2021-12-10 22:24:46 +00:00
FROM docker.io/debian:11-slim
2019-10-23 09:22:23 +00:00
2021-01-16 09:16:05 +00:00
ARG VCS_VER
2019-10-23 09:22:23 +00:00
ARG VCS_REF
2021-01-16 09:16:05 +00:00
ARG DEBIAN_FRONTEND = noninteractive
2019-10-23 09:22:23 +00:00
2021-05-15 09:11:10 +00:00
ARG FAIL2BAN_DEB_URL = https://github.com/fail2ban/fail2ban/releases/download/0.11.2/fail2ban_0.11.2-1.upstream1_all.deb
ARG FAIL2BAN_DEB_ASC_URL = ${ FAIL2BAN_DEB_URL } .asc
ARG FAIL2BAN_GPG_PUBLIC_KEY_ID = 0x683BF1BEBD0A882C
2021-06-22 08:37:44 +00:00
ARG FAIL2BAN_GPG_PUBLIC_KEY_SERVER = hkps://keyserver.ubuntu.com
2021-05-15 09:11:10 +00:00
ARG FAIL2BAN_GPG_FINGERPRINT = "8738 559E 26F6 71DF 9E2C 6D9E 683B F1BE BD0A 882C"
2021-01-16 09:16:05 +00:00
LABEL org.opencontainers.image.version= ${ VCS_VER }
LABEL org.opencontainers.image.revision= ${ VCS_REF }
LABEL org.opencontainers.image.title= "docker-mailserver"
LABEL org.opencontainers.image.vendor= "The Docker Mailserver Organization"
LABEL org.opencontainers.image.authors= "The Docker Mailserver Organization on GitHub"
LABEL org.opencontainers.image.licenses= "MIT"
LABEL org.opencontainers.image.description= "A fullstack but simple mail server (SMTP, IMAP, LDAP, Antispam, Antivirus, etc.). Only configuration files, no SQL database."
LABEL org.opencontainers.image.url= "https://github.com/docker-mailserver"
LABEL org.opencontainers.image.documentation= "https://github.com/docker-mailserver/docker-mailserver/blob/master/README.md"
LABEL org.opencontainers.image.source= "https://github.com/docker-mailserver/docker-mailserver"
2015-03-28 14:59:15 +00:00
2017-08-07 15:39:40 +00:00
ENV ENABLE_POSTGREY = 0
2017-10-04 20:10:18 +00:00
ENV FETCHMAIL_POLL = 300
2021-08-31 11:50:56 +00:00
ENV ONE_DIR = 1
2021-01-16 09:16:05 +00:00
ENV POSTGREY_AUTO_WHITELIST_CLIENTS = 5
2017-08-07 15:39:40 +00:00
ENV POSTGREY_DELAY = 300
ENV POSTGREY_MAX_AGE = 35
2021-01-16 09:16:05 +00:00
ENV POSTGREY_TEXT = "Delayed by Postgrey"
2017-08-07 15:39:40 +00:00
ENV SASLAUTHD_MECHANISMS = pam
ENV SASLAUTHD_MECH_OPTIONS = ""
2017-03-14 14:22:19 +00:00
2019-08-13 09:41:38 +00:00
SHELL [ "/bin/bash" , "-o" , "pipefail" , "-c" ]
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
# --- Install Basic Software --------------------
# -----------------------------------------------
2021-01-16 09:16:05 +00:00
2019-12-31 15:34:21 +00:00
RUN \
2021-02-21 22:36:09 +00:00
apt-get -qq update && \
2021-06-08 23:07:01 +00:00
apt-get -qq install apt-utils 2>/dev/null && \
apt-get -qq dist-upgrade && \
2022-03-06 19:52:38 +00:00
echo "applying workaround for ubuntu/postfix bug described in https://github.com/docker-mailserver/docker-mailserver/issues/2023#issuecomment-855326403" && \
mv /bin/hostname{ ,.bak} && \
echo "echo docker-mailserver.invalid" > /bin/hostname && \
chmod +x /bin/hostname && \
2021-06-08 23:07:01 +00:00
apt-get -qq install postfix && \
2022-03-06 19:52:38 +00:00
mv /bin/hostname{ .bak,} && \
2021-06-08 23:07:01 +00:00
apt-get -qq --no-install-recommends install \
2021-01-18 19:51:56 +00:00
# A - D
2021-05-19 19:18:06 +00:00
altermime amavisd-new apt-transport-https arj binutils bzip2 bsd-mailx \
2021-02-23 19:03:01 +00:00
ca-certificates cabextract clamav clamav-daemon cpio curl \
2021-07-05 10:25:26 +00:00
dbconfig-no-thanks dovecot-core dovecot-fts-xapian dovecot-imapd \
dovecot-ldap dovecot-lmtpd dovecot-managesieved dovecot-pop3d \
dovecot-sieve dovecot-solr dumb-init \
2021-01-18 19:51:56 +00:00
# E - O
2021-05-15 09:11:10 +00:00
ed fetchmail file gamin gnupg gzip iproute2 iptables \
2021-12-25 19:44:24 +00:00
locales logwatch lhasa libdate-manip-perl libldap-common liblz4-tool \
2021-01-16 09:16:05 +00:00
libmail-spf-perl libnet-dns-perl libsasl2-modules lrzip lzop \
netcat-openbsd nomarch opendkim opendkim-tools opendmarc \
# P - Z
pax pflogsumm postgrey p7zip-full postfix-ldap postfix-pcre \
postfix-policyd-spf-python postsrsd pyzor \
razor rpm2cpio rsyslog sasl2-bin spamassassin supervisor \
2021-09-13 08:09:01 +00:00
unrar-free unzip uuid whois xz-utils && \
2021-05-15 09:11:10 +00:00
# Fail2Ban
gpg --keyserver ${ FAIL2BAN_GPG_PUBLIC_KEY_SERVER } \
2021-06-08 01:20:20 +00:00
--recv-keys ${ FAIL2BAN_GPG_PUBLIC_KEY_ID } 2>& 1 && \
2021-05-16 19:05:39 +00:00
curl -Lkso fail2ban.deb ${ FAIL2BAN_DEB_URL } && \
curl -Lkso fail2ban.deb.asc ${ FAIL2BAN_DEB_ASC_URL } && \
2021-05-15 09:11:10 +00:00
FINGERPRINT = " $( LANG = C gpg --verify \
fail2ban.deb.asc fail2ban.deb 2>& 1 \
| sed -n 's#Primary key fingerprint: \(.*\)#\1#p' ) " && \
if [ [ -z ${ FINGERPRINT } ] ] ; then \
2021-06-08 01:20:20 +00:00
echo "ERROR: Invalid GPG signature!" >& 2; exit 1; fi && \
2021-05-15 09:11:10 +00:00
if [ [ ${ FINGERPRINT } != " ${ FAIL2BAN_GPG_FINGERPRINT } " ] ] ; then \
2021-06-08 01:20:20 +00:00
echo "ERROR: Wrong GPG fingerprint!" >& 2; exit 1; fi && \
dpkg -i fail2ban.deb 2>& 1 && \
2021-05-15 09:11:10 +00:00
rm fail2ban.deb fail2ban.deb.asc && \
2021-01-16 09:16:05 +00:00
# cleanup
2021-06-08 01:20:20 +00:00
apt-get -qq autoremove && \
2021-01-16 09:16:05 +00:00
apt-get -qq autoclean && \
apt-get -qq clean && \
2017-07-23 17:38:34 +00:00
rm -rf /var/lib/apt/lists/* && \
2021-06-08 01:20:20 +00:00
c_rehash 2>& 1
2021-01-16 09:16:05 +00:00
2021-09-19 12:36:26 +00:00
COPY ./target/bin/sedfile /usr/local/bin/sedfile
2021-09-05 22:07:02 +00:00
2021-09-19 12:36:26 +00:00
RUN chmod +x /usr/local/bin/sedfile
2021-09-05 22:07:02 +00:00
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
# --- ClamAV & FeshClam -------------------------
# -----------------------------------------------
2015-03-28 14:59:15 +00:00
2021-01-16 09:16:05 +00:00
RUN \
2021-05-15 09:11:10 +00:00
echo '0 */6 * * * clamav /usr/bin/freshclam --quiet' >/etc/cron.d/clamav-freshclam && \
2017-07-23 17:38:34 +00:00
chmod 644 /etc/clamav/freshclam.conf && \
2017-08-07 15:39:40 +00:00
freshclam && \
2021-09-05 22:07:02 +00:00
sedfile -i 's/Foreground false/Foreground true/g' /etc/clamav/clamd.conf && \
2017-08-07 15:39:40 +00:00
mkdir /var/run/clamav && \
2020-01-15 13:29:39 +00:00
chown -R clamav:root /var/run/clamav && \
rm -rf /var/log/clamav/
2016-10-08 17:02:47 +00:00
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
fix: Remove `mkcert.sh` usage + `_setup_ssl` refactor. (#2196)
* chore(refactor): DRY up the `_setup_ssl` method
- `/etc/postfix/ssl` was a bit misleading in usage here. As a maintainer (of my own contribution!) I was confused why only `/etc/postfix/ssl` was referenced and not `/etc/dovecot/ssl`.
- The postfix specific path is unnecessary, dovecot was referencing it via it's config, the same can be done from postfix to a generic DMS specific config location instead.
- This location is defined and created early as `/etc/dms/tls` (with var `DMS_TLS_PATH`). All usage of `/etc/postfix/ssl` has been replaced, making it easier to grok. Several `mkdir` commands related to this have been dropped as a result.
- Likewise, a related `TMP_DMS_TLS_PATH` var provides a reference to the config volume path `/tmp/docker-mailserver` which is used for conditions on presently hard-coded paths.
- Other values that benefit from being DRY have been lifted up into vars. Definitely easier to follow now and makes some further opportunities clearer to tackle in a future refactor.
- `chmod` has been updated where appropriate. Public key/cert is acceptable to have as readable by non-root users (644). The custom type with single fullchain file was not root accessible only, but should as it contains a private key.
- That said, the security benefit can be a bit moot due to source files that were copied remain present, the user would be responsible to ensure similar permissions on their source files.
- I've not touched LetsEncrypt section as I don't have time to investigate into that yet (not familiar with that portion).
---
* chore: Remove mkcert logic and dovecot cert
- No longer serving a purpose.
- Our own TLS startup script handles a variety of cert scenarios, while the dropped code was always generating a self-signed cert and persisting an unused cert regardless with `ONE_DIR=1`.
- To avoid similar issues that DH params had with doveadm validating filepath values in the SSL config, the default dummy values match postfix pointing to "snakeoil" cert. That serves the same purpose as mkcert was covering in the image.
- Bonus, no more hassle with differing mkcert target paths for users replacing our supplied Dovecot with the latest community edition.
---
* Error handling for SSL_TYPE
- Added a panic utility to exit early when SSL_TYPE conditions are misconfigured.
- Some info text had order of key/cert occurrence swapped to be consistent with key then cert.
- Some existing comments moved and rephrased.
- Additional comments added.
- `-f` test for cert files instead of `-e` (true also for directories/devices/symlinks).
- _notify messages lifted out of conditionals so that they always output when the case is hit.
- ~~Empty SSL_TYPE collapsed into catch all panic, while it's contents is now mapped to a new 'disabled' value.~~
---
* Use sedfile + improve sed expressions + update case style
- Uses sedfile when appropriate (file change intentional, not optional match/check).
- sed expressions modified to be DRY and reduce escaping via `-r` flag (acceptable if actual text content contains no `?`,`+`,`()` or `{}` characters, [otherwise they must be escaped](https://www.gnu.org/software/sed/manual/html_node/Extended-regexps.html)).
- sed captures anything matched between the parenthesis`()` and inserts it via `\1` as part of the replacement.
- case statements adopt the `(` prefix, adopting recent shell style for consistency.
---
* Refactor SSL_TYPE=disabled
- Postfix is also disabled now.
- Included heavy inline documentation reference for maintainers.
- Dropped an obsolete postfix config option 'use_tls' on the relayhost function, it was replaced by 'security_level'.
---
* I'm a friggin' sed wizard now
- The `modern` TLS_LEVEL is the default values for the configs they modify. As such, `sedfile` outputs an "Error" which isn't an actual concern, back to regular `sed`.
- I realized that multiple edits for the same file can all be done at once via `-e` (assuming other sed options are the same for each operation), and that `g` suffix is global scope for single line match, not whole file (default as sed iterates through individual lines).
- Some postfix replacements have `smtp` and `smtpd` lines, collapsed into a single `smtpd?` instead now that I know sed better.
---
* tests(fix): Tests that require SSL/TLS to pass
- SSL_TYPE=snakeoil added as temporary workaround.
- nmap tests are being dropped. These were added about 4-5 years ago, I have since made these redundant with the `testssl.sh` tests.
- Additionally the `--link` option is deprecated and IIRC these grades were a bit misleading when I initially used nmap in my own TLS cipher suite update PRs in the past.
- The removed SSL test is already handled in mail_ssl_manual.bats
ldap test:
- Replace `--link` alias option with `--network` and alias assignment.
- Parameterized some values and added the `SSL_TYPE` to resolve the starttls test failure.
privacy test:
- Also needed `SSL_TYPE` to pass the starttls test.
`tests.bats` had another starttls test for imap:
- Workaround for now is to give the main test container `SSL_TYPE=snakeoil`.
---
* Remove the expired lets-encrypt cert
This expired in March 2021. It was originally required when first added back in 2016 as LetsEncrypt was fairly new and not as broadly accepted into OS trust stores.
No longer the case today.
---
* chore: Housekeeping
Not required for this PR branch, little bit of tidying up while working on these two test files.
- privacy test copied over content when extracted from `tests.bats` that isn't relevant.
- ldap test was not as easy to identify the source of DOVECOT_TLS. Added comment to make the prefix connection to `configomat.sh` and `.ext` files more easier to find.
- Additionally converted the two localhost FQDN to vars.
---
* Default SSL_TYPE becomes `''` (aka equivalent to desired `disabled` case)
- This is to prevent other tests from failing by hitting the panic catchall case.
- More ideal would be adjusting tests to default to `disabled`, rather than treating `disabled` as an empty / unset SSL_TYPE value.
---
* Add inline documentation for `dms_panic`
- This could later be better formatted and placed into contributor docs.
Panic with kill (shutdown) not exit (errex):
- `kill 1` from `_shutdown` will send SIGTERM signal to PID 1 (init process).
- `exit 1` within the `start-mailserver.sh` init scripts context, will just exit the initialization script leaving the container running when it shouldn't.
The two previous `_shutdown` methods can benefit from using `dms_panic` wrapper instead to standardize on panic messages.
2021-09-19 12:31:11 +00:00
# --- Dovecot -----------------------------------
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
2021-01-16 09:16:05 +00:00
2017-07-23 17:38:34 +00:00
COPY target/dovecot/auth-passwdfile.inc target/dovecot/??-*.conf /etc/dovecot/conf.d/
2020-05-03 22:24:10 +00:00
COPY target/dovecot/sieve/ /etc/dovecot/sieve/
2020-12-06 18:57:38 +00:00
COPY target/dovecot/dovecot-purge.cron /etc/cron.d/dovecot-purge.disabled
RUN chmod 0 /etc/cron.d/dovecot-purge.disabled
2019-08-13 09:41:38 +00:00
WORKDIR /usr/share/dovecot
2021-01-16 09:16:05 +00:00
# hadolint ignore=SC2016,SC2086,SC2069
RUN \
2021-09-05 22:07:02 +00:00
sedfile -i -e 's/include_try \/usr\/share\/dovecot\/protocols\.d/include_try \/etc\/dovecot\/protocols\.d/g' /etc/dovecot/dovecot.conf && \
sedfile -i -e 's/#mail_plugins = \$mail_plugins/mail_plugins = \$mail_plugins sieve/g' /etc/dovecot/conf.d/15-lda.conf && \
sedfile -i -e 's/^.*lda_mailbox_autocreate.*/lda_mailbox_autocreate = yes/g' /etc/dovecot/conf.d/15-lda.conf && \
sedfile -i -e 's/^.*lda_mailbox_autosubscribe.*/lda_mailbox_autosubscribe = yes/g' /etc/dovecot/conf.d/15-lda.conf && \
sedfile -i -e 's/^.*postmaster_address.*/postmaster_address = ' ${ POSTMASTER_ADDRESS : = "postmaster@domain.com" } '/g' /etc/dovecot/conf.d/15-lda.conf && \
2018-04-05 16:54:01 +00:00
mkdir -p /usr/lib/dovecot/sieve-pipe /usr/lib/dovecot/sieve-filter /usr/lib/dovecot/sieve-global && \
2019-08-09 20:13:50 +00:00
chmod 755 -R /usr/lib/dovecot/sieve-pipe /usr/lib/dovecot/sieve-filter /usr/lib/dovecot/sieve-global
2015-03-29 12:07:56 +00:00
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
# --- LDAP & SpamAssassin's Cron ----------------
# -----------------------------------------------
2021-01-16 09:16:05 +00:00
2016-11-13 10:39:45 +00:00
COPY target/dovecot/dovecot-ldap.conf.ext /etc/dovecot
2021-01-16 09:16:05 +00:00
COPY \
target/postfix/ldap-users.cf \
target/postfix/ldap-groups.cf \
target/postfix/ldap-aliases.cf \
target/postfix/ldap-domains.cf \
2021-04-17 20:40:19 +00:00
target/postfix/ldap-senders.cf \
2021-01-16 09:16:05 +00:00
/etc/postfix/
2016-11-13 10:39:45 +00:00
2019-08-13 09:41:38 +00:00
# hadolint ignore=SC2016
2021-01-16 09:16:05 +00:00
RUN \
2021-09-05 22:07:02 +00:00
sedfile -i -r 's/^(CRON)=0/\1=1/g' /etc/default/spamassassin && \
2022-02-21 09:48:28 +00:00
sedfile -i -r 's/^\$INIT restart/supervisorctl restart amavis/g' \
/etc/spamassassin/sa-update-hooks.d/amavisd-new && \
mkdir -p /etc/spamassassin/kam/ && \
curl -sSfLo /etc/spamassassin/kam/kam.sa-channels.mcgrail.com.key \
https://mcgrail.com/downloads/kam.sa-channels.mcgrail.com.key
2015-03-28 14:59:15 +00:00
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
# --- PostSRSD, Postgrey & Amavis ---------------
# -----------------------------------------------
2021-01-16 09:16:05 +00:00
COPY target/postsrsd/postsrsd /etc/default/postsrsd
2017-02-06 09:21:18 +00:00
COPY target/postgrey/postgrey /etc/default/postgrey
COPY target/postgrey/postgrey.init /etc/init.d/postgrey
2021-01-16 09:16:05 +00:00
RUN \
chmod 755 /etc/init.d/postgrey && \
2017-07-23 17:38:34 +00:00
mkdir /var/run/postgrey && \
2021-06-17 16:16:28 +00:00
chown postgrey:postgrey /var/run/postgrey && \
curl -Lsfo /etc/postgrey/whitelist_clients https://postgrey.schweikert.ch/pub/postgrey_whitelist_clients
2017-02-06 09:21:18 +00:00
2017-08-09 21:19:00 +00:00
COPY target/amavis/conf.d/* /etc/amavis/conf.d/
2021-01-16 09:16:05 +00:00
RUN \
2021-09-05 22:07:02 +00:00
sedfile -i -r 's/#(@| \\%)bypass/\1bypass/g' /etc/amavis/conf.d/15-content_filter_mode && \
2021-09-19 12:36:26 +00:00
# add users clamav and amavis to each others group
2021-06-08 01:20:20 +00:00
adduser clamav amavis && \
adduser amavis clamav && \
2021-01-18 19:51:56 +00:00
# no syslog user in Debian compared to Ubuntu
2021-06-08 01:20:20 +00:00
adduser --system syslog && \
useradd -u 5000 -d /home/docker -s /bin/bash -p " $( echo docker | openssl passwd -1 -stdin) " docker && \
2020-10-01 11:54:43 +00:00
echo "0 4 * * * /usr/local/bin/virus-wiper" | crontab - && \
2020-10-05 15:11:15 +00:00
chmod 644 /etc/amavis/conf.d/*
2015-03-28 14:59:15 +00:00
2021-01-19 14:32:16 +00:00
# overcomplication necessary for CI
2021-04-11 15:33:39 +00:00
RUN \
for _ in { 1..10} ; do su - amavis -c "razor-admin -create" ; sleep 3 ; \
2021-06-08 01:20:20 +00:00
if su - amavis -c "razor-admin -register" ; then { EC = 0 ; break ; } ; \
2021-01-19 14:32:16 +00:00
else EC = ${ ? } ; fi ; done ; ( exit ${ EC } )
2021-01-16 09:16:05 +00:00
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
# --- Fail2Ban, DKIM & DMARC --------------------
# -----------------------------------------------
2021-01-16 09:16:05 +00:00
2021-04-11 15:33:39 +00:00
COPY target/fail2ban/jail.local /etc/fail2ban/jail.local
RUN \
ln -s /var/log/mail/mail.log /var/log/mail.log && \
# disable sshd jail
rm /etc/fail2ban/jail.d/defaults-debian.conf && \
mkdir /var/run/fail2ban
2016-04-17 20:59:35 +00:00
2016-09-04 18:37:16 +00:00
COPY target/opendkim/opendkim.conf /etc/opendkim.conf
COPY target/opendkim/default-opendkim /etc/default/opendkim
2016-01-20 15:41:34 +00:00
2016-09-04 18:37:16 +00:00
COPY target/opendmarc/opendmarc.conf /etc/opendmarc.conf
COPY target/opendmarc/default-opendmarc /etc/default/opendmarc
2016-10-25 06:57:08 +00:00
COPY target/opendmarc/ignore.hosts /etc/opendmarc/ignore.hosts
2016-01-26 17:26:50 +00:00
2021-01-16 09:16:05 +00:00
RUN \
2021-01-18 19:51:56 +00:00
# switch iptables and ip6tables to legacy for Fail2Ban
2021-01-16 09:16:05 +00:00
update-alternatives --set iptables /usr/sbin/iptables-legacy && \
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
2016-08-21 20:13:13 +00:00
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
# --- Fetchmail, Postfix & Let'sEncrypt ---------
# -----------------------------------------------
2021-01-16 09:16:05 +00:00
2022-03-22 16:53:12 +00:00
# Remove invalid URL from SPF message
# https://bugs.launchpad.net/spf-engine/+bug/1896912
RUN echo 'Reason_Message = Message {rejectdefer} due to: {spf}.' >>/etc/postfix-policyd-spf-python/policyd-spf.conf
2021-01-16 09:16:05 +00:00
COPY target/fetchmail/fetchmailrc /etc/fetchmailrc_general
2016-09-04 18:37:16 +00:00
COPY target/postfix/main.cf target/postfix/master.cf /etc/postfix/
2021-09-15 08:28:04 +00:00
# DH parameters for DHE cipher suites, ffdhe4096 is the official standard 4096-bit DH params now part of TLS 1.3
# This file is for TLS <1.3 handshakes that rely on DHE cipher suites
# Handled at build to avoid failures by doveadm validating ssl_dh filepath in 10-ssl.auth (eg generate-accounts)
COPY target/shared/ffdhe4096.pem /etc/postfix/dhparams.pem
COPY target/shared/ffdhe4096.pem /etc/dovecot/dh.pem
2021-01-16 09:16:05 +00:00
COPY \
target/postfix/header_checks.pcre \
target/postfix/sender_header_filter.pcre \
target/postfix/sender_login_maps.pcre \
/etc/postfix/maps/
2015-03-31 15:27:54 +00:00
2021-01-16 09:16:05 +00:00
RUN \
: >/etc/aliases && \
2021-09-05 22:07:02 +00:00
sedfile -i 's/START_DAEMON=no/START_DAEMON=yes/g' /etc/default/fetchmail && \
fix: Remove `mkcert.sh` usage + `_setup_ssl` refactor. (#2196)
* chore(refactor): DRY up the `_setup_ssl` method
- `/etc/postfix/ssl` was a bit misleading in usage here. As a maintainer (of my own contribution!) I was confused why only `/etc/postfix/ssl` was referenced and not `/etc/dovecot/ssl`.
- The postfix specific path is unnecessary, dovecot was referencing it via it's config, the same can be done from postfix to a generic DMS specific config location instead.
- This location is defined and created early as `/etc/dms/tls` (with var `DMS_TLS_PATH`). All usage of `/etc/postfix/ssl` has been replaced, making it easier to grok. Several `mkdir` commands related to this have been dropped as a result.
- Likewise, a related `TMP_DMS_TLS_PATH` var provides a reference to the config volume path `/tmp/docker-mailserver` which is used for conditions on presently hard-coded paths.
- Other values that benefit from being DRY have been lifted up into vars. Definitely easier to follow now and makes some further opportunities clearer to tackle in a future refactor.
- `chmod` has been updated where appropriate. Public key/cert is acceptable to have as readable by non-root users (644). The custom type with single fullchain file was not root accessible only, but should as it contains a private key.
- That said, the security benefit can be a bit moot due to source files that were copied remain present, the user would be responsible to ensure similar permissions on their source files.
- I've not touched LetsEncrypt section as I don't have time to investigate into that yet (not familiar with that portion).
---
* chore: Remove mkcert logic and dovecot cert
- No longer serving a purpose.
- Our own TLS startup script handles a variety of cert scenarios, while the dropped code was always generating a self-signed cert and persisting an unused cert regardless with `ONE_DIR=1`.
- To avoid similar issues that DH params had with doveadm validating filepath values in the SSL config, the default dummy values match postfix pointing to "snakeoil" cert. That serves the same purpose as mkcert was covering in the image.
- Bonus, no more hassle with differing mkcert target paths for users replacing our supplied Dovecot with the latest community edition.
---
* Error handling for SSL_TYPE
- Added a panic utility to exit early when SSL_TYPE conditions are misconfigured.
- Some info text had order of key/cert occurrence swapped to be consistent with key then cert.
- Some existing comments moved and rephrased.
- Additional comments added.
- `-f` test for cert files instead of `-e` (true also for directories/devices/symlinks).
- _notify messages lifted out of conditionals so that they always output when the case is hit.
- ~~Empty SSL_TYPE collapsed into catch all panic, while it's contents is now mapped to a new 'disabled' value.~~
---
* Use sedfile + improve sed expressions + update case style
- Uses sedfile when appropriate (file change intentional, not optional match/check).
- sed expressions modified to be DRY and reduce escaping via `-r` flag (acceptable if actual text content contains no `?`,`+`,`()` or `{}` characters, [otherwise they must be escaped](https://www.gnu.org/software/sed/manual/html_node/Extended-regexps.html)).
- sed captures anything matched between the parenthesis`()` and inserts it via `\1` as part of the replacement.
- case statements adopt the `(` prefix, adopting recent shell style for consistency.
---
* Refactor SSL_TYPE=disabled
- Postfix is also disabled now.
- Included heavy inline documentation reference for maintainers.
- Dropped an obsolete postfix config option 'use_tls' on the relayhost function, it was replaced by 'security_level'.
---
* I'm a friggin' sed wizard now
- The `modern` TLS_LEVEL is the default values for the configs they modify. As such, `sedfile` outputs an "Error" which isn't an actual concern, back to regular `sed`.
- I realized that multiple edits for the same file can all be done at once via `-e` (assuming other sed options are the same for each operation), and that `g` suffix is global scope for single line match, not whole file (default as sed iterates through individual lines).
- Some postfix replacements have `smtp` and `smtpd` lines, collapsed into a single `smtpd?` instead now that I know sed better.
---
* tests(fix): Tests that require SSL/TLS to pass
- SSL_TYPE=snakeoil added as temporary workaround.
- nmap tests are being dropped. These were added about 4-5 years ago, I have since made these redundant with the `testssl.sh` tests.
- Additionally the `--link` option is deprecated and IIRC these grades were a bit misleading when I initially used nmap in my own TLS cipher suite update PRs in the past.
- The removed SSL test is already handled in mail_ssl_manual.bats
ldap test:
- Replace `--link` alias option with `--network` and alias assignment.
- Parameterized some values and added the `SSL_TYPE` to resolve the starttls test failure.
privacy test:
- Also needed `SSL_TYPE` to pass the starttls test.
`tests.bats` had another starttls test for imap:
- Workaround for now is to give the main test container `SSL_TYPE=snakeoil`.
---
* Remove the expired lets-encrypt cert
This expired in March 2021. It was originally required when first added back in 2016 as LetsEncrypt was fairly new and not as broadly accepted into OS trust stores.
No longer the case today.
---
* chore: Housekeeping
Not required for this PR branch, little bit of tidying up while working on these two test files.
- privacy test copied over content when extracted from `tests.bats` that isn't relevant.
- ldap test was not as easy to identify the source of DOVECOT_TLS. Added comment to make the prefix connection to `configomat.sh` and `.ext` files more easier to find.
- Additionally converted the two localhost FQDN to vars.
---
* Default SSL_TYPE becomes `''` (aka equivalent to desired `disabled` case)
- This is to prevent other tests from failing by hitting the panic catchall case.
- More ideal would be adjusting tests to default to `disabled`, rather than treating `disabled` as an empty / unset SSL_TYPE value.
---
* Add inline documentation for `dms_panic`
- This could later be better formatted and placed into contributor docs.
Panic with kill (shutdown) not exit (errex):
- `kill 1` from `_shutdown` will send SIGTERM signal to PID 1 (init process).
- `exit 1` within the `start-mailserver.sh` init scripts context, will just exit the initialization script leaving the container running when it shouldn't.
The two previous `_shutdown` methods can benefit from using `dms_panic` wrapper instead to standardize on panic messages.
2021-09-19 12:31:11 +00:00
mkdir /var/run/fetchmail && chown fetchmail /var/run/fetchmail
2021-01-16 09:16:05 +00:00
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
# --- Logs --------------------------------------
# -----------------------------------------------
2021-01-16 09:16:05 +00:00
RUN \
2021-09-05 22:07:02 +00:00
sedfile -i -r "/^#?compress/c\compress\ncopytruncate" /etc/logrotate.conf && \
2017-07-23 17:38:34 +00:00
mkdir -p /var/log/mail && \
chown syslog:root /var/log/mail && \
touch /var/log/mail/clamav.log && \
chown -R clamav:root /var/log/mail/clamav.log && \
touch /var/log/mail/freshclam.log && \
chown -R clamav:root /var/log/mail/freshclam.log && \
2021-09-05 22:07:02 +00:00
sedfile -i -r 's|/var/log/mail|/var/log/mail/mail|g' /etc/rsyslog.conf && \
sedfile -i -r 's|;auth,authpriv.none|;mail.none;mail.error;auth,authpriv.none|g' /etc/rsyslog.conf && \
sedfile -i -r 's|LogFile /var/log/clamav/|LogFile /var/log/mail/|g' /etc/clamav/clamd.conf && \
sedfile -i -r 's|UpdateLogFile /var/log/clamav/|UpdateLogFile /var/log/mail/|g' /etc/clamav/freshclam.conf && \
sedfile -i -r 's|/var/log/clamav|/var/log/mail|g' /etc/logrotate.d/clamav-daemon && \
sedfile -i -r 's|invoke-rc.d.*|/usr/bin/supervisorctl signal hup clamav >/dev/null \|\| true|g' /etc/logrotate.d/clamav-daemon && \
sedfile -i -r 's|/var/log/clamav|/var/log/mail|g' /etc/logrotate.d/clamav-freshclam && \
sedfile -i -r '/postrotate/,/endscript/d' /etc/logrotate.d/clamav-freshclam && \
sedfile -i -r 's|/var/log/mail|/var/log/mail/mail|g' /etc/logrotate.d/rsyslog && \
sedfile -i -r '/\/var\/log\/mail\/mail.log/d' /etc/logrotate.d/rsyslog && \
2021-01-18 19:51:56 +00:00
# prevent syslog logrotate warnings
2021-09-05 22:07:02 +00:00
sedfile -i -e 's/\(printerror "could not determine current runlevel"\)/#\1/' /usr/sbin/invoke-rc.d && \
sedfile -i -e 's/^\(POLICYHELPER=\).*/\1/' /usr/sbin/invoke-rc.d && \
2021-01-16 09:16:05 +00:00
# prevent syslog warning about imklog permissions
2021-09-05 22:07:02 +00:00
sedfile -i -e 's/^module(load=\"imklog\")/#module(load=\"imklog\")/' /etc/rsyslog.conf && \
2021-01-18 19:51:56 +00:00
# prevent email when /sbin/init or init system is not existing
2021-09-05 22:07:02 +00:00
sedfile -i -e 's|invoke-rc.d rsyslog rotate > /dev/null|/usr/bin/supervisorctl signal hup rsyslog >/dev/null|g' /usr/lib/rsyslog/rsyslog-rotate
2016-04-18 21:38:52 +00:00
2021-08-11 09:31:00 +00:00
# -----------------------------------------------
# --- Logwatch ----------------------------------
# -----------------------------------------------
COPY target/logwatch/maillog.conf /etc/logwatch/conf/logfiles/maillog.conf
2021-06-08 01:20:20 +00:00
# -----------------------------------------------
# --- Supervisord & Start -----------------------
# -----------------------------------------------
2016-02-08 22:47:42 +00:00
2017-09-10 13:26:21 +00:00
COPY target/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
COPY target/supervisor/conf.d/* /etc/supervisor/conf.d/
2016-01-23 22:51:09 +00:00
2021-09-19 12:36:26 +00:00
# -----------------------------------------------
# --- Scripts & Miscellaneous--------------------
# -----------------------------------------------
RUN \
rm -rf /usr/share/locale/* && \
rm -rf /usr/share/man/* && \
rm -rf /usr/share/doc/* && \
touch /var/log/auth.log && \
update-locale && \
rm /etc/postsrsd.secret && \
rm /etc/cron.daily/00logwatch
COPY ./VERSION /
COPY \
./target/bin/* \
./target/scripts/*.sh \
./target/scripts/startup/*.sh \
2022-02-21 10:56:57 +00:00
./target/scripts/wrapper/*.sh \
2021-09-19 12:36:26 +00:00
./target/docker-configomat/configomat.sh \
/usr/local/bin/
RUN chmod +x /usr/local/bin/*
2021-11-20 20:33:49 +00:00
COPY ./target/scripts/helpers /usr/local/bin/helpers
2019-08-13 09:41:38 +00:00
WORKDIR /
2017-09-07 16:08:25 +00:00
EXPOSE 25 587 143 465 993 110 995 4190
2016-09-29 20:52:05 +00:00
2021-01-16 18:35:42 +00:00
ENTRYPOINT [ "/usr/bin/dumb-init" , "--" ]
2018-11-04 19:23:50 +00:00
CMD [ "supervisord" , "-c" , "/etc/supervisor/supervisord.conf" ]
