tegwick
d766d61e7f
Profile in integrations/postfix (install.sh + README), now used by the live deployment. Probe runs every conformance-corpus local-part and the relay negatives against it; tests/test_postfix_profile.py runs it where Docker is available. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5787@bnt-lap001 Assistant-Session: 5db26b82-138b-40cc-9856-4d5eb0f752fd
60 lines
2.5 KiB
Bash
60 lines
2.5 KiB
Bash
#!/bin/sh
|
|
# mx : Postfix -> pipe -> mas-gateway -> capture (JSONL evidence) -> ticket service
|
|
# statute : static /.well-known/mas only (the only thing exposed over HTTPS)
|
|
set -e
|
|
DOMAIN="${MAS_DOMAIN:-mas.coulomb.social}"
|
|
STATUTE_DIR="/app/examples/statute/$DOMAIN"
|
|
|
|
if [ "$1" = "statute" ]; then
|
|
exec python3 /app/examples/statute/serve.py "$STATUTE_DIR" --host 0.0.0.0 --port 8080
|
|
fi
|
|
|
|
cat > /usr/local/bin/mas-gateway <<SH
|
|
#!/bin/sh
|
|
exec env PYTHONPATH=/app python3 -m mas_gateway.main "\$@"
|
|
SH
|
|
chmod +x /usr/local/bin/mas-gateway
|
|
|
|
# The MAS setup (relay control, no rewriting, mas pipe, outbound relay, sender
|
|
# authentication) is the integration profile; see integrations/postfix/.
|
|
# Port 25 out is blocked on railiance01, so replies go through an
|
|
# authenticated submission relay, and only when its credentials are mounted.
|
|
RELAY_ARGS=""
|
|
if [ -n "$MAS_RELAY" ] && [ -s /etc/mas-relay/username ]; then
|
|
RELAY_ARGS="--relay $MAS_RELAY --relay-credentials /etc/mas-relay"
|
|
fi
|
|
/app/integrations/postfix/install.sh --domain "$DOMAIN" \
|
|
--statute "$STATUTE_DIR/.well-known/mas" --app-url http://127.0.0.1:8024/mas-events --auth \
|
|
$RELAY_ARGS
|
|
|
|
# Deployment specifics.
|
|
postconf -e \
|
|
"maillog_file=/dev/stdout" "message_size_limit=10240000" \
|
|
"smtpd_banner=\$myhostname ESMTP MAS live test" \
|
|
"smtpd_tls_security_level=may" \
|
|
"smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem" \
|
|
"smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key" \
|
|
"inet_protocols=ipv4" "compatibility_level=3.6"
|
|
# start-fg does not populate the chroot (no resolv.conf), so DNS fails inside
|
|
# it: client rDNS shows "unknown" and a relayhost would not resolve. The
|
|
# container already isolates Postfix, so run the daemons unchrooted.
|
|
postconf -F '*/*/chroot = n'
|
|
|
|
# The ticket service sends replies only with a relay, capped at MAS_MAX_SENT.
|
|
SMTP_ARG=""
|
|
if [ -n "$MAS_RELAY" ] && [ -s /etc/mas-relay/username ]; then
|
|
SMTP_ARG="--smtp 127.0.0.1:25 --max-sent ${MAS_MAX_SENT:-300} --require-dmarc-pass"
|
|
fi
|
|
|
|
# Milters in the foreground: daemonized, OpenDKIM died on its first
|
|
# connection in this container.
|
|
opendkim -f -x /etc/opendkim.conf &
|
|
opendmarc -f -c /etc/opendmarc.conf &
|
|
|
|
mkdir -p /var/lib/mas && chown mas /var/lib/mas
|
|
# Replies are only recorded in the outbox unless a relay is configured above.
|
|
su -s /bin/sh mas -c "python3 /app/examples/ticket_service/ticket_service.py \
|
|
--db /var/lib/mas/tickets.sqlite3 --listen 127.0.0.1:8025 $SMTP_ARG" &
|
|
su -s /bin/sh mas -c "python3 /app/capture.py http://127.0.0.1:8025/mas-events \
|
|
/var/lib/mas/events.jsonl 127.0.0.1" &
|
|
exec postfix start-fg
|