mirror of
https://github.com/docker-mailserver/docker-mailserver
synced 2024-05-25 16:56:04 +02:00
e807631a76
Split into scoped commits with messages if further details are needed, view those via the associated PR :) **Commit Summary:** **`check-for-changes.sh`** - Prevent `SSL_DOMAIN` silently skipping when value has wildcard prefix `*.` (_at least this was known as a bugfix when originally committed in linked PR_). - Improved inlined docs for maintainers. - Additional logging for debugging. **`helper-functions.sh:_extract_certs_from_acme`**: - Fail if the input arg (_`$CERT_DOMAIN`, aka the FQDN_) provided for extraction is empty. - Use `$CERT_DOMAIN` in place of `$HOSTNAME` and `$1` for a consistent value (_previously could mismatch, eg with `SSL_DOMAIN` defined_). - The conditional is now only for handling extraction failure (_key or cert value is missing from extraction_). - Log an actual warning or success (debug) based on outcome. - Don't use `SSL_DOMAIN` with wildcard value for the `mkdir` letsencrypt directory name (_wildcard prefix `*.` is first stripped instead_). **`acme_extract`** (_new python utility for `acme.json` handling_): - Extracted out into a python script that can be treated as a utility in the `$PATH` like other helper scripts. It can now be used and optionally tested directly instead of via `helper-functions.sh`. -Made compatible with Python 3, as Python 2 is EOL and no longer in newer versions of Debian.
263 lines
9.0 KiB
Bash
Executable File
263 lines
9.0 KiB
Bash
Executable File
#! /bin/bash
|
||
|
||
# shellcheck source=./helper-functions.sh
|
||
. /usr/local/bin/helper-functions.sh
|
||
|
||
function _log_date
|
||
{
|
||
date +"%Y-%m-%d %H:%M:%S"
|
||
}
|
||
|
||
LOG_DATE=$(_log_date)
|
||
_notify 'task' "${LOG_DATE} Start check-for-changes script."
|
||
|
||
# ? --------------------------------------------- Checks
|
||
|
||
cd /tmp/docker-mailserver || exit 1
|
||
|
||
# check postfix-accounts.cf exist else break
|
||
if [[ ! -f postfix-accounts.cf ]]
|
||
then
|
||
_notify 'inf' "${LOG_DATE} postfix-accounts.cf is missing! This should not run! Exit!"
|
||
exit 0
|
||
fi
|
||
|
||
# verify checksum file exists; must be prepared by start-mailserver.sh
|
||
if [[ ! -f ${CHKSUM_FILE} ]]
|
||
then
|
||
_notify 'err' "${LOG_DATE} ${CHKSUM_FILE} is missing! Start script failed? Exit!"
|
||
exit 0
|
||
fi
|
||
|
||
# ? --------------------------------------------- Actual script begins
|
||
|
||
# determine postmaster address, duplicated from start-mailserver.sh
|
||
# this script previously didn't work when POSTMASTER_ADDRESS was empty
|
||
_obtain_hostname_and_domainname
|
||
|
||
PM_ADDRESS="${POSTMASTER_ADDRESS:=postmaster@${DOMAINNAME}}"
|
||
_notify 'inf' "${LOG_DATE} Using postmaster address ${PM_ADDRESS}"
|
||
|
||
# Change detection delayed during startup to avoid conflicting writes
|
||
sleep 10
|
||
|
||
_notify 'inf' "$(_log_date) check-for-changes is ready"
|
||
|
||
while true
|
||
do
|
||
# get chksum and check it, no need to lock config yet
|
||
_monitored_files_checksums >"${CHKSUM_FILE}.new"
|
||
cmp --silent -- "${CHKSUM_FILE}" "${CHKSUM_FILE}.new"
|
||
# cmp return codes
|
||
# 0 – files are identical
|
||
# 1 – files differ
|
||
# 2 – inaccessible or missing argument
|
||
if [ $? -eq 1 ]
|
||
then
|
||
_notify 'inf' "$(_log_date) Change detected"
|
||
create_lock # Shared config safety lock
|
||
CHANGED=$(grep -Fxvf "${CHKSUM_FILE}" "${CHKSUM_FILE}.new" | sed 's/^[^ ]\+ //')
|
||
|
||
# Bug alert! This overwrites the alias set by start-mailserver.sh
|
||
# Take care that changes in one script are propagated to the other
|
||
|
||
# ! NEEDS FIX -----------------------------------------
|
||
# TODO FIX --------------------------------------------
|
||
# ! NEEDS EXTENSIONS ----------------------------------
|
||
# TODO Perform updates below conditionally too --------
|
||
# Also note that changes are performed in place and are not atomic
|
||
# We should fix that and write to temporary files, stop, swap and start
|
||
|
||
# TODO: Consider refactoring this:
|
||
for FILE in ${CHANGED}
|
||
do
|
||
case "${FILE}" in
|
||
# This file is only relevant to Traefik, and is where it stores the certificates
|
||
# it manages. When a change is detected it's assumed to be a possible cert renewal
|
||
# that needs to be extracted for `docker-mailserver` to switch to.
|
||
"/etc/letsencrypt/acme.json" )
|
||
_notify 'inf' "'/etc/letsencrypt/acme.json' has changed, extracting certs.."
|
||
# This breaks early as we only need the first successful extraction. For more details see `setup-stack.sh` `SSL_TYPE=letsencrypt` case handling.
|
||
# NOTE: HOSTNAME is set via `helper-functions.sh`, it is not the original system HOSTNAME ENV anymore.
|
||
# TODO: SSL_DOMAIN is Traefik specific, it no longer seems relevant and should be considered for removal.
|
||
FQDN_LIST=("${SSL_DOMAIN}" "${HOSTNAME}" "${DOMAINNAME}")
|
||
for CERT_DOMAIN in "${FQDN_LIST[@]}"
|
||
do
|
||
_notify 'inf' "Attempting to extract for '${CERT_DOMAIN}'"
|
||
_extract_certs_from_acme "${CERT_DOMAIN}" && break
|
||
done
|
||
;;
|
||
|
||
# This seems like an invalid warning, as if the whole loop and case statement
|
||
# are only intended for the `acme.json` file..?
|
||
* )
|
||
_notify 'warn' "No certificate found in '${FILE}'"
|
||
;;
|
||
|
||
esac
|
||
done
|
||
|
||
# WARNING: This block of duplicate code is already out of sync
|
||
# It appears to unneccesarily run, even if the related entry in the CHKSUM_FILE
|
||
# has not changed?
|
||
#
|
||
# regenerate postix aliases
|
||
echo "root: ${PM_ADDRESS}" >/etc/aliases
|
||
if [[ -f /tmp/docker-mailserver/postfix-aliases.cf ]]
|
||
then
|
||
cat /tmp/docker-mailserver/postfix-aliases.cf >>/etc/aliases
|
||
fi
|
||
postalias /etc/aliases
|
||
|
||
# regenerate postfix accounts
|
||
: >/etc/postfix/vmailbox
|
||
: >/etc/dovecot/userdb
|
||
|
||
if [[ -f /tmp/docker-mailserver/postfix-accounts.cf ]] && [[ ${ENABLE_LDAP} -ne 1 ]]
|
||
then
|
||
sed -i 's/\r//g' /tmp/docker-mailserver/postfix-accounts.cf
|
||
echo "# WARNING: this file is auto-generated. Modify config/postfix-accounts.cf to edit user list." >/etc/postfix/vmailbox
|
||
|
||
# Checking that /tmp/docker-mailserver/postfix-accounts.cf ends with a newline
|
||
# shellcheck disable=SC1003
|
||
sed -i -e '$a\' /tmp/docker-mailserver/postfix-accounts.cf
|
||
chown dovecot:dovecot /etc/dovecot/userdb
|
||
chmod 640 /etc/dovecot/userdb
|
||
sed -i -e '/\!include auth-ldap\.conf\.ext/s/^/#/' /etc/dovecot/conf.d/10-auth.conf
|
||
sed -i -e '/\!include auth-passwdfile\.inc/s/^#//' /etc/dovecot/conf.d/10-auth.conf
|
||
|
||
# rebuild relay host
|
||
if [[ -n ${RELAY_HOST} ]]
|
||
then
|
||
# keep old config
|
||
: >/etc/postfix/sasl_passwd
|
||
if [[ -n ${SASL_PASSWD} ]]
|
||
then
|
||
echo "${SASL_PASSWD}" >>/etc/postfix/sasl_passwd
|
||
fi
|
||
|
||
# add domain-specific auth from config file
|
||
if [[ -f /tmp/docker-mailserver/postfix-sasl-password.cf ]]
|
||
then
|
||
while read -r LINE
|
||
do
|
||
if ! grep -q -e "\s*#" <<< "${LINE}"
|
||
then
|
||
echo "${LINE}" >>/etc/postfix/sasl_passwd
|
||
fi
|
||
done < <(grep -v "^\s*$\|^\s*\#" /tmp/docker-mailserver/postfix-sasl-password.cf || true)
|
||
fi
|
||
|
||
# add default relay
|
||
if [[ -n "${RELAY_USER}" ]] && [[ -n "${RELAY_PASSWORD}" ]]
|
||
then
|
||
echo "[${RELAY_HOST}]:${RELAY_PORT} ${RELAY_USER}:${RELAY_PASSWORD}" >>/etc/postfix/sasl_passwd
|
||
fi
|
||
fi
|
||
|
||
# creating users ; 'pass' is encrypted
|
||
# comments and empty lines are ignored
|
||
while IFS=$'|' read -r LOGIN PASS USER_ATTRIBUTES
|
||
do
|
||
USER=$(echo "${LOGIN}" | cut -d @ -f1)
|
||
DOMAIN=$(echo "${LOGIN}" | cut -d @ -f2)
|
||
|
||
# test if user has a defined quota
|
||
if [[ -f /tmp/docker-mailserver/dovecot-quotas.cf ]]
|
||
then
|
||
declare -a USER_QUOTA
|
||
IFS=':' ; read -r -a USER_QUOTA < <(grep "${USER}@${DOMAIN}:" -i /tmp/docker-mailserver/dovecot-quotas.cf)
|
||
unset IFS
|
||
|
||
[[ ${#USER_QUOTA[@]} -eq 2 ]] && USER_ATTRIBUTES="${USER_ATTRIBUTES} userdb_quota_rule=*:bytes=${USER_QUOTA[1]}"
|
||
fi
|
||
|
||
echo "${LOGIN} ${DOMAIN}/${USER}/" >>/etc/postfix/vmailbox
|
||
|
||
# user database for dovecot has the following format:
|
||
# user:password:uid:gid:(gecos):home:(shell):extra_fields
|
||
# example :
|
||
# ${LOGIN}:${PASS}:5000:5000::/var/mail/${DOMAIN}/${USER}::userdb_mail=maildir:/var/mail/${DOMAIN}/${USER}
|
||
echo "${LOGIN}:${PASS}:5000:5000::/var/mail/${DOMAIN}/${USER}::${USER_ATTRIBUTES}" >>/etc/dovecot/userdb
|
||
mkdir -p "/var/mail/${DOMAIN}/${USER}"
|
||
|
||
if [[ -e /tmp/docker-mailserver/${LOGIN}.dovecot.sieve ]]
|
||
then
|
||
cp "/tmp/docker-mailserver/${LOGIN}.dovecot.sieve" "/var/mail/${DOMAIN}/${USER}/.dovecot.sieve"
|
||
fi
|
||
|
||
echo "${DOMAIN}" >>/tmp/vhost.tmp
|
||
done < <(grep -v "^\s*$\|^\s*\#" /tmp/docker-mailserver/postfix-accounts.cf)
|
||
fi
|
||
|
||
[[ -n ${RELAY_HOST} ]] && _populate_relayhost_map
|
||
|
||
|
||
if [[ -f /etc/postfix/sasl_passwd ]]
|
||
then
|
||
chown root:root /etc/postfix/sasl_passwd
|
||
chmod 0600 /etc/postfix/sasl_passwd
|
||
fi
|
||
|
||
if [[ -f postfix-virtual.cf ]]
|
||
then
|
||
# regenerate postfix aliases
|
||
: >/etc/postfix/virtual
|
||
: >/etc/postfix/regexp
|
||
|
||
if [[ -f /tmp/docker-mailserver/postfix-virtual.cf ]]
|
||
then
|
||
cp -f /tmp/docker-mailserver/postfix-virtual.cf /etc/postfix/virtual
|
||
|
||
# the `to` seems to be important; don't delete it
|
||
# shellcheck disable=SC2034
|
||
while read -r FROM TO
|
||
do
|
||
UNAME=$(echo "${FROM}" | cut -d @ -f1)
|
||
DOMAIN=$(echo "${FROM}" | cut -d @ -f2)
|
||
|
||
# if they are equal it means the line looks like: "user1 other@domain.tld"
|
||
[ "${UNAME}" != "${DOMAIN}" ] && echo "${DOMAIN}" >>/tmp/vhost.tmp
|
||
done < <(grep -v "^\s*$\|^\s*\#" /tmp/docker-mailserver/postfix-virtual.cf || true)
|
||
fi
|
||
|
||
if [[ -f /tmp/docker-mailserver/postfix-regexp.cf ]]
|
||
then
|
||
cp -f /tmp/docker-mailserver/postfix-regexp.cf /etc/postfix/regexp
|
||
sed -i -e '/^virtual_alias_maps/{
|
||
s/ regexp:.*//
|
||
s/$/ regexp:\/etc\/postfix\/regexp/
|
||
}' /etc/postfix/main.cf
|
||
fi
|
||
fi
|
||
|
||
if [[ -f /tmp/vhost.tmp ]]
|
||
then
|
||
sort < /tmp/vhost.tmp | uniq >/etc/postfix/vhost
|
||
rm /tmp/vhost.tmp
|
||
fi
|
||
|
||
if find /var/mail -maxdepth 3 -a \( \! -user 5000 -o \! -group 5000 \) | read -r
|
||
then
|
||
chown -R 5000:5000 /var/mail
|
||
fi
|
||
|
||
_notify 'inf' "Restarting services due to detected changes.."
|
||
|
||
supervisorctl restart postfix
|
||
|
||
# prevent restart of dovecot when smtp_only=1
|
||
[[ ${SMTP_ONLY} -ne 1 ]] && supervisorctl restart dovecot
|
||
|
||
remove_lock
|
||
_notify 'inf' "$(_log_date) Completed handling of detected change"
|
||
fi
|
||
|
||
# mark changes as applied
|
||
mv "${CHKSUM_FILE}.new" "${CHKSUM_FILE}"
|
||
|
||
sleep 1
|
||
done
|
||
|
||
exit 0
|