install_and_configure_postfix_opendkim_and_postsrs_on_alpine.sh

#!/bin/sh

# ABOUT THIS SCRIPT
# This script automates the setup of an email server on Alpine Linux using Postfix, OpenDKIM, and PostSRSd.
# It configures all necessary components to send and receive emails securely and handles virtual mailing lists.
#
# USAGE
# 1. Modify the configuration variables below to match your domain and server settings.
# 2. Run the script as root.
# 3. After running the script, ensure that you see the master process, the postsrsd process and the opendkim process in the netstat output that is shown after the script completes.
# 4. Run the following command to get the value of your DKIM record:
# echo -n 'v=DKIM1; k=rsa; '; grep -o 'p=.*' /etc/opendkim/keys/YOURDKIMSELECTOR.txt | sed 's/.*p="//;s/"[^"]*$//'
# 5. Go to your DNS panel and add new TXT record YOURDKIMSELECTOR._domainkey with the previous command's output as its value.
# 6. Install Swaks from https://jetmore.org/john/code/swaks/installation.html and send a test mail to your Gmail address. Then observe /var/log/mail.log and if the message reaches your Gmail then open the message and choose Show original from the three dots menu and check if DMARC, SPF and DKIM all are PASS.


# Before running, ensure you have set up DNS records as described below:
# 
# DNS REQUIREMENTS
# 1. Ensure that the hostname (e.g., mail.example.com) has a correct PTR record, pointing back to the A record of the IP address.

# 2. Add a TXT record for DKIM in your DNS with the name 'example._domainkey.example.com' where example is your DKIM_SELECTOR
#    and the value provided by the OpenDKIM key generation (this script will generate this value).
# 3. Ensure SPF and DMARC records are set up to enhance email deliverability and security.
#
# Ensure you modify the configuration variables below as per your domain and server settings.


# Configuration variables
MYHOSTNAME="mail.example.com" # must match the reverse DNS of the IP address that is used to send emails
MYDOMAIN="example.com" # the domain that is used to send emails from the server
DKIM_SELECTOR="example" # the DKIM selector that is listed in the DNS records of the domain
MYDESTINATION="localhost, ${MYHOSTNAME}, ${MYDOMAIN}, ${MYDOMAIN}.localdomain" # the destinations that the server will accept emails for
MAILING_LIST="list@${MYDOMAIN}" # a mailing list that will be used to send emails to multiple recipients
MAILING_LIST_MEMBERS="user1@example.net, user2@example.org" # mailing list members who will receive emails sent to the list

# Check for root privileges
if [ "$(id -u)" -ne 0 ]; then
    echo "This script must be run as root." 1>&2
    exit 1
fi

# Define the version of Alpine to check for the community repository
ALPINE_VERSION=$(cut -d'.' -f1-2 /etc/alpine-release)
COMMUNITY_REPO="http://dl-cdn.alpinelinux.org/alpine/v${ALPINE_VERSION}/community"

# Check and ensure the community repository is in the repositories file
if ! grep -Fq "$COMMUNITY_REPO" /etc/apk/repositories; then
    echo "$COMMUNITY_REPO" >> /etc/apk/repositories
    echo "Community repository added."
else
    # Ensure it's not commented out if already present
    COMMUNITY_REPO_ESCAPED=$(echo "$COMMUNITY_REPO" | sed 's/\//\\\//g')
    sed -i -e "/^#.*$COMMUNITY_REPO_ESCAPED/s/^#//" /etc/apk/repositories
fi


# Update and install necessary packages
apk update
apk add postfix postfix-pcre postsrsd opendkim opendkim-utils

# Configure Postfix
postconf -e "myhostname = $MYHOSTNAME"
postconf -e "mydestination = $MYDESTINATION"
postconf -e "myorigin = $MYDOMAIN"
postconf -e "virtual_alias_maps = lmdb:/etc/postfix/virtual"
postconf -e "milter_default_action = accept"
postconf -e "milter_protocol = 2"
postconf -e "smtpd_milters = inet:localhost:8891"
postconf -e "non_smtpd_milters = inet:localhost:8891"
postconf -e "relay_domains = $MYHOSTNAME"
postconf -e "relayhost = "
postconf -e "smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination"
postconf -e "mynetworks = 127.0.0.0/8, 10.0.0.0/8"
echo "$MAILING_LIST $MAILING_LIST_MEMBERS" > /etc/postfix/virtual
postmap /etc/postfix/virtual

# Configure OpenDKIM
mkdir -p /etc/opendkim/keys
chown opendkim:opendkim /etc/opendkim /etc/opendkim/keys

# Update OpenDKIM configuration to use the right paths
cat > /etc/opendkim/opendkim.conf << EOF
BaseDirectory		    /run/opendkim
LogWhy                  yes
Syslog                  yes
SyslogSuccess           yes
Canonicalization	    relaxed/simple
Domain			        $MYDESTINATION
ReportAddress           postmaster@$MYDOMAIN
SendReports             yes
InternalHosts		    127.0.0.1, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12
PidFile		            /var/run/opendkim/opendkim.pid
UserID                  opendkim:opendkim
Socket                  inet:8891@localhost
Selector                $DKIM_SELECTOR
KeyFile                 /etc/opendkim/keys/${DKIM_SELECTOR}.private
EOF
opendkim-genkey -D /etc/opendkim/keys/ -d $MYHOSTNAME -s $DKIM_SELECTOR
chown opendkim:opendkim /etc/opendkim/keys/$DKIM_SELECTOR.private

# Configure PostSRSd v2
cat > /etc/postsrsd/postsrsd.conf << EOF
# PostSRSd configuration file
domains = { "$MYDOMAIN" }
syslog = on
debug = on
socketmap = inet:localhost:10003
keep-alive = 30
original-envelope = embedded
secrets-file = "/etc/postsrsd/postsrsd.secret"
separator = "="
hash-length = 4
hash-minimum = 4
always-rewrite = off
unprivileged-user = "postsrsd"
chroot-dir = "/var/lib/postsrsd"
EOF

# Create the chroot directory for PostSRSd
mkdir -p /etc/postsrsd/root

# Postfix configuration to use PostSRSd
postconf -e 'sender_canonical_maps = socketmap:inet:localhost:10003:forward'
postconf -e 'sender_canonical_classes = envelope_sender'
postconf -e 'recipient_canonical_maps = socketmap:inet:localhost:10003:reverse'
postconf -e 'recipient_canonical_classes = envelope_recipient, header_recipient'

# Check and set correct permissions
chmod 755 /var/spool/postfix
chmod 640 /etc/postfix/main.cf /etc/postfix/master.cf
chmod 700 /etc/opendkim/keys
chmod 600 /etc/opendkim/keys/$DKIM_SELECTOR.private

# Log mail and subject
postconf -e 'maillog_file = /var/log/mail.log'
echo '/^subject:/ WARN' >> /etc/postfix/header_checks
postconf -e 'header_checks = pcre:/etc/postfix/header_checks'

# Reload and restart services
rc-service opendkim start
rc-service postsrsd start
rc-service postfix restart
rc-update add postfix default
rc-update add opendkim default
rc-update add postsrsd default

netstat -plant