git subrepo clone https://github.com/mailcow/mailcow-dockerized.git mailcow/src/mailcow-dockerized
subrepo: subdir: "mailcow/src/mailcow-dockerized"
merged: "a832becb"
upstream: origin: "https://github.com/mailcow/mailcow-dockerized.git"
branch: "master"
commit: "a832becb"
git-subrepo: version: "0.4.3"
origin: "???"
commit: "???"
Change-Id: If5be2d621a211e164c9b6577adaa7884449f16b5
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/Dockerfile b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/Dockerfile
new file mode 100644
index 0000000..8369ce3
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/Dockerfile
@@ -0,0 +1,28 @@
+FROM alpine:3.11
+
+LABEL maintainer "Andre Peters <andre.peters@servercow.de>"
+
+RUN apk upgrade --no-cache \
+ && apk add --update --no-cache \
+ bash \
+ curl \
+ openssl \
+ bind-tools \
+ jq \
+ mariadb-client \
+ redis \
+ tini \
+ tzdata \
+ python3 \
+ && python3 -m pip install --upgrade pip \
+ && python3 -m pip install acme-tiny
+
+COPY acme.sh /srv/acme.sh
+COPY functions.sh /srv/functions.sh
+COPY obtain-certificate.sh /srv/obtain-certificate.sh
+COPY reload-configurations.sh /srv/reload-configurations.sh
+COPY expand6.sh /srv/expand6.sh
+
+RUN chmod +x /srv/*.sh
+
+CMD ["/sbin/tini", "-g", "--", "/srv/acme.sh"]
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/acme.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/acme.sh
new file mode 100755
index 0000000..5d5da1e
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/acme.sh
@@ -0,0 +1,422 @@
+#!/bin/bash
+set -o pipefail
+exec 5>&1
+
+# Do not attempt to write to slave
+if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
+ export REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT}"
+else
+ export REDIS_CMDLINE="redis-cli -h redis -p 6379"
+fi
+
+until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
+ echo "Waiting for Redis..."
+ sleep 2
+done
+
+source /srv/functions.sh
+# Thanks to https://github.com/cvmiller -> https://github.com/cvmiller/expand6
+source /srv/expand6.sh
+
+# Skipping IP check when we like to live dangerously
+if [[ "${SKIP_IP_CHECK}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+ SKIP_IP_CHECK=y
+fi
+
+# Skipping HTTP check when we like to live dangerously
+if [[ "${SKIP_HTTP_VERIFICATION}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+ SKIP_HTTP_VERIFICATION=y
+fi
+
+# Request certificate for MAILCOW_HOSTNAME only
+if [[ "${ONLY_MAILCOW_HOSTNAME}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+ ONLY_MAILCOW_HOSTNAME=y
+fi
+
+# Request individual certificate for every domain
+if [[ "${ENABLE_SSL_SNI}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+ ENABLE_SSL_SNI=y
+fi
+
+if [[ "${SKIP_LETS_ENCRYPT}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+ log_f "SKIP_LETS_ENCRYPT=y, skipping Let's Encrypt..."
+ sleep 365d
+ exec $(readlink -f "$0")
+fi
+
+log_f "Waiting for Docker API..."
+until ping dockerapi -c1 > /dev/null; do
+ sleep 1
+done
+log_f "Docker API OK"
+
+log_f "Waiting for Postfix..."
+until ping postfix -c1 > /dev/null; do
+ sleep 1
+done
+log_f "Postfix OK"
+
+log_f "Waiting for Dovecot..."
+until ping dovecot -c1 > /dev/null; do
+ sleep 1
+done
+log_f "Dovecot OK"
+
+ACME_BASE=/var/lib/acme
+SSL_EXAMPLE=/var/lib/ssl-example
+
+mkdir -p ${ACME_BASE}/acme
+
+# Migrate
+[[ -f ${ACME_BASE}/acme/private/privkey.pem ]] && mv ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/acme/key.pem
+[[ -f ${ACME_BASE}/acme/private/account.key ]] && mv ${ACME_BASE}/acme/private/account.key ${ACME_BASE}/acme/account.pem
+if [[ -f ${ACME_BASE}/acme/key.pem && -f ${ACME_BASE}/acme/cert.pem ]]; then
+ if verify_hash_match ${ACME_BASE}/acme/cert.pem ${ACME_BASE}/acme/key.pem; then
+ log_f "Migrating to SNI folder structure..."
+ CERT_DOMAIN=($(openssl x509 -noout -text -in ${ACME_BASE}/acme/cert.pem | grep "Subject:" | sed -e 's/\(Subject:\)\|\(CN = \)\|\(CN=\)//g' | sed -e 's/^[[:space:]]*//'))
+ CERT_DOMAINS=(${CERT_DOMAIN} $(openssl x509 -noout -text -in ${ACME_BASE}/acme/cert.pem | grep "DNS:" | sed -e 's/\(DNS:\)\|,//g' | sed "s/${CERT_DOMAIN}//" | sed -e 's/^[[:space:]]*//'))
+ mkdir -p ${ACME_BASE}/${CERT_DOMAIN}
+ mv ${ACME_BASE}/acme/cert.pem ${ACME_BASE}/${CERT_DOMAIN}/cert.pem
+ # key is only copied, not moved, because it is used by all other requests too
+ cp ${ACME_BASE}/acme/key.pem ${ACME_BASE}/${CERT_DOMAIN}/key.pem
+ chmod 600 ${ACME_BASE}/${CERT_DOMAIN}/key.pem
+ echo -n ${CERT_DOMAINS[*]} > ${ACME_BASE}/${CERT_DOMAIN}/domains
+ mv ${ACME_BASE}/acme/acme.csr ${ACME_BASE}/${CERT_DOMAIN}/acme.csr
+ log_f "OK" no_date
+ fi
+fi
+
+[[ ! -f ${ACME_BASE}/dhparams.pem ]] && cp ${SSL_EXAMPLE}/dhparams.pem ${ACME_BASE}/dhparams.pem
+
+if [[ -f ${ACME_BASE}/cert.pem ]] && [[ -f ${ACME_BASE}/key.pem ]] && [[ $(stat -c%s ${ACME_BASE}/cert.pem) != 0 ]]; then
+ ISSUER=$(openssl x509 -in ${ACME_BASE}/cert.pem -noout -issuer)
+ if [[ ${ISSUER} != *"Let's Encrypt"* && ${ISSUER} != *"mailcow"* && ${ISSUER} != *"Fake LE Intermediate"* ]]; then
+ log_f "Found certificate with issuer other than mailcow snake-oil CA and Let's Encrypt, skipping ACME client..."
+ sleep 3650d
+ exec $(readlink -f "$0")
+ fi
+else
+ if [[ -f ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ]] && [[ -f ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem ]] && verify_hash_match ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem; then
+ log_f "Restoring previous acme certificate and restarting script..."
+ cp ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ${ACME_BASE}/cert.pem
+ cp ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem ${ACME_BASE}/key.pem
+ # Restarting with env var set to trigger a restart,
+ exec env TRIGGER_RESTART=1 $(readlink -f "$0")
+ else
+ log_f "Restoring mailcow snake-oil certificates and restarting script..."
+ cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
+ cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
+ exec env TRIGGER_RESTART=1 $(readlink -f "$0")
+ fi
+fi
+
+chmod 600 ${ACME_BASE}/key.pem
+
+log_f "Waiting for database..."
+while ! mysqladmin status --socket=/var/run/mysqld/mysqld.sock -u${DBUSER} -p${DBPASS} --silent > /dev/null; do
+ sleep 2
+done
+log_f "Database OK"
+
+log_f "Waiting for Nginx..."
+until $(curl --output /dev/null --silent --head --fail http://nginx:8081); do
+ sleep 2
+done
+log_f "Nginx OK"
+
+log_f "Waiting for resolver..."
+until dig letsencrypt.org +time=3 +tries=1 @unbound > /dev/null; do
+ sleep 2
+done
+log_f "Resolver OK"
+
+# Waiting for domain table
+log_f "Waiting for domain table..."
+while [[ -z ${DOMAIN_TABLE} ]]; do
+ curl --silent http://nginx/ >/dev/null 2>&1
+ DOMAIN_TABLE=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SHOW TABLES LIKE 'domain'" -Bs)
+ [[ -z ${DOMAIN_TABLE} ]] && sleep 10
+done
+log_f "OK" no_date
+
+log_f "Initializing, please wait..."
+
+while true; do
+ POSTFIX_CERT_SERIAL="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+ DOVECOT_CERT_SERIAL="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+ POSTFIX_CERT_SERIAL_NEW="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+ DOVECOT_CERT_SERIAL_NEW="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+ # Re-using previous acme-mailcow account and domain keys
+ if [[ ! -f ${ACME_BASE}/acme/key.pem ]]; then
+ log_f "Generating missing domain private rsa key..."
+ openssl genrsa 4096 > ${ACME_BASE}/acme/key.pem
+ else
+ log_f "Using existing domain rsa key ${ACME_BASE}/acme/key.pem"
+ fi
+ if [[ ! -f ${ACME_BASE}/acme/account.pem ]]; then
+ log_f "Generating missing Lets Encrypt account key..."
+ openssl genrsa 4096 > ${ACME_BASE}/acme/account.pem
+ else
+ log_f "Using existing Lets Encrypt account key ${ACME_BASE}/acme/account.pem"
+ fi
+
+ chmod 600 ${ACME_BASE}/acme/key.pem
+ chmod 600 ${ACME_BASE}/acme/account.pem
+
+ unset EXISTING_CERTS
+ declare -a EXISTING_CERTS
+ for cert_dir in ${ACME_BASE}/*/ ; do
+ if [[ ! -f ${cert_dir}domains ]] || [[ ! -f ${cert_dir}cert.pem ]] || [[ ! -f ${cert_dir}key.pem ]]; then
+ continue
+ fi
+ EXISTING_CERTS+=("$(basename ${cert_dir})")
+ done
+
+ # Cleaning up and init validation arrays
+ unset SQL_DOMAIN_ARR
+ unset VALIDATED_CONFIG_DOMAINS
+ unset ADDITIONAL_VALIDATED_SAN
+ unset ADDITIONAL_WC_ARR
+ unset ADDITIONAL_SAN_ARR
+ unset CERT_ERRORS
+ unset CERT_CHANGED
+ unset CERT_AMOUNT_CHANGED
+ unset VALIDATED_CERTIFICATES
+ CERT_ERRORS=0
+ CERT_CHANGED=0
+ CERT_AMOUNT_CHANGED=0
+ declare -a SQL_DOMAIN_ARR
+ declare -a VALIDATED_CONFIG_DOMAINS
+ declare -a ADDITIONAL_VALIDATED_SAN
+ declare -a ADDITIONAL_WC_ARR
+ declare -a ADDITIONAL_SAN_ARR
+ declare -a VALIDATED_CERTIFICATES
+ IFS=',' read -r -a TMP_ARR <<< "${ADDITIONAL_SAN}"
+ for i in "${TMP_ARR[@]}" ; do
+ if [[ "$i" =~ \.\*$ ]]; then
+ ADDITIONAL_WC_ARR+=(${i::-2})
+ else
+ ADDITIONAL_SAN_ARR+=($i)
+ fi
+ done
+ ADDITIONAL_WC_ARR+=('autodiscover' 'autoconfig')
+
+ # Start IP detection
+ log_f "Detecting IP addresses..."
+ IPV4=$(get_ipv4)
+ IPV6=$(get_ipv6)
+ log_f "OK: ${IPV4}, ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}"
+
+ # Hard-fail on CAA errors for MAILCOW_HOSTNAME
+ MH_PARENT_DOMAIN=$(echo ${MAILCOW_HOSTNAME} | cut -d. -f2-)
+ MH_CAAS=( $(dig CAA ${MH_PARENT_DOMAIN} +short | sed -n 's/\d issue "\(.*\)"/\1/p') )
+ if [[ ! -z ${MH_CAAS} ]]; then
+ if [[ ${MH_CAAS[@]} =~ "letsencrypt.org" ]]; then
+ log_f "Validated CAA for parent domain ${MH_PARENT_DOMAIN}"
+ else
+ log_f "Skipping ACME validation: Lets Encrypt disallowed for ${MAILCOW_HOSTNAME} by CAA record, retrying in 1h..."
+ sleep 1h
+ exec $(readlink -f "$0")
+ fi
+ fi
+
+ #########################################
+ # IP and webroot challenge verification #
+ SQL_DOMAINS=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain WHERE backupmx=0" -Bs)
+ if [[ ! $? -eq 0 ]]; then
+ log_f "Failed to read SQL domains, retrying in 1 minute..."
+ sleep 1m
+ exec $(readlink -f "$0")
+ fi
+ while read domains; do
+ if [[ -z "${domains}" ]]; then
+ # ignore empty lines
+ continue
+ fi
+ SQL_DOMAIN_ARR+=("${domains}")
+ done <<< "${SQL_DOMAINS}"
+
+ if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
+ for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do
+ unset VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
+ declare -a VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
+ for SUBDOMAIN in "${ADDITIONAL_WC_ARR[@]}"; do
+ if [[ "${SUBDOMAIN}.${SQL_DOMAIN}" != "${MAILCOW_HOSTNAME}" ]]; then
+ if check_domain "${SUBDOMAIN}.${SQL_DOMAIN}"; then
+ VALIDATED_CONFIG_DOMAINS_SUBDOMAINS+=("${SUBDOMAIN}.${SQL_DOMAIN}")
+ fi
+ fi
+ done
+ VALIDATED_CONFIG_DOMAINS+=("${VALIDATED_CONFIG_DOMAINS_SUBDOMAINS[*]}")
+ done
+ fi
+
+ if check_domain ${MAILCOW_HOSTNAME}; then
+ VALIDATED_MAILCOW_HOSTNAME="${MAILCOW_HOSTNAME}"
+ fi
+
+ if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
+ for SAN in "${ADDITIONAL_SAN_ARR[@]}"; do
+ # Skip on CAA errors for SAN
+ SAN_PARENT_DOMAIN=$(echo ${SAN} | cut -d. -f2-)
+ SAN_CAAS=( $(dig CAA ${SAN_PARENT_DOMAIN} +short | sed -n 's/\d issue "\(.*\)"/\1/p') )
+ if [[ ! -z ${SAN_CAAS} ]]; then
+ if [[ ${SAN_CAAS[@]} =~ "letsencrypt.org" ]]; then
+ log_f "Validated CAA for parent domain ${SAN_PARENT_DOMAIN} of ${SAN}"
+ else
+ log_f "Skipping ACME validation for ${SAN}: Lets Encrypt disallowed for ${SAN} by CAA record"
+ continue
+ fi
+ fi
+ if [[ ${SAN} == ${MAILCOW_HOSTNAME} ]]; then
+ continue
+ fi
+ if check_domain ${SAN}; then
+ ADDITIONAL_VALIDATED_SAN+=("${SAN}")
+ fi
+ done
+ fi
+
+ # Unique domains for server certificate
+ if [[ ${ENABLE_SSL_SNI} == "y" ]]; then
+ # create certificate for server name and fqdn SANs only
+ SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+ else
+ # create certificate for all domains, including all subdomains from other domains [*]
+ SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+ fi
+ if [[ ! -z ${SERVER_SAN_VALIDATED[*]} ]]; then
+ CERT_NAME=${SERVER_SAN_VALIDATED[0]}
+ VALIDATED_CERTIFICATES+=("${CERT_NAME}")
+
+ # obtain server certificate if required
+ DOMAINS=${SERVER_SAN_VALIDATED[@]} /srv/obtain-certificate.sh rsa
+ RETURN="$?"
+ if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
+ CERT_AMOUNT_CHANGED=1
+ CERT_CHANGED=1
+ elif [[ "$RETURN" == "1" ]]; then # 1 = cert renewed successfully
+ CERT_CHANGED=1
+ elif [[ "$RETURN" == "2" ]]; then # 2 = cert not due for renewal
+ :
+ else
+ CERT_ERRORS=1
+ fi
+ # copy hostname certificate to default/server certificate
+ # do not a key when cert is missing, this can lead to a mismatch of cert/key
+ if [[ -f ${ACME_BASE}/${CERT_NAME}/cert.pem ]]; then
+ cp ${ACME_BASE}/${CERT_NAME}/cert.pem ${ACME_BASE}/cert.pem
+ cp ${ACME_BASE}/${CERT_NAME}/key.pem ${ACME_BASE}/key.pem
+ fi
+ fi
+
+ # individual certificates for SNI [@]
+ if [[ ${ENABLE_SSL_SNI} == "y" ]]; then
+ for VALIDATED_DOMAINS in "${VALIDATED_CONFIG_DOMAINS[@]}"; do
+ VALIDATED_DOMAINS_ARR=(${VALIDATED_DOMAINS})
+
+ unset VALIDATED_DOMAINS_SORTED
+ declare -a VALIDATED_DOMAINS_SORTED
+ VALIDATED_DOMAINS_SORTED=(${VALIDATED_DOMAINS_ARR[0]} $(echo ${VALIDATED_DOMAINS_ARR[@]:1} | xargs -n1 | sort -u | xargs))
+
+ # remove all domain names that are already inside the server certificate (SERVER_SAN_VALIDATED)
+ for domain in "${SERVER_SAN_VALIDATED[@]}"; do
+ for i in "${!VALIDATED_DOMAINS_SORTED[@]}"; do
+ if [[ ${VALIDATED_DOMAINS_SORTED[i]} = $domain ]]; then
+ unset 'VALIDATED_DOMAINS_SORTED[i]'
+ fi
+ done
+ done
+
+ if [[ ! -z ${VALIDATED_DOMAINS_SORTED[*]} ]]; then
+ CERT_NAME=${VALIDATED_DOMAINS_SORTED[0]}
+ VALIDATED_CERTIFICATES+=("${CERT_NAME}")
+ # obtain certificate if required
+ DOMAINS=${VALIDATED_DOMAINS_SORTED[@]} /srv/obtain-certificate.sh rsa
+ RETURN="$?"
+ if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
+ CERT_AMOUNT_CHANGED=1
+ CERT_CHANGED=1
+ elif [[ "$RETURN" == "1" ]]; then # 1 = cert renewed successfully
+ CERT_CHANGED=1
+ elif [[ "$RETURN" == "2" ]]; then # 2 = cert not due for renewal
+ :
+ else
+ CERT_ERRORS=1
+ fi
+ fi
+ done
+ fi
+
+ if [[ -z ${VALIDATED_CERTIFICATES[*]} ]]; then
+ log_f "Cannot validate any hostnames, skipping Let's Encrypt for 1 hour."
+ log_f "Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently."
+ ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+ sleep 1h
+ exec $(readlink -f "$0")
+ fi
+
+ # find orphaned certificates if no errors occurred
+ if [[ "${CERT_ERRORS}" == "0" ]]; then
+ for EXISTING_CERT in "${EXISTING_CERTS[@]}"; do
+ if [[ ! "`printf '_%s_\n' "${VALIDATED_CERTIFICATES[@]}"`" == *"_${EXISTING_CERT}_"* ]]; then
+ DATE=$(date +%Y-%m-%d_%H_%M_%S)
+ log_f "Found orphaned certificate: ${EXISTING_CERT} - archiving it at ${ACME_BASE}/backups/${EXISTING_CERT}/"
+ BACKUP_DIR=${ACME_BASE}/backups/${EXISTING_CERT}/${DATE}
+ # archive rsa cert and any other files
+ mkdir -p ${ACME_BASE}/backups/${EXISTING_CERT}
+ mv ${ACME_BASE}/${EXISTING_CERT} ${BACKUP_DIR}
+ CERT_CHANGED=1
+ CERT_AMOUNT_CHANGED=1
+ fi
+ done
+ fi
+
+ # reload on new or changed certificates
+ if [[ "${CERT_CHANGED}" == "1" ]]; then
+ rm -f "${ACME_BASE}/force_renew" 2> /dev/null
+ RELOAD_LOOP_C=1
+ while [[ "${POSTFIX_CERT_SERIAL}" == "${POSTFIX_CERT_SERIAL_NEW}" ]] || [[ "${DOVECOT_CERT_SERIAL}" == "${DOVECOT_CERT_SERIAL_NEW}" ]] || [[ ${#POSTFIX_CERT_SERIAL_NEW} -ne 36 ]] || [[ ${#DOVECOT_CERT_SERIAL_NEW} -ne 36 ]]; do
+ log_f "Reloading or restarting services... (${RELOAD_LOOP_C})"
+ RELOAD_LOOP_C=$((RELOAD_LOOP_C + 1))
+ CERT_AMOUNT_CHANGED=${CERT_AMOUNT_CHANGED} /srv/reload-configurations.sh
+ log_f "Waiting for containers to settle..."
+ sleep 10
+ until nc -z dovecot 143; do
+ sleep 1
+ done
+ until nc -z postfix 25; do
+ sleep 1
+ done
+ POSTFIX_CERT_SERIAL_NEW="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+ DOVECOT_CERT_SERIAL_NEW="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+ if [[ ${RELOAD_LOOP_C} -gt 3 ]]; then
+ log_f "Some services do return old end dates, something went wrong!"
+ ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+ break;
+ fi
+ done
+ fi
+
+ case "$CERT_ERRORS" in
+ 0) # all successful
+ if [[ "${CERT_CHANGED}" == "1" ]]; then
+ if [[ "${CERT_AMOUNT_CHANGED}" == "1" ]]; then
+ log_f "Certificates successfully requested and renewed where required, sleeping one day"
+ else
+ log_f "Certificates were successfully renewed where required, sleeping for another day."
+ fi
+ else
+ log_f "Certificates were successfully validated, no changes or renewals required, sleeping for another day."
+ fi
+ sleep 1d
+ ;;
+ *) # non-zero
+ log_f "Some errors occurred, retrying in 30 minutes..."
+ ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+ sleep 30m
+ exec $(readlink -f "$0")
+ ;;
+ esac
+
+done
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/expand6.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/expand6.sh
new file mode 100755
index 0000000..a781722
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/expand6.sh
@@ -0,0 +1,131 @@
+#!/bin/bash
+
+##################################################################################
+#
+# Copyright (C) 2017 Craig Miller
+#
+# See the file "LICENSE" for information on usage and redistribution
+# of this file, and for a DISCLAIMER OF ALL WARRANTIES.
+# Distributed under GPLv2 License
+#
+##################################################################################
+
+
+# IPv6 Address Expansion functions
+#
+# by Craig Miller 19 Feb 2017
+#
+# 16 Nov 2017 v0.93 - added CLI functionality
+
+
+VERSION=0.93
+
+empty_addr="0000:0000:0000:0000:0000:0000:0000:0000"
+empty_addr_len=${#empty_addr}
+
+function usage {
+ echo " $0 - expand compressed IPv6 addresss "
+ echo " e.g. $0 2001:db8:1:12:123::456 "
+ echo " "
+ echo " -t self test"
+ echo " "
+ echo " By Craig Miller - Version: $VERSION"
+ exit 1
+ }
+
+if [ "$1" == "-h" ]; then
+ #call help
+ usage
+fi
+
+#
+# Expands IPv6 quibble to 4 digits with leading zeros e.g. db8 -> 0db8
+#
+# Returns string with expanded quibble
+
+function expand_quibble() {
+ addr=$1
+ # create array of quibbles
+ addr_array=(${addr//:/ })
+ addr_array_len=${#addr_array[@]}
+ # step thru quibbles
+ for ((i=0; i< $addr_array_len ; i++ ))
+ do
+ quibble=${addr_array[$i]}
+ quibble_len=${#quibble}
+ case $quibble_len in
+ 1) quibble="000$quibble";;
+ 2) quibble="00$quibble";;
+ 3) quibble="0$quibble";;
+ esac
+ addr_array[$i]=$quibble
+ done
+ # reconstruct addr from quibbles
+ return_str=${addr_array[*]}
+ return_str="${return_str// /:}"
+ echo $return_str
+}
+
+#
+# Expands IPv6 address :: format to full zeros
+#
+# Returns string with expanded address
+
+function expand() {
+ if [[ $1 == *"::"* ]]; then
+ # check for leading zeros on front_addr
+ if [[ $1 == "::"* ]]; then
+ front_addr=0
+ else
+ front_addr=$(echo $1 | sed -r 's;([^ ]+)::.*;\1;')
+ fi
+ # check for trailing zeros on back_addr
+ if [[ $1 == *"::" ]]; then
+ back_addr=0
+ else
+ back_addr=$(echo $1 | sed -r 's;.*::([^ ]+);\1;')
+ fi
+ front_addr=$(expand_quibble $front_addr)
+ back_addr=$(expand_quibble $back_addr)
+
+ new_addr=$empty_addr
+ front_addr_len=${#front_addr}
+ back_addr_len=${#back_addr}
+ # calculate fill needed
+ num_zeros=$(($empty_addr_len - $front_addr_len - $back_addr_len - 1))
+
+ #fill_str=${empty_addr[0]:0:$num_zeros}
+ new_addr="$front_addr:${empty_addr[0]:0:$num_zeros}$back_addr"
+
+ # return expanded address
+ echo $new_addr
+ else
+ # return input with expandd quibbles
+ expand_quibble $1
+ fi
+}
+
+# self test - call with '-t' parameter
+if [ "$1" == "-t" ]; then
+ # add address examples to test
+ expand fd11::1d70:cf84:18ef:d056
+ expand 2a01::1
+ expand fe80::f203:8cff:fe3f:f041
+ expand 2001:db8:123::5
+ expand 2001:470:ebbd:0:f203:8cff:fe3f:f041
+ # special cases
+ expand ::1
+ expand fd32:197d:3022:1101::
+ exit 1
+fi
+
+# allow script to be sourced (with no arguements)
+if [[ $1 != "" ]]; then
+ # validate input is an IPv6 address
+ if [[ $1 == *":"* ]]; then
+ expand $1
+ else
+ echo "ERROR: unregcognized IPv6 address $1"
+ exit 1
+ fi
+fi
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/functions.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/functions.sh
new file mode 100644
index 0000000..454946d
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/functions.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+
+log_f() {
+ if [[ ${2} == "no_nl" ]]; then
+ echo -n "$(date) - ${1}"
+ elif [[ ${2} == "no_date" ]]; then
+ echo "${1}"
+ elif [[ ${2} != "redis_only" ]]; then
+ echo "$(date) - ${1}"
+ fi
+ if [[ ${3} == "b64" ]]; then
+ ${REDIS_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"base64,$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}")\"}" > /dev/null
+ else
+ ${REDIS_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}" | \
+ tr '%&;$"[]{}-\r\n' ' ')\"}" > /dev/null
+ fi
+}
+
+verify_hash_match(){
+ CERT_HASH=$(openssl x509 -in "${1}" -noout -pubkey | openssl md5)
+ KEY_HASH=$(openssl pkey -in "${2}" -pubout | openssl md5)
+ if [[ ${CERT_HASH} != ${KEY_HASH} ]]; then
+ log_f "Certificate and key hashes do not match!"
+ return 1
+ else
+ log_f "Verified hashes."
+ return 0
+ fi
+}
+
+get_ipv4(){
+ local IPV4=
+ local IPV4_SRCS=
+ local TRY=
+ IPV4_SRCS[0]="ip4.mailcow.email"
+ IPV4_SRCS[1]="ip4.korves.net"
+ until [[ ! -z ${IPV4} ]] || [[ ${TRY} -ge 10 ]]; do
+ IPV4=$(curl --connect-timeout 3 -m 10 -L4s ${IPV4_SRCS[$RANDOM % ${#IPV4_SRCS[@]} ]} | grep -E "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$")
+ [[ ! -z ${TRY} ]] && sleep 1
+ TRY=$((TRY+1))
+ done
+ echo ${IPV4}
+}
+
+get_ipv6(){
+ local IPV6=
+ local IPV6_SRCS=
+ local TRY=
+ IPV6_SRCS[0]="ip6.korves.net"
+ IPV6_SRCS[1]="ip6.mailcow.email"
+ until [[ ! -z ${IPV6} ]] || [[ ${TRY} -ge 10 ]]; do
+ IPV6=$(curl --connect-timeout 3 -m 10 -L6s ${IPV6_SRCS[$RANDOM % ${#IPV6_SRCS[@]} ]} | grep "^\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}$")
+ [[ ! -z ${TRY} ]] && sleep 1
+ TRY=$((TRY+1))
+ done
+ echo ${IPV6}
+}
+
+check_domain(){
+ DOMAIN=$1
+ A_DOMAIN=$(dig A ${DOMAIN} +short | tail -n 1)
+ AAAA_DOMAIN=$(dig AAAA ${DOMAIN} +short | tail -n 1)
+ # Check if CNAME without v6 enabled target
+ if [[ ! -z ${AAAA_DOMAIN} ]] && [[ -z $(echo ${AAAA_DOMAIN} | grep "^\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}$") ]]; then
+ AAAA_DOMAIN=
+ fi
+ if [[ ! -z ${AAAA_DOMAIN} ]]; then
+ log_f "Found AAAA record for ${DOMAIN}: ${AAAA_DOMAIN} - skipping A record check"
+ if [[ $(expand ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}) == $(expand ${AAAA_DOMAIN}) ]] || [[ ${SKIP_IP_CHECK} == "y" ]] || [[ ${SNAT6_TO_SOURCE} != "n" ]]; then
+ if verify_challenge_path "${DOMAIN}" 6; then
+ log_f "Confirmed AAAA record with IP $(expand ${AAAA_DOMAIN})"
+ return 0
+ else
+ log_f "Confirmed AAAA record with IP $(expand ${AAAA_DOMAIN}), but HTTP validation failed"
+ fi
+ else
+ log_f "Cannot match your IP $(expand ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}) against hostname ${DOMAIN} (DNS returned $(expand ${AAAA_DOMAIN}))"
+ fi
+ elif [[ ! -z ${A_DOMAIN} ]]; then
+ log_f "Found A record for ${DOMAIN}: ${A_DOMAIN}"
+ if [[ ${IPV4:-ERR} == ${A_DOMAIN} ]] || [[ ${SKIP_IP_CHECK} == "y" ]] || [[ ${SNAT_TO_SOURCE} != "n" ]]; then
+ if verify_challenge_path "${DOMAIN}" 4; then
+ log_f "Confirmed A record ${A_DOMAIN}"
+ return 0
+ else
+ log_f "Confirmed A record with IP ${A_DOMAIN}, but HTTP validation failed"
+ fi
+ else
+ log_f "Cannot match your IP ${IPV4} against hostname ${DOMAIN} (DNS returned ${A_DOMAIN})"
+ fi
+ else
+ log_f "No A or AAAA record found for hostname ${DOMAIN}"
+ fi
+ return 1
+}
+
+verify_challenge_path(){
+ if [[ ${SKIP_HTTP_VERIFICATION} == "y" ]]; then
+ echo '(skipping check, returning 0)'
+ return 0
+ fi
+ # verify_challenge_path URL 4|6
+ RANDOM_N=${RANDOM}${RANDOM}${RANDOM}
+ echo ${RANDOM_N} > /var/www/acme/${RANDOM_N}
+ if [[ "$(curl --insecure -${2} -L http://${1}/.well-known/acme-challenge/${RANDOM_N} --silent)" == "${RANDOM_N}" ]]; then
+ rm /var/www/acme/${RANDOM_N}
+ return 0
+ else
+ rm /var/www/acme/${RANDOM_N}
+ return 1
+ fi
+}
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/obtain-certificate.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/obtain-certificate.sh
new file mode 100644
index 0000000..8264a2c
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/obtain-certificate.sh
@@ -0,0 +1,130 @@
+#!/bin/bash
+
+# Return values / exit codes
+# 0 = cert created successfully
+# 1 = cert renewed successfully
+# 2 = cert not due for renewal
+# * = errors
+
+
+source /srv/functions.sh
+
+CERT_DOMAINS=(${DOMAINS[@]})
+CERT_DOMAIN=${CERT_DOMAINS[0]}
+ACME_BASE=/var/lib/acme
+
+TYPE=${1}
+PREFIX=""
+# only support rsa certificates for now
+if [[ "${TYPE}" != "rsa" ]]; then
+ log_f "Unknown certificate type '${TYPE}' requested"
+ exit 5
+fi
+DOMAINS_FILE=${ACME_BASE}/${CERT_DOMAIN}/domains
+CERT=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}cert.pem
+SHARED_KEY=${ACME_BASE}/acme/${PREFIX}key.pem # must already exist
+KEY=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}key.pem
+CSR=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}acme.csr
+
+if [[ -z ${CERT_DOMAINS[*]} ]]; then
+ log_f "Missing CERT_DOMAINS to obtain a certificate"
+ exit 3
+fi
+
+if [[ "${LE_STAGING}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+ if [[ ! -z "${DIRECTORY_URL}" ]]; then
+ log_f "Cannot use DIRECTORY_URL with LE_STAGING=y - ignoring DIRECTORY_URL"
+ fi
+ log_f "Using Let's Encrypt staging servers"
+ DIRECTORY_URL='--directory-url https://acme-staging-v02.api.letsencrypt.org/directory'
+elif [[ ! -z "${DIRECTORY_URL}" ]]; then
+ log_f "Using custom directory URL ${DIRECTORY_URL}"
+ DIRECTORY_URL="--directory-url ${DIRECTORY_URL}"
+fi
+
+if [[ -f ${DOMAINS_FILE} && "$(cat ${DOMAINS_FILE})" == "${CERT_DOMAINS[*]}" ]]; then
+ if [[ ! -f ${CERT} || ! -f "${KEY}" || -f "${ACME_BASE}/force_renew" ]]; then
+ log_f "Certificate ${CERT} doesn't exist yet or forced renewal - start obtaining"
+ # Certificate exists and did not change but could be due for renewal (30 days)
+ elif ! openssl x509 -checkend 2592000 -noout -in ${CERT} > /dev/null; then
+ log_f "Certificate ${CERT} is due for renewal (< 30 days) - start renewing"
+ else
+ log_f "Certificate ${CERT} validation done, neither changed nor due for renewal."
+ exit 2
+ fi
+else
+ log_f "Certificate ${CERT} missing or changed domains '${CERT_DOMAINS[*]}' - start obtaining"
+fi
+
+
+# Make backup
+if [[ -f ${CERT} ]]; then
+ DATE=$(date +%Y-%m-%d_%H_%M_%S)
+ BACKUP_DIR=${ACME_BASE}/backups/${CERT_DOMAIN}/${PREFIX}${DATE}
+ log_f "Creating backups in ${BACKUP_DIR} ..."
+ mkdir -p ${BACKUP_DIR}/
+ [[ -f ${DOMAINS_FILE} ]] && cp ${DOMAINS_FILE} ${BACKUP_DIR}/
+ [[ -f ${CERT} ]] && cp ${CERT} ${BACKUP_DIR}/
+ [[ -f ${KEY} ]] && cp ${KEY} ${BACKUP_DIR}/
+ [[ -f ${CSR} ]] && cp ${CSR} ${BACKUP_DIR}/
+fi
+
+mkdir -p ${ACME_BASE}/${CERT_DOMAIN}
+if [[ ! -f ${KEY} ]]; then
+ log_f "Copying shared private key for this certificate..."
+ cp ${SHARED_KEY} ${KEY}
+ chmod 600 ${KEY}
+fi
+
+# Generating CSR
+printf "[SAN]\nsubjectAltName=" > /tmp/_SAN
+printf "DNS:%s," "${CERT_DOMAINS[@]}" >> /tmp/_SAN
+sed -i '$s/,$//' /tmp/_SAN
+openssl req -new -sha256 -key ${KEY} -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf /tmp/_SAN) > ${CSR}
+
+# acme-tiny writes info to stderr and ceritifcate to stdout
+# The redirects will do the following:
+# - redirect stdout to temp certificate file
+# - redirect acme-tiny stderr to stdout (logs to variable ACME_RESPONSE)
+# - tee stderr to get live output and log to dockerd
+
+log_f "Checking resolver..."
+until dig letsencrypt.org +time=3 +tries=1 @unbound > /dev/null; do
+ sleep 2
+done
+log_f "Resolver OK"
+
+ACME_RESPONSE=$(acme-tiny ${DIRECTORY_URL} \
+ --account-key ${ACME_BASE}/acme/account.pem \
+ --disable-check \
+ --csr ${CSR} \
+ --acme-dir /var/www/acme/ 2>&1 > /tmp/_cert.pem | tee /dev/fd/5; exit ${PIPESTATUS[0]})
+SUCCESS="$?"
+ACME_RESPONSE_B64=$(echo "${ACME_RESPONSE}" | openssl enc -e -A -base64)
+log_f "${ACME_RESPONSE_B64}" redis_only b64
+case "$SUCCESS" in
+ 0) # cert requested
+ log_f "Deploying certificate ${CERT}..."
+ # Deploy the new certificate and key
+ # Moving temp cert to {domain} folder
+ if verify_hash_match /tmp/_cert.pem ${KEY}; then
+ RETURN=0 # certificate created
+ if [[ -f ${CERT} ]]; then
+ RETURN=1 # certificate renewed
+ fi
+ mv -f /tmp/_cert.pem ${CERT}
+ echo -n ${CERT_DOMAINS[*]} > ${DOMAINS_FILE}
+ rm /var/www/acme/* 2> /dev/null
+ log_f "Certificate successfully obtained"
+ exit ${RETURN}
+ else
+ log_f "Certificate was successfully requested, but key and certificate have non-matching hashes, ignoring certificate"
+ exit 4
+ fi
+ ;;
+ *) # non-zero is non-fun
+ log_f "Failed to obtain certificate ${CERT} for domains '${CERT_DOMAINS[*]}'"
+ redis-cli -h redis SET ACME_FAIL_TIME "$(date +%s)"
+ exit 100${SUCCESS}
+ ;;
+esac
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/reload-configurations.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/reload-configurations.sh
new file mode 100644
index 0000000..d5461a4
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/reload-configurations.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Reading container IDs
+# Wrapping as array to ensure trimmed content when calling $NGINX etc.
+NGINX=($(curl --silent --insecure https://dockerapi/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"nginx-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
+DOVECOT=($(curl --silent --insecure https://dockerapi/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"dovecot-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
+POSTFIX=($(curl --silent --insecure https://dockerapi/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"postfix-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
+
+reload_nginx(){
+ echo "Reloading Nginx..."
+ NGINX_RELOAD_RET=$(curl -X POST --insecure https://dockerapi/containers/${NGINX}/exec -d '{"cmd":"reload", "task":"nginx"}' --silent -H 'Content-type: application/json' | jq -r .type)
+ [[ ${NGINX_RELOAD_RET} != 'success' ]] && { echo "Could not reload Nginx, restarting container..."; restart_container ${NGINX} ; }
+}
+
+reload_dovecot(){
+ echo "Reloading Dovecot..."
+ DOVECOT_RELOAD_RET=$(curl -X POST --insecure https://dockerapi/containers/${DOVECOT}/exec -d '{"cmd":"reload", "task":"dovecot"}' --silent -H 'Content-type: application/json' | jq -r .type)
+ [[ ${DOVECOT_RELOAD_RET} != 'success' ]] && { echo "Could not reload Dovecot, restarting container..."; restart_container ${DOVECOT} ; }
+}
+
+reload_postfix(){
+ echo "Reloading Postfix..."
+ POSTFIX_RELOAD_RET=$(curl -X POST --insecure https://dockerapi/containers/${POSTFIX}/exec -d '{"cmd":"reload", "task":"postfix"}' --silent -H 'Content-type: application/json' | jq -r .type)
+ [[ ${POSTFIX_RELOAD_RET} != 'success' ]] && { echo "Could not reload Postfix, restarting container..."; restart_container ${POSTFIX} ; }
+}
+
+restart_container(){
+ for container in $*; do
+ echo "Restarting ${container}..."
+ C_REST_OUT=$(curl -X POST --insecure https://dockerapi/containers/${container}/restart --silent | jq -r '.msg')
+ echo "${C_REST_OUT}"
+ done
+}
+
+if [[ "${CERT_AMOUNT_CHANGED}" == "1" ]]; then
+ restart_container ${NGINX}
+ restart_container ${DOVECOT}
+ restart_container ${POSTFIX}
+else
+ reload_nginx
+ #reload_dovecot
+ restart_container ${DOVECOT}
+ #reload_postfix
+ restart_container ${POSTFIX}
+fi