69 lines
2.7 KiB
Bash
69 lines
2.7 KiB
Bash
#!/bin/bash
|
|
# =============================================================================
|
|
# Renders Postfix config templates from environment variables and starts
|
|
# Postfix in the foreground.
|
|
# =============================================================================
|
|
set -euo pipefail
|
|
|
|
TEMPLATE_DIR="/etc/postfix/templates"
|
|
SSL_DIR="/etc/postfix/ssl"
|
|
|
|
require_var() {
|
|
local name="$1"
|
|
if [ -z "${!name:-}" ]; then
|
|
echo "ERROR: required environment variable ${name} is not set" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
for var in MAIL_DOMAIN MYHOSTNAME \
|
|
POSTGRES_HOST POSTGRES_PORT POSTGRES_USER POSTGRES_PASSWORD POSTGRES_DB \
|
|
SMTP_RELAY_HOST SMTP_RELAY_PORT; do
|
|
require_var "$var"
|
|
done
|
|
|
|
# TLS: use mounted cert/key if provided, otherwise generate a self-signed
|
|
# "snakeoil" certificate on first start, matching the upstream docs' approach.
|
|
mkdir -p "$SSL_DIR"
|
|
if [ -n "${TLS_CERT_FILE:-}" ] && [ -n "${TLS_KEY_FILE:-}" ]; then
|
|
export SMTPD_TLS_CERT_FILE="$TLS_CERT_FILE"
|
|
export SMTPD_TLS_KEY_FILE="$TLS_KEY_FILE"
|
|
else
|
|
export SMTPD_TLS_CERT_FILE="${SSL_DIR}/snakeoil.pem"
|
|
export SMTPD_TLS_KEY_FILE="${SSL_DIR}/snakeoil.key"
|
|
if [ ! -f "$SMTPD_TLS_CERT_FILE" ] || [ ! -f "$SMTPD_TLS_KEY_FILE" ]; then
|
|
echo "No TLS_CERT_FILE/TLS_KEY_FILE provided, generating a self-signed certificate"
|
|
openssl req -x509 -nodes -days 3650 \
|
|
-newkey rsa:2048 \
|
|
-subj "/CN=${MYHOSTNAME}" \
|
|
-keyout "$SMTPD_TLS_KEY_FILE" \
|
|
-out "$SMTPD_TLS_CERT_FILE"
|
|
chmod 600 "$SMTPD_TLS_KEY_FILE"
|
|
fi
|
|
fi
|
|
|
|
render() {
|
|
local template="$1"
|
|
local destination="$2"
|
|
envsubst '${MAIL_DOMAIN} ${MYHOSTNAME} ${SMTPD_TLS_CERT_FILE} ${SMTPD_TLS_KEY_FILE} ${POSTGRES_HOST} ${POSTGRES_PORT} ${POSTGRES_USER} ${POSTGRES_PASSWORD} ${POSTGRES_DB} ${SMTP_RELAY_HOST} ${SMTP_RELAY_PORT}' \
|
|
< "$template" > "$destination"
|
|
}
|
|
|
|
render "${TEMPLATE_DIR}/main.cf.template" /etc/postfix/main.cf
|
|
render "${TEMPLATE_DIR}/pgsql-relay-domains.cf.template" /etc/postfix/pgsql-relay-domains.cf
|
|
render "${TEMPLATE_DIR}/pgsql-transport-maps.cf.template" /etc/postfix/pgsql-transport-maps.cf
|
|
|
|
# The pgsql lookup config files embed the database password; restrict access.
|
|
chown root:postfix /etc/postfix/pgsql-relay-domains.cf /etc/postfix/pgsql-transport-maps.cf
|
|
chmod 640 /etc/postfix/pgsql-relay-domains.cf /etc/postfix/pgsql-transport-maps.cf
|
|
|
|
postfix check
|
|
|
|
# Disable chroot for all master.cf services so child processes (smtpd,
|
|
# trivial-rewrite, etc.) can resolve Docker-internal hostnames via the host's
|
|
# /etc/resolv.conf. Without this, chrooted processes have no DNS and every
|
|
# pgsql lookup returns "451 4.3.0 Temporary lookup failure".
|
|
postconf -F '*/*/chroot = n'
|
|
|
|
exec /usr/sbin/postfix start-fg
|