test/lib/mail.sh

#!/bin/bash
#
# Mail Service

PATH=$HOME/.docker/cli-plugins:/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

config_mail() {
  echo -ne "\n* Configuring /federated/apps/mail container.."

  if [ ! -d "/federated/apps/mail" ]; then
    mkdir -p /federated/apps/mail/data/root/certs &> /dev/null
    mkdir -p /federated/apps/mail/data/var/mail &> /dev/null
    mkdir -p /federated/apps/mail/data/var/mail-state &> /dev/null
    mkdir -p /federated/apps/mail/data/var/log/mail &> /dev/null
    mkdir -p /federated/apps/mail/data/tmp/docker-mailserver &> /dev/null
    cp /federated/certs/certs/$DOMAIN.crt /federated/certs/private/$DOMAIN.key /federated/apps/mail/data/root/certs/
  fi

cat > /federated/apps/mail/docker-compose.yml <<EOF
version: '3.7'

services:
  mail:
    image: docker.io/mailserver/docker-mailserver:\${IMAGE_VERSION}
    container_name: mail
    hostname: mail.$DOMAIN
    domainname: $DOMAIN
    restart: always
    networks:
      federated:
        ipv4_address: 172.99.0.16
    ports:
      - "25:25"
      - "143:143"
      - "465:465"
      - "587:587"
      - "993:993"
    volumes:
      - ./data/root/certs:/root/certs
      - ./data/var/mail:/var/mail/
      - ./data/var/mail-state:/var/mail-state/
      - ./data/var/log/mail:/var/log/mail/
      - ./data/tmp/docker-mailserver:/tmp/docker-mailserver/
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - ./.env
    cap_add:
      - NET_ADMIN
      - SYS_PTRACE

networks:
  federated:
    external: true
EOF

LDAP_SECRET=`cat /federated/apps/ldap/.ldap.secret`

cat > /federated/apps/mail/.env <<EOF
IMAGE_VERSION="12.1"
ENABLE_SPAMASSASSIN=1
ENABLE_SPAMASSASSIN_KAM=1
SPAMASSASSIN_SPAM_TO_INBOX=1
ENABLE_CLAMAV=0
ENABLE_FAIL2BAN=1
ENABLE_POSTGREY=1
ENABLE_OPENDKIM=1
ENBALE_OPENDMARC=1
ONE_DIR=1
DMS_DEBUG=0
LOG_LEVEL=debug
ENABLE_LDAP=1
SSL_TYPE=manual
SSL_CERT_PATH=/root/certs/$DOMAIN.crt
SSL_KEY_PATH=/root/certs/$DOMAIN.key
LDAP_START_TLS=yes
DOVECOT_TLS=yes
SASLAUTHD_LDAP_START_TLS=yes
LDAP_SERVER_HOST=ldap.$DOMAIN
LDAP_SEARCH_BASE=ou=people,dc=federatedcomputer,dc=cloud
LDAP_BIND_DN=cn=admin,dc=federatedcomputer,dc=cloud
LDAP_BIND_PW=$LDAP_SECRET
LDAP_QUERY_FILTER_USER=(&(mail=%s)(mailEnabled=TRUE))
LDAP_QUERY_FILTER_GROUP=(&(mailGroupMember=%s)(mailEnabled=TRUE))
LDAP_QUERY_FILTER_ALIAS=(|(&(mailAlias=%s)(objectClass=PostfixBookMailForward))(&(mailAlias=%s)(objectClass=inetOrgPerson)(mailEnabled=TRUE)))
LDAP_QUERY_FILTER_DOMAIN=(mail=%u@$DOMAIN)
# DOVECOT
DOVECOT_PASS_FILTER=(&(objectClass=inetOrgPerson)(mail=%u))
DOVECOT_USER_FILTER=(&(objectClass=inetOrgPerson)(mail=%u))
DOVECOT_USER_ATTRS=homeDirectory=home,=uid=5000,=gid=5000
# SASLAUTHD
ENABLE_SASLAUTHD=1
SASLAUTHD_MECHANISMS=ldap
SASLAUTHD_LDAP_SERVER=ldap.$DOMAIN
SASLAUTHD_LDAP_BIND_DN=cn=admin,dc=federatedcomputer,dc=cloud
SASLAUTHD_LDAP_PASSWORD=$LDAP_SECRET
SASLAUTHD_LDAP_SEARCH_BASE=ou=people,dc=federatedcomputer,dc=cloud
SASLAUTHD_LDAP_FILTER=(&(objectClass=inetOrgPerson)(mail=%U@%r))
POSTMASTER_ADDRESS=postmaster@localhost.localdomain
POSTFIX_MESSAGE_SIZE_LIMIT=100000000
EOF
chmod 600 /federated/apps/mail/.env

cat > /federated/apps/mail/data/tmp/docker-mailserver/postfix-main.cf <<'EOF'
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unknown_sender_domain, reject_sender_login_mismatch, reject_unknown_reverse_client_hostname, reject_unknown_client_hostname
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_invalid_helo_hostname, check_policy_service unix:private/policyd-spf
smtpd_sender_login_maps = ldap:/etc/postfix/ldap-aliases.cf
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname
EOF

cat > /federated/apps/mail/data/tmp/docker-mailserver/fail2ban-jail.cf <<'EOF'
[DEFAULT]

# "bantime" is the number of seconds that a host is banned.
bantime = 3h

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 5m

# "maxretry" is the number of failures before a host get banned.
maxretry = 12

# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator.
ignoreip = 127.0.0.1/8,172.99.0.0/16

# default ban action
# nftables-multiport: block IP only on affected port
# nftables-allports:  block IP on all ports
banaction = nftables-allports

[dovecot]
enabled = true

[postfix]
enabled = true

[postfix-sasl]
enabled = true

# This jail is used for manual bans.
# To ban an IP address use: setup.sh fail2ban ban <IP>
[custom]
enabled = true
bantime = 180d
port = smtp,pop3,pop3s,imap,imaps,submission,submissions,sieve
EOF

  echo -ne "done."
}
start_mail() {
  # Start service with command to make sure it's up before proceeding
  start_service "mail" "nc -z 172.99.0.16 25 &> /dev/null" "25"

  # Generate the DKIM DNS key and setup
  docker exec mail setup config dkim
  docker exec mail setup config dkim keysize 2048 domain $DOMAIN &> /dev/null
  [ $? -ne 0 ] && fail "Couldn't generate DKIM record"

  docker exec mail bash -c "setup config dkim domain '$DOMAIN'"
  [ $? -ne 0 ] && fail "Couldn't setup DKIM domain"

  # Insert the DKIM DNS TXT entry into /federated/apps/pdns container
  DKIM_RECORD_STRIP=`cat /federated/apps/mail/data/tmp/docker-mailserver/opendkim/keys/$DOMAIN/mail.txt | sed 's/.*(//'`
  DKIM_RECORD=`echo $DKIM_RECORD_STRIP | sed 's/).*//'`
  docker exec pdns pdnsutil add-record $DOMAIN mail._domainkey TXT 86400 "$DKIM_RECORD" &> /dev/null
  [ $? -ne 0 ] && fail "Couldn't insert DKIM record into /federated/apps/pdns container"

  # Insert the DMARC DNS TXT entry into /federated/apps/pdns container
  docker exec pdns pdnsutil add-record $DOMAIN _dmarc TXT 86400 "\"v=DMARC1; p=quarantine; rua=mailto:admin@$DOMAIN; ruf=mailto:admin@$DOMAIN; sp=none; ri=86400\"" &> /dev/null
  [ $? -ne 0 ] && fail "Couldn't insert DMARC record into /federated/apps/pdns container"

  # Stop and Start mail to reload DKIM
  /federated/bin/stop mail &> /dev/null
  /federated/bin/start mail &> /dev/null

  echo -ne "done."
}