added postsrs

docker-compose.yml

@@ -81,6 +81,15 @@ services:
                   - milter-sasl.mx.internal.docker
         env_file:
             - env
+    postsrs:
+        build: ./postsrs
+        container_name: mx-postsrs
+        networks:
+            mx.internal.docker:
+                aliases:
+                  - postsrs.mx.internal.docker
+        env_file:
+            - env
 
 networks:
     mx.internal.docker:

dovecot/vars-vars

@@ -18,6 +18,10 @@ OPENDKIM_PORT
 MILTER_SASL_HOST
 MILTER_SASL_PORT
 
+POSTSRS_HOST
+POSTSRS_PORT_FORWARD
+POSTSRS_PORT_REVERSE
+
 EXIM_SMARTHOST_HOST
 EXIM_SMARTHOST_USER
 EXIM_SMARTHOST_PASSWORD

env

@@ -18,6 +18,10 @@ OPENDKIM_PORT=12345
 MILTER_SASL_HOST=milter-sasl.mx.internal.docker
 MILTER_SASL_PORT=12345
 
+POSTSRS_HOST=postsrs.mx.internal.docker
+POSTSRS_PORT_FORWARD=10001
+POSTSRS_PORT_REVERSE=10002
+
 EXIM_SMARTHOST_HOST=test-mx.rthoni.com
 EXIM_SMARTHOST_USER=smarthost@test-mx.rthoni.com
 EXIM_SMARTHOST_PASSWORD=smarthost

milter-sasl/vars-vars

@@ -18,6 +18,10 @@ OPENDKIM_PORT
 MILTER_SASL_HOST
 MILTER_SASL_PORT
 
+POSTSRS_HOST
+POSTSRS_PORT_FORWARD
+POSTSRS_PORT_REVERSE
+
 EXIM_SMARTHOST_HOST
 EXIM_SMARTHOST_USER
 EXIM_SMARTHOST_PASSWORD

opendkim/vars-vars

@@ -18,6 +18,10 @@ OPENDKIM_PORT
 MILTER_SASL_HOST
 MILTER_SASL_PORT
 
+POSTSRS_HOST
+POSTSRS_PORT_FORWARD
+POSTSRS_PORT_REVERSE
+
 EXIM_SMARTHOST_HOST
 EXIM_SMARTHOST_USER
 EXIM_SMARTHOST_PASSWORD

postfix/config/main.cf

@@ -91,3 +91,8 @@ smtpd_relay_restrictions = permit_mynetworks,
         reject_unknown_recipient_domain,
         reject_unauth_pipelining,
         reject_unauth_destination
+
+sender_canonical_maps = tcp:POSTSRS_HOST:POSTSRS_PORT_FORWARD
+sender_canonical_classes = envelope_sender
+recipient_canonical_maps = tcp:POSTSRS_HOST:POSTSRS_PORT_REVERSE
+recipient_canonical_classes = envelope_recipient

postfix/vars-vars

@@ -18,6 +18,10 @@ OPENDKIM_PORT
 MILTER_SASL_HOST
 MILTER_SASL_PORT
 
+POSTSRS_HOST
+POSTSRS_PORT_FORWARD
+POSTSRS_PORT_REVERSE
+
 EXIM_SMARTHOST_HOST
 EXIM_SMARTHOST_USER
 EXIM_SMARTHOST_PASSWORD

postfixadmin/vars-vars

@@ -18,6 +18,10 @@ OPENDKIM_PORT
 MILTER_SASL_HOST
 MILTER_SASL_PORT
 
+POSTSRS_HOST
+POSTSRS_PORT_FORWARD
+POSTSRS_PORT_REVERSE
+
 EXIM_SMARTHOST_HOST
 EXIM_SMARTHOST_USER
 EXIM_SMARTHOST_PASSWORD

postsrs/Dockerfile

@@ -0,0 +1,30 @@
+FROM debian:jessie
+
+MAINTAINER Robin Thoni <robin@rthoni.com>
+
+RUN apt-get update &&\
+    apt-get install -y gcc cmake make git &&\
+    apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+RUN git clone https://git.rthoni.com/robin.thoni/roehling-postsrsd &&\
+    cd roehling-postsrsd &&\
+    git checkout 1.4 &&\
+    make &&\
+    make install
+
+RUN rm -rf /var/log/* &&\
+    mkfifo /var/log/syslog &&\
+    ln -s /dev/null /var/log/mail.log &&\
+    ln -s /dev/null /var/log/mail.err &&\
+    ln -s /dev/null /var/log/main.info &&\
+    ln -s /dev/null /var/log/messages
+
+COPY ./config/postsrs.conf /etc/default/postsrsd
+
+COPY ./vars-vars /etc/vars-vars
+
+COPY ./vars-files /etc/vars-files
+
+COPY ./run.sh /run.sh
+
+CMD ["/run.sh"]

postsrs/config/postsrs.conf

@@ -0,0 +1,41 @@
+# Default settings for postsrsd
+
+# Local domain name.
+# Addresses are rewritten to originate from this domain. The default value
+# is taken from `postconf -h mydomain` and probably okay.
+#
+SRS_DOMAIN=MAIL_DOMAIN
+
+# Exclude additional domains.
+# You may list domains which shall not be subjected to address rewriting.
+# If a domain name starts with a dot, it matches all subdomains, but not
+# the domain itself. Separate multiple domains by space or comma.
+#
+#SRS_EXCLUDE_DOMAINS=.example.com,example.org
+
+# First separator character after SRS0 or SRS1.
+# Can be one of: -+=
+SRS_SEPARATOR==
+
+# Secret key to sign rewritten addresses.
+# When postsrsd is installed for the first time, a random secret is generated
+# and stored in /etc/postsrsd.secret. For most installations, that's just fine.
+#
+SRS_SECRET=/etc/postsrsd.secret
+
+# Local ports for TCP list.
+# These ports are used to bind the TCP list for postfix. If you change
+# these, you have to modify the postfix settings accordingly. The ports
+# are bound to the loopback interface, and should never be exposed on
+# the internet.
+#
+SRS_FORWARD_PORT=10001
+SRS_REVERSE_PORT=10002
+
+# Drop root privileges and run as another user after initialization.
+# This is highly recommended as postsrsd handles untrusted input.
+#
+RUN_AS=nobody
+
+# Jail daemon in chroot environment
+CHROOT=/usr/local/lib/postsrsd

postsrs/run.sh

@@ -0,0 +1,31 @@
+#! /usr/bin/env bash
+
+replace_var()
+{
+  file="${1}"
+  var="${2}"
+  sed -e "s?${var}?${!var}?g" -i "${file}"
+}
+
+replace_vars()
+{
+  file="${1}"
+  for var in $(cat /etc/vars-vars)
+  do
+    replace_var "${file}" "${var}"
+  done
+}
+
+replace_files()
+{
+  for file in $(cat /etc/vars-files)
+  do
+    replace_vars "${file}"
+  done
+}
+
+replace_files
+
+. /etc/default/postsrsd
+
+postsrsd -f "${SRS_FORWARD_PORT}" -r "${SRS_REVERSE_PORT}" -d "${SRS_DOMAIN}" -s "${SRS_SECRET}" -a "${SRS_SEPARATOR}" -u "${RUN_AS}" -c "${CHROOT}" -X"${SRS_EXCLUDE_DOMAINS}"

postsrs/vars-files

@@ -0,0 +1 @@
+/etc/default/postsrsd

postsrs/vars-vars

@@ -0,0 +1,27 @@
+POSTGRES_HOST
+POSTGRES_USER
+POSTGRES_PASSWORD
+POSTGRES_DB
+
+MAIL_DOMAIN
+MAIL_HOSTNAME
+
+DOVECOT_HOST
+DOVECOT_SASL_PORT
+DOVECOT_LMTP_PORT
+
+POSTFIX_HOST
+
+OPENDKIM_HOST
+OPENDKIM_PORT
+
+MILTER_SASL_HOST
+MILTER_SASL_PORT
+
+POSTSRS_HOST
+POSTSRS_PORT_FORWARD
+POSTSRS_PORT_REVERSE
+
+EXIM_SMARTHOST_HOST
+EXIM_SMARTHOST_USER
+EXIM_SMARTHOST_PASSWORD

update_vars.sh

@@ -1,7 +1,7 @@
 #! /usr/bin/env sh
 
 vars=$(cat env | cut -d= -f1)
-for docker in dovecot opendkim postfix postfixadmin
+for docker in dovecot opendkim postfix postfixadmin milter-sasl postsrs
 do
   echo "${vars}" > "./${docker}/vars-vars"
 done