add sbom stuff

.gitignore

@@ -1,2 +1,5 @@
 *~
 .*~
+ENV
+ENV.test
+tmp/

.woodpecker.yml

@@ -13,6 +13,49 @@ steps:
       dockerfile: Dockerfile
     when:
       - event: [push, tag]
+
+  scan_image:
+    image: aquasec/trivy
+    commands:
+      - trivy image $FORGE_NAME/$CI_REPO:$CI_COMMIT_SHA --quiet --exit-code 1
+    when:
+      - event: [push, tag]
+
+  generate_sbom:
+    image: quay.io/wollud1969/woodpecker-helper:0.5.1
+    environment:
+      TRIVY_TOKEN:
+        from_secret: trivy_token
+      TRIVY_URL:
+        from_secret: trivy_url
+      DTRACK_API_KEY:
+        from_secret: dtrack_api_key
+      DTRACK_API_URL:
+        from_secret: dtrack_api_url
+    commands:
+      - HOME=/home/`id -nu`
+      - TAG="${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
+      - |
+        trivy image \
+              --server $TRIVY_URL \
+              --token $TRIVY_TOKEN \
+              --format cyclonedx \
+              --scanners license \
+              --output /tmp/sbom.xml \
+              $FORGE_NAME/$CI_REPO:$CI_COMMIT_SHA
+      - cat /tmp/sbom.xml
+      - |
+        curl -X "POST" \
+             -H "Content-Type: multipart/form-data" \
+             -H "X-Api-Key: $DTRACK_API_KEY" \
+             -F "autoCreate=true" \
+             -F "projectName=$CI_REPO" \
+             -F "projectVersion=$TAG" \
+             -F "bom=@/tmp/sbom.xml"\
+             "$DTRACK_API_URL/api/v1/bom"
+    when:
+      - event: [push, tag]
+
   build:
     image: plugins/kaniko
     settings:

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.21.0
+FROM alpine:3.21.3
 
 LABEL Maintainer="Wolfgang Hottgenroth <woho@hottis.de>"
 LABEL ImageName="quay.io/wollud1969/exim-docker"

ENV

@@ -1,9 +0,0 @@
-export HOSTNAME=`hostname`
-export LOCALMAILNAME="hottis.de"
-#export LOCALMAILNAME=""
-export SMARTHOST=smtprelaypool.ispgateway.de
-#export SMARTHOST=""
-export SMARTHOST_USER=pseudosmarthostuser@hottis.de 
-#export SMARTHOST_USER="_"
-export SMARTHOST_PASS="Chaediek3Chaer7u" 
-export RELAYNETS="0.0.0.0/0"

examples/deploy.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+
+kubectl create secret generic smtp-secrets \
+  --dry-run=client \
+  -o yaml \
+  --save-config \
+  --from-literal=SMARTHOST="smtprelaypool.ispgateway.de" \
+  --from-literal=SMARTHOST_USER="pseudosmarthostuser@hottis.de" \
+  --from-literal=SMARTHOST_PASS="$SMARTHOST_PASSWORD" \
+  --from-literal=RELAY_NETWORKS=":10.0.0.0/8" | \
+kubectl apply -n system -f -
+
+kubectl apply -n system -f deploy.yml
+
+

examples/deploy.yml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: smtp
+  labels:
+    app: smtp
+  annotations:
+    secret.reloader.stakater.com/reload: smtp-secrets
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: smtp
+  template:
+    metadata:
+      labels:
+        app: smtp
+    spec:
+      containers:
+        - name: smtp
+          image: quay.io/wollud1969/exim-docker:0.2.1
+          envFrom:
+            - secretRef:
+                name: smtp-secrets
+          ports:
+            - containerPort: 25
+              protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: smtp
+spec:
+  type: ClusterIP
+  selector:
+    app: smtp
+  ports:
+    - name: smtp
+      protocol: TCP
+      port: 25
+      targetPort: 25
+

exim.conf.m4

@@ -5,6 +5,8 @@ define(`SMARTHOST', esyscmd(`echo -n $SMARTHOST'))dnl
 define(`SMARTHOST_USER', esyscmd(`echo -n $SMARTHOST_USER'))dnl
 define(`SMARTHOST_PASS', esyscmd(`echo -n $SMARTHOST_PASS'))dnl
 define(`RELAYNETS', esyscmd(`echo -n $RELAYNETS'))dnl
+define(`WHITELISTED_RECIPIENTS', esyscmd(`echo -n $WHITELISTED_RECIPIENTS'))dnl
+
 
 ifelse(SMARTHOST, `', `
 errprint(`Error: SMARTHOST not set')
@@ -16,12 +18,16 @@ errprint(`Error: HOSTNAME not set')
 m4exit(1)
 ')
 
+
+dnl ----------------------------------------------------------------
 dnl template for exim.conf
 
 primary_hostname = HOSTNAME
 
 acl_smtp_rcpt = acl_check_rcpt
 
+tls_advertise_hosts =
+
 begin routers
 smarthost_route:
   driver = manualroute
@@ -55,8 +61,12 @@ begin acl
 acl_check_rcpt:
   accept
     hosts = RELAYNETS
+ifelse(WHITELISTED_RECIPIENTS, `', `', `
+  accept
+    domains = WHITELISTED_RECIPIENTS
+')
   deny
-    message = "Relaying denied"
+    message = "550 5.7.1 Relaying denied"
 
 ifelse(LOCALMAILNAME, `', `', `
 begin rewrite

readme.md

@@ -8,9 +8,10 @@ option to send mail from other containers without the need to configure the smar
 Four environment variables are used to configure the container:
 
 * `SMARTHOST`: The is the name of the smarthost. exim within this container will send all mail to this smarthost for further delivery. Make sure the smarthost accepts mail from this container without authentication.
-* `LOCALMAILNAME`: The domain name which shall be used as the domain part of the sender address in every outgoing mail.
+* `SMARTHOST_USER`: Login for smarthost. If no authentication is required, skip it.
+* `SMARTHOST_PASS`: Password for smarthost.
+* `LOCALMAILNAME`: The domain name which shall be used as the domain part of the sender address in every outgoing mail. If not required, skip it.
 * `RELAYNETS`: Networks exim in this container accepts for relaying. Separate multiple networks by semicolon.
-* `ROOT`: Addresses to forward root mail to. Separate multiple addresses by space.
 
 
 ## Deployment
@@ -23,7 +24,7 @@ Typically, don't expose the smtp port of this container to the default network o
 ```
 #!/bin/bash
 
-IMAGE=quay.io/wollud1969/exim-docker:0.0.9
+IMAGE=quay.io/wollud1969/exim-docker:0.2.2
 MAILER_NETWORK=mailer-network
 
 docker network create $MAILER_NETWORK || echo "mailer-network already exists"
@@ -37,7 +38,6 @@ docker run \
   -e SMARTHOST=smarthost.example.com \
   -e LOCALMAILNAME=krohne.com \
   -e RELAYNETS=$RELAYNETS \
-  -e ROOT=root@example.com \
   --network $MAILER_NETWORK \
   --name mailer \
   --restart always \
@@ -54,3 +54,4 @@ docker network connect mailer-network name_of_other_container
 
 Now you can use the name of the mailer container, here `mailer` as smarthost name in that other container.
 
+