81 lines
3.5 KiB
Bash
81 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
source ./lib.sh
|
||
|
||
MAIL_SSL_DIR="/etc/ssl/mail"
|
||
MAIL_CERT="${MAIL_SSL_DIR}/fullchain.pem"
|
||
MAIL_KEY="${MAIL_SSL_DIR}/privkey.pem"
|
||
|
||
log "Postfix konfigurieren …"
|
||
postconf -e "myhostname = ${MAIL_HOSTNAME}"
|
||
postconf -e "myorigin = \$myhostname"
|
||
postconf -e "mydestination = "
|
||
postconf -e "inet_interfaces = all"
|
||
postconf -e "inet_protocols = ipv4"
|
||
postconf -e "smtpd_banner = \$myhostname ESMTP"
|
||
|
||
postconf -e "smtpd_tls_cert_file=${MAIL_CERT}"
|
||
postconf -e "smtpd_tls_key_file=${MAIL_KEY}"
|
||
postconf -e "smtpd_tls_security_level = may"
|
||
postconf -e "smtp_tls_security_level = may"
|
||
postconf -e "smtpd_tls_received_header = yes"
|
||
postconf -e "smtpd_tls_protocols=!SSLv2,!SSLv3"
|
||
postconf -e "smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3"
|
||
postconf -e "smtpd_tls_loglevel=1"
|
||
postconf -e "smtp_tls_loglevel=1"
|
||
|
||
postconf -e "disable_vrfy_command = yes"
|
||
postconf -e "smtpd_helo_required = yes"
|
||
|
||
postconf -e "milter_default_action = accept"
|
||
postconf -e "milter_protocol = 6"
|
||
postconf -e "smtpd_milters = inet:127.0.0.1:11332, inet:127.0.0.1:8891"
|
||
postconf -e "non_smtpd_milters = inet:127.0.0.1:11332, inet:127.0.0.1:8891"
|
||
|
||
postconf -e "smtpd_sasl_type = dovecot"
|
||
postconf -e "smtpd_sasl_path = private/auth"
|
||
postconf -e "smtpd_sasl_auth_enable = yes"
|
||
postconf -e "smtpd_sasl_security_options = noanonymous"
|
||
|
||
postconf -e "smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination"
|
||
postconf -e "smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination"
|
||
|
||
postconf -M "smtp/inet=smtp inet n - n - - smtpd -o smtpd_peername_lookup=no -o smtpd_timeout=30s"
|
||
postconf -M "submission/inet=submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_peername_lookup=no -o smtpd_tls_security_level=encrypt -o smtpd_tls_auth_only=yes -o smtpd_sasl_auth_enable=yes -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject"
|
||
postconf -M "smtps/inet=smtps inet n - n - - smtpd -o syslog_name=postfix/smtps -o smtpd_peername_lookup=no -o smtpd_tls_wrappermode=yes -o smtpd_tls_auth_only=yes -o smtpd_sasl_auth_enable=yes -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject"
|
||
postconf -M "pickup/unix=pickup unix n - y 60 1 pickup"
|
||
postconf -M "cleanup/unix=cleanup unix n - y - 0 cleanup"
|
||
postconf -M "qmgr/unix=qmgr unix n - n 300 1 qmgr"
|
||
|
||
install -d -o root -g postfix -m 750 /etc/postfix/sql
|
||
|
||
cat > /etc/postfix/sql/mysql-virtual-mailbox-maps.cf <<CONF
|
||
hosts = 127.0.0.1
|
||
user = ${DB_USER}
|
||
password = ${DB_PASS}
|
||
dbname = ${DB_NAME}
|
||
query = SELECT 1
|
||
FROM mail_users u
|
||
JOIN domains d ON d.id = u.domain_id
|
||
WHERE u.email = '%s' AND u.is_active = 1 AND d.is_active = 1
|
||
LIMIT 1;
|
||
CONF
|
||
chown root:postfix /etc/postfix/sql/mysql-virtual-mailbox-maps.cf
|
||
chmod 640 /etc/postfix/sql/mysql-virtual-mailbox-maps.cf
|
||
|
||
cat > /etc/postfix/sql/mysql-virtual-alias-maps.cf <<CONF
|
||
hosts = 127.0.0.1
|
||
user = ${DB_USER}
|
||
password = ${DB_PASS}
|
||
dbname = ${DB_NAME}
|
||
query = SELECT destination
|
||
FROM mail_aliases a
|
||
JOIN domains d ON d.id = a.domain_id
|
||
WHERE a.source = '%s' AND a.is_active = 1 AND d.is_active = 1
|
||
LIMIT 1;
|
||
CONF
|
||
chown root:postfix /etc/postfix/sql/mysql-virtual-alias-maps.cf
|
||
chmod 640 /etc/postfix/sql/mysql-virtual-alias-maps.cf
|
||
|
||
# Nur aktivieren – Start/Reload erst nach App/DB in 90-services.sh
|
||
systemctl enable postfix >/dev/null 2>&1 || true |