#!/bin/bash
# =============================================================================
# Renders Postfix config templates from environment variables and starts
# Postfix in the foreground.
# =============================================================================
set -euo pipefail

TEMPLATE_DIR="/etc/postfix/templates"
SSL_DIR="/etc/postfix/ssl"

require_var() {
    local name="$1"
    if [ -z "${!name:-}" ]; then
        echo "ERROR: required environment variable ${name} is not set" >&2
        exit 1
    fi
}

for var in MAIL_DOMAIN MYHOSTNAME \
    POSTGRES_HOST POSTGRES_PORT POSTGRES_USER POSTGRES_PASSWORD POSTGRES_DB \
    SMTP_RELAY_HOST SMTP_RELAY_PORT; do
    require_var "$var"
done

# TLS: use mounted cert/key if provided, otherwise generate a self-signed
# "snakeoil" certificate on first start, matching the upstream docs' approach.
mkdir -p "$SSL_DIR"
if [ -n "${TLS_CERT_FILE:-}" ] && [ -n "${TLS_KEY_FILE:-}" ]; then
    export SMTPD_TLS_CERT_FILE="$TLS_CERT_FILE"
    export SMTPD_TLS_KEY_FILE="$TLS_KEY_FILE"
else
    export SMTPD_TLS_CERT_FILE="${SSL_DIR}/snakeoil.pem"
    export SMTPD_TLS_KEY_FILE="${SSL_DIR}/snakeoil.key"
    if [ ! -f "$SMTPD_TLS_CERT_FILE" ] || [ ! -f "$SMTPD_TLS_KEY_FILE" ]; then
        echo "No TLS_CERT_FILE/TLS_KEY_FILE provided, generating a self-signed certificate"
        openssl req -x509 -nodes -days 3650 \
            -newkey rsa:2048 \
            -subj "/CN=${MYHOSTNAME}" \
            -keyout "$SMTPD_TLS_KEY_FILE" \
            -out "$SMTPD_TLS_CERT_FILE"
        chmod 600 "$SMTPD_TLS_KEY_FILE"
    fi
fi

render() {
    local template="$1"
    local destination="$2"
    envsubst '${MAIL_DOMAIN} ${MYHOSTNAME} ${SMTPD_TLS_CERT_FILE} ${SMTPD_TLS_KEY_FILE} ${POSTGRES_HOST} ${POSTGRES_PORT} ${POSTGRES_USER} ${POSTGRES_PASSWORD} ${POSTGRES_DB} ${SMTP_RELAY_HOST} ${SMTP_RELAY_PORT}' \
        < "$template" > "$destination"
}

render "${TEMPLATE_DIR}/main.cf.template" /etc/postfix/main.cf
render "${TEMPLATE_DIR}/pgsql-relay-domains.cf.template" /etc/postfix/pgsql-relay-domains.cf
render "${TEMPLATE_DIR}/pgsql-transport-maps.cf.template" /etc/postfix/pgsql-transport-maps.cf

# The pgsql lookup config files embed the database password; restrict access.
chown root:postfix /etc/postfix/pgsql-relay-domains.cf /etc/postfix/pgsql-transport-maps.cf
chmod 640 /etc/postfix/pgsql-relay-domains.cf /etc/postfix/pgsql-transport-maps.cf

postfix check

# Disable chroot for all master.cf services so child processes (smtpd,
# trivial-rewrite, etc.) can resolve Docker-internal hostnames via the host's
# /etc/resolv.conf. Without this, chrooted processes have no DNS and every
# pgsql lookup returns "451 4.3.0 Temporary lookup failure".
postconf -F '*/*/chroot = n'

exec /usr/sbin/postfix start-fg