIMIT" }}postconf message_size_limit='{{.}}'{{ end }} +{{ with getenv "MYDESTINATION" }}postconf mydestination='{{.}}'{{ end }} +{{ with getenv "MYDOMAIN" }}postconf mydomain='{{.}}'{{ end }} +{{ with getenv "MYHOSTNAME" }}postconf myhostname='{{.}}'{{ end }} +{{ with getenv "MYNETWORKS" }}postconf mynetworks='{{.}}'{{ end }} +{{ with getenv "MYNETWORKS_STYLE" }}postconf mynetworks_style='{{.}}'{{ end }} +{{ with getenv "PROPAGATE_UNMATCHED_EXTENSIONS" }}postconf propagate_unmatched_extensions='{{.}}'{{ end }} +{{ with getenv "RECIPIENT_DELIMITER" }}postconf recipient_delimiter='{{.}}'{{ end }} +{{ with getenv "SMTP_TLS_SECURITY_LEVEL" }}postconf smtp_tls_security_level='{{.}}'{{ end }} +{{ with getenv "SMTPD_CLIENT_RESTRICTIONS" }}postconf smtpd_client_restrictions='{{.}}'{{ end }} +{{ with getenv "SMTPD_DATA_RESTRICTIONS" }}postconf smtpd_data_restrictions='{{.}}'{{ end }} +{{ with getenv "SMTPD_HELO_REQUIRED" }}postconf smtpd_helo_required='{{.}}'{{ end }} +{{ with getenv "SMTPD_HELO_RESTRICTIONS" }}postconf smtpd_helo_restrictions='{{.}}'{{ end }} +{{ with getenv "SMTPD_RECIPIENT_RESTRICTIONS" }}postconf smtpd_recipient_restrictions='{{.}}'{{ end }} +{{ with getenv "SMTPD_RELAY_RESTRICTIONS" }}postconf smtpd_relay_restrictions='{{.}}'{{ end }} +{{ with getenv "SMTPD_SASL_AUTH_ENABLE" }}postconf smtpd_sasl_auth_enable='{{.}}'{{ end }} +{{ with getenv "SMTPD_SASL_PATH" }}postconf smtpd_sasl_path='{{.}}'{{ end }} +{{ with getenv "SMTPD_SASL_TYPE" }}postconf smtpd_sasl_type='{{.}}'{{ end }} +{{ with getenv "SMTPD_TLS_AUTH_ONLY" }}postconf smtpd_tls_auth_only='{{.}}'{{ end }} +{{ with getenv "SMTPD_TLS_CERT_FILE" }}postconf smtpd_tls_cert_file='{{.}}'{{ end }} +{{ with getenv "SMTPD_TLS_KEY_FILE" }}postconf smtpd_tls_key_file='{{.}}'{{ end }} +{{ with getenv "SMTPD_TLS_SECURITY_LEVEL" }}postconf smtpd_tls_security_level='{{.}}'{{ end }} +{{ with getenv "SMTPD_TLS_SESSION_CACHE_DATABASE" }}postconf smtpd_tls_session_cache_database='{{.}}'{{ end }} +{{ with getenv "SMTPUTF8_ENABLE" }}postconf smtputf8_enable='{{.}}'{{ end }} +{{ with getenv "VIRTUAL_ALIAS_MAPS" }}postconf virtual_alias_maps='{{.}}'{{ end }} +{{ with getenv "VIRTUAL_MAILBOX_DOMAINS" }}postconf virtual_mailbox_domains='{{.}}'{{ end }} +{{ with getenv "VIRTUAL_MAILBOX_MAPS" }}postconf virtual_mailbox_maps='{{.}}'{{ end }} +{{ with getenv "VIRTUAL_TRANSPORT" }}postconf virtual_transport='{{.}}'{{ end }} + +postconf -M spamfilter/unix | grep -q spamfilter || { + postconf -M spamfilter/unix="spamfilter unix - n n - - pipe" +} +postconf -F spamfilter/unix/private=- \ + spamfilter/unix/unprivileged=n \ + spamfilter/unix/chroot=n \ + spamfilter/unix/wakeup=- \ + spamfilter/unix/process_limit=- \ + spamfilter/unix/command='pipe flags=Rq user=vmail argv=/usr/local/bin/spamfilter -oi -f ${sender} ${recipient}' + +# run postmap for all lookup tables +postmap_all diff --git a/templates/start.d/setup_milter b/templates/start.d/setup_milter new file mode 100755 index 0000000..42015d4 --- /dev/null +++ b/templates/start.d/setup_milter @@ -0,0 +1,6 @@ +#!/bin/bash + +{{ with getenv "INTERNAL_MAIL_FILTER_CLASSES" }}postconf internal_mail_filter_classes='{{.}}'{{ end }} +{{ with getenv "MILTER_DEFAULT_ACTION" }}postconf milter_default_action='{{.}}'{{ end }} +{{ with getenv "NON_SMTPD_MILTERS" }}postconf non_smtpd_milters='{{.}}'{{ end }} +{{ with getenv "SMTPD_MILTERS" }}postconf smtpd_milters='{{.}}'{{ end }} diff --git a/confd/templates/setup_postscreen.tmpl b/templates/start.d/setup_postscreen old mode 100644 new mode 100755 similarity index 75% rename from confd/templates/setup_postscreen.tmpl rename to templates/start.d/setup_postscreen index 8cabbd8..a788a7d --- a/confd/templates/setup_postscreen.tmpl +++ b/templates/start.d/setup_postscreen @@ -23,7 +23,7 @@ #postconf -h postscreen_non_smtp_command_action #postconf -h postscreen_pipelining_action -{{ if eq (getv "/postscreen/enable") "yes"}} +{{ if eq (getenv "POSTSCREEN_ENABLE") "yes" -}} postconf -M smtpd/pass="smtpd pass - - n - - smtpd" postconf -F smtpd/pass/private=- \ smtpd/pass/unprivileged=- \ @@ -52,28 +52,28 @@ postconf -F dnsblog/unix/private=- \ dnsblog/unix/process_limit=0 \ dnsblog/unix/command="dnsblog" -{{ if eq (getv "/bogofilter/enable") "yes" }} +{{ if eq (getenv "BOGOFILTER_ENABLE") "yes" -}} postconf -P smtpd/pass/content_filter=spamfilter -{{ else }} +{{ else -}} postconf -X -P smtpd/pass/content_filter -{{ end }} +{{ end -}} # FIXME: template tables instead of creating empty files touch /etc/postfix/rules/postscreen_access_list.cidr touch /etc/postfix/rules/postscreen_dnsbl_mask.pcre # main.cf options -# FIXME: allow un-setting options by blanking variable values -{{ with getv "/postscreen/access/list" }}postconf -e postscreen_access_list='{{.}}'{{ end }} -{{ with getv "/postscreen/blacklist/action" }}postconf -e postscreen_blacklist_action='{{.}}'{{ end }} -{{ with getv "/postscreen/dnsbl/action" }}postconf -e postscreen_dnsbl_action='{{.}}'{{ end }} -{{ with getv "/postscreen/dnsbl/reply/map" }}postconf -e postscreen_dnsbl_reply_map='{{.}}'{{ end }} -{{ with getv "/postscreen/dnsbl/sites" }}postconf -e postscreen_dnsbl_sites='{{.}}'{{ end }} -{{ with getv "/postscreen/dnsbl/threshold" }}postconf -e postscreen_dnsbl_threshold='{{.}}'{{ end }} -{{ with getv "/postscreen/dnsbl/whitelist/threshold" }}postconf -e postscreen_dnsbl_whitelist_threshold='{{.}}'{{ end }} -{{ with getv "/postscreen/greet/action" }}postconf -e postscreen_greet_action='{{.}}'{{ end }} +# FIXME: allow un-setting options by blanking variable values +{{ with getenv "POSTSCREEN_ACCESS_LIST" }}postconf -e postscreen_access_list='{{.}}'{{ end }} +{{ with getenv "POSTSCREEN_BLACKLIST_ACTION" }}postconf -e postscreen_blacklist_action='{{.}}'{{ end }} +{{ with getenv "POSTSCREEN_DNSBL_ACTION" }}postconf -e postscreen_dnsbl_action='{{.}}'{{ end }} +{{ with getenv "POSTSCREEN_DNSBL_REPLY_MAP" }}postconf -e postscreen_dnsbl_reply_map='{{.}}'{{ end }} +{{ with getenv "POSTSCREEN_DNSBL_SITES" }}postconf -e postscreen_dnsbl_sites='{{.}}'{{ end }} +{{ with getenv "POSTSCREEN_DNSBL_THRESHOLD" }}postconf -e postscreen_dnsbl_threshold='{{.}}'{{ end }} +{{ with getenv "POSTSCREEN_DNSBL_WHITELIST_THRESHOLD" }}postconf -e postscreen_dnsbl_whitelist_threshold='{{.}}'{{ end }} +{{ with getenv "POSTSCREEN_GREET_ACTION" }}postconf -e postscreen_greet_action='{{.}}'{{ end }} -{{ else }} +{{ else -}} # disable postscreen postconf -M# smtpd/pass @@ -84,15 +84,15 @@ postconf -F smtp/inet/private=n \ smtp/inet/process_limit=- \ smtp/inet/command="smtpd" -{{ if eq (getv "/bogofilter/enable") "yes" }} +{{ if eq (getenv "BOGOFILTER_ENABLE") "yes" -}} postconf -P smtp/inet/content_filter=spamfilter -{{ else }} +{{ else -}} postconf -X -P smtp/inet/content_filter -{{ end }} +{{ end -}} postconf -M# dnsblog/unix -{{ end }} +{{ end -}} # TODO: access list: # # Ansible-generated postscreen CIDR access table. You can change this diff --git a/templates/start.d/setup_relayhost b/templates/start.d/setup_relayhost new file mode 100755 index 0000000..d31dbc8 --- /dev/null +++ b/templates/start.d/setup_relayhost @@ -0,0 +1,14 @@ +#!/bin/bash + +# These postfix settings allow for sending all mail through a relay host. + +{{ with getenv "RELAYHOST" }}postconf relayhost='{{.}}'{{ end }} +{{ with getenv "SMTP_FALLBACK_RELAY" }}postconf smtp_fallback_relay='{{.}}'{{ end }} +{{ with getenv "SMTP_SASL_AUTH_ENABLE" }}postconf smtp_sasl_auth_enable='{{.}}'{{ end }} +{{ with getenv "SMTP_SASL_PASSWORD_MAPS" }}postconf smtp_sasl_password_maps='{{.}}'{{ end }} +{{ with getenv "SMTP_SASL_SECURITY_OPTIONS" }}postconf smtp_sasl_security_options='{{.}}'{{ end }} +{{ with getenv "SMTP_TLS_CAFILE" }}postconf smtp_tls_CAfile='{{.}}'{{ end }} +{{ with getenv "SMTP_TLS_MANDATORY_PROTOCOLS" }}postconf smtp_tls_mandatory_protocols='{{.}}'{{ end }} +{{ with getenv "SMTP_TLS_NOTE_STARTTLS_OFFER" }}postconf smtp_tls_note_starttls_offer='{{.}}'{{ end }} +{{ with getenv "SMTP_TLS_SECURITY_LEVEL" }}postconf smtp_tls_security_level='{{.}}'{{ end }} +{{ with getenv "SMTP_TLS_SESSION_CACHE_DATABASE" }}postconf smtp_tls_session_cache_database='{{.}}'{{ end }} diff --git a/confd/templates/setup_submission.tmpl b/templates/start.d/setup_submission old mode 100644 new mode 100755 similarity index 93% rename from confd/templates/setup_submission.tmpl rename to templates/start.d/setup_submission index b6d21f7..d0b801e --- a/confd/templates/setup_submission.tmpl +++ b/templates/start.d/setup_submission @@ -7,7 +7,7 @@ #postconf -P -h submission/inet/smtpd_tls_security_level #postconf -P -h submission/inet/syslog_name -{{ if eq (getv "/submission/enable") "yes"}} +{{ if eq (getenv "SUBMISSION_ENABLE") "yes" -}} postconf -M submission/inet="submission inet n - n - - smtpd" postconf -F submission/inet/private=n \ submission/inet/unprivileged=- \ @@ -20,6 +20,6 @@ postconf -P -e submission/inet/smtpd_helo_restrictions="permit" postconf -P -e submission/inet/smtpd_sasl_auth_enable="yes" postconf -P -e submission/inet/smtpd_tls_security_level="encrypt" postconf -P -e submission/inet/syslog_name="postfix/submission" -{{ else }} +{{ else -}} postconf -M# submission/inet -{{ end }} +{{ end -}} diff --git a/templates/start.d/spamfilter b/templates/start.d/spamfilter new file mode 100755 index 0000000..fabf04a --- /dev/null +++ b/templates/start.d/spamfilter @@ -0,0 +1,6 @@ +#!/bin/bash + +# pass mail through spam filter Bogofilter +# arguments are passed on to sendmail + +/usr/bin/bogofilter -d /vmail/bogofilter -p {{ with getenv "BOGOFILTER_HAM_CUTOFF" }}--ham-cutoff '{{.}}'{{ end }} {{ with getenv "BOGOFILTER_SPAM_CUTOFF" }}--spam-cutoff '{{.}}'{{ end }} | /usr/sbin/sendmail "$@"