cronekorkn/bundlewrap
1
0
Fork 0
Code Issues Pull requests 8 Projects Releases Wiki Activity

wip

Browse source
This commit is contained in:
mwiegand 2021-06-15 00:51:07 +02:00
parent 72b7f38553
commit c146491367
7 changed files with 103 additions and 293 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
bundles/dovecot/files/dovecot-sql.conf
View file

@ -8,10 +8,3 @@ password_query = SELECT CONCAT(users.name, '@', domains.name) AS user, password\
WHERE redirect IS NULL \ WHERE redirect IS NULL \
AND users.name = SPLIT_PART('%u', '@', 1) \ AND users.name = SPLIT_PART('%u', '@', 1) \
AND domains.name = SPLIT_PART('%u', '@', 2) AND domains.name = SPLIT_PART('%u', '@', 2)
user_query = SELECT CONCAT(users.name, '@', domains.name) AS user, '/var/vmail/%u' AS home \
FROM users \
LEFT JOIN domains ON users.domain_id = domains.id \
WHERE redirect IS NULL \
AND users.name = SPLIT_PART('%u', '@', 1) \
AND domains.name = SPLIT_PART('%u', '@', 2)

152
bundles/dovecot/files/dovecot.conf
View file

@ -1,138 +1,52 @@
!include conf.d/*.conf auth_mechanisms = plain login
mail_privileged_group = mail
ssl = required
ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
ssl_dh = </etc/dovecot/dhparam.pem
ssl_client_ca_dir = /etc/ssl/certs
mail_location = maildir:~/Maildir
namespace inbox { namespace inbox {
separator = .
type = private
inbox = yes inbox = yes
location = separator = .
mailbox Drafts { mailbox Drafts {
auto = subscribe
special_use = \Drafts special_use = \Drafts
} }
mailbox Junk { mailbox Junk {
auto = create
special_use = \Junk special_use = \Junk
autoexpunge = 30d
}
mailbox Sent {
auto = subscribe
special_use = \Sent
} }
mailbox Trash { mailbox Trash {
auto = subscribe
special_use = \Trash special_use = \Trash
autoexpunge = 360d
} }
prefix = mailbox Sent {
} special_use = \Sent
}
mail_location = maildir:/var/vmail/%u mailbox "Sent Messages" {
protocols = imap lmtp sieve special_use = \Sent
}
ssl = yes
ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
ssl_dh = </etc/dovecot/ssl/dhparam.pem
ssl_min_protocol = TLSv1.2
ssl_cipher_list = EECDH+AESGCM:EDH+AESGCM
ssl_prefer_server_ciphers = yes
login_greeting = IMAPd ready
auth_mechanisms = plain login
disable_plaintext_auth = yes
mail_plugins = $mail_plugins zlib
plugin {
zlib_save_level = 6
zlib_save = gz
sieve_plugins = sieve_imapsieve sieve_extprograms
sieve_dir = /var/vmail/sieve/%u/
sieve = /var/vmail/sieve/%u.sieve
sieve_pipe_bin_dir = /var/vmail/sieve/bin
sieve_extensions = +vnd.dovecot.pipe
old_stats_refresh = 30 secs
old_stats_track_cmds = yes
% if node.has_bundle('rspamd'):
sieve_before = /var/vmail/sieve/global/spam-global.sieve
# From elsewhere to Spam folder
imapsieve_mailbox1_name = Junk
imapsieve_mailbox1_causes = COPY
imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve
# From Spam folder to elsewhere
imapsieve_mailbox2_name = *
imapsieve_mailbox2_from = Junk
imapsieve_mailbox2_causes = COPY
imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve
% endif
}
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
unix_listener auth-userdb {
mode = 0660
user = nobody
group = nogroup
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
mode = 0600
user = postfix
}
}
service imap {
executable = imap
}
service imap-login {
service_count = 1
process_min_avail = 8
vsz_limit = 64M
}
service managesieve-login {
inet_listener sieve {
port = 4190
}
}
userdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf
} }
passdb { passdb {
driver = sql driver = sql
args = /etc/dovecot/dovecot-sql.conf args = /etc/dovecot/dovecot-sql.conf
}
userdb {
driver = static
args = uid=vmail gid=vmail home=/var/vmail/%u
} }
protocol lmtp { service auth {
mail_plugins = $mail_plugins sieve unix_listener /var/spool/postfix/private/auth {
postmaster_address = ${admin_email} mode = 0660
user = postfix
group = postfix
}
} }
service lmtp {
protocol imap { unix_listener /var/spool/postfix/private/dovecot-lmtp {
mail_plugins = $mail_plugins imap_zlib imap_sieve imap_old_stats group = postfix
mail_max_userip_connections = 50 mode = 0600
imap_idle_notify_interval = 29 mins user = postfix
} }
protocol sieve {
plugin {
sieve = /var/vmail/sieve/%u.sieve
sieve_storage = /var/vmail/sieve/%u/
}
} }

32
bundles/dovecot/items.py
View file

@ -1,6 +1,9 @@
assert node.has_bundle('mailserver') assert node.has_bundle('mailserver')
directories = { directories = {
'/etc/dovecot': {
'purge': True,
},
'/etc/dovecot/ssl': {}, '/etc/dovecot/ssl': {},
'/var/vmail': { '/var/vmail': {
'owner': 'vmail', 'owner': 'vmail',
@ -8,17 +11,14 @@ directories = {
} }
} }
# groups['vmail'] = { groups['vmail'] = {}
# 'gid': 5000,
# } users['vmail'] = {
# 'home': '/var/vmail',
# users['vmail'] = { 'needs': [
# 'uid': 5000, 'group:vmail',
# 'home': '/var/vmail', ]
# 'needs': [ }
# 'group:vmail',
# ]
# }
files = { files = {
'/etc/dovecot/dovecot.conf': { '/etc/dovecot/dovecot.conf': {
@ -43,15 +43,19 @@ files = {
'svc_systemd:dovecot:restart', 'svc_systemd:dovecot:restart',
}, },
}, },
'/etc/dovecot/dhparam.pem': {
'content_type': 'any',
},
} }
actions = { actions = {
'dovecot_generate_dhparam': { 'dovecot_generate_dhparam': {
'command': 'openssl dhparam -out /etc/dovecot/ssl/dhparam.pem 2048', 'command': 'openssl dhparam -out /etc/dovecot/dhparam.pem 2048',
'unless': 'test -f /etc/dovecot/ssl/dhparam.pem', 'unless': 'test -f /etc/dovecot/dhparam.pem',
'cascade_skip': False, 'cascade_skip': False,
'needs': { 'needs': {
'pkg_apt:' 'pkg_apt:',
'directory:/etc/dovecot/ssl',
}, },
'triggers': { 'triggers': {
'svc_systemd:dovecot:restart', 'svc_systemd:dovecot:restart',

6
bundles/dovecot/metadata.py
View file

@ -4,10 +4,10 @@ defaults = {
'apt': { 'apt': {
'packages': { 'packages': {
'dovecot-imapd': {}, 'dovecot-imapd': {},
'dovecot-lmtpd': {},
'dovecot-managesieved': {},
'dovecot-pgsql': {}, 'dovecot-pgsql': {},
'dovecot-sieve': {}, 'dovecot-lmtpd': {},
# 'dovecot-sieve': {},
# 'dovecot-managesieved': {},
}, },
}, },
'letsencrypt': { 'letsencrypt': {

2
bundles/mailserver/metadata.py
View file

@ -4,7 +4,7 @@ defaults = {
'mailserver': { 'mailserver': {
'maildir': '/var/vmail', 'maildir': '/var/vmail',
'database': { 'database': {
'host': 'localhost', 'host': '127.0.0.1', # dont use localhost
'name': 'mailserver', 'name': 'mailserver',
'user': 'mailserver', 'user': 'mailserver',
'password': database_password, 'password': database_password,

52
bundles/postfix/files/main.cf
View file

@ -1,63 +1,39 @@
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no readme_directory = no
compatibility_level = 2
# TLS parameters
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.sublimity.de/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.sublimity.de/privkey.pem
smtpd_use_tls=yes smtpd_use_tls=yes
<%text> <%text>
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
</%text> </%text>
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.sublimity.de myhostname = debian-2gb-nbg1-1
alias_maps = hash:/etc/aliases alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases alias_database = hash:/etc/aliases
myorigin = /etc/mailname myorigin = /etc/mailname
mydestination = mail.sublimity.de, localhost.localdomain, localhost mydestination = $myhostname, mail2.sublimity.de, debian-2gb-nbg1-1, localhost.localdomain, localhost
relayhost = relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0 mailbox_size_limit = 0
recipient_delimiter = + recipient_delimiter = +
inet_interfaces = all inet_interfaces = all
inet_protocols = all inet_protocols = all
virtual_mailbox_domains = psql:/etc/postfix/virtual_domains.cf
virtual_mailbox_maps = psql:/etc/postfix/virtual_mailboxes.cf virtual_mailbox_domains = pgsql:/etc/postfix/virtual_mailbox_domains.cf
virtual_alias_maps = psql:/etc/postfix/virtual_aliases.cf,psql:/etc/postfix/virtual_mailboxes.cf virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf
virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf,pgsql:/etc/postfix/virtual_mailbox_maps.cf
smtpd_sender_login_maps = pgsql:/etc/postfix/email2email.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_transport = lmtp:unix:private/dovecot-lmtp
smtpd_sasl_type = dovecot smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes smtpd_sasl_auth_enable = yes
smtpd_tls_security_level = may smtpd_tls_security_level = may
smtpd_tls_auth_only = yes smtpd_tls_auth_only = yes
message_size_limit = 1000000000 smtpd_tls_cert_file = /var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
smtpd_milters = unix:/spamass/spamass.sock smtpd_tls_key_file = /var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
milter_connect_macros = i j {daemon_name} v {if_name} _ smtp_tls_security_level = may
policyd-spf_time_limit = 3600
smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,check_policy_service unix:private/policyd-spf
# reject_rbl_client dnsbl.sorbs.net
# reject_rbl_client bl.spamcop.net
# reject_rbl_client zen.spamhaus.org
# reject_rbl_client dnsbl1.uceprotect.net
# reject_unauth_destination

145
bundles/postfix/files/master.cf
View file

@ -1,124 +1,37 @@
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ========================================================================== # ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args # service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100) # (yes) (yes) (no) (never) (100)
# ========================================================================== # ==========================================================================
smtp inet n - - - - smtpd smtp inet n - y - - smtpd
#smtp inet n - - - 1 postscreen pickup unix n - y 60 1 pickup
#smtpd pass - - - - - smtpd cleanup unix n - y - 0 cleanup
#dnsblog unix - - - - 0 dnsblog
#tlsproxy unix - - - - 0 tlsproxy
#submission inet n - - - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
submission inet n - - - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
#smtps inet n - - - - smtpd
# -o syslog_name=postfix/smtps
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - - - - qmqpd
pickup unix n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr unix n - n 300 1 qmgr qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr tlsmgr unix - - y 1000? 1 tlsmgr
tlsmgr unix - - - 1000? 1 tlsmgr rewrite unix - - y - - trivial-rewrite
rewrite unix - - - - - trivial-rewrite bounce unix - - y - 0 bounce
bounce unix - - - - 0 bounce defer unix - - y - 0 bounce
defer unix - - - - 0 bounce trace unix - - y - 0 bounce
trace unix - - - - 0 bounce verify unix - - y - 1 verify
verify unix - - - - 1 verify flush unix n - y 1000? 0 flush
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp smtp unix - - y - - smtp
relay unix - - - - - smtp relay unix - - y - - smtp
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 -o syslog_name=postfix/$service_name
showq unix n - - - - showq showq unix n - y - - showq
error unix - - - - - error error unix - - y - - error
retry unix - - - - - error retry unix - - y - - error
discard unix - - - - - discard discard unix - - y - - discard
local unix - n n - - local local unix - n n - - local
virtual unix - n n - - virtual virtual unix - n n - - virtual
lmtp unix - - - - - lmtp lmtp unix - - y - - lmtp
anvil unix - - - - 1 anvil anvil unix - - y - 1 anvil
scache unix - - - - 1 scache scache unix - - y - 1 scache
# postlog unix-dgram n - n - 1 postlogd
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient} flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe bsmtp unix - n n - - pipe
@ -128,5 +41,15 @@ scalemail-backend unix - n n - 2 pipe
mailman unix - n n - - pipe mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user} ${nexthop} ${user}
policyd-spf unix - n n - 0 spawn submission inet n - y - - smtpd
user=policyd-spf argv=/usr/bin/policyd-spf -o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_auth_only=yes
-o smtpd_reject_unlisted_recipient=no
-o smtpd_client_restrictions=$mua_client_restrictions
-o smtpd_helo_restrictions=$mua_helo_restrictions
-o smtpd_sender_restrictions=$mua_sender_restrictions
-o smtpd_recipient_restrictions=
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING