AlmaLinux 10でメールサーバーを自動構築する非公式スタートアップスクリプトを作成してみた

#!/bin/bash
set -x
. /etc/os-release
D="@@@DOMAIN@@@";A="@@@ADMIN_NAME@@@";AP="@@@ADMIN_PASSWORD@@@";DP="@@@DATABASE_PASSWORD@@@";AE="$A@$D"
hostnamectl set-hostname "$D"
if [ ! -f /swapfile ];then dd if=/dev/zero of=/swapfile bs=1M count=4096;chmod 600 /swapfile;mkswap /swapfile;fi
grep -qE '^[^#][[:space:]]*/swapfile[[:space:]]' /etc/fstab||echo '/swapfile none swap sw 0 0'>>/etc/fstab
grep -q '^/swapfile[[:space:]]' /proc/swaps||swapon /swapfile
r(){ for i in 1 2 3 4 5;do dnf clean all;eval "$*"&&return;sleep 3;done;echo "Command failed five times. So exit.";exit 1;}
r 'dnf -y update'
r 'dnf -y install dovecot dovecot-mysql postfix postfix-mysql mariadb-server httpd mod_ssl'
dnf -y install "https://rpms.remirepo.net/enterprise/remi-release-${VERSION_ID%.*}.rpm"
r 'dnf -y install epel-release'
r 'dnf -y install php85-php php85-php-mbstring php85-php-imap php85-php-mysql php85-php-pecl-zip snapd git'
ln -sf php85 /usr/bin/php
systemctl enable --now firewalld.service
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-port={80,443}/tcp
firewall-cmd --permanent --add-port={25,110,143,465,587,993,995}/tcp
firewall-cmd --reload
systemctl enable --now snapd.socket||exit 1
ln -sf /var/lib/snapd/snap /snap
for i in 1 2 3 4 5;do sleep 5;snap install core&&break;[ "$i" = 5 ]&&exit 1;done
snap refresh core;snap install certbot --classic||exit 1
ln -sf /snap/bin/certbot /usr/bin/certbot||exit 1
certbot -n certonly --standalone --agree-tos -d "$D" -m "$AE" --server https://acme-v02.api.letsencrypt.org/directory||exit 1
LD=/etc/letsencrypt/live/$D;CERT=$LD/fullchain.pem;PKEY=$LD/privkey.pem;CHAIN=$LD/chain.pem;PRE=/etc/letsencrypt/renewal-hooks/pre/stop.sh;POST=/etc/letsencrypt/renewal-hooks/post/reload.sh
[ -f "$CERT" ]||{ echo "証明書の取得に失敗しました";exit 1;}
snap start --enable certbot.renew||exit 1
sed -i -e "/^server/a pre_hook = $PRE" -e "/^pre_hook/a post_hook = $POST" /etc/letsencrypt/renewal/$D.conf
echo -e '#!/bin/bash\nsystemctl stop httpd'>"$PRE";chmod +x "$PRE"
echo -e '#!/bin/bash\nsystemctl reload postfix dovecot\nsystemctl start httpd'>"$POST";chmod +x "$POST"
cd /srv/;git clone https://github.com/postfixadmin/postfixadmin.git;cd postfixadmin;git checkout $(git tag -l|sort -V|grep -iv 'push\|rc\|beta'|tail -1)
export HOME=/root COMPOSER_HOME=/root/.composer;mkdir -p /root/.composer;/bin/bash install.sh
systemctl enable --now mariadb.service
mysqladmin -u root password "$DP"
cat >/root/.my.cnf <<EOF2
[client]
host=localhost
user=root
password=$DP
socket=/var/lib/mysql/mysql.sock
EOF2
chmod 600 /root/.my.cnf
mysql --defaults-file=/root/.my.cnf <<EOF2
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost','127.0.0.1','::1');
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\_%';
CREATE DATABASE IF NOT EXISTS postfix;
CREATE USER 'postfix'@'localhost' IDENTIFIED BY '$DP';
GRANT ALL PRIVILEGES ON postfix.* TO 'postfix'@'localhost';
FLUSH PRIVILEGES;
EOF2
SP=$(php -r "echo password_hash(\"$AP\",PASSWORD_DEFAULT);")
cat >/srv/postfixadmin/config.local.php <<EOF2
<?php
\$CONF['configured']=true;
\$CONF['default_language']='ja';
\$CONF['database_type']='mysql';
\$CONF['database_user']='postfix';
\$CONF['database_password']='$DP';
\$CONF['database_name']='postfix';
\$CONF['setup_password']='$SP';
\$CONF['domain_path']='YES';
\$CONF['domain_in_mailbox']='NO';
\$CONF['encrypt']='php_crypt:MD5';
\$CONF['footer_link']='https://$D/postfixadmin/';
\$CONF['footer_text']='Return to $D/postfixadmin/';
?>
EOF2
mkdir -p /srv/postfixadmin/templates_c;chown -R apache /srv/postfixadmin/templates_c
cat >/etc/httpd/conf.d/postfixadmin.conf <<EOF2
Alias /postfixadmin "/srv/postfixadmin/public"
<Directory "/srv/postfixadmin/public">
DirectoryIndex index.html index.php
AllowOverride All
Options FollowSymlinks
Require all granted
</Directory>
EOF2
sed -ie "s|^[#\s]*SSLCertificateFile.*$|SSLCertificateFile $CERT|;s|^[#\s]*SSLCertificateKeyFile.*$|SSLCertificateKeyFile $PKEY|;s|^[#\s]*SSLCertificateChainFile.*$|SSLCertificateChainFile $CHAIN|;s|^[#\s]*SSLProtocol.*$|SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1|" /etc/httpd/conf.d/ssl.conf
sed -i 's/Options Indexes FollowSymLinks/Options FollowSymLinks/' /etc/httpd/conf/httpd.conf
sed -i 's/Options -Indexes/#Options -Indexes/;s|ErrorDocument 403 /.noindex.html|#ErrorDocument 403 /.noindex.html|' /etc/httpd/conf.d/welcome.conf
echo 'ServerTokens ProductOnly'>>/etc/httpd/conf/httpd.conf;echo 'ServerSignature Off'>>/etc/httpd/conf/httpd.conf
cat >/etc/httpd/conf.d/rewrite.conf <<'EOF2'
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
</IfModule>
EOF2
systemctl enable --now httpd.service
curl -s -o /dev/null -X POST -d "setup_password=$AP" -d "submit=setuppw" -L -k "https://$D/postfixadmin/setup.php"
PA=/srv/postfixadmin/scripts/postfixadmin-cli
$PA admin add "$AE" --superadmin 1 --active 1 --password "$AP" --password2 "$AP"
$PA domain add "$D";$PA domain update "$D" --mailboxes 0;$PA mailbox add "$AE" --password "$AP" --password2 "$AP"
$PA alias add root@$D --goto "$AE"
for a in abuse hostmaster postmaster webmaster;do $PA alias update $a@$D --goto "$AE";done
postconf -e smtpd_banner='$myhostname ESMTP' smtp_header_checks=regexp:/etc/postfix/smtp_header_checks mime_header_checks=regexp:/etc/postfix/mime_header_checks disable_vrfy_command=yes smtpd_helo_required=yes inet_interfaces=all myhostname=$D mydestination='localhost.$mydomain, localhost' relay_domains='$mydestination' virtual_alias_maps=proxy:mysql:/etc/postfix/virtual_alias_maps.cf virtual_mailbox_domains=proxy:mysql:/etc/postfix/virtual_mailbox_domains.cf virtual_mailbox_maps=proxy:mysql:/etc/postfix/virtual_mailbox_maps.cf virtual_mailbox_base=/home/vmail virtual_mailbox_limit=512000000 message_size_limit=20480000 virtual_minimum_uid=10000 virtual_transport=virtual virtual_uid_maps=static:10000 virtual_gid_maps=static:10000 local_transport=virtual local_recipient_maps='$virtual_mailbox_maps' smtpd_sasl_auth_enable=yes smtpd_sasl_type=dovecot smtpd_sasl_path=/var/run/dovecot/auth-client smtpd_recipient_restrictions='permit_auth_destination, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination' smtpd_client_restrictions='permit_mynetworks, reject_unknown_client, permit' smtpd_sender_restrictions='reject_unknown_sender_domain, reject_non_fqdn_sender' smtpd_relay_restrictions='permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination' smtpd_sasl_security_options=noanonymous smtpd_sasl_tls_security_options='$smtpd_sasl_security_options' smtpd_tls_security_level=may smtpd_tls_auth_only=yes smtpd_tls_received_header=yes smtpd_tls_cert_file=$CERT smtpd_tls_key_file=$PKEY smtpd_tls_CAfile=/etc/pki/tls/certs/ca-bundle.crt smtpd_tls_mandatory_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1' smtpd_tls_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1' smtpd_tls_ask_ccert=yes smtpd_tls_mandatory_ciphers=high smtpd_use_tls=yes smtpd_sasl_local_domain='$mydomain' broken_sasl_auth_clients=yes smtpd_tls_loglevel=1 smtp_tls_security_level=may smtp_tls_loglevel=1 smtp_tls_mandatory_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1' smtp_tls_protocols='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
echo '# smtpd_client_restrictions=permit_mynetworks, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, permit'>>/etc/postfix/main.cf
sed -i 's/^#\(submission.*smtpd$\)/\1/g;s/^#\(smtps.*smtpd$\)/\1 \n -o smtpd_tls_wrappermode=yes\n -o smtpd_sasl_auth_enable=yes/g' /etc/postfix/master.cf
cat >/etc/postfix/smtp_header_checks <<'EOF2'
/^Received: .*/ IGNORE
/^User-Agent: .*/ IGNORE
EOF2
cat >/etc/postfix/mime_header_checks <<'EOF2'
/^Mime-Version:/ IGNORE
EOF2
for f in virtual_alias_maps:alias:goto:address virtual_mailbox_domains:domain:domain:domain virtual_mailbox_maps:mailbox:maildir:username;do IFS=: read n t s w<<<$f;cat >/etc/postfix/$n.cf <<EOF2
user = postfix
password = $DP
hosts = localhost
dbname = postfix
table = $t
select_field = $s
where_field = $w
EOF2
done
systemctl enable --now postfix.service;systemctl restart postfix.service
groupadd -g 10000 vmail;useradd -u 10000 -g vmail -s /usr/bin/nologin -d /home/vmail -m vmail
mkdir -p /home/vmail/$D/$A/{cur,new,tmp};chown -R vmail. /home/vmail/
sed -i 's/.*!include conf.d\/\*.conf/#&/g' /etc/dovecot/dovecot.conf
cat >>/etc/dovecot/dovecot.conf <<EOF2
protocols = imap pop3
auth_mechanisms = plain
passdb {
    driver = sql
    args = /etc/dovecot/dovecot-sql.conf
}
userdb {
    driver = sql
    args = /etc/dovecot/dovecot-sql.conf
}
service auth {
    unix_listener auth-client {
        group = postfix
        mode = 0660
        user = postfix
    }
    user = root
}
mail_home = /home/vmail/%d/%n
mail_location = maildir:~
ssl = yes
ssl_cert = <$CERT
ssl_key = <$PKEY
ssl_min_protocol = TLSv1.2
service stats {
    unix_listener stats-writer {
        mode = 0666
    }
}

EOF2
cat >/etc/dovecot/dovecot-sql.conf <<EOF2
driver = mysql
connect = host=localhost dbname=postfix user=postfix password=$DP
default_pass_scheme = MD5-CRYPT
user_query = SELECT '/home/vmail/%d/%n' as home, 'maildir:/home/vmail/%d/%n' as mail, 10000 AS uid, 10000 AS gid, concat('dirsize:storage=', quota) AS quota FROM mailbox WHERE username = '%u' AND active = '1'
password_query = SELECT username as user, password, '/home/vmail/%d/%n' as userdb_home, 'maildir:/home/vmail/%d/%n' as userdb_mail, 10000 as userdb_uid, 10000 as userdb_gid FROM mailbox WHERE username = '%u' AND active = '1'
EOF2
systemctl enable --now dovecot.service
reboot