feat(postfix-pgsql): add Dockerfile with templated config and entrypoint

images/postfix-pgsql/docker-entrypoint.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# =============================================================================
+# Renders Postfix config templates from environment variables and starts
+# Postfix in the foreground.
+# =============================================================================
+set -euo pipefail
+
+TEMPLATE_DIR="/etc/postfix/templates"
+SSL_DIR="/etc/postfix/ssl"
+
+require_var() {
+    local name="$1"
+    if [ -z "${!name:-}" ]; then
+        echo "ERROR: required environment variable ${name} is not set" >&2
+        exit 1
+    fi
+}
+
+for var in MAIL_DOMAIN MYHOSTNAME \
+    POSTGRES_HOST POSTGRES_PORT POSTGRES_USER POSTGRES_PASSWORD POSTGRES_DB \
+    SMTP_RELAY_HOST SMTP_RELAY_PORT; do
+    require_var "$var"
+done
+
+# TLS: use mounted cert/key if provided, otherwise generate a self-signed
+# "snakeoil" certificate on first start, matching the upstream docs' approach.
+mkdir -p "$SSL_DIR"
+if [ -n "${TLS_CERT_FILE:-}" ] && [ -n "${TLS_KEY_FILE:-}" ]; then
+    export SMTPD_TLS_CERT_FILE="$TLS_CERT_FILE"
+    export SMTPD_TLS_KEY_FILE="$TLS_KEY_FILE"
+else
+    export SMTPD_TLS_CERT_FILE="${SSL_DIR}/snakeoil.pem"
+    export SMTPD_TLS_KEY_FILE="${SSL_DIR}/snakeoil.key"
+    if [ ! -f "$SMTPD_TLS_CERT_FILE" ] || [ ! -f "$SMTPD_TLS_KEY_FILE" ]; then
+        echo "No TLS_CERT_FILE/TLS_KEY_FILE provided, generating a self-signed certificate"
+        openssl req -x509 -nodes -days 3650 \
+            -newkey rsa:2048 \
+            -subj "/CN=${MYHOSTNAME}" \
+            -keyout "$SMTPD_TLS_KEY_FILE" \
+            -out "$SMTPD_TLS_CERT_FILE"
+        chmod 600 "$SMTPD_TLS_KEY_FILE"
+    fi
+fi
+
+render() {
+    local template="$1"
+    local destination="$2"
+    envsubst '${MAIL_DOMAIN} ${MYHOSTNAME} ${SMTPD_TLS_CERT_FILE} ${SMTPD_TLS_KEY_FILE} ${POSTGRES_HOST} ${POSTGRES_PORT} ${POSTGRES_USER} ${POSTGRES_PASSWORD} ${POSTGRES_DB} ${SMTP_RELAY_HOST} ${SMTP_RELAY_PORT}' \
+        < "$template" > "$destination"
+}
+
+render "${TEMPLATE_DIR}/main.cf.template" /etc/postfix/main.cf
+render "${TEMPLATE_DIR}/pgsql-relay-domains.cf.template" /etc/postfix/pgsql-relay-domains.cf
+render "${TEMPLATE_DIR}/pgsql-transport-maps.cf.template" /etc/postfix/pgsql-transport-maps.cf
+
+# The pgsql lookup config files embed the database password; restrict access.
+chown root:postfix /etc/postfix/pgsql-relay-domains.cf /etc/postfix/pgsql-transport-maps.cf
+chmod 640 /etc/postfix/pgsql-relay-domains.cf /etc/postfix/pgsql-transport-maps.cf
+
+postfix check
+
+exec /usr/sbin/postfix start-fg