Commit

Author:

Hash:

Timestamp:

+800 -715 +/-31 browse

Kevin Schoon [me@kevinschoon.com]

171793e5ea9bc648a0648dbbea7861d2285e1921

Mon, 24 Jun 2024 07:04:09 +0000 (1.0 years ago)

split apart multiuser and multiuser-mail containers
1diff --git a/containers/ayllu/Containerfile b/containers/ayllu/Containerfile
2new file mode 100644
3index 0000000..83f726a
4--- /dev/null
5+++ b/containers/ayllu/Containerfile
6 @@ -0,0 +1,118 @@
7+ ARG BASE_BUILD_IMAGE=registry.ayllu-forge.org/ayllu/base-build
8+ FROM $BASE_BUILD_IMAGE AS build
9+
10+ ARG TREE_SITTER_DIFF_UPSTREAM_URL="https://github.com/the-mikedavis/tree-sitter-diff/archive"
11+ ARG TREE_SITTER_DIFF_COMMIT_ID="629676fc3919606964231b2c7b9677d6998a2cb4"
12+ ARG TREE_SITTER_DIFF_SHA256SUM="3b43eba0afcdbbc405a9d3284b3af73332fa3522f888a8629f8d14d685e69781"
13+
14+ # TODO: tree-sitter-diff needs APK support but they haven't cut a release yet
15+ RUN \
16+ curl -L "$TREE_SITTER_DIFF_UPSTREAM_URL/$TREE_SITTER_DIFF_COMMIT_ID.tar.gz" \
17+ -o tree-sitter-diff.tar.gz \
18+ && echo "$TREE_SITTER_DIFF_SHA256SUM tree-sitter-diff.tar.gz" | sha256sum -c \
19+ && tar xvf tree-sitter-diff.tar.gz
20+
21+ RUN cd tree-sitter-diff-* && abuild-tree-sitter build && abuild-tree-sitter install
22+
23+ # Install rudolfs for LFS support
24+ ARG RUDOLFS_VERSION="0.3.7"
25+ ARG RUDOLFS_SHA256SUM="0ac57990e8923d2bf220a5c46a996d3b666f2d0454487597c0c106f8e079f2aa"
26+ ARG RUDOLFS_UPSTREAM_URL="https://github.com/jasonwhite/rudolfs/archive/refs/tags/${RUDOLFS_VERSION}.tar.gz"
27+
28+ RUN \
29+ curl -L "$RUDOLFS_UPSTREAM_URL" -o rudolfs.tar.gz \
30+ && echo "$RUDOLFS_SHA256SUM rudolfs.tar.gz" | sha256sum -c \
31+ && tar xvf rudolfs.tar.gz
32+
33+ RUN --mount=type=cache,target=/root/.cargo \
34+ cd "rudolfs-$RUDOLFS_VERSION" && cargo fetch --color=never --locked
35+ RUN --mount=type=cache,target=/root/.cargo --network=none \
36+ cd "rudolfs-$RUDOLFS_VERSION" && cargo build \
37+ --color=never --locked --frozen --offline --release \
38+ && cp -v target/release/rudolfs /usr/bin/
39+
40+ COPY ayllu /src/ayllu/ayllu
41+ COPY ayllu-mail /src/ayllu/ayllu-mail
42+ COPY contrib /src/ayllu/contrib
43+ COPY crates /src/ayllu/crates
44+ COPY quipu /src/ayllu/quipu
45+ COPY scripts /src/ayllu/scripts
46+ COPY *.toml /src/ayllu/
47+ COPY Cargo.lock /src/ayllu/
48+ COPY LICENSE /src/ayllu/
49+ COPY ATTRIBUTIONS.md /src/ayllu/
50+ COPY package.json /src/ayllu/
51+
52+ WORKDIR /src/ayllu
53+
54+ RUN npm install
55+
56+ RUN --mount=type=cache,target=/root/.cargo \
57+ scripts/check_build_dependencies.sh || true
58+
59+ RUN --mount=type=cache,target=/root/.cargo \
60+ scripts/ensure_database.sh ayllu
61+
62+ # cache all Ayllu dependencies required for the build
63+ RUN --mount=type=cache,target=/root/.cargo cargo fetch --color=never --locked
64+
65+ # build the main ayllu binary
66+ RUN --mount=type=cache,target=/root/.cargo --network=none \
67+ cargo build \
68+ --color=never --locked --frozen --offline --release --package ayllu
69+
70+ # build the ayllu-mail binary
71+ RUN --mount=type=cache,target=/root/.cargo --network=none \
72+ cargo build \
73+ --color=never --locked --frozen --offline --release --package ayllu-mail
74+
75+ # build the quipu binary
76+ RUN --mount=type=cache,target=/root/.cargo --network=none \
77+ cargo build \
78+ --color=never --locked --frozen --offline --release --package quipu
79+
80+ FROM alpine:3
81+
82+ RUN apk add \
83+ fontconfig font-misc-misc git git-daemon libgit2-dev sqlite \
84+ tree-sitter-grammars # all of the syntax highlighting available in alpine
85+
86+ # FIXME: Due to a bug in tree-sitter-cpp we have to remove this parser
87+ RUN rm -v /usr/lib/libtree-sitter-cpp.so
88+
89+ COPY --from=build --chown=0:0 /usr/bin/rudolfs /usr/bin/
90+ COPY --from=build --chown=0:0 /src/ayllu/target/release/ayllu /usr/bin/
91+ COPY --from=build --chown=0:0 /src/ayllu/target/release/ayllu-mail /usr/bin/
92+ COPY --from=build --chown=0:0 /src/ayllu/target/release/quipu /usr/bin/
93+ COPY --from=build --chown=0:0 /src/ayllu/ayllu/themes /usr/lib/ayllu/themes
94+ COPY --from=build --chown=0:0 /src/ayllu/ayllu/migrations /usr/lib/ayllu/migrations/ayllu
95+ COPY --from=build --chown=0:0 /src/ayllu/LICENSE /usr/share/licenses/ayllu/
96+ COPY --from=build --chown=0:0 /src/ayllu/ATTRIBUTIONS.md /usr/share/licenses/ayllu/
97+
98+ COPY --from=build --chown=0:0 /usr/lib/tree-sitter/diff.so /usr/lib/tree-sitter/diff.so
99+ COPY --from=build --chown=0:0 /usr/share/tree-sitter/queries/diff /usr/share/tree-sitter/queries/diff
100+ RUN ln -sv /usr/lib/tree-sitter/diff.so /usr/lib/libtree-sitter-diff.so
101+
102+ # this container supports running Ayllu as root and non-root depending on the
103+ # desired runtime security and required UID/GID mapping.
104+ RUN adduser -D -s /bin/sh -h /home/ayllu ayllu
105+
106+ RUN \
107+ mkdir -p /etc/ayllu /var/lib/ayllu /var/lib/git && \
108+ ayllu config generate > /etc/ayllu/config.toml && \
109+ fc-cache -fv # update font cache which is required by plotters.rs
110+
111+ # setup an unprivileged user for rudolfs
112+ RUN adduser -D -s /bin/sh -h /home/rudolfs rudolfs
113+
114+ # default to the non-root ayllu user
115+ USER ayllu
116+ WORKDIR /home/ayllu
117+
118+ # NOTE: this explicitly ignores CVE 2022-24765 because this is not a multi-user
119+ # git environment.
120+ RUN \
121+ git config --global --add user.name 'ayllu' && \
122+ git config --global --add safe.directory '*'
123+
124+ CMD ["/usr/bin/ayllu", "serve"]
125 diff --git a/containers/ayllu/README.md b/containers/ayllu/README.md
126new file mode 100644
127index 0000000..91e90ff
128--- /dev/null
129+++ b/containers/ayllu/README.md
130 @@ -0,0 +1,4 @@
131+ # Ayllu
132+
133+ This container has all of the software required to run a basic installation of
134+ Ayllu without any server extensions such as mail, builds, etc.
135 diff --git a/containers/base-build/Containerfile b/containers/base-build/Containerfile
136new file mode 100644
137index 0000000..f6848e1
138--- /dev/null
139+++ b/containers/base-build/Containerfile
140 @@ -0,0 +1,13 @@
141+ FROM alpine:3
142+
143+ RUN apk add \
144+ curl cargo rust pkgconf sqlite sassc npm \
145+ openssl openssl-dev fontconfig fontconfig-dev \
146+ tree-sitter-dev build-base git
147+
148+ WORKDIR /src
149+
150+ RUN --mount=type=cache,target=/root/.cargo \
151+ cargo install --color=never --no-default-features --features sqlite sqlx-cli
152+
153+ ENV PATH="/root/.cargo/bin:$PATH"
154 diff --git a/containers/base-build/README.md b/containers/base-build/README.md
155new file mode 100644
156index 0000000..a0afac9
157--- /dev/null
158+++ b/containers/base-build/README.md
159 @@ -0,0 +1,4 @@
160+ # base-build
161+
162+ Container used to build Ayllu and Ayllu related components, not for
163+ distribution.
164 diff --git a/containers/base/Containerfile b/containers/base/Containerfile
165deleted file mode 100644
166index 0e68f99..0000000
167--- a/containers/base/Containerfile
168+++ /dev/null
169 @@ -1,129 +0,0 @@
170- FROM alpine:3 AS build
171-
172- RUN apk add \
173- curl cargo rust pkgconf sqlite sassc npm \
174- openssl openssl-dev fontconfig fontconfig-dev \
175- tree-sitter-dev build-base git
176-
177- WORKDIR /src
178-
179- RUN --mount=type=cache,target=/root/.cargo \
180- cargo install --color=never --no-default-features --features sqlite sqlx-cli
181-
182- ENV PATH="/root/.cargo/bin:$PATH"
183-
184- ARG TREE_SITTER_DIFF_UPSTREAM_URL="https://github.com/the-mikedavis/tree-sitter-diff/archive"
185- ARG TREE_SITTER_DIFF_COMMIT_ID="629676fc3919606964231b2c7b9677d6998a2cb4"
186- ARG TREE_SITTER_DIFF_SHA256SUM="3b43eba0afcdbbc405a9d3284b3af73332fa3522f888a8629f8d14d685e69781"
187-
188- # TODO: tree-sitter-diff needs APK support but they haven't cut a release yet
189- RUN \
190- curl -L "$TREE_SITTER_DIFF_UPSTREAM_URL/$TREE_SITTER_DIFF_COMMIT_ID.tar.gz" \
191- -o tree-sitter-diff.tar.gz \
192- && echo "$TREE_SITTER_DIFF_SHA256SUM tree-sitter-diff.tar.gz" | sha256sum -c \
193- && tar xvf tree-sitter-diff.tar.gz
194-
195- RUN cd tree-sitter-diff-* && abuild-tree-sitter build && abuild-tree-sitter install
196-
197- # Install rudolfs for LFS support
198- ARG RUDOLFS_VERSION="0.3.7"
199- ARG RUDOLFS_SHA256SUM="0ac57990e8923d2bf220a5c46a996d3b666f2d0454487597c0c106f8e079f2aa"
200- ARG RUDOLFS_UPSTREAM_URL="https://github.com/jasonwhite/rudolfs/archive/refs/tags/${RUDOLFS_VERSION}.tar.gz"
201-
202- RUN \
203- curl -L "$RUDOLFS_UPSTREAM_URL" -o rudolfs.tar.gz \
204- && echo "$RUDOLFS_SHA256SUM rudolfs.tar.gz" | sha256sum -c \
205- && tar xvf rudolfs.tar.gz
206-
207- RUN --mount=type=cache,target=/root/.cargo \
208- cd "rudolfs-$RUDOLFS_VERSION" && cargo fetch --color=never --locked
209- RUN --mount=type=cache,target=/root/.cargo --network=none \
210- cd "rudolfs-$RUDOLFS_VERSION" && cargo build \
211- --color=never --locked --frozen --offline --release \
212- && cp -v target/release/rudolfs /usr/bin/
213-
214- COPY ayllu /src/ayllu/ayllu
215- COPY contrib /src/ayllu/contrib
216- COPY crates /src/ayllu/crates
217- COPY quipu /src/ayllu/quipu
218- COPY ayllu-mail /src/ayllu/ayllu-mail
219- COPY scripts /src/ayllu/scripts
220- COPY *.toml /src/ayllu/
221- COPY Cargo.lock /src/ayllu/
222- COPY LICENSE /src/ayllu/
223- COPY ATTRIBUTIONS.md /src/ayllu/
224- COPY package.json /src/ayllu/
225-
226- WORKDIR /src/ayllu
227-
228- RUN npm install
229-
230- RUN --mount=type=cache,target=/root/.cargo \
231- scripts/check_build_dependencies.sh || true
232-
233- RUN --mount=type=cache,target=/root/.cargo \
234- scripts/ensure_database.sh ayllu
235-
236- # cache all Ayllu dependencies required for the build
237- RUN --mount=type=cache,target=/root/.cargo cargo fetch --color=never --locked
238-
239- # build the main ayllu binary
240- RUN --mount=type=cache,target=/root/.cargo --network=none \
241- cargo build \
242- --color=never --locked --frozen --offline --release --package ayllu
243-
244- # build the quipu binary
245- RUN --mount=type=cache,target=/root/.cargo --network=none \
246- cargo build \
247- --color=never --locked --frozen --offline --release --package quipu
248-
249- # build the ayllu-mail binary
250- RUN --mount=type=cache,target=/root/.cargo --network=none \
251- cargo build \
252- --color=never --locked --frozen --offline --release --package ayllu-mail
253-
254- FROM alpine:3
255-
256- RUN apk add \
257- fontconfig font-misc-misc git git-daemon libgit2-dev sqlite \
258- tree-sitter-grammars # all of the syntax highlighting available in alpine
259-
260- # FIXME: Due to a bug in tree-sitter-cpp we have to remove this parser
261- RUN rm -v /usr/lib/libtree-sitter-cpp.so
262-
263- COPY --from=build --chown=0:0 /usr/bin/rudolfs /usr/bin/
264- COPY --from=build --chown=0:0 /src/ayllu/target/release/ayllu /usr/bin/
265- COPY --from=build --chown=0:0 /src/ayllu/target/release/quipu /usr/bin/
266- COPY --from=build --chown=0:0 /src/ayllu/target/release/ayllu-mail /usr/bin/
267- COPY --from=build --chown=0:0 /src/ayllu/ayllu/themes /usr/lib/ayllu/themes
268- COPY --from=build --chown=0:0 /src/ayllu/ayllu/migrations /usr/lib/ayllu/migrations/ayllu
269- COPY --from=build --chown=0:0 /src/ayllu/LICENSE /usr/share/licenses/ayllu/
270- COPY --from=build --chown=0:0 /src/ayllu/ATTRIBUTIONS.md /usr/share/licenses/ayllu/
271-
272- COPY --from=build --chown=0:0 /usr/lib/tree-sitter/diff.so /usr/lib/tree-sitter/diff.so
273- COPY --from=build --chown=0:0 /usr/share/tree-sitter/queries/diff /usr/share/tree-sitter/queries/diff
274- RUN ln -sv /usr/lib/tree-sitter/diff.so /usr/lib/libtree-sitter-diff.so
275-
276- # this container supports running Ayllu as root and non-root depending on the
277- # desired runtime security and required UID/GID mapping.
278- RUN adduser -D -s /bin/sh -h /home/ayllu ayllu
279-
280- RUN \
281- mkdir -p /etc/ayllu /var/lib/ayllu /var/lib/git && \
282- ayllu config generate > /etc/ayllu/config.toml && \
283- fc-cache -fv # update font cache which is required by plotters.rs
284-
285- # setup an unprivileged user for rudolfs
286- RUN adduser -D -s /bin/sh -h /home/rudolfs rudolfs
287-
288- # default to the non-root ayllu user
289- USER ayllu
290- WORKDIR /home/ayllu
291-
292- # NOTE: this explicitly ignores CVE 2022-24765 because this is not a multi-user
293- # git environment.
294- RUN \
295- git config --global --add user.name 'ayllu' && \
296- git config --global --add safe.directory '*'
297-
298- CMD ["/usr/bin/ayllu", "serve"]
299 diff --git a/containers/base/README.md b/containers/base/README.md
300deleted file mode 100644
301index d7930dc..0000000
302--- a/containers/base/README.md
303+++ /dev/null
304 @@ -1,4 +0,0 @@
305- # Base Container Configuration
306-
307- This container has all of the software required to run a basic installation of
308- Ayllu without any server extensions such as mail, builds, etc.
309 diff --git a/containers/multiuser-mail/Containerfile b/containers/multiuser-mail/Containerfile
310new file mode 100644
311index 0000000..90cd251
312--- /dev/null
313+++ b/containers/multiuser-mail/Containerfile
314 @@ -0,0 +1,29 @@
315+ # milter and other mail security utilities from
316+ ARG BASE_BUILD_IMAGE
317+ FROM $BASE_BUILD_IMAGE AS build
318+
319+ ARG DKIMDO_VERSION="0.1.1"
320+ ARG DKIM_MILTER="0.1.0"
321+ ARG SPF_MILTER="0.6.0"
322+
323+ # FIXME: mirror these in ayllu-forge.org and build them from there
324+ RUN cargo install --locked dkimdo@"$DKIMDO_VERSION"
325+ RUN cargo install --locked dkim-milter@"$DKIM_MILTER"
326+ RUN cargo install --locked spf-milter@"$SPF_MILTER"
327+
328+ RUN mkdir /build && mv -v /root/.cargo/bin/* /build
329+
330+ ARG BASE_IMAGE
331+ FROM $BASE_IMAGE
332+
333+ USER root
334+
335+ RUN apk add --no-cache mutt postfix
336+
337+ COPY --from=build --chown=0:0 /build/dkimdo /usr/bin/
338+ COPY --from=build --chown=0:0 /build/dkim-milter /usr/bin/
339+ COPY --from=build --chown=0:0 /build/spf-milter /usr/bin/
340+
341+ COPY containers/multiuser-mail/templates /etc/templates/
342+ COPY containers/multiuser-mail/service /etc/service
343+ COPY containers/multiuser-mail/cron.d /etc/cron.d/
344 diff --git a/containers/multiuser-mail/cron.d/mail.cron b/containers/multiuser-mail/cron.d/mail.cron
345new file mode 100644
346index 0000000..cd565ea
347--- /dev/null
348+++ b/containers/multiuser-mail/cron.d/mail.cron
349 @@ -0,0 +1,2 @@
350+ # send queued messages every minute
351+ */1 * * * * su ayllu -c 'ayllu-mail --config /etc/ayllu/config.toml send'
352 diff --git a/containers/multiuser-mail/init/mail.sh b/containers/multiuser-mail/init/mail.sh
353new file mode 100755
354index 0000000..d37118b
355--- /dev/null
356+++ b/containers/multiuser-mail/init/mail.sh
357 @@ -0,0 +1,2 @@
358+ #!/bin/sh
359+ set -e
360 diff --git a/containers/multiuser-mail/post-message.sh b/containers/multiuser-mail/post-message.sh
361new file mode 100755
362index 0000000..75640a5
363--- /dev/null
364+++ b/containers/multiuser-mail/post-message.sh
365 @@ -0,0 +1,4 @@
366+ #!/bin/sh
367+
368+ export HOME=/home/ayllu
369+ ayllu-mail -c /etc/ayllu/config.toml post
370 diff --git a/containers/multiuser-mail/service/ayllu-mail/run b/containers/multiuser-mail/service/ayllu-mail/run
371new file mode 100755
372index 0000000..8863caa
373--- /dev/null
374+++ b/containers/multiuser-mail/service/ayllu-mail/run
375 @@ -0,0 +1,3 @@
376+ #!/bin/sh
377+
378+ exec su ayllu -c 'ayllu-mail --config /etc/ayllu/config.toml serve'
379 diff --git a/containers/multiuser-mail/service/postfix/run b/containers/multiuser-mail/service/postfix/run
380new file mode 100755
381index 0000000..218c9ea
382--- /dev/null
383+++ b/containers/multiuser-mail/service/postfix/run
384 @@ -0,0 +1,59 @@
385+ #!/bin/sh
386+ set -e
387+
388+ AYLLU_MAIL="/usr/bin/ayllu-mail"
389+ AYLLU_CONFIG="${AYLLU_CONFIG-/etc/ayllu/config.toml}"
390+ AYLLU_DB_PATH="${AYLLU_DB_PATH-/home/ayllu/.local/share/ayllu/mail.db}"
391+
392+ # FIXME: Mailpot's master-cf generation seems to be broken but it may also be
393+ # due to my own ignorance so manually specifying it for now.
394+
395+ AYLLU_SMTP_TLS_SECURITY_LEVEL="${AYLLU_SMTP_TLS_SECURITY_LEVEL:-none}"
396+
397+ [ -n "${AYLLU_ROOT_MAIL_USER}" ] && {
398+ echo "# AYLLU: DO NOT EDIT" > /etc/postfix/aliases
399+ AYLLU_ROOT_MAIL_USER="$(echo "$AYLLU_ROOT_MAIL_USER" | tr '[:upper:]' '[:lower:]')"
400+ AYLLU_ROOT_MAIL_USER="$AYLLU_ROOT_MAIL_USER" envsubst < /etc/templates/postfix/aliases >> /etc/postfix/aliases
401+ newaliases
402+ }
403+
404+ # hide sender's IP address / User Agent
405+ # See https://wiki.archlinux.org/title/Postfix#Hide_the_sender's_IP_and_user_agent_in_the_Received_header
406+ cp /etc/templates/postfix/smtp_header_checks /etc/postfix/
407+ postconf -e smtp_header_checks="regexp:/etc/postfix/smtp_header_checks"
408+ postconf -e smtpd_helo_required=yes
409+
410+ # attachments are entirely disallowed
411+ cp /etc/templates/postfix/mime_header_checks /etc/postfix/
412+ postconf -e mime_header_checks="regexp:/etc/postfix/mime_header_checks"
413+
414+ postconf -e smtp_tls_security_level="$AYLLU_SMTP_TLS_SECURITY_LEVEL"
415+ postconf -e maillog_file="/dev/stdout"
416+
417+ AYLLU_MAIL_HOSTNAME="${AYLLU_MAIL_HOSTNAME:-localhost}"
418+ postconf -e myhostname="${AYLLU_MAIL_HOSTNAME}"
419+
420+ # disallow relay from anywhere but localhost
421+ postconf -e inet_interfaces="loopback-only"
422+ postconf -e mynetworks="127.0.0.0/8"
423+ postconf -e local_transport="local"
424+ postconf -e transport_maps="lmdb:/etc/postfix/transport"
425+
426+ # DKIM
427+ postconf -e non_smtpd_milters="unix:/run/opendkim/opendkim.sock"
428+ postconf -e smtpd_milters="unix:/run/opendkim/opendkim.sock"
429+
430+ # SPF
431+ postconf -e policyd-spf_time_limit="3600"
432+ postconf -e smtpd_recipient_restrictions="permit_mynetworks,reject_unauth_destination,check_policy_service unix:private/policyd-spf"
433+
434+ # setup master.cf
435+ AYLLU_CONFIG="$AYLLU_CONFIG" AYLLU_DB_PATH="$AYLLU_DB_PATH" envsubst \
436+ < /etc/templates/postfix/master.cf > /etc/postfix/master.cf
437+
438+ "$AYLLU_MAIL" --config "$AYLLU_CONFIG" --database "$AYLLU_DB_PATH" \
439+ postfix maps > /etc/postfix/transport
440+
441+ postmap /etc/postfix/transport
442+
443+ exec postfix -c /etc/postfix start-fg
444 diff --git a/containers/multiuser-mail/templates/postfix/aliases b/containers/multiuser-mail/templates/postfix/aliases
445new file mode 100644
446index 0000000..bedd39e
447--- /dev/null
448+++ b/containers/multiuser-mail/templates/postfix/aliases
449 @@ -0,0 +1,273 @@
450+ #
451+ # Sample aliases file. Install in the location as specified by the
452+ # output from the command "postconf alias_maps". Typical path names
453+ # are /etc/aliases or /etc/mail/aliases.
454+ #
455+ # >>>>>>>>>> The program "newaliases" must be run after
456+ # >> NOTE >> this file is updated for any changes to
457+ # >>>>>>>>>> show through to Postfix.
458+ #
459+
460+ # Person who should get root's mail. Don't receive mail as root!
461+ root: ${AYLLU_ROOT_MAIL_USER}
462+
463+ # Basic system aliases -- these MUST be present
464+ MAILER-DAEMON: postmaster
465+ postmaster: root
466+
467+ # General redirections for pseudo accounts
468+ bin: root
469+ daemon: root
470+ named: root
471+ nobody: root
472+ uucp: root
473+ www: root
474+ ftp-bugs: root
475+ postfix: root
476+
477+ # Put your local aliases here.
478+
479+ # Well-known aliases
480+ manager: root
481+ dumper: root
482+ operator: root
483+ abuse: postmaster
484+
485+ # trap decode to catch security attacks
486+ decode: root
487+
488+ # ALIASES(5) ALIASES(5)
489+ #
490+ # NAME
491+ # aliases - Postfix local alias database format
492+ #
493+ # SYNOPSIS
494+ # newaliases
495+ #
496+ # DESCRIPTION
497+ # The optional aliases(5) table (alias_maps) redirects mail
498+ # for local recipients. The redirections are processed by
499+ # the Postfix local(8) delivery agent.
500+ #
501+ # This is unlike virtual(5) aliasing (virtual_alias_maps)
502+ # which applies to all recipients: local(8), virtual, and
503+ # remote, and which is implemented by the cleanup(8) daemon.
504+ #
505+ # Normally, the aliases(5) table is specified as a text file
506+ # that serves as input to the postalias(1) command. The
507+ # result, an indexed file in dbm or db format, is used for
508+ # fast lookup by the mail system. Execute the command
509+ # newaliases in order to rebuild the indexed file after
510+ # changing the Postfix alias database.
511+ #
512+ # When the table is provided via other means such as NIS,
513+ # LDAP or SQL, the same lookups are done as for ordinary
514+ # indexed files.
515+ #
516+ # Alternatively, the table can be provided as a regu-
517+ # lar-expression map where patterns are given as regular
518+ # expressions. In this case, the lookups are done in a
519+ # slightly different way as described below under "REGULAR
520+ # EXPRESSION TABLES".
521+ #
522+ # Users can control delivery of their own mail by setting up
523+ # .forward files in their home directory. Lines in per-user
524+ # .forward files have the same syntax as the right-hand side
525+ # of aliases(5) entries.
526+ #
527+ # The format of the alias database input file is as follows:
528+ #
529+ # o An alias definition has the form
530+ #
531+ # name: value1, value2, ...
532+ #
533+ # o Empty lines and whitespace-only lines are ignored,
534+ # as are lines whose first non-whitespace character
535+ # is a `#'.
536+ #
537+ # o A logical line starts with non-whitespace text. A
538+ # line that starts with whitespace continues a logi-
539+ # cal line.
540+ #
541+ # The name is a local address (no domain part). Use double
542+ # quotes when the name contains any special characters such
543+ # as whitespace, `#', `:', or `@'. The name is folded to
544+ # lowercase, in order to make database lookups case insensi-
545+ # tive.
546+ #
547+ # In addition, when an alias exists for owner-name, this
548+ # will override the envelope sender address, so that deliv-
549+ # ery diagnostics are directed to owner-name, instead of the
550+ # originator of the message (for details, see
551+ # owner_request_special, expand_owner_alias and
552+ # reset_owner_alias). This is typically used to direct
553+ # delivery errors to the maintainer of a mailing list, who
554+ # is in a better position to deal with mailing list delivery
555+ # problems than the originator of the undelivered mail.
556+ #
557+ # The value contains one or more of the following:
558+ #
559+ # address
560+ # Mail is forwarded to address, which is compatible
561+ # with the RFC 822 standard.
562+ #
563+ # /file/name
564+ # Mail is appended to /file/name. For details on how
565+ # a file is written see the sections "EXTERNAL FILE
566+ # DELIVERY" and "DELIVERY RIGHTS" in the local(8)
567+ # documentation. Delivery is not limited to regular
568+ # files. For example, to dispose of unwanted mail,
569+ # deflect it to /dev/null.
570+ #
571+ # |command
572+ # Mail is piped into command. Commands that contain
573+ # special characters, such as whitespace, should be
574+ # enclosed between double quotes. For details on how
575+ # a command is executed see "EXTERNAL COMMAND DELIV-
576+ # ERY" and "DELIVERY RIGHTS" in the local(8) documen-
577+ # tation.
578+ #
579+ # When the command fails, a limited amount of command
580+ # output is mailed back to the sender. The file
581+ # /usr/include/sysexits.h defines the expected exit
582+ # status codes. For example, use "|exit 67" to simu-
583+ # late a "user unknown" error, and "|exit 0" to
584+ # implement an expensive black hole.
585+ #
586+ # :include:/file/name
587+ # Mail is sent to the destinations listed in the
588+ # named file. Lines in :include: files have the same
589+ # syntax as the right-hand side of alias entries.
590+ #
591+ # A destination can be any destination that is
592+ # described in this manual page. However, delivery to
593+ # "|command" and /file/name is disallowed by default.
594+ # To enable, edit the allow_mail_to_commands and
595+ # allow_mail_to_files configuration parameters.
596+ #
597+ # ADDRESS EXTENSION
598+ # When alias database search fails, and the recipient local-
599+ # part contains the optional recipient delimiter (e.g.,
600+ # user+foo), the search is repeated for the unextended
601+ # address (e.g., user).
602+ #
603+ # The propagate_unmatched_extensions parameter controls
604+ # whether an unmatched address extension (+foo) is propa-
605+ # gated to the result of table lookup.
606+ #
607+ # CASE FOLDING
608+ # The local(8) delivery agent always folds the search string
609+ # to lowercase before database lookup.
610+ #
611+ # REGULAR EXPRESSION TABLES
612+ # This section describes how the table lookups change when
613+ # the table is given in the form of regular expressions. For
614+ # a description of regular expression lookup table syntax,
615+ # see regexp_table(5) or pcre_table(5). NOTE: these formats
616+ # do not use ":" at the end of a pattern.
617+ #
618+ # Each regular expression is applied to the entire search
619+ # string. Thus, a search string user+foo is not broken up
620+ # into user and foo.
621+ #
622+ # Regular expressions are applied in the order as specified
623+ # in the table, until a regular expression is found that
624+ # matches the search string.
625+ #
626+ # Lookup results are the same as with indexed file lookups.
627+ # For security reasons there is no support for $1, $2 etc.
628+ # substring interpolation.
629+ #
630+ # SECURITY
631+ # The local(8) delivery agent disallows regular expression
632+ # substitution of $1 etc. in alias_maps, because that would
633+ # open a security hole.
634+ #
635+ # The local(8) delivery agent will silently ignore requests
636+ # to use the proxymap(8) server within alias_maps. Instead
637+ # it will open the table directly. Before Postfix version
638+ # 2.2, the local(8) delivery agent will terminate with a
639+ # fatal error.
640+ #
641+ # CONFIGURATION PARAMETERS
642+ # The following main.cf parameters are especially relevant.
643+ # The text below provides only a parameter summary. See
644+ # postconf(5) for more details including examples.
645+ #
646+ # alias_database (see 'postconf -d' output)
647+ # The alias databases for local(8) delivery that are
648+ # updated with "newaliases" or with "sendmail -bi".
649+ #
650+ # alias_maps (see 'postconf -d' output)
651+ # Optional lookup tables with aliases that apply only
652+ # to local(8) recipients; this is unlike vir-
653+ # tual_alias_maps that apply to all recipients:
654+ # local(8), virtual, and remote.
655+ #
656+ # allow_mail_to_commands (alias, forward)
657+ # Restrict local(8) mail delivery to external com-
658+ # mands.
659+ #
660+ # allow_mail_to_files (alias, forward)
661+ # Restrict local(8) mail delivery to external files.
662+ #
663+ # expand_owner_alias (no)
664+ # When delivering to an alias "aliasname" that has an
665+ # "owner-aliasname" companion alias, set the envelope
666+ # sender address to the expansion of the
667+ # "owner-aliasname" alias.
668+ #
669+ # propagate_unmatched_extensions (canonical, virtual)
670+ # What address lookup tables copy an address exten-
671+ # sion from the lookup key to the lookup result.
672+ #
673+ # owner_request_special (yes)
674+ # Enable special treatment for owner-listname entries
675+ # in the aliases(5) file, and don't split owner-list-
676+ # name and listname-request address localparts when
677+ # the recipient_delimiter is set to "-".
678+ #
679+ # recipient_delimiter (empty)
680+ # The set of characters that can separate an email
681+ # address localpart, user name, or a .forward file
682+ # name from its extension.
683+ #
684+ # Available in Postfix version 2.3 and later:
685+ #
686+ # frozen_delivered_to (yes)
687+ # Update the local(8) delivery agent's idea of the
688+ # Delivered-To: address (see prepend_deliv-
689+ # ered_header) only once, at the start of a delivery
690+ # attempt; do not update the Delivered-To: address
691+ # while expanding aliases or .forward files.
692+ #
693+ # STANDARDS
694+ # RFC 822 (ARPA Internet Text Messages)
695+ #
696+ # SEE ALSO
697+ # local(8), local delivery agent
698+ # newaliases(1), create/update alias database
699+ # postalias(1), create/update alias database
700+ # postconf(5), configuration parameters
701+ #
702+ # README FILES
703+ # Use "postconf readme_directory" or "postconf html_direc-
704+ # tory" to locate this information.
705+ # DATABASE_README, Postfix lookup table overview
706+ #
707+ # LICENSE
708+ # The Secure Mailer license must be distributed with this
709+ # software.
710+ #
711+ # AUTHOR(S)
712+ # Wietse Venema
713+ # IBM T.J. Watson Research
714+ # P.O. Box 704
715+ # Yorktown Heights, NY 10598, USA
716+ #
717+ # Wietse Venema
718+ # Google, Inc.
719+ # 111 8th Avenue
720+ # New York, NY 10011, USA
721+ #
722+ #
723 diff --git a/containers/multiuser-mail/templates/postfix/master.cf b/containers/multiuser-mail/templates/postfix/master.cf
724new file mode 100644
725index 0000000..47f2a46
726--- /dev/null
727+++ b/containers/multiuser-mail/templates/postfix/master.cf
728 @@ -0,0 +1,155 @@
729+ #
730+ # Postfix master process configuration file. For details on the format
731+ # of the file, see the master(5) manual page (command: "man 5 master" or
732+ # on-line: http://www.postfix.org/master.5.html).
733+ #
734+ # Do not forget to execute "postfix reload" after editing this file.
735+ #
736+ # ==========================================================================
737+ # service type private unpriv chroot wakeup maxproc command + args
738+ # (yes) (yes) (no) (never) (100)
739+ # ==========================================================================
740+ smtp inet n - n - - smtpd
741+ #smtp inet n - n - 1 postscreen
742+ #smtpd pass - - n - - smtpd
743+ #dnsblog unix - - n - 0 dnsblog
744+ #tlsproxy unix - - n - 0 tlsproxy
745+ # Choose one: enable submission for loopback clients only, or for any client.
746+ #127.0.0.1:submission inet n - n - - smtpd
747+ #submission inet n - n - - smtpd
748+ # -o syslog_name=postfix/submission
749+ # -o smtpd_tls_security_level=encrypt
750+ # -o smtpd_sasl_auth_enable=yes
751+ # -o smtpd_tls_auth_only=yes
752+ # -o local_header_rewrite_clients=static:all
753+ # -o smtpd_reject_unlisted_recipient=no
754+ # Instead of specifying complex smtpd_<xxx>_restrictions here,
755+ # specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
756+ # here, and specify mua_<xxx>_restrictions in main.cf (where
757+ # "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
758+ # -o smtpd_client_restrictions=
759+ # -o smtpd_helo_restrictions=
760+ # -o smtpd_sender_restrictions=
761+ # -o smtpd_relay_restrictions=
762+ # -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
763+ # -o milter_macro_daemon_name=ORIGINATING
764+ # Choose one: enable submissions for loopback clients only, or for any client.
765+ #127.0.0.1:submissions inet n - n - - smtpd
766+ #submissions inet n - n - - smtpd
767+ # -o syslog_name=postfix/submissions
768+ # -o smtpd_tls_wrappermode=yes
769+ # -o smtpd_sasl_auth_enable=yes
770+ # -o local_header_rewrite_clients=static:all
771+ # -o smtpd_reject_unlisted_recipient=no
772+ # Instead of specifying complex smtpd_<xxx>_restrictions here,
773+ # specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
774+ # here, and specify mua_<xxx>_restrictions in main.cf (where
775+ # "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
776+ # -o smtpd_client_restrictions=
777+ # -o smtpd_helo_restrictions=
778+ # -o smtpd_sender_restrictions=
779+ # -o smtpd_relay_restrictions=
780+ # -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
781+ # -o milter_macro_daemon_name=ORIGINATING
782+ #628 inet n - n - - qmqpd
783+ pickup unix n - n 60 1 pickup
784+ cleanup unix n - n - 0 cleanup
785+ qmgr unix n - n 300 1 qmgr
786+ #qmgr unix n - n 300 1 oqmgr
787+ tlsmgr unix - - n 1000? 1 tlsmgr
788+ rewrite unix - - n - - trivial-rewrite
789+ bounce unix - - n - 0 bounce
790+ defer unix - - n - 0 bounce
791+ trace unix - - n - 0 bounce
792+ verify unix - - n - 1 verify
793+ flush unix n - n 1000? 0 flush
794+ proxymap unix - - n - - proxymap
795+ proxywrite unix - - n - 1 proxymap
796+ smtp unix - - n - - smtp
797+ relay unix - - n - - smtp
798+ -o syslog_name=postfix/$service_name
799+ # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
800+ showq unix n - n - - showq
801+ error unix - - n - - error
802+ retry unix - - n - - error
803+ discard unix - - n - - discard
804+ local unix - n n - - local
805+ virtual unix - n n - - virtual
806+ lmtp unix - - n - - lmtp
807+ anvil unix - - n - 1 anvil
808+ scache unix - - n - 1 scache
809+ postlog unix-dgram n - n - 1 postlogd
810+ #
811+ # ====================================================================
812+ # Interfaces to non-Postfix software. Be sure to examine the manual
813+ # pages of the non-Postfix software to find out what options it wants.
814+ #
815+ # Many of the following services use the Postfix pipe(8) delivery
816+ # agent. See the pipe(8) man page for information about ${recipient}
817+ # and other message envelope options.
818+ # ====================================================================
819+ #
820+ # maildrop. See the Postfix MAILDROP_README file for details.
821+ # Also specify in main.cf: maildrop_destination_recipient_limit=1
822+ #
823+ #maildrop unix - n n - - pipe
824+ # flags=DRXhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
825+ #
826+ # ====================================================================
827+ #
828+ # Recent Cyrus versions can use the existing "lmtp" master.cf entry.
829+ #
830+ # Specify in cyrus.conf:
831+ # lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
832+ #
833+ # Specify in main.cf one or more of the following:
834+ # mailbox_transport = lmtp:inet:localhost
835+ # virtual_transport = lmtp:inet:localhost
836+ #
837+ # ====================================================================
838+ #
839+ # Cyrus 2.1.5 (Amos Gouaux)
840+ # Also specify in main.cf: cyrus_destination_recipient_limit=1
841+ #
842+ #cyrus unix - n n - - pipe
843+ # flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
844+ #
845+ # ====================================================================
846+ #
847+ # Old example of delivery via Cyrus.
848+ #
849+ #old-cyrus unix - n n - - pipe
850+ # flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
851+ #
852+ # ====================================================================
853+ #
854+ # See the Postfix UUCP_README file for configuration details.
855+ #
856+ #uucp unix - n n - - pipe
857+ # flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
858+ #
859+ # ====================================================================
860+ #
861+ # Other external delivery methods.
862+ #
863+ #ifmail unix - n n - - pipe
864+ # flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
865+ #
866+ #bsmtp unix - n n - - pipe
867+ # flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
868+ #
869+ #scalemail-backend unix - n n - 2 pipe
870+ # flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
871+ # ${nexthop} ${user} ${extension}
872+ #
873+ #mailman unix - n n - - pipe
874+ # flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
875+ # ${nexthop} ${user}
876+
877+ # SPF Verifier
878+ policyd-spf unix - n n - 0 spawn
879+ user=nobody argv=/usr/bin/postfix-policyd-spf-perl
880+
881+ # Mailpot
882+ mailpot unix - n n - 1 pipe
883+ flags=RX user=ayllu directory=/home/ayllu argv=/usr/bin/ayllu-mail --database ${AYLLU_DB_PATH} --config ${AYLLU_CONFIG} post"
884 diff --git a/containers/multiuser-mail/templates/postfix/mime_header_checks b/containers/multiuser-mail/templates/postfix/mime_header_checks
885new file mode 100644
886index 0000000..50cf33f
887--- /dev/null
888+++ b/containers/multiuser-mail/templates/postfix/mime_header_checks
889 @@ -0,0 +1 @@
890+ /Content-(Type|Disposition):.*attachment;/ REJECT Attachments are disallowed
891 diff --git a/containers/multiuser-mail/templates/postfix/smtp_header_checks b/containers/multiuser-mail/templates/postfix/smtp_header_checks
892new file mode 100644
893index 0000000..9e39150
894--- /dev/null
895+++ b/containers/multiuser-mail/templates/postfix/smtp_header_checks
896 @@ -0,0 +1,2 @@
897+ /^Received: .*/ IGNORE
898+ /^User-Agent: .*/ IGNORE
899 diff --git a/containers/multiuser/Containerfile b/containers/multiuser/Containerfile
900index 4ad6237..d6b5efa 100644
901--- a/containers/multiuser/Containerfile
902+++ b/containers/multiuser/Containerfile
903 @@ -6,25 +6,19 @@ USER root
904 RUN apk add --no-cache \
905 acl \
906 cronie \
907- cronie-openrc \
908 dropbear \
909+ file \
910 gawk \
911 gettext-envsubst \
912 htop \
913- mutt \
914- postfix \
915 runit \
916 tmux \
917 vim
918
919- # template files used to configure postfix at runtime
920- COPY containers/multiuser/postfix /etc/postfix-templates
921-
922+ COPY containers/multiuser/init/ /etc/ayllu-init/
923 COPY containers/multiuser/motd.txt /etc/motd
924- COPY containers/multiuser/service /etc/service
925+ COPY containers/multiuser/service/ /etc/service/
926 COPY containers/multiuser/welcome.sh /etc/profile.d/
927- COPY containers/multiuser/crontabs /etc/crontabs/
928- COPY containers/multiuser/post-message.sh /usr/bin/post-message.sh
929 COPY containers/multiuser/run_all.sh /
930
931 CMD ["/run_all.sh"]
932 diff --git a/containers/multiuser/crontabs/ayllu b/containers/multiuser/crontabs/ayllu
933deleted file mode 100644
934index 11009c7..0000000
935--- a/containers/multiuser/crontabs/ayllu
936+++ /dev/null
937 @@ -1,2 +0,0 @@
938- # send messages from the queue every minute
939- */1 * * * * ayllu-mail --config /etc/ayllu/config.toml send
940 diff --git a/containers/multiuser/crontabs/root b/containers/multiuser/crontabs/root
941deleted file mode 100644
942index bcfb4cf..0000000
943--- a/containers/multiuser/crontabs/root
944+++ /dev/null
945 @@ -1,2 +0,0 @@
946- # generate transport map every 5 minutes and reload postfix
947- */5 * * * * su ayllu -c 'ayllu-mail --config /etc/ayllu/config.toml postfix maps' > /etc/postfix/transport && postmap /etc/postfix/transport
948 diff --git a/containers/multiuser/init/config.sh b/containers/multiuser/init/config.sh
949new file mode 100755
950index 0000000..0afc6f3
951--- /dev/null
952+++ b/containers/multiuser/init/config.sh
953 @@ -0,0 +1,8 @@
954+ #!/bin/sh
955+ set -e
956+
957+ # TODO: Ayllu should have a programmatic way to set configuration values
958+ # at runtime e.g. ayllu config set http.address = ....
959+ [ -n "${AYLLU_LISTEN_ADDRESS}" ] && {
960+ sed -i "s/127.0.0.1:8080/$AYLLU_LISTEN_ADDRESS/" /etc/ayllu/config.toml
961+ }
962 diff --git a/containers/multiuser/init/users.sh b/containers/multiuser/init/users.sh
963new file mode 100755
964index 0000000..aece463
965--- /dev/null
966+++ b/containers/multiuser/init/users.sh
967 @@ -0,0 +1,65 @@
968+ #!/bin/sh
969+ set -e
970+ # initialize users for the container
971+
972+ # first setup the ayllu user
973+ AYLLU_HOME="/home/ayllu"
974+ AYLLU_CONFIG="/etc/ayllu/config.toml"
975+ AYLLU_SSH_AUTHORIZED_KEYS_FILE="$AYLLU_HOME/.ssh/authorized_keys"
976+
977+ mkdir -p /var/lib/ayllu
978+ chown -R ayllu:ayllu /var/lib/ayllu
979+ mkdir -p "$AYLLU_HOME/.ssh"
980+ chown ayllu:ayllu "$AYLLU_HOME/.ssh"
981+ echo /dev/null > "$AYLLU_SSH_AUTHORIZED_KEYS_FILE"
982+ chmod 644 "$AYLLU_SSH_AUTHORIZED_KEYS_FILE"
983+
984+ echo "$AYLLU_AUTHORIZED_KEYS" | while IFS= read -r public_key
985+ do
986+ echo "$public_key" >> "$AYLLU_SSH_AUTHORIZED_KEYS_FILE"
987+ done
988+
989+ # take envs with the format AYLLU_USER_$NAME="ecdsa-sha2 ...::ssh-rsa ..."
990+ # and configure a user within the container setting each SSH public key into
991+ # that user's ~/.ssh/authorized_keys file.
992+
993+ env |grep AYLLU_USER_ | while IFS= read -r env_entry
994+ do
995+ username="$(echo "$env_entry" \
996+ | awk -F= '{split($1, arr, "_"); print tolower(arr[3])}')"
997+
998+ echo "creating user $username"
999+
1000+ adduser -h "/home/$username" -D -g "Ayllu Managed User" "$username"
1001+ # create a directory called "repos" which we give full access to both the
1002+ # user and Ayllu.
1003+ mkdir "/home/$username/repos"
1004+ chmod g+s "/home/$username/repos"
1005+ setfacl -d -m g::rwx "/home/$username/repos"
1006+
1007+ addgroup "$username" ayllu
1008+ mkdir -p "/home/$username/.ssh"
1009+ cat /dev/null > "/home/$username/.ssh/authorized_keys"
1010+
1011+ env_key=$(echo "$env_entry" | awk -F= '{print $1}' | sed "r/")
1012+ replacement=$(printf "s/%s=//" "$env_key")
1013+ all_keys="$(echo "$env_entry" | sed "${replacement}")"
1014+
1015+ echo "$all_keys" | sed 's/::/\n/g' | while IFS= read -r key_entry
1016+ do
1017+ echo "$key_entry" >> "/home/$username/.ssh/authorized_keys"
1018+ done
1019+
1020+ chown -R "$username:$username" "/home/$username"
1021+ chmod 644 "/home/$username/.ssh/authorized_keys"
1022+
1023+ # add ayllu to all user groups so it can access their repositories
1024+ addgroup ayllu "$username"
1025+
1026+ done
1027+
1028+ # TODO: Ayllu should have a programmatic way to set configuration values
1029+ # at runtime e.g. ayllu config set http.address = ....
1030+ [ -n "${AYLLU_LISTEN_ADDRESS}" ] && {
1031+ sed -i "s/127.0.0.1:8080/$AYLLU_LISTEN_ADDRESS/" /etc/ayllu/config.toml
1032+ }
1033 diff --git a/containers/multiuser/post-message.sh b/containers/multiuser/post-message.sh
1034deleted file mode 100755
1035index 75640a5..0000000
1036--- a/containers/multiuser/post-message.sh
1037+++ /dev/null
1038 @@ -1,4 +0,0 @@
1039- #!/bin/sh
1040-
1041- export HOME=/home/ayllu
1042- ayllu-mail -c /etc/ayllu/config.toml post
1043 diff --git a/containers/multiuser/postfix/aliases b/containers/multiuser/postfix/aliases
1044deleted file mode 100644
1045index bedd39e..0000000
1046--- a/containers/multiuser/postfix/aliases
1047+++ /dev/null
1048 @@ -1,273 +0,0 @@
1049- #
1050- # Sample aliases file. Install in the location as specified by the
1051- # output from the command "postconf alias_maps". Typical path names
1052- # are /etc/aliases or /etc/mail/aliases.
1053- #
1054- # >>>>>>>>>> The program "newaliases" must be run after
1055- # >> NOTE >> this file is updated for any changes to
1056- # >>>>>>>>>> show through to Postfix.
1057- #
1058-
1059- # Person who should get root's mail. Don't receive mail as root!
1060- root: ${AYLLU_ROOT_MAIL_USER}
1061-
1062- # Basic system aliases -- these MUST be present
1063- MAILER-DAEMON: postmaster
1064- postmaster: root
1065-
1066- # General redirections for pseudo accounts
1067- bin: root
1068- daemon: root
1069- named: root
1070- nobody: root
1071- uucp: root
1072- www: root
1073- ftp-bugs: root
1074- postfix: root
1075-
1076- # Put your local aliases here.
1077-
1078- # Well-known aliases
1079- manager: root
1080- dumper: root
1081- operator: root
1082- abuse: postmaster
1083-
1084- # trap decode to catch security attacks
1085- decode: root
1086-
1087- # ALIASES(5) ALIASES(5)
1088- #
1089- # NAME
1090- # aliases - Postfix local alias database format
1091- #
1092- # SYNOPSIS
1093- # newaliases
1094- #
1095- # DESCRIPTION
1096- # The optional aliases(5) table (alias_maps) redirects mail
1097- # for local recipients. The redirections are processed by
1098- # the Postfix local(8) delivery agent.
1099- #
1100- # This is unlike virtual(5) aliasing (virtual_alias_maps)
1101- # which applies to all recipients: local(8), virtual, and
1102- # remote, and which is implemented by the cleanup(8) daemon.
1103- #
1104- # Normally, the aliases(5) table is specified as a text file
1105- # that serves as input to the postalias(1) command. The
1106- # result, an indexed file in dbm or db format, is used for
1107- # fast lookup by the mail system. Execute the command
1108- # newaliases in order to rebuild the indexed file after
1109- # changing the Postfix alias database.
1110- #
1111- # When the table is provided via other means such as NIS,
1112- # LDAP or SQL, the same lookups are done as for ordinary
1113- # indexed files.
1114- #
1115- # Alternatively, the table can be provided as a regu-
1116- # lar-expression map where patterns are given as regular
1117- # expressions. In this case, the lookups are done in a
1118- # slightly different way as described below under "REGULAR
1119- # EXPRESSION TABLES".
1120- #
1121- # Users can control delivery of their own mail by setting up
1122- # .forward files in their home directory. Lines in per-user
1123- # .forward files have the same syntax as the right-hand side
1124- # of aliases(5) entries.
1125- #
1126- # The format of the alias database input file is as follows:
1127- #
1128- # o An alias definition has the form
1129- #
1130- # name: value1, value2, ...
1131- #
1132- # o Empty lines and whitespace-only lines are ignored,
1133- # as are lines whose first non-whitespace character
1134- # is a `#'.
1135- #
1136- # o A logical line starts with non-whitespace text. A
1137- # line that starts with whitespace continues a logi-
1138- # cal line.
1139- #
1140- # The name is a local address (no domain part). Use double
1141- # quotes when the name contains any special characters such
1142- # as whitespace, `#', `:', or `@'. The name is folded to
1143- # lowercase, in order to make database lookups case insensi-
1144- # tive.
1145- #
1146- # In addition, when an alias exists for owner-name, this
1147- # will override the envelope sender address, so that deliv-
1148- # ery diagnostics are directed to owner-name, instead of the
1149- # originator of the message (for details, see
1150- # owner_request_special, expand_owner_alias and
1151- # reset_owner_alias). This is typically used to direct
1152- # delivery errors to the maintainer of a mailing list, who
1153- # is in a better position to deal with mailing list delivery
1154- # problems than the originator of the undelivered mail.
1155- #
1156- # The value contains one or more of the following:
1157- #
1158- # address
1159- # Mail is forwarded to address, which is compatible
1160- # with the RFC 822 standard.
1161- #
1162- # /file/name
1163- # Mail is appended to /file/name. For details on how
1164- # a file is written see the sections "EXTERNAL FILE
1165- # DELIVERY" and "DELIVERY RIGHTS" in the local(8)
1166- # documentation. Delivery is not limited to regular
1167- # files. For example, to dispose of unwanted mail,
1168- # deflect it to /dev/null.
1169- #
1170- # |command
1171- # Mail is piped into command. Commands that contain
1172- # special characters, such as whitespace, should be
1173- # enclosed between double quotes. For details on how
1174- # a command is executed see "EXTERNAL COMMAND DELIV-
1175- # ERY" and "DELIVERY RIGHTS" in the local(8) documen-
1176- # tation.
1177- #
1178- # When the command fails, a limited amount of command
1179- # output is mailed back to the sender. The file
1180- # /usr/include/sysexits.h defines the expected exit
1181- # status codes. For example, use "|exit 67" to simu-
1182- # late a "user unknown" error, and "|exit 0" to
1183- # implement an expensive black hole.
1184- #
1185- # :include:/file/name
1186- # Mail is sent to the destinations listed in the
1187- # named file. Lines in :include: files have the same
1188- # syntax as the right-hand side of alias entries.
1189- #
1190- # A destination can be any destination that is
1191- # described in this manual page. However, delivery to
1192- # "|command" and /file/name is disallowed by default.
1193- # To enable, edit the allow_mail_to_commands and
1194- # allow_mail_to_files configuration parameters.
1195- #
1196- # ADDRESS EXTENSION
1197- # When alias database search fails, and the recipient local-
1198- # part contains the optional recipient delimiter (e.g.,
1199- # user+foo), the search is repeated for the unextended
1200- # address (e.g., user).
1201- #
1202- # The propagate_unmatched_extensions parameter controls
1203- # whether an unmatched address extension (+foo) is propa-
1204- # gated to the result of table lookup.
1205- #
1206- # CASE FOLDING
1207- # The local(8) delivery agent always folds the search string
1208- # to lowercase before database lookup.
1209- #
1210- # REGULAR EXPRESSION TABLES
1211- # This section describes how the table lookups change when
1212- # the table is given in the form of regular expressions. For
1213- # a description of regular expression lookup table syntax,
1214- # see regexp_table(5) or pcre_table(5). NOTE: these formats
1215- # do not use ":" at the end of a pattern.
1216- #
1217- # Each regular expression is applied to the entire search
1218- # string. Thus, a search string user+foo is not broken up
1219- # into user and foo.
1220- #
1221- # Regular expressions are applied in the order as specified
1222- # in the table, until a regular expression is found that
1223- # matches the search string.
1224- #
1225- # Lookup results are the same as with indexed file lookups.
1226- # For security reasons there is no support for $1, $2 etc.
1227- # substring interpolation.
1228- #
1229- # SECURITY
1230- # The local(8) delivery agent disallows regular expression
1231- # substitution of $1 etc. in alias_maps, because that would
1232- # open a security hole.
1233- #
1234- # The local(8) delivery agent will silently ignore requests
1235- # to use the proxymap(8) server within alias_maps. Instead
1236- # it will open the table directly. Before Postfix version
1237- # 2.2, the local(8) delivery agent will terminate with a
1238- # fatal error.
1239- #
1240- # CONFIGURATION PARAMETERS
1241- # The following main.cf parameters are especially relevant.
1242- # The text below provides only a parameter summary. See
1243- # postconf(5) for more details including examples.
1244- #
1245- # alias_database (see 'postconf -d' output)
1246- # The alias databases for local(8) delivery that are
1247- # updated with "newaliases" or with "sendmail -bi".
1248- #
1249- # alias_maps (see 'postconf -d' output)
1250- # Optional lookup tables with aliases that apply only
1251- # to local(8) recipients; this is unlike vir-
1252- # tual_alias_maps that apply to all recipients:
1253- # local(8), virtual, and remote.
1254- #
1255- # allow_mail_to_commands (alias, forward)
1256- # Restrict local(8) mail delivery to external com-
1257- # mands.
1258- #
1259- # allow_mail_to_files (alias, forward)
1260- # Restrict local(8) mail delivery to external files.
1261- #
1262- # expand_owner_alias (no)
1263- # When delivering to an alias "aliasname" that has an
1264- # "owner-aliasname" companion alias, set the envelope
1265- # sender address to the expansion of the
1266- # "owner-aliasname" alias.
1267- #
1268- # propagate_unmatched_extensions (canonical, virtual)
1269- # What address lookup tables copy an address exten-
1270- # sion from the lookup key to the lookup result.
1271- #
1272- # owner_request_special (yes)
1273- # Enable special treatment for owner-listname entries
1274- # in the aliases(5) file, and don't split owner-list-
1275- # name and listname-request address localparts when
1276- # the recipient_delimiter is set to "-".
1277- #
1278- # recipient_delimiter (empty)
1279- # The set of characters that can separate an email
1280- # address localpart, user name, or a .forward file
1281- # name from its extension.
1282- #
1283- # Available in Postfix version 2.3 and later:
1284- #
1285- # frozen_delivered_to (yes)
1286- # Update the local(8) delivery agent's idea of the
1287- # Delivered-To: address (see prepend_deliv-
1288- # ered_header) only once, at the start of a delivery
1289- # attempt; do not update the Delivered-To: address
1290- # while expanding aliases or .forward files.
1291- #
1292- # STANDARDS
1293- # RFC 822 (ARPA Internet Text Messages)
1294- #
1295- # SEE ALSO
1296- # local(8), local delivery agent
1297- # newaliases(1), create/update alias database
1298- # postalias(1), create/update alias database
1299- # postconf(5), configuration parameters
1300- #
1301- # README FILES
1302- # Use "postconf readme_directory" or "postconf html_direc-
1303- # tory" to locate this information.
1304- # DATABASE_README, Postfix lookup table overview
1305- #
1306- # LICENSE
1307- # The Secure Mailer license must be distributed with this
1308- # software.
1309- #
1310- # AUTHOR(S)
1311- # Wietse Venema
1312- # IBM T.J. Watson Research
1313- # P.O. Box 704
1314- # Yorktown Heights, NY 10598, USA
1315- #
1316- # Wietse Venema
1317- # Google, Inc.
1318- # 111 8th Avenue
1319- # New York, NY 10011, USA
1320- #
1321- #
1322 diff --git a/containers/multiuser/postfix/master.cf b/containers/multiuser/postfix/master.cf
1323deleted file mode 100644
1324index fd282dd..0000000
1325--- a/containers/multiuser/postfix/master.cf
1326+++ /dev/null
1327 @@ -1,147 +0,0 @@
1328- #
1329- # Postfix master process configuration file. For details on the format
1330- # of the file, see the master(5) manual page (command: "man 5 master" or
1331- # on-line: http://www.postfix.org/master.5.html).
1332- #
1333- # Do not forget to execute "postfix reload" after editing this file.
1334- #
1335- # ==========================================================================
1336- # service type private unpriv chroot wakeup maxproc command + args
1337- # (yes) (yes) (no) (never) (100)
1338- # ==========================================================================
1339- smtp inet n - n - - smtpd
1340- #smtp inet n - n - 1 postscreen
1341- #smtpd pass - - n - - smtpd
1342- #dnsblog unix - - n - 0 dnsblog
1343- #tlsproxy unix - - n - 0 tlsproxy
1344- # Choose one: enable submission for loopback clients only, or for any client.
1345- #127.0.0.1:submission inet n - n - - smtpd
1346- #submission inet n - n - - smtpd
1347- # -o syslog_name=postfix/submission
1348- # -o smtpd_tls_security_level=encrypt
1349- # -o smtpd_sasl_auth_enable=yes
1350- # -o smtpd_tls_auth_only=yes
1351- # -o local_header_rewrite_clients=static:all
1352- # -o smtpd_reject_unlisted_recipient=no
1353- # Instead of specifying complex smtpd_<xxx>_restrictions here,
1354- # specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
1355- # here, and specify mua_<xxx>_restrictions in main.cf (where
1356- # "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
1357- # -o smtpd_client_restrictions=
1358- # -o smtpd_helo_restrictions=
1359- # -o smtpd_sender_restrictions=
1360- # -o smtpd_relay_restrictions=
1361- # -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
1362- # -o milter_macro_daemon_name=ORIGINATING
1363- # Choose one: enable submissions for loopback clients only, or for any client.
1364- #127.0.0.1:submissions inet n - n - - smtpd
1365- #submissions inet n - n - - smtpd
1366- # -o syslog_name=postfix/submissions
1367- # -o smtpd_tls_wrappermode=yes
1368- # -o smtpd_sasl_auth_enable=yes
1369- # -o local_header_rewrite_clients=static:all
1370- # -o smtpd_reject_unlisted_recipient=no
1371- # Instead of specifying complex smtpd_<xxx>_restrictions here,
1372- # specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
1373- # here, and specify mua_<xxx>_restrictions in main.cf (where
1374- # "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
1375- # -o smtpd_client_restrictions=
1376- # -o smtpd_helo_restrictions=
1377- # -o smtpd_sender_restrictions=
1378- # -o smtpd_relay_restrictions=
1379- # -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
1380- # -o milter_macro_daemon_name=ORIGINATING
1381- #628 inet n - n - - qmqpd
1382- pickup unix n - n 60 1 pickup
1383- cleanup unix n - n - 0 cleanup
1384- qmgr unix n - n 300 1 qmgr
1385- #qmgr unix n - n 300 1 oqmgr
1386- tlsmgr unix - - n 1000? 1 tlsmgr
1387- rewrite unix - - n - - trivial-rewrite
1388- bounce unix - - n - 0 bounce
1389- defer unix - - n - 0 bounce
1390- trace unix - - n - 0 bounce
1391- verify unix - - n - 1 verify
1392- flush unix n - n 1000? 0 flush
1393- proxymap unix - - n - - proxymap
1394- proxywrite unix - - n - 1 proxymap
1395- smtp unix - - n - - smtp
1396- relay unix - - n - - smtp
1397- -o syslog_name=postfix/$service_name
1398- # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
1399- showq unix n - n - - showq
1400- error unix - - n - - error
1401- retry unix - - n - - error
1402- discard unix - - n - - discard
1403- local unix - n n - - local
1404- virtual unix - n n - - virtual
1405- lmtp unix - - n - - lmtp
1406- anvil unix - - n - 1 anvil
1407- scache unix - - n - 1 scache
1408- postlog unix-dgram n - n - 1 postlogd
1409- #
1410- # ====================================================================
1411- # Interfaces to non-Postfix software. Be sure to examine the manual
1412- # pages of the non-Postfix software to find out what options it wants.
1413- #
1414- # Many of the following services use the Postfix pipe(8) delivery
1415- # agent. See the pipe(8) man page for information about ${recipient}
1416- # and other message envelope options.
1417- # ====================================================================
1418- #
1419- # maildrop. See the Postfix MAILDROP_README file for details.
1420- # Also specify in main.cf: maildrop_destination_recipient_limit=1
1421- #
1422- #maildrop unix - n n - - pipe
1423- # flags=DRXhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
1424- #
1425- # ====================================================================
1426- #
1427- # Recent Cyrus versions can use the existing "lmtp" master.cf entry.
1428- #
1429- # Specify in cyrus.conf:
1430- # lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
1431- #
1432- # Specify in main.cf one or more of the following:
1433- # mailbox_transport = lmtp:inet:localhost
1434- # virtual_transport = lmtp:inet:localhost
1435- #
1436- # ====================================================================
1437- #
1438- # Cyrus 2.1.5 (Amos Gouaux)
1439- # Also specify in main.cf: cyrus_destination_recipient_limit=1
1440- #
1441- #cyrus unix - n n - - pipe
1442- # flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
1443- #
1444- # ====================================================================
1445- #
1446- # Old example of delivery via Cyrus.
1447- #
1448- #old-cyrus unix - n n - - pipe
1449- # flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
1450- #
1451- # ====================================================================
1452- #
1453- # See the Postfix UUCP_README file for configuration details.
1454- #
1455- #uucp unix - n n - - pipe
1456- # flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
1457- #
1458- # ====================================================================
1459- #
1460- # Other external delivery methods.
1461- #
1462- #ifmail unix - n n - - pipe
1463- # flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
1464- #
1465- #bsmtp unix - n n - - pipe
1466- # flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
1467- #
1468- #scalemail-backend unix - n n - 2 pipe
1469- # flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
1470- # ${nexthop} ${user} ${extension}
1471- #
1472- #mailman unix - n n - - pipe
1473- # flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
1474- # ${nexthop} ${user}
1475 diff --git a/containers/multiuser/postfix/smtp_header_checks b/containers/multiuser/postfix/smtp_header_checks
1476deleted file mode 100644
1477index 9e39150..0000000
1478--- a/containers/multiuser/postfix/smtp_header_checks
1479+++ /dev/null
1480 @@ -1,2 +0,0 @@
1481- /^Received: .*/ IGNORE
1482- /^User-Agent: .*/ IGNORE
1483 diff --git a/containers/multiuser/run_all.sh b/containers/multiuser/run_all.sh
1484index 15491b0..20f5feb 100755
1485--- a/containers/multiuser/run_all.sh
1486+++ b/containers/multiuser/run_all.sh
1487 @@ -1,71 +1,7 @@
1488 #!/usr/bin/env sh
1489-
1490- # copy all authorized keys specified as AYLLU_AUTHORIZED_KEYS=ecdsa-sha-2 ...::ssh-rsa ...
1491- # to the ~/.ssh/authorized_keys file of the Ayllu user.
1492-
1493- AYLLU_HOME="/home/ayllu"
1494- AYLLU_CONFIG="/etc/ayllu/config.toml"
1495- AYLLU_SSH_AUTHORIZED_KEYS_FILE="$AYLLU_HOME/.ssh/authorized_keys"
1496-
1497- mkdir -p /var/lib/ayllu
1498- chown -R ayllu:ayllu /var/lib/ayllu
1499- mkdir -p "$AYLLU_HOME/.ssh"
1500- chown ayllu:ayllu "$AYLLU_HOME/.ssh"
1501- echo /dev/null > "$AYLLU_SSH_AUTHORIZED_KEYS_FILE"
1502- chmod 644 "$AYLLU_SSH_AUTHORIZED_KEYS_FILE"
1503-
1504- echo "$AYLLU_AUTHORIZED_KEYS" | while IFS= read -r public_key
1505- do
1506- echo "$public_key" >> "$AYLLU_SSH_AUTHORIZED_KEYS_FILE"
1507- done
1508-
1509- # take envs with the format AYLLU_USER_$NAME="ecdsa-sha2 ...::ssh-rsa ..."
1510- # and configure a user within the container setting each SSH public key into
1511- # that user's ~/.ssh/authorized_keys file.
1512-
1513- env |grep AYLLU_USER_ | while IFS= read -r env_entry
1514- do
1515- username="$(echo "$env_entry" \
1516- | awk -F= '{split($1, arr, "_"); print tolower(arr[3])}')"
1517-
1518- echo "creating user $username"
1519-
1520- adduser -h "/home/$username" -D -g "Ayllu Managed User" "$username"
1521- # create a directory called "repos" which we give full access to both the
1522- # user and Ayllu.
1523- mkdir "/home/$username/repos"
1524- chmod g+s "/home/$username/repos"
1525- setfacl -d -m g::rwx "/home/$username/repos"
1526-
1527- addgroup "$username" ayllu
1528- mkdir -p "/home/$username/.ssh"
1529- cat /dev/null > "/home/$username/.ssh/authorized_keys"
1530-
1531- env_key=$(echo "$env_entry" | awk -F= '{print $1}' | sed "r/")
1532- replacement=$(printf "s/%s=//" "$env_key")
1533- all_keys="$(echo "$env_entry" | sed "${replacement}")"
1534-
1535- echo "$all_keys" | sed 's/::/\n/g' | while IFS= read -r key_entry
1536- do
1537- echo "$key_entry" >> "/home/$username/.ssh/authorized_keys"
1538- done
1539-
1540- chown -R "$username:$username" "/home/$username"
1541- chmod 644 "/home/$username/.ssh/authorized_keys"
1542-
1543- # add ayllu to all user groups so it can access their repositories
1544- addgroup ayllu "$username"
1545-
1546- done
1547-
1548- # TODO: Ayllu should have a programmatic way to set configuration values
1549- # at runtime e.g. ayllu config set http.address = ....
1550- [ -n "${AYLLU_LISTEN_ADDRESS}" ] && {
1551- sed -i "s/127.0.0.1:8080/$AYLLU_LISTEN_ADDRESS/" /etc/ayllu/config.toml
1552- }
1553-
1554- # ensure ayllu mail database exists even if it isn't configured yet
1555- su ayllu -c "ayllu-mail --config $AYLLU_CONFIG send"
1556+ set -e
1557+ # run all init scripts in /etc/ayllu-init
1558+ run-parts --exit-on-error /etc/ayllu-init
1559
1560 /sbin/runsvdir /etc/service &
1561
1562 diff --git a/containers/multiuser/service/ayllu-mail/run b/containers/multiuser/service/ayllu-mail/run
1563deleted file mode 100755
1564index 8863caa..0000000
1565--- a/containers/multiuser/service/ayllu-mail/run
1566+++ /dev/null
1567 @@ -1,3 +0,0 @@
1568- #!/bin/sh
1569-
1570- exec su ayllu -c 'ayllu-mail --config /etc/ayllu/config.toml serve'
1571 diff --git a/containers/multiuser/service/postfix/run b/containers/multiuser/service/postfix/run
1572deleted file mode 100755
1573index 51ead59..0000000
1574--- a/containers/multiuser/service/postfix/run
1575+++ /dev/null
1576 @@ -1,62 +0,0 @@
1577- #!/bin/sh
1578- set -e
1579-
1580- AYLLU_MAIL="/usr/bin/ayllu-mail"
1581- AYLLU_CONFIG="/etc/ayllu/config.toml"
1582- AYLLU_DB_PATH="/home/ayllu/.local/share/ayllu/mail.db"
1583-
1584- # FIXME: Mailpot's master-cf generation seems to be broken but it may also be
1585- # due to my own ignorance so manually specifying it for now.
1586-
1587- # "$AYLLU_MAIL" --config "$AYLLU_CONFIG" --database "$AYLLU_DB_PATH" postfix master-cf > /etc/postfix/ayllu.cf
1588- gen_master_cf() {
1589- printf "mailpot unix - n n - 1 pipe flags=RX user=ayllu directory=/home/ayllu argv=/usr/bin/ayllu-mail --database $AYLLU_DB_PATH --config $AYLLU_CONFIG post"
1590- }
1591-
1592- # FIXME
1593- AYLLU_SMTP_TLS_SECURITY_LEVEL="${AYLLU_SMTP_TLS_SECURITY_LEVEL:-none}"
1594-
1595- [ -n "${AYLLU_ROOT_MAIL_USER+x}" ] && {
1596- echo "# AYLLU: DO NOT EDIT" > /etc/postfix/aliases
1597- AYLLU_ROOT_MAIL_USER="$(echo "$AYLLU_ROOT_MAIL_USER" | tr '[:upper:]' '[:lower:]')"
1598- AYLLU_ROOT_MAIL_USER="$AYLLU_ROOT_MAIL_USER" envsubst < /etc/postfix-templates/aliases >> /etc/postfix/aliases
1599- newaliases
1600- }
1601-
1602- [ -n "${AYLLU_VIRTUAL_DOMAINS+x}" ] && {
1603- echo "# AYLLU: DO NOT EDIT" > /etc/postfix/transport
1604- echo "$AYLLU_VIRTUAL_DOMAINS" | sed 's/::/\n/g' | while IFS= read -r virtual_domain
1605- do
1606- echo "configuring virtual domain: ${virtual_domain}"
1607- echo "$virtual_domain" >> /etc/postfix/transport
1608- done
1609-
1610- postmap /etc/postfix/transport
1611- postconf virtual_alias_maps="lmdb:/etc/postfix/virtual"
1612- }
1613-
1614- # hide sender's IP address / User Agent
1615- # See https://wiki.archlinux.org/title/Postfix#Hide_the_sender's_IP_and_user_agent_in_the_Received_header
1616- cp /etc/postfix-templates/smtp_header_checks /etc/postfix/
1617- postconf -e smtp_header_checks="regexp:/etc/postfix/smtp_header_checks"
1618- postconf -e smtpd_helo_required=yes
1619-
1620- postconf -e smtp_tls_security_level="$AYLLU_SMTP_TLS_SECURITY_LEVEL"
1621- postconf -e maillog_file="/dev/stdout"
1622-
1623- AYLLU_MAIL_HOSTNAME="${AYLLU_MAIL_HOSTNAME:-localhost}"
1624- postconf -e myhostname="${AYLLU_MAIL_HOSTNAME}"
1625-
1626- # disallow relay from anywhere but localhost
1627- postconf -e inet_interfaces="loopback-only"
1628- postconf -e mynetworks="127.0.0.0/8"
1629- postconf -e local_transport="local"
1630- postconf -e transport_maps="lmdb:/etc/postfix/transport"
1631-
1632- cat /etc/postfix-templates/master.cf > /etc/postfix/master.cf
1633- gen_master_cf >> /etc/postfix/master.cf
1634-
1635- "$AYLLU_MAIL" --config "$AYLLU_CONFIG" --database "$AYLLU_DB_PATH" postfix maps > /etc/postfix/transport
1636- postmap /etc/postfix/transport
1637-
1638- exec postfix -c /etc/postfix start-fg
1639 diff --git a/scripts/build_all_containers.sh b/scripts/build_all_containers.sh
1640index 296a506..0cfc44a 100755
1641--- a/scripts/build_all_containers.sh
1642+++ b/scripts/build_all_containers.sh
1643 @@ -1,4 +1,7 @@
1644 #!/bin/sh
1645+ set -e
1646
1647- scripts/build_container.sh containers/base
1648+ scripts/build_container.sh containers/base-build
1649+ scripts/build_container.sh containers/ayllu
1650 scripts/build_container.sh containers/multiuser
1651+ scripts/build_container.sh containers/multiuser-mail
1652 diff --git a/scripts/build_container.sh b/scripts/build_container.sh
1653index f96dd13..0a23bf1 100755
1654--- a/scripts/build_container.sh
1655+++ b/scripts/build_container.sh
1656 @@ -1,10 +1,11 @@
1657 #!/bin/sh
1658- set -e
1659+ set -ex
1660
1661 REGISTRY="registry.ayllu-forge.org"
1662- IMAGE_NAME="ayllu/ayllu"
1663 COMMIT_ID="$(git rev-parse HEAD)"
1664 BRANCH_NAME="$(git branch --show-current)"
1665+ BASE_BUILD_IMAGE="$REGISTRY/ayllu/base-build:$COMMIT_ID"
1666+ EXTRA_ARGS="--build-arg=BASE_BUILD_IMAGE=$BASE_BUILD_IMAGE"
1667
1668 usage() {
1669 printf "USAGE: build_container.sh PATH\n"
1670 @@ -16,14 +17,36 @@ TARGET_DIR="$1"
1671 [ -z "$TARGET_DIR" ] && usage
1672
1673 FLAVOR="$(basename "$TARGET_DIR")"
1674- if [ "$FLAVOR" = "base" ]; then
1675- DETAILED_TAG="$COMMIT_ID"
1676- FRIENDLY_TAG="$BRANCH_NAME"
1677- else
1678- DETAILED_TAG="$FLAVOR-$COMMIT_ID"
1679- FRIENDLY_TAG="$FLAVOR-$BRANCH_NAME"
1680- EXTRA_ARGS=--build-arg=BASE_IMAGE="$REGISTRY/$IMAGE_NAME:$COMMIT_ID"
1681- fi
1682+ case "$FLAVOR" in
1683+ "base-build")
1684+ IMAGE_NAME="ayllu/base-build"
1685+ DETAILED_TAG="$COMMIT_ID"
1686+ FRIENDLY_TAG="$BRANCH_NAME"
1687+ ;;
1688+ "ayllu")
1689+ IMAGE_NAME="ayllu/ayllu"
1690+ DETAILED_TAG="$COMMIT_ID"
1691+ FRIENDLY_TAG="$BRANCH_NAME"
1692+ ;;
1693+ "multiuser")
1694+ IMAGE_NAME="ayllu/ayllu"
1695+ DETAILED_TAG="$FLAVOR-$COMMIT_ID"
1696+ FRIENDLY_TAG="$FLAVOR-$BRANCH_NAME"
1697+ EXTRA_ARGS="${EXTRA_ARGS} --build-arg=BASE_IMAGE=$REGISTRY/$IMAGE_NAME:$COMMIT_ID"
1698+ ;;
1699+ "multiuser-mail")
1700+ IMAGE_NAME="ayllu/ayllu"
1701+ DETAILED_TAG="$FLAVOR-$COMMIT_ID"
1702+ FRIENDLY_TAG="$FLAVOR-$BRANCH_NAME"
1703+ EXTRA_ARGS="${EXTRA_ARGS} --build-arg=BASE_IMAGE=$REGISTRY/$IMAGE_NAME:multiuser-$COMMIT_ID"
1704+ ;;
1705+ *)
1706+ echo "bad container name $FLAVOR"
1707+ exit 1
1708+ ;;
1709+ esac
1710+
1711+ echo "building container $REGISTRY/$IMAGE_NAME:$DETAILED_TAG"
1712
1713 podman \
1714 build --network=host \
1715 diff --git a/www/content/docs/mail.md b/www/content/docs/mail.md
1716index cf5dd97..1668f95 100644
1717--- a/www/content/docs/mail.md
1718+++ b/www/content/docs/mail.md
1719 @@ -8,3 +8,18 @@ weight = 1
1720 Ayllu has full featured support for email based development workflows. It is
1721 based on the excellent [mailpot](https://git.meli-email.org/meli/mailpot)
1722 mailing list manager.
1723+
1724+ ## Configuration
1725+
1726+ The configuration of mail servers can be complex. Ayllu encapsulates most of
1727+ these settings in the [mutliuser](https://ayllu-forge.org/ayllu/ayllu/tree/main/containers/multiuser)
1728+ container which can be used as a reference for configuring your own mail server.
1729+
1730+ ### Minimum Recommended Security Settings
1731+
1732+ #### DKIM
1733+
1734+ #### SPF Validation
1735+
1736+ The container provides SPF validation and the recommended DNS configuration for
1737+ a single host e.g. `ayllu-forge.org` is `"v=spf1 a mx ~all"`.