enable starttls and generate self-signed certificate

.woodpecker.yml

@@ -13,49 +13,6 @@ steps:
       dockerfile: Dockerfile
     when:
       - event: [push, tag]
-
-  scan_image:
-    image: aquasec/trivy
-    commands:
-      - env TRIVY_DISABLE_VEX_NOTICE=1 trivy image $FORGE_NAME/$CI_REPO:$CI_COMMIT_SHA --quiet --exit-code 1
-    when:
-      - event: [push, tag]
-
-  generate_sbom:
-    image: quay.io/wollud1969/woodpecker-helper:0.5.1
-    environment:
-      TRIVY_TOKEN:
-        from_secret: trivy_token
-      TRIVY_URL:
-        from_secret: trivy_url
-      DTRACK_API_KEY:
-        from_secret: dtrack_api_key
-      DTRACK_API_URL:
-        from_secret: dtrack_api_url
-    commands:
-      - HOME=/home/`id -nu`
-      - TAG="${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
-      - |
-        trivy image \
-              --server $TRIVY_URL \
-              --token $TRIVY_TOKEN \
-              --format cyclonedx \
-              --scanners license \
-              --output /tmp/sbom.xml \
-              $FORGE_NAME/$CI_REPO:$CI_COMMIT_SHA
-      - cat /tmp/sbom.xml
-      - |
-        curl -X "POST" \
-             -H "Content-Type: multipart/form-data" \
-             -H "X-Api-Key: $DTRACK_API_KEY" \
-             -F "autoCreate=true" \
-             -F "projectName=$CI_REPO" \
-             -F "projectVersion=$TAG" \
-             -F "bom=@/tmp/sbom.xml"\
-             "$DTRACK_API_URL/api/v1/bom"
-    when:
-      - event: [push, tag]
-
   build:
     image: plugins/kaniko
     settings:

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.21.3
+FROM alpine:3.21.0
 
 LABEL Maintainer="Wolfgang Hottgenroth <woho@hottis.de>"
 LABEL ImageName="quay.io/wollud1969/exim-docker"
@@ -11,11 +11,8 @@ ENV SMARTHOST_USER=""
 ENV SMARTHOST_PASS=""
 # ip addresses or networks to allow for relaying, separate multiple ones by semicolon
 ENV RELAYNETS="127.0.0.1/32"
-# whitelist of recipient domains, colon-separated, if empty all no restrictions
-ENV WHITELISTED_RECIPIENTS=""
 
-
-RUN apk add --no-cache exim m4
+RUN apk add --no-cache exim m4 openssl
 
 COPY exim.conf.m4 /etc/exim
 COPY start.sh /etc/exim

examples/deploy.sh

@@ -8,7 +8,7 @@ kubectl create secret generic smtp-secrets \
   --from-literal=SMARTHOST="smtprelaypool.ispgateway.de" \
   --from-literal=SMARTHOST_USER="pseudosmarthostuser@hottis.de" \
   --from-literal=SMARTHOST_PASS="$SMARTHOST_PASSWORD" \
-  --from-literal=RELAY_NETWORKS=":10.0.0.0/8" | \
+  --from-literal=RELAYNETS=":10.0.0.0/8" | \
 kubectl apply -n system -f -
 
 kubectl apply -n system -f deploy.yml

examples/deploy.yml

@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: smtp
-  namespace: system
   labels:
     app: smtp
   annotations:
@@ -19,7 +18,7 @@ spec:
     spec:
       containers:
         - name: smtp
-          image: quay.io/wollud1969/exim-docker:0.3.2
+          image: quay.io/wollud1969/exim-docker:0.2.2
           envFrom:
             - secretRef:
                 name: smtp-secrets
@@ -31,7 +30,6 @@ apiVersion: v1
 kind: Service
 metadata:
   name: smtp
-  namespace: system
 spec:
   type: ClusterIP
   selector:

exim.conf.m4

@@ -5,8 +5,6 @@ define(`SMARTHOST', esyscmd(`echo -n $SMARTHOST'))dnl
 define(`SMARTHOST_USER', esyscmd(`echo -n $SMARTHOST_USER'))dnl
 define(`SMARTHOST_PASS', esyscmd(`echo -n $SMARTHOST_PASS'))dnl
 define(`RELAYNETS', esyscmd(`echo -n $RELAYNETS'))dnl
-define(`WHITELISTED_RECIPIENTS', esyscmd(`echo -n $WHITELISTED_RECIPIENTS'))dnl
-
 
 ifelse(SMARTHOST, `', `
 errprint(`Error: SMARTHOST not set')
@@ -18,15 +16,14 @@ errprint(`Error: HOSTNAME not set')
 m4exit(1)
 ')
 
-
-dnl ----------------------------------------------------------------
 dnl template for exim.conf
 
 primary_hostname = HOSTNAME
 
 acl_smtp_rcpt = acl_check_rcpt
 
-tls_advertise_hosts =
+tls_certificate = /etc/exim/tls.crt
+tls_privatekey = /etc/exim/tls.key
 
 begin routers
 smarthost_route:
@@ -61,11 +58,8 @@ begin acl
 acl_check_rcpt:
   accept
     hosts = RELAYNETS
-ifelse(WHITELISTED_RECIPIENTS, `', `', `
-    domains = WHITELISTED_RECIPIENTS
-')
   deny
-    message = "550 5.7.1 Relaying denied"
+    message = "Relaying denied"
 
 ifelse(LOCALMAILNAME, `', `', `
 begin rewrite

readme.md

@@ -12,7 +12,6 @@ Four environment variables are used to configure the container:
 * `SMARTHOST_PASS`: Password for smarthost.
 * `LOCALMAILNAME`: The domain name which shall be used as the domain part of the sender address in every outgoing mail. If not required, skip it.
 * `RELAYNETS`: Networks exim in this container accepts for relaying. Separate multiple networks by semicolon.
-* `WHITELISTED_RECIPIENT`: Colon-separated list of whitelisted recipient domains, if empty no recipient restrictions will be applied
 
 
 ## Deployment
@@ -25,7 +24,7 @@ Typically, don't expose the smtp port of this container to the default network o
 ```
 #!/bin/bash
 
-IMAGE=quay.io/wollud1969/exim-docker:0.3.2
+IMAGE=quay.io/wollud1969/exim-docker:0.2.2
 MAILER_NETWORK=mailer-network
 
 docker network create $MAILER_NETWORK || echo "mailer-network already exists"
@@ -39,7 +38,6 @@ docker run \
   -e SMARTHOST=smarthost.example.com \
   -e LOCALMAILNAME=krohne.com \
   -e RELAYNETS=$RELAYNETS \
-  -e WHITELISTED_RECIPIENT="example-recipients.com" \
   --network $MAILER_NETWORK \
   --name mailer \
   --restart always \
@@ -56,4 +54,3 @@ docker network connect mailer-network name_of_other_container
 
 Now you can use the name of the mailer container, here `mailer` as smarthost name in that other container.
 
-

start.sh

@@ -1,4 +1,9 @@
 #!/bin/sh
 
-m4 exim.conf.m4 > exim.conf && exim -bd -q15m -v
+openssl genpkey -algorithm RSA -out tls.key && \
+openssl req -new -key tls.key -out tls.csr -subj "/C=DE/CN=$HOSTNAME" && \
+openssl x509 -req -in tls.csr -signkey tls.key -out tls.crt -days 3650 && \
+chown exim tls.key tls.crt && \
+m4 exim.conf.m4 > exim.conf && \
+exim -bd -q15m -v
 

tools/smtp-dialog.exp

@@ -1,64 +0,0 @@
-#!/usr/bin/expect
-
-package require base64
-
-
-# SMTP-Server und Port definieren
-set smtp_server "localhost"
-set smtp_port "25"
-set timeout 25
-
-# Absender, Empfänger und Nachricht
-set sender $env(SMTP_SENDER)
-set recipient "test@hottis.de"
-set message "Subject: Test Email\r\n\r\nThis is a test email sent via an expect script."
-
-set smtp_user $env(SMTP_USER)
-set smtp_pass $env(SMTP_PASS) 
-
-set smtp_user_64 [base64::encode $smtp_user]
-set smtp_pass_64 [base64::encode $smtp_pass]
-
-
-# Verbindung herstellen
-spawn nc -C $smtp_server $smtp_port
-
-# Begrüßung vom Server erwarten
-expect "220 *"
-
-# HELO/EHLO senden
-send "EHLO de01rdsi01.krohnegroup.com\n"
-expect "250 *"
-
-send "AUTH LOGIN\n"
-expect "334 VXNlcm5hbWU6"
-
-send "$smtp_user_64\n"
-expect "334 UGFzc3dvcmQ6"
-
-send "$smtp_pass_64\n"
-expect "235 2.7.0 Authentication successful"
-
-# Absender definieren
-send "MAIL FROM:<$sender>\n"
-expect "250 *"
-
-# Empfänger definieren
-send "RCPT TO:<$recipient>\n"
-expect "250 *"
-
-# Datenübertragung starten
-send "DATA\n"
-expect "354 *"
-
-# Nachricht senden und Übertragung abschließen
-send "$message\n.\n"
-expect "250 *"
-
-# Verbindung schließen
-send "QUIT\n"
-expect "221 *"
-
-# Beenden
-interact
-