tegwick
6518044633
smtpd refused to start without a reject-class entry in smtpd_relay_restrictions, and ignored access-map results for !/% local-parts without allow_untrusted_routing. Relay regexp now permits @DOMAIN only and the list ends in reject. Deployed to railiance01 namespace mas and verified live. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 252470@bnt-lap001 Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241
57 lines
2.9 KiB
Bash
57 lines
2.9 KiB
Bash
#!/bin/sh
|
|
# mx : Postfix -> pipe -> mas-gateway -> capture (JSONL evidence) -> ticket service
|
|
# statute : static /.well-known/mas only (the only thing exposed over HTTPS)
|
|
set -e
|
|
DOMAIN="${MAS_DOMAIN:-mas.coulomb.social}"
|
|
STATUTE_DIR="/app/examples/statute/$DOMAIN"
|
|
|
|
if [ "$1" = "statute" ]; then
|
|
exec python3 /app/examples/statute/serve.py "$STATUTE_DIR" --host 0.0.0.0 --port 8080
|
|
fi
|
|
|
|
cat > /usr/local/bin/mas-gateway <<SH
|
|
#!/bin/sh
|
|
exec env PYTHONPATH=/app python3 -m mas_gateway.main "\$@"
|
|
SH
|
|
chmod +x /usr/local/bin/mas-gateway
|
|
|
|
# Not an open relay: no relay_domains, mynetworks is loopback only, so the
|
|
# only accepted recipients are @$DOMAIN, all delivered to the mas pipe.
|
|
# Stock reject_unauth_destination refuses any local-part containing '!' or '%'
|
|
# (treated as sender-specified routing), which kills every P2 address, and an
|
|
# access-map result is ignored for such routed addresses unless
|
|
# allow_untrusted_routing=yes (safe here: relay_domains is empty). So relay control is an
|
|
# explicit regexp whose match runs the `permit` restriction (not OK) for
|
|
# anything ending in @$DOMAIN; everything else falls through to `reject`
|
|
# (Postfix refuses to start smtpd without a reject-class entry in the list).
|
|
# With swap_bangpath/percent_hack off and local_transport=mas, those
|
|
# addresses can only reach the mas pipe.
|
|
DOMAIN_RE=$(printf '%s' "$DOMAIN" | sed 's/\./\\./g')
|
|
printf '/@%s$/ permit\n' "$DOMAIN_RE" > /etc/postfix/mas_rcpt.regexp
|
|
postconf -e \
|
|
"maillog_file=/dev/stdout" "myhostname=$DOMAIN" "mydomain=$DOMAIN" \
|
|
"mydestination=$DOMAIN" "relay_domains=" "mynetworks=127.0.0.0/8" \
|
|
"smtpd_relay_restrictions=permit_mynetworks,check_recipient_access regexp:/etc/postfix/mas_rcpt.regexp,reject" \
|
|
"local_transport=mas" "local_recipient_maps=" "mas_destination_recipient_limit=1" \
|
|
"recipient_delimiter=+" "swap_bangpath=no" "allow_percent_hack=no" \
|
|
"allow_untrusted_routing=yes" \
|
|
"disable_vrfy_command=yes" "smtpd_helo_required=yes" "smtpd_recipient_limit=20" \
|
|
"message_size_limit=10240000" "smtpd_banner=\$myhostname ESMTP MAS live test" \
|
|
"smtpd_tls_security_level=may" \
|
|
"smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem" \
|
|
"smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key" \
|
|
"inet_protocols=ipv4" "compatibility_level=3.6"
|
|
cat >> /etc/postfix/master.cf <<CF
|
|
mas unix - n n - - pipe
|
|
flags=Rq user=mas argv=/usr/local/bin/mas-gateway
|
|
--statute $STATUTE_DIR/.well-known/mas
|
|
pipe --app-url http://127.0.0.1:8024/mas-events --recipient \${recipient}
|
|
CF
|
|
|
|
mkdir -p /var/lib/mas && chown mas /var/lib/mas
|
|
# Replies stay in the outbox (no --smtp) until the subdomain has SPF/DKIM.
|
|
su -s /bin/sh mas -c "python3 /app/examples/ticket_service/ticket_service.py \
|
|
--db /var/lib/mas/tickets.sqlite3 --listen 127.0.0.1:8025" &
|
|
su -s /bin/sh mas -c "python3 /app/capture.py http://127.0.0.1:8025/mas-events \
|
|
/var/lib/mas/events.jsonl 127.0.0.1" &
|
|
exec postfix start-fg
|