Fix catchall resolution.

It has to be performed last, to give a chance to be accepted as a
regular mailbox.

We introduce a new, dedicated, smtpd daemon whose only purpose is to
resolve catch-alls.

9 files changed, 76 insertions, 14 deletions

diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2
index d301aaf..c0da5e7 100644
--- a/roles/MX/templates/etc/postfix/main.cf.j2
+++ b/roles/MX/templates/etc/postfix/main.cf.j2
@@ -19,7 +19,7 @@ append_dot_mydomain = no
 
 # Turn off all TCP/IP listener ports except that necessary for the mail
 # exchange.
-master_service_disable = !smtp.inet inet
+master_service_disable = !smtp.inet !127.0.0.1:2599.inet inet
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
@@ -52,24 +52,23 @@ relay_domains =
 
 # Virtual transport
 {% if 'LDA' in group_names %}
-virtual_transport = smtp:[127.0.0.1]:{{ LDA.port }}
+virtual_transport = smtpl:[127.0.0.1]:{{ LDA.port }}
 {% else %}
-virtual_transport = smtp:[{{ LDA.IPv4 }}]:{{ LDA.port }}
+virtual_transport = smtps:[{{ LDA.host }}]:{{ LDA.port }}
 {% endif %}
-transport_maps = ldap:$config_directory/virtual/transport_lists_maps.cf
+# It's a bit stupid to include part of the virtual_mailbox_maps here,
+# but we need to tell postfix to accept the recipient
+# (virtual_mailbox_maps) *before* sending away to the right machine
+# (transport_maps)
+transport_maps = pcre:$config_directory/virtual/transport_reserved_maps.pcre
+                 ldap:$config_directory/virtual/transport_mailbox_maps.cf
+                 ldap:$config_directory/virtual/transport_lists_maps.cf
+                 ldap:$config_directory/virtual/transport_catchall_maps.cf
 
 virtual_mailbox_domains = ldap:$config_directory/virtual/mailbox_domains.cf
-virtual_alias_maps      = pcre:$config_directory/virtual/reserved_maps.pcre
+virtual_alias_maps      = cdb:$config_directory/virtual/reserved_alias_maps
                           ldap:$config_directory/virtual/alias_maps.cf
-                          ldap:$config_directory/virtual/alias_catchall_maps.cf
-virtual_mailbox_maps    = ldap:$config_directory/virtual/mailbox_maps.cf
-                          # it's a bit stupid to lookup for lists here
-                          # and in transport, but we need to tell
-                          # postfix to accept the recipient
-                          # (virtual_mailbox_maps) *before* sending away
-                          # to the list server (transport_maps)
-                          ldap:$config_directory/virtual/transport_lists_maps.cf
-mailbox_transport_maps  = cdb:$config_directory/virtual/reserved_transport_maps
+virtual_mailbox_maps    = $transport_maps
 
 # Don't rewrite remote headers
 local_header_rewrite_clients     =
diff --git a/roles/MX/templates/etc/postfix/virtual/alias_maps.cf.j2 b/roles/MX/templates/etc/postfix/virtual/alias_maps.cf.j2
new file mode 100644
index 0000000..8e3a778
--- /dev/null
+++ b/roles/MX/templates/etc/postfix/virtual/alias_maps.cf.j2
@@ -0,0 +1,6 @@
+server_host      = ldapi://%2Fprivate%2Fldapi/
+version          = 3
+search_base      = fvl=%u,fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
+scope            = base
+query_filter     = (&(objectClass=FripostVirtualAlias)(fvl=%u))
+result_attribute = fripostMaildrop
diff --git a/roles/MX/templates/etc/postfix/virtual/catchall_maps.cf.j2 b/roles/MX/templates/etc/postfix/virtual/catchall_maps.cf.j2
new file mode 100644
index 0000000..f8324f6
--- /dev/null
+++ b/roles/MX/templates/etc/postfix/virtual/catchall_maps.cf.j2
@@ -0,0 +1,7 @@
+server_host      = ldapi://%2Fprivate%2Fldapi/
+version          = 3
+search_base      = fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
+scope            = base
+bind             = none
+query_filter     = (&(objectClass=FripostVirtualDomain)(fvd=%d)(fripostOptionalMaildrop=*))
+result_attribute = fripostOptionalMaildrop
diff --git a/roles/MX/templates/etc/postfix/virtual/mailbox_domains.cf.j2 b/roles/MX/templates/etc/postfix/virtual/mailbox_domains.cf.j2
new file mode 100644
index 0000000..74304a4
--- /dev/null
+++ b/roles/MX/templates/etc/postfix/virtual/mailbox_domains.cf.j2
@@ -0,0 +1,8 @@
+server_host      = ldapi://%2Fprivate%2Fldapi/
+version          = 3
+search_base      = fvd=%s,ou=virtual,o=mailHosting,dc=fripost,dc=org
+scope            = base
+bind             = none
+query_filter     = (&(objectClass=FripostVirtualDomain)(fvd=%s))
+result_attribute = fvd
+result_format    = OK
diff --git a/roles/MX/templates/etc/postfix/virtual/reserved_alias_maps.j2 b/roles/MX/templates/etc/postfix/virtual/reserved_alias_maps.j2
new file mode 100644
index 0000000..fe04715
--- /dev/null
+++ b/roles/MX/templates/etc/postfix/virtual/reserved_alias_maps.j2
@@ -0,0 +1,4 @@
+# RFC 822 section 6.3 and RFC 2142 section 4 mandatory aliases are
+# forwarded to the admin team.
+postmaster@fripost.org  admin@fripost.org
+abuse@fripost.org       admin@fripost.org
diff --git a/roles/MX/templates/etc/postfix/virtual/transport_catchall_maps.cf.j2 b/roles/MX/templates/etc/postfix/virtual/transport_catchall_maps.cf.j2
new file mode 100644
index 0000000..cc189cf
--- /dev/null
+++ b/roles/MX/templates/etc/postfix/virtual/transport_catchall_maps.cf.j2
@@ -0,0 +1,8 @@
+server_host      = ldapi://%2Fprivate%2Fldapi/
+version          = 3
+search_base      = fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
+scope            = base
+bind             = none
+query_filter     = (&(objectClass=FripostVirtualDomain)(fvd=%d)(fripostOptionalMaildrop=*))
+result_attribute = fvd
+result_format    = smtpl:[127.0.0.1]:2599
diff --git a/roles/MX/templates/etc/postfix/virtual/transport_lists_maps.cf.j2 b/roles/MX/templates/etc/postfix/virtual/transport_lists_maps.cf.j2
new file mode 100644
index 0000000..6a0965f
--- /dev/null
+++ b/roles/MX/templates/etc/postfix/virtual/transport_lists_maps.cf.j2
@@ -0,0 +1,12 @@
+server_host      = ldapi://%2Fprivate%2Fldapi/
+version          = 3
+search_base      = fvl=%u,fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
+scope            = base
+bind             = none
+query_filter     = (&(|(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand))(fvl=%u))
+result_attribute = fvl
+{% if 'lists' in group_names %}
+result_format    = smtpl:[127.0.0.1]:{{ lists.port }}
+{% else %}
+result_format    = smtps:[{{ lists.host }}]:{{ lists.port }}
+{% endif %}
diff --git a/roles/MX/templates/etc/postfix/virtual/transport_mailbox_maps.cf.j2 b/roles/MX/templates/etc/postfix/virtual/transport_mailbox_maps.cf.j2
new file mode 100644
index 0000000..3e003db
--- /dev/null
+++ b/roles/MX/templates/etc/postfix/virtual/transport_mailbox_maps.cf.j2
@@ -0,0 +1,12 @@
+server_host      = ldapi://%2Fprivate%2Fldapi/
+version          = 3
+search_base      = fvl=%u,fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
+scope            = base
+bind             = none
+query_filter     = (&(objectClass=FripostVirtualUser)(fvl=%u))
+result_attribute = fvl
+{% if 'LDA' in group_names %}
+result_format    = smtpl:[127.0.0.1]:{{ LDA.port }}
+{% else %}
+result_format    = smtps:[{{ LDA.host }}]:{{ LDA.port }}
+{% endif %}
diff --git a/roles/MX/templates/etc/postfix/virtual/transport_reserved_maps.pcre.j2 b/roles/MX/templates/etc/postfix/virtual/transport_reserved_maps.pcre.j2
new file mode 100644
index 0000000..e240e91
--- /dev/null
+++ b/roles/MX/templates/etc/postfix/virtual/transport_reserved_maps.pcre.j2
@@ -0,0 +1,6 @@
+if !/@fripost\.org$/
+# For other domains, RFC 822 section 6.3 and RFC 2142 section 4
+# mandatory aliases are forwarded to OUR admin team and to the domain
+# owner or postmaster, if there are any.
+/^(?:postmaster|abuse)(?:\+.*)?@/   reserved-alias:
+endif