cronekorkn/bundlewrap
1
0
Fork 0
Code Issues Pull requests 8 Projects Releases Wiki Activity

Merge pull request 'autoconfig' (#5) from autoconfig into master

Browse source 
Reviewed-on: #5
This commit is contained in:
cronekorkn 2021-11-18 21:26:31 +01:00
commit 7309a20c47
14 changed files with 280 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
bundles/dovecot/files/sudors
View file

@ -1 +0,0 @@
www-data ALL=(ALL) NOPASSWD: /usr/bin/doveadm pw -s ARGON2ID

2
bundles/letsencrypt/files/hook.sh
View file

@ -9,8 +9,6 @@ deploy_challenge() {
update add $1.${zone}. 60 IN TXT \"$3\"
send
" | tee | nsupdate -y hmac-sha512:${acme_key_name}:${acme_key}
sleep 10
}
clean_challenge() {

2
bundles/letsencrypt/metadata.py
View file

@ -1,5 +1,3 @@
from ipaddress import ip_interface
defaults = {
'apt': {
'packages': {

3
bundles/mailserver-autoconfig/README.md Normal file
View file

@ -0,0 +1,3 @@
test autodiscover.php:
`curl -X POST https://autoconfig.mail.example.com/Autodiscover/Autodiscover.xml -d '<EMailAddress>test@example.com</EMailAddress>'`

83
bundles/mailserver-autoconfig/files/autodiscover.php Normal file
View file

@ -0,0 +1,83 @@
<?php
// https://raw.githubusercontent.com/Radiergummi/autodiscover/master/autodiscover/autodiscover.php
/********************************
* Autodiscover responder
********************************
* This PHP script is intended to respond to any request to http(s)://mydomain.com/autodiscover/autodiscover.xml.
* If configured properly, it will send a spec-complient autodiscover XML response, pointing mail clients to the
* appropriate mail services.
* If you use MAPI or ActiveSync, stick with the Autodiscover service your mail server provides for you. But if
* you use POP/IMAP servers, this will provide autoconfiguration to Outlook, Apple Mail and mobile devices.
*
* To work properly, you'll need to set the service (sub)domains below in the settings section to the correct
* domain names, adjust ports and SSL.
*/
//get raw POST data so we can extract the email address
$request = file_get_contents("php://input");
// optional debug log
# file_put_contents( 'request.log', $request, FILE_APPEND );
// retrieve email address from client request
preg_match( "/\<EMailAddress\>(.*?)\<\/EMailAddress\>/", $request, $email );
// check for invalid mail, to prevent XSS
if (filter_var($email[1], FILTER_VALIDATE_EMAIL) === false) {
throw new Exception('Invalid E-Mail provided');
}
// get domain from email address
$domain = substr( strrchr( $email[1], "@" ), 1 );
/**************************************
* Port and server settings below *
**************************************/
// IMAP settings
$imapServer = 'imap.' . $domain; // imap.example.com
$imapPort = 993;
$imapSSL = true;
// SMTP settings
$smtpServer = 'smtp.' . $domain; // smtp.example.com
$smtpPort = 587;
$smtpSSL = true;
//set Content-Type
header( 'Content-Type: application/xml' );
?>
<?php echo '<?xml version="1.0" encoding="utf-8" ?>'; ?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" >
<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
<Account>
<AccountType>email</AccountType>
<Action>settings</Action>
<Protocol>
<Protocol>
<Type>IMAP</Type>
<Server><?php echo $imapServer; ?></Server>
<Port><?php echo $imapPort; ?></Port>
<DomainRequired>off</DomainRequired>
<LoginName><?php echo $email[1]; ?></LoginName>
<SPA>off</SPA>
<SSL><?php echo $imapSSL ? 'on' : 'off'; ?></SSL>
<AuthRequired>on</AuthRequired>
</Protocol>
<Protocol>
<Type>SMTP</Type>
<Server><?php echo $smtpServer; ?></Server>
<Port><?php echo $smtpPort; ?></Port>
<DomainRequired>off</DomainRequired>
<LoginName><?php echo $email[1]; ?></LoginName>
<SPA>off</SPA>
<SSL><?php echo $smtpSSL ? 'on' : 'off'; ?></SSL>
<AuthRequired>on</AuthRequired>
<UsePOPAuth>on</UsePOPAuth>
<SMTPLast>on</SMTPLast>
</Protocol>
</Account>
</Response>
</Autodiscover>

57
bundles/mailserver-autoconfig/files/config-v1.1.xml Normal file
View file

@ -0,0 +1,57 @@
<?xml version="1.0"?>
<clientConfig version="1.1">
<!-- Outgoing Server -->
<emailProvider id="${mailserver}">
<!-- Hosted Domains -->
<domain>${mailserver}</domain>
<displayName>${mailserver}</displayName>
<displayShortName>${mailserver}</displayShortName>
<!-- Incoming Mail Servers -->
<incomingServer type="imap">
<hostname>${mailserver}</hostname>
<port>993</port>
<socketType>SSL</socketType>
<authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username>
</incomingServer>
<incomingServer type="imap">
<hostname>${mailserver}</hostname>
<port>143</port>
<socketType>STARTTLS</socketType>
<authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username>
</incomingServer>
<!-- Outgoing Mail Servers -->
<outgoingServer type="smtp">
<hostname>${mailserver}</hostname>
<port>465</port>
<socketType>SSL</socketType>
<authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username>
</outgoingServer>
<outgoingServer type="smtp">
<hostname>${mailserver}</hostname>
<port>587</port>
<socketType>STARTTLS</socketType>
<authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username>
</outgoingServer>
<!-- Documentation -->
<documentation url="http://www.example.com/help/mail/thunderbird">
<descr lang="en">Configure Thunderbird 2.0 for IMAP</descr>
<descr lang="de">Thunderbird 2.0 mit IMAP konfigurieren</descr>
</documentation>
</emailProvider>
<clientConfigUpdate url="https://${autoconfig}/mail/config-v1.1.xml" />
</clientConfig>

16
bundles/mailserver-autoconfig/items.py Normal file
View file

@ -0,0 +1,16 @@
autoconfig_hostname = node.metadata.get('mailserver/autoconfig_hostname')
files = {
f'/var/www/{autoconfig_hostname}/mail/config-v1.1.xml': {
'content_type': 'mako',
'context': {
'mailserver': node.metadata.get('mailserver/hostname'),
'autoconfig': autoconfig_hostname,
},
'owner': 'www-data',
},
f'/var/www/{autoconfig_hostname}/autodiscover/autodiscover.php': {
'content_type': 'mako',
'owner': 'www-data',
},
}

78
bundles/mailserver-autoconfig/metadata.py Normal file
View file

@ -0,0 +1,78 @@
defaults = {}
@metadata_reactor.provides(
'mailserver/autoconfig_hostname',
)
def hostname(metadata):
return {
'mailserver': {
'autoconfig_hostname': f"autoconfig.{metadata.get('mailserver/hostname')}",
},
}
@metadata_reactor.provides(
'nginx/vhosts',
)
def nginx(metadata):
return {
'nginx': {
'vhosts': {
metadata.get('mailserver/autoconfig_hostname'): {
'content': 'mailserver-autodiscover/vhost.conf',
'context': {
'root': f"/var/www/{metadata.get('mailserver/autoconfig_hostname')}",
},
},
},
},
}
@metadata_reactor.provides(
'letsencrypt/domains',
)
def letsencrypt(metadata):
return {
'letsencrypt': {
'domains': {
metadata.get('mailserver/autoconfig_hostname'): {
'aliases': {
*{
f'autoconfig.{domain}'
for domain in metadata.get('mailserver/domains')
},
*{
f'autodiscover.{domain}'
for domain in metadata.get('mailserver/domains')
},
},
},
},
},
}
@metadata_reactor.provides(
'dns',
)
def autoconfig(metadata):
dns = {}
for domain in metadata.get('mailserver/domains'):
dns.update({
f'autoconfig.{domain}': {
'CNAME': {f"{metadata.get('mailserver/autoconfig_hostname')}."},
},
f'_autodiscover._tcp.{domain}': {
'SRV': {f"10 10 443 {metadata.get('mailserver/autoconfig_hostname')}."},
},
f'autodiscover.{domain}': {
'CNAME': {f"{metadata.get('mailserver/autoconfig_hostname')}."},
},
})
return {
'dns': dns,
}

33
bundles/postfix/files/master.cf
View file

@ -42,14 +42,25 @@ mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_auth_only=yes
-o smtpd_reject_unlisted_recipient=no
-o smtpd_client_restrictions=$mua_client_restrictions
-o smtpd_helo_restrictions=$mua_helo_restrictions
-o smtpd_sender_restrictions=$mua_sender_restrictions
-o smtpd_recipient_restrictions=
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_auth_only=yes
-o smtpd_reject_unlisted_recipient=no
-o smtpd_client_restrictions=$mua_client_restrictions
-o smtpd_helo_restrictions=$mua_helo_restrictions
-o smtpd_sender_restrictions=$mua_sender_restrictions
-o smtpd_recipient_restrictions=
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
smtps inet n - y - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_reject_unlisted_recipient=no
-o smtpd_client_restrictions=$mua_client_restrictions
-o smtpd_helo_restrictions=$mua_helo_restrictions
-o smtpd_sender_restrictions=$mua_sender_restrictions
-o smtpd_recipient_restrictions=
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING

1
data/dkim/wiegand.tel.privkey.enc Normal file
View file

@ -0,0 +1 @@
encrypt$gAAAAABhlq_D2jvj7dxi_FGdRARCtVD03iEUWDY3dyX-wzZmc1MlyW4c2hOv-K1FzXzH3Ki9kdniBVtu3V8eewizG7p1eZAwO-hn4mD2WJOV30pHo2_ZLiS8UDCtxDTvAYhNILiCVefZVb_-8RWBpojIhI3MEB7GHbHWuTb6vNFMuS4pGGTMqXRH5HFQOsVxp6ID7vTKL_sRc3hM_wNncGd0Nh02BPMC9JzuGLuVJPBWEfzslPfkmTy_6qN-D-cppFkXcR7aLOWtfOQxPnZy5vZ_3vT5LDSG9B1xjVuFcUXsb8_f0K6gu3pkrjJOsi5_CuJhterC9mYXp0A3vo7AVRFAuZHL0Y7cSb_kmbWGmqCi2-wqHSjnl5jkdLjvT8qWoftdpYt0cIDNkiAOaU9JSf4J6GCK2Ph5ZYZAoSu7jjYrysqjuW3EzfrYFYNGrvWzP3ZLGggMb8aCmwOqDRmeOF859nO2O4_dUpeBSEwvihv8cO5WCgZKm2-niGf_UprmGWtqKOxZ-Oix0DQ4npaf2u65X1xXahXsxJH-UCkymrW7p7qzrLOCH0E0B90HhhL2U4IGMxUtYV0egX2vHg45b1YSnLRg3lQmCk6SUitcrNCWmwTRMilsY-RRcYOQFu3-Z9Pbz3QTLGGOTeFAhi1jqdhP3CObtKRbkhRc8FXABiErrNkAcWYM-SW3lqWAZbVhDewfD0m_uQuEJLDpHFNnqW_xCJiFpC-1RIXBwcGDCCoki0Gto8S1EdsIk-c7taq6F1cR__eXc6E3phIh9C7GignOUnlwlz1qvJ6zKZ5BXeUxI_MlSxZy18KTVjUhxrk4X-p8x4CSVrPR7yi5k9Pr31KdqjUSileb5byZIORkiyh6UCx40ODf98zLJVFF3NxiFRrAGRDFyKQ-bWX2JTGZ0M62CSkFdqM7rA6IenZ0WpVWY4jNu8u8ir-IMgLNP_iQzJGSSXsJn-hMI580fza_dJD8L-A05u0ZcAMcEXAQ7Vs9X3ilCcqQd-vZJIPlIc6lUch_evNBwreRSZ32I5GabVYWLbXKO1wJUi6fIzHmLY_vYNPpF15mDqcMbHcIxyDgua-zFGeK51PI9vHlbgfnDbHdqvXm8hGVI8R5fVFr_CTTqHBXAXkzYTtRd1YgNf4ibbdWyx6Bx0l_Zper21-FHnbjgDLKG9yeKz-5SLIL0F_uY_K4WdEn9UVlC5BP7OS2etk-pFXOgKdJry91jlZ-7NdEwki7mwYYndO_rNCMcjPvmQ1V050dh4kZNOYBHo18roFgojgiJSDYv3CSziXXHUAEiELXnfhssarF7OZ3blM9K6RNSz2vKx4blVifTYhA3zcyLa5vPJyn2zySLHU9u4-E_UDe9lYa7esCJhBhWi1PtqMC8nIJmU-DW3vcb_Jkc7MuKUBIcPLlSiJu5Y7lV469-rztRbj6BaNJQCtXgYii8dZgeA5GsUSc6ofwWKgmA7aCdL5xcQWYlQ7nho0HNapSjqe7uh3fwLxud2BExfJRd9T2HWScoZ77qbRuHn4zp5fdZQD26fbmMgMVpP7PjB1pBXOnmVIyJBXqN2KhemRYul9RL7YjeuydFgM-Ek8II0WdZf0S0dbzjRmLNHz8hoVwHV18V7yTXazx6vYTIzrhQlcY8Q91VyuYuA8EV-AbdM5WxFKCUr4NDSOrJzCXray0HjD2YY_MdqRbD3-IdQGqm5LM9yHq9YqVskGc1HU0eA_jt-Sst7YclyfZl01LvG_tvg-rz1eCAO8rzGt5M_x7FJZdxKrQW8L_fyONtPhgdzYg6aYToKZhsN8iR-mFbsfJ8097H3KVtfmXPijrdiJRCrhkp-0MGhS8WHUplbhlxXyxgzzaXkTdTWp4pEc4ei6YpZ_f6IVBKKRlFVlsua-0J9PbZVFAX2D_tUMFI5NlwLoKHUm7WNFBypRULdp6xiW8fDboZi6daZ8kCQRNbhqgZRxZQs1Wy5OH6yZxBJC1J6sY38n36Y6UP_xLYUnAlaHITu2dyIShvpRgZQCDYxeWv8oaJxodFiGpJaMOBukozz4sVL_-dBIQxK9_oGTyE-5wPo_5ad-fuhd2lnCYDtWhDhSNaKrk0yMRhFgRNAQzMFBKPibUvpLX5NGek8VcP5KRO3dbLB8Q3QacjWe2CI3Y16Ix1HqPCAZ1j79A-LmowoYq7qhTUHoVYJ4zf2Jd2zeuaMjdpZ4Bej0Be6dJNpZBsolXQl-QJPlw08ZUf1HbP-XhT0URcVQt9reAHU-G77rJVSo30OrrsDRjNxvh0LVnzrvaeFdtEl6rKh_Qtli6vNDBOCk1hNre6cKDgjCy-O-rOKdOwmBueXI5tEJMNaFLOoX29elGTHE=

1
data/dkim/wiegand.tel.pubkey Normal file
View file

@ -0,0 +1 @@
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxvB69VOHK0vJ0yumq5TR9/29N0PQiZj4HQJ1hMdQGuwt3zozDR7vvgINJ5lJo8NXcZEJtbRbkIEJLJFvMiGfALNYU/Lcgpfc0bfCgWgwsvFe2P8JrcxSDf0M0eEV/k78agXVn75b5eWDCPPSm16XqjK8RlNz3LJo7ENkVAZshPg4mRm039ejAFmKKCirfzw3l4uZak9czSQxlLmOd503uiu0ljlguwHoNRX2FLSi77mdDYQl16BtHgu96fJL0ruiokfyuBi0Ves1LX2Fc4KQIzk1cgEt/dSZvQBkvYH/idR48rVgOT+lGyT30y2VbyFK0rCSft8tcC7HDoqYi2zJQQIDAQAB

16
data/mailserver-autodiscover/vhost.conf Normal file
View file

@ -0,0 +1,16 @@
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name ${server_name};
ssl_certificate /var/lib/dehydrated/certs/${server_name}/fullchain.pem;
ssl_certificate_key /var/lib/dehydrated/certs/${server_name}/privkey.pem;
root ${root};
location ~ /(?:a|A)utodiscover/(?:a|A)utodiscover.xml {
try_files /autodiscover/autodiscover.php =404;
fastcgi_pass php-handler;
include fastcgi.conf;
}
}

1
groups/applications/mailserver.py
View file

@ -4,6 +4,7 @@
'dovecot',
'letsencrypt',
'mailserver',
'mailserver-autoconfig',
'nginx',
'php',
'postfix',

6
nodes/netcup.mails.py
View file

@ -38,13 +38,13 @@
'freibrief.net',
'nadenau.net',
'naeder.net',
'rolfwerner.eu',
'wettengl.net',
'wingl.de',
'woodpipe.de',
'ckn.li',
'islamicstate.eu',
'hausamsilberberg.de',
'wiegand.tel',
},
},
'dns': {
@ -80,10 +80,8 @@
'freibrief.net',
'nadenau.net',
'naeder.net',
'rolfwerner.eu',
'wettengl.net',
'wingl.de',
'woodpipe.de',
'wiegand.tel',
},
},
'rspamd': {