From 774a340d766a5cf502a27862b7ba720449891900 Mon Sep 17 00:00:00 2001
From: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
Date: Fri, 3 Feb 2023 17:32:07 +0100
Subject: [PATCH] chore(Amavis): only add configuration to Postfix when enabled
 (#3046)

* only add Amavis configuration to Postfix when enabled

Since I am running Rspamd nowadays, I noticed there still are ports open
that belong to Amavis. This is because the Amavis configuration is a
fixed part of Postfix's `master.cf`. I changed that. Now, the Amavis
section is added when Amavis really is enabled.

I took the chance and added proper indentation to `master.cf`; hence the
diff is a bit fuzzy. **But**, only the Amavis part was adjusted, the
rest is just styling.
---
 Dockerfile                            |   1 +
 target/amavis/postfix-amavis.cf       |  35 +++++++++
 target/postfix/master.cf              | 104 ++++++++------------------
 target/scripts/startup/setup-stack.sh |   1 +
 4 files changed, 70 insertions(+), 71 deletions(-)
 create mode 100644 target/amavis/postfix-amavis.cf

diff --git a/Dockerfile b/Dockerfile
index 7ad2b0a5..a6158d5b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -112,6 +112,7 @@ RUN <<EOF
 EOF
 
 COPY target/amavis/conf.d/* /etc/amavis/conf.d/
+COPY target/amavis/postfix-amavis.cf /etc/dms/postfix/master.d/
 RUN <<EOF
   sedfile -i -r 's/#(@|   \\%)bypass/\1bypass/g' /etc/amavis/conf.d/15-content_filter_mode
   # add users clamav and amavis to each others group
diff --git a/target/amavis/postfix-amavis.cf b/target/amavis/postfix-amavis.cf
new file mode 100644
index 00000000..a2939d16
--- /dev/null
+++ b/target/amavis/postfix-amavis.cf
@@ -0,0 +1,35 @@
+
+#
+# Amavis configuration
+#
+
+smtp-amavis     unix    -       -       n       -       2       smtp
+  -o syslog_name=postfix/$service_name
+  -o smtp_data_done_timeout=1200
+  -o smtp_send_xforward_command=yes
+  -o disable_dns_lookups=yes
+  -o max_use=20
+  -o smtp_tls_security_level=none
+  -o smtp_tls_wrappermode=no
+
+127.0.0.1:10025 inet    n       -       n       -       -       smtpd
+  -o syslog_name=postfix/smtpd-amavis
+  -o content_filter=
+  -o local_recipient_maps=
+  -o relay_recipient_maps=
+  -o smtpd_restriction_classes=
+  -o smtpd_delay_reject=no
+  -o smtpd_client_restrictions=permit_mynetworks,reject
+  -o smtpd_helo_restrictions=
+  -o smtpd_sender_restrictions=
+  -o smtpd_recipient_restrictions=permit_mynetworks,reject
+  -o smtpd_data_restrictions=reject_unauth_pipelining
+  -o smtpd_end_of_data_restrictions=
+  -o mynetworks=127.0.0.0/8
+  -o smtpd_error_sleep_time=0
+  -o smtpd_soft_error_limit=1001
+  -o smtpd_hard_error_limit=1000
+  -o smtpd_client_connection_count_limit=0
+  -o smtpd_client_connection_rate_limit=0
+  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
+  -o smtp_tls_security_level=none
diff --git a/target/postfix/master.cf b/target/postfix/master.cf
index bec6916a..2e42ab79 100644
--- a/target/postfix/master.cf
+++ b/target/postfix/master.cf
@@ -6,15 +6,15 @@
 # Do not forget to execute "postfix reload" after editing this file.
 #
 # ==========================================================================
-# service type  private unpriv  chroot  wakeup  maxproc command + args
-#               (yes)   (yes)   (no)   (never) (100)
+# service      type  private unpriv  chroot  wakeup  maxproc command + args
+#                    (yes)   (yes)   (no)    (never) (100)
 # ==========================================================================
 
-smtp       inet n       -       n       -       1       postscreen
-smtpd      pass -       -       n       -       -       smtpd
-tlsproxy   unix -       -       n       -       0       tlsproxy
-dnsblog    unix -       -       n       -       0       dnsblog
-submission inet n       -       n       -       -       smtpd
+smtp           inet  n       -       n       -       1       postscreen
+smtpd          pass  -       -       n       -       -       smtpd
+tlsproxy       unix  -       -       n       -       0       tlsproxy
+dnsblog        unix  -       -       n       -       0       dnsblog
+submission     inet  n       -       n       -       -       smtpd
   -o syslog_name=postfix/submission
   -o smtpd_tls_security_level=encrypt
   -o smtpd_sasl_auth_enable=yes
@@ -27,7 +27,7 @@ submission inet n       -       n       -       -       smtpd
   -o milter_macro_daemon_name=ORIGINATING
   -o cleanup_service_name=sender-cleanup
 
-smtps     inet  n       -       n       -       -       smtpd
+smtps          inet  n       -       n       -       -       smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes
   -o smtpd_sasl_auth_enable=yes
@@ -40,74 +40,36 @@ smtps     inet  n       -       n       -       -       smtpd
   -o milter_macro_daemon_name=ORIGINATING
   -o cleanup_service_name=sender-cleanup
 
-pickup    fifo  n       -       n       60      1       pickup
+pickup         fifo  n       -       n       60      1       pickup
   -o content_filter=
   -o receive_override_options=no_header_body_checks
 
-cleanup   unix  n       -       n       -       0       cleanup
-qmgr      unix  n       -       n       300     1       qmgr
-tlsmgr    unix  -       -       n       1000?   1       tlsmgr
-rewrite   unix  -       -       n       -       -       trivial-rewrite
-bounce    unix  -       -       n       -       0       bounce
-defer     unix  -       -       n       -       0       bounce
-trace     unix  -       -       n       -       0       bounce
-verify    unix  -       -       n       -       1       verify
-flush     unix  n       -       n       1000?   0       flush
-proxymap  unix  -       -       n       -       -       proxymap
-proxywrite unix -       -       n       -       1       proxymap
-smtp      unix  -       -       n       -       -       smtp
-relay     unix  -       -       n       -       -       smtp
-showq     unix  n       -       n       -       -       showq
-error     unix  -       -       n       -       -       error
-retry     unix  -       -       n       -       -       error
-discard   unix  -       -       n       -       -       discard
-local     unix  -       n       n       -       -       local
-virtual   unix  -       n       n       -       -       virtual
-lmtp      unix  -       -       n       -       -       lmtp
-anvil     unix  -       -       n       -       1       anvil
-scache    unix  -       -       n       -       1       scache
-
-sender-cleanup unix n   -       n       -       0       cleanup
+sender-cleanup unix  n       -       n       -       0       cleanup
   -o syslog_name=postfix/sender-cleanup
   -o header_checks=pcre:/etc/postfix/maps/sender_header_filter.pcre
 
-#
-# SPF configuration
-#
-policyd-spf  unix  -       n       n       -       0       spawn
+policyd-spf    unix  -       n       n       -       0       spawn
     user=policyd-spf argv=/usr/bin/policyd-spf
 
-#
-# Amavis configuration
-#
-
-smtp-amavis     unix    -       -       n       -       2       smtp
-  -o syslog_name=postfix/$service_name
-  -o smtp_data_done_timeout=1200
-  -o smtp_send_xforward_command=yes
-  -o disable_dns_lookups=yes
-  -o max_use=20
-  -o smtp_tls_security_level=none
-  -o smtp_tls_wrappermode=no
-
-127.0.0.1:10025 inet    n       -       n       -       -       smtpd
-  -o syslog_name=postfix/smtpd-amavis
-  -o content_filter=
-  -o local_recipient_maps=
-  -o relay_recipient_maps=
-  -o smtpd_restriction_classes=
-  -o smtpd_delay_reject=no
-  -o smtpd_client_restrictions=permit_mynetworks,reject
-  -o smtpd_helo_restrictions=
-  -o smtpd_sender_restrictions=
-  -o smtpd_recipient_restrictions=permit_mynetworks,reject
-  -o smtpd_data_restrictions=reject_unauth_pipelining
-  -o smtpd_end_of_data_restrictions=
-  -o mynetworks=127.0.0.0/8
-  -o smtpd_error_sleep_time=0
-  -o smtpd_soft_error_limit=1001
-  -o smtpd_hard_error_limit=1000
-  -o smtpd_client_connection_count_limit=0
-  -o smtpd_client_connection_rate_limit=0
-  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-  -o smtp_tls_security_level=none
+cleanup        unix  n       -       n       -       0       cleanup
+qmgr           unix  n       -       n       300     1       qmgr
+tlsmgr         unix  -       -       n       1000?   1       tlsmgr
+rewrite        unix  -       -       n       -       -       trivial-rewrite
+bounce         unix  -       -       n       -       0       bounce
+defer          unix  -       -       n       -       0       bounce
+trace          unix  -       -       n       -       0       bounce
+verify         unix  -       -       n       -       1       verify
+flush          unix  n       -       n       1000?   0       flush
+proxymap       unix  -       -       n       -       -       proxymap
+proxywrite     unix  -       -       n       -       1       proxymap
+smtp           unix  -       -       n       -       -       smtp
+relay          unix  -       -       n       -       -       smtp
+showq          unix  n       -       n       -       -       showq
+error          unix  -       -       n       -       -       error
+retry          unix  -       -       n       -       -       error
+discard        unix  -       -       n       -       -       discard
+local          unix  -       n       n       -       -       local
+virtual        unix  -       n       n       -       -       virtual
+lmtp           unix  -       -       n       -       -       lmtp
+anvil          unix  -       -       n       -       1       anvil
+scache         unix  -       -       n       -       1       scache
diff --git a/target/scripts/startup/setup-stack.sh b/target/scripts/startup/setup-stack.sh
index 04f0c806..cb8c991c 100644
--- a/target/scripts/startup/setup-stack.sh
+++ b/target/scripts/startup/setup-stack.sh
@@ -73,6 +73,7 @@ function _setup_amavis
   if [[ ${ENABLE_AMAVIS} -eq 1 ]]
   then
     _log 'debug' 'Setting up Amavis'
+    cat /etc/dms/postfix/master.d/postfix-amavis.cf >>/etc/postfix/master.cf
     sed -i \
       "s|^#\$myhostname = \"mail.example.com\";|\$myhostname = \"${HOSTNAME}\";|" \
       /etc/amavis/conf.d/05-node_id