tegwick
d766d61e7f
Profile in integrations/postfix (install.sh + README), now used by the live deployment. Probe runs every conformance-corpus local-part and the relay negatives against it; tests/test_postfix_profile.py runs it where Docker is available. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5787@bnt-lap001 Assistant-Session: 5db26b82-138b-40cc-9856-4d5eb0f752fd
60 lines
3.2 KiB
Bash
60 lines
3.2 KiB
Bash
#!/bin/sh
|
|
# Repo is mounted read-only at /mas. PROFILE=defaults|mas-safe selects Postfix settings.
|
|
set -e
|
|
cat > /usr/local/bin/mas-gateway <<'SH'
|
|
#!/bin/sh
|
|
exec env PYTHONPATH=/mas python3 -m mas_gateway.main "$@"
|
|
SH
|
|
chmod +x /usr/local/bin/mas-gateway
|
|
|
|
# mas-profile: the shipped integration profile (integrations/postfix), as
|
|
# deployed live. Relaying is loopback-only, so the probe client is an ordinary
|
|
# outside sender. The other profiles below are the MAS-WP-0002 experiments.
|
|
if [ "$PROFILE" = "mas-profile" ]; then
|
|
postconf -e "maillog_file=/dev/stdout" "compatibility_level=3.6"
|
|
sh /mas/integrations/postfix/install.sh --domain great-service.example \
|
|
--statute /mas/examples/statute/great-service.example/.well-known/mas \
|
|
--app-url http://127.0.0.1:8024/mas-events --auth
|
|
opendkim -f -x /etc/opendkim.conf &
|
|
opendmarc -f -c /etc/opendmarc.conf &
|
|
mkdir -p /var/lib/tickets && chown mas /var/lib/tickets
|
|
su -s /bin/sh mas -c "PYTHONPATH=/mas python3 /mas/examples/ticket_service/ticket_service.py \
|
|
--db /var/lib/tickets/t.sqlite3 --listen 0.0.0.0:8025" &
|
|
python3 /mas/experiments/postfix-probe/capture.py http://127.0.0.1:8025/mas-events &
|
|
echo "PROFILE=mas-profile"
|
|
exec postfix start-fg
|
|
fi
|
|
|
|
postconf -e "maillog_file=/dev/stdout" "myhostname=mx.probe.test" "mydestination=" \
|
|
"relay_domains=great-service.example" "transport_maps=inline:{great-service.example=mas:}" \
|
|
"mynetworks=0.0.0.0/0" "smtpd_relay_restrictions=permit_mynetworks,reject" \
|
|
"mas_destination_recipient_limit=1" "recipient_delimiter=+" "compatibility_level=3.6"
|
|
# PROFILE: defaults - Postfix defaults; probe client is "remote" (no address rewriting)
|
|
# defaults-local - defaults, but every client gets the local rewrite context
|
|
# mas-safe-local - local rewrite context with swap_bangpath/allow_percent_hack off
|
|
# local-domain - domain served via mydestination (local delivery class), defaults
|
|
# local-domain-safe - local-domain with swap_bangpath/allow_percent_hack off
|
|
case "$PROFILE" in
|
|
local-domain*) postconf -e "relay_domains=" "transport_maps=" "mydestination=great-service.example" \
|
|
"local_transport=mas" "local_recipient_maps=" ;;
|
|
esac
|
|
case "$PROFILE" in
|
|
*-local) postconf -e "local_header_rewrite_clients=static:all" ;;
|
|
esac
|
|
case "$PROFILE" in
|
|
mas-safe*|*-safe) postconf -e "swap_bangpath=no" "allow_percent_hack=no" ;;
|
|
esac
|
|
cat >> /etc/postfix/master.cf <<'CF'
|
|
mas unix - n n - - pipe
|
|
flags=Rq user=mas argv=/usr/local/bin/mas-gateway
|
|
--statute /mas/examples/statute/great-service.example/.well-known/mas
|
|
pipe --app-url http://127.0.0.1:8024/mas-events --recipient ${recipient}
|
|
CF
|
|
# Postfix runs `mas-gateway` as user mas; the service needs a writable DB.
|
|
mkdir -p /var/lib/tickets && chown mas /var/lib/tickets
|
|
su -s /bin/sh mas -c "PYTHONPATH=/mas python3 /mas/examples/ticket_service/ticket_service.py \
|
|
--db /var/lib/tickets/t.sqlite3 --listen 0.0.0.0:8025" &
|
|
python3 /mas/experiments/postfix-probe/capture.py http://127.0.0.1:8025/mas-events &
|
|
echo "PROFILE=${PROFILE:-defaults}"
|
|
postconf swap_bangpath allow_percent_hack recipient_delimiter local_header_rewrite_clients
|
|
exec postfix start-fg
|