AWS & Cloudflare Script
This commit is contained in:
parent
6ae4da137e
commit
2174fe4869
|
|
@ -0,0 +1,108 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ -z "$DOMAIN_NAME" ]; then
|
||||||
|
echo "Fehler: DOMAIN_NAME ist nicht gesetzt."
|
||||||
|
echo "Bitte setzen Sie die Variable mit: export DOMAIN_NAME='IhreDomain.de'"
|
||||||
|
exit 1 # Skript mit Fehlercode beenden
|
||||||
|
fi
|
||||||
|
AWS_REGION="us-east-2"
|
||||||
|
EMAIL_PREFIX="emails/"
|
||||||
|
S3_BUCKET_NAME=$(echo "$DOMAIN_NAME" | tr '.' '-' | awk '{print $0 "-emails"}')
|
||||||
|
# Ersetzen Sie alle Punkte durch Bindestriche und erstellen Sie den RULE_NAME
|
||||||
|
RULE_NAME="store-$(echo "$DOMAIN_NAME" | tr '.' '-')-to-s3"
|
||||||
|
|
||||||
|
# ------------------------
|
||||||
|
# 1. S3 Bucket erstellen
|
||||||
|
# ------------------------
|
||||||
|
echo "S3 Bucket erstellen..."
|
||||||
|
aws s3api create-bucket \
|
||||||
|
--bucket ${S3_BUCKET_NAME} \
|
||||||
|
--region ${AWS_REGION} \
|
||||||
|
--create-bucket-configuration LocationConstraint=${AWS_REGION}
|
||||||
|
|
||||||
|
# Öffentlichen Zugriff blockieren
|
||||||
|
aws s3api put-public-access-block \
|
||||||
|
--bucket ${S3_BUCKET_NAME} \
|
||||||
|
--public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
|
||||||
|
|
||||||
|
# Lebenszyklus-Konfiguration hinzufügen
|
||||||
|
aws s3api put-bucket-lifecycle-configuration \
|
||||||
|
--bucket ${S3_BUCKET_NAME} \
|
||||||
|
--lifecycle-configuration '{
|
||||||
|
"Rules": [
|
||||||
|
{
|
||||||
|
"ID": "DeleteOldEmails",
|
||||||
|
"Status": "Enabled",
|
||||||
|
"Expiration": {
|
||||||
|
"Days": 90
|
||||||
|
},
|
||||||
|
"Filter": {
|
||||||
|
"Prefix": ""
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}'
|
||||||
|
|
||||||
|
echo "S3 Bucket Policy hinzufügen..."
|
||||||
|
aws s3api put-bucket-policy \
|
||||||
|
--bucket ${S3_BUCKET_NAME} \
|
||||||
|
--policy '{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Principal": {
|
||||||
|
"Service": "ses.amazonaws.com"
|
||||||
|
},
|
||||||
|
"Action": [
|
||||||
|
"s3:PutObject",
|
||||||
|
"s3:GetBucketLocation",
|
||||||
|
"s3:ListBucket"
|
||||||
|
],
|
||||||
|
"Resource": [
|
||||||
|
"arn:aws:s3:::'${S3_BUCKET_NAME}'",
|
||||||
|
"arn:aws:s3:::'${S3_BUCKET_NAME}'/*"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}'
|
||||||
|
|
||||||
|
# ------------------------
|
||||||
|
# 2. SES Domain-Identität erstellen
|
||||||
|
# ------------------------
|
||||||
|
echo "SES Domain-Identität erstellen..."
|
||||||
|
aws sesv2 create-email-identity \
|
||||||
|
--email-identity ${DOMAIN_NAME} \
|
||||||
|
--region ${AWS_REGION}
|
||||||
|
|
||||||
|
# DKIM-Signierung aktivieren
|
||||||
|
aws sesv2 put-email-identity-dkim-attributes \
|
||||||
|
--email-identity ${DOMAIN_NAME} \
|
||||||
|
--signing-enabled \
|
||||||
|
--region ${AWS_REGION}
|
||||||
|
|
||||||
|
# Mail-From-Domain konfigurieren
|
||||||
|
aws sesv2 put-email-identity-mail-from-attributes \
|
||||||
|
--email-identity ${DOMAIN_NAME} \
|
||||||
|
--mail-from-domain "mail.${DOMAIN_NAME}" \
|
||||||
|
--behavior-on-mx-failure USE_DEFAULT_VALUE \
|
||||||
|
--region ${AWS_REGION}
|
||||||
|
|
||||||
|
# --------------------------
|
||||||
|
# Receive Emails
|
||||||
|
# -------------------------
|
||||||
|
# 3. Receipt Rule Set erstellen
|
||||||
|
echo "Receipt Rule for bizmatch ruleset erstellen..."
|
||||||
|
|
||||||
|
aws ses create-receipt-rule --rule-set-name "bizmatch-ruleset" --rule '{
|
||||||
|
"Name": "'"${RULE_NAME}"'",
|
||||||
|
"Enabled": true,
|
||||||
|
"ScanEnabled": true,
|
||||||
|
"Actions": [{
|
||||||
|
"S3Action": {
|
||||||
|
"BucketName": "'"${S3_BUCKET_NAME}"'",
|
||||||
|
"ObjectKeyPrefix": "emails/"
|
||||||
|
}
|
||||||
|
}],
|
||||||
|
"TlsPolicy": "Require"
|
||||||
|
}'
|
||||||
|
|
@ -0,0 +1,156 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Cloudflare API-Konfiguration
|
||||||
|
# Setze deine API-Schlüssel und Zone-ID als Umgebungsvariablen oder ersetze sie direkt
|
||||||
|
# CF_ZONE_ID="1b7756cee93ed8ba8c05bdc3cb0a5da8" # Die Zone-ID deiner Domain bei Cloudflare
|
||||||
|
# DOMAIN_NAME="andreasknuth.de" # Deine Domain
|
||||||
|
AWS_REGION="us-east-2" # AWS-Region
|
||||||
|
if [ -z "$DOMAIN_NAME" ]; then
|
||||||
|
echo "Fehler: DOMAIN_NAME ist nicht gesetzt."
|
||||||
|
echo "Bitte setzen Sie die Variable mit: export DOMAIN_NAME='IhreDomain.de'"
|
||||||
|
exit 1 # Skript mit Fehlercode beenden
|
||||||
|
fi
|
||||||
|
# Überprüfen, ob der erforderliche API-Token gesetzt ist
|
||||||
|
if [ -z "$CF_API_TOKEN" ]; then
|
||||||
|
echo "Fehler: Bitte setze CF_API_TOKEN als Umgebungsvariable oder im Skript."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Zone ID basierend auf Domain-Namen abrufen
|
||||||
|
echo "Zone ID für $DOMAIN_NAME abrufen..."
|
||||||
|
ZONE_RESPONSE=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=$DOMAIN_NAME" \
|
||||||
|
-H "Authorization: Bearer $CF_API_TOKEN" \
|
||||||
|
-H "Content-Type: application/json")
|
||||||
|
|
||||||
|
# Überprüfen, ob die Antwort erfolgreich war
|
||||||
|
if [ "$(echo $ZONE_RESPONSE | jq -r '.success')" != "true" ]; then
|
||||||
|
echo "Fehler beim Abrufen der Zone ID:"
|
||||||
|
echo $ZONE_RESPONSE | jq .
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Zone ID extrahieren
|
||||||
|
CF_ZONE_ID=$(echo $ZONE_RESPONSE | jq -r '.result[0].id')
|
||||||
|
|
||||||
|
# Überprüfen, ob eine Zone ID gefunden wurde
|
||||||
|
if [ -z "$CF_ZONE_ID" ] || [ "$CF_ZONE_ID" = "null" ]; then
|
||||||
|
echo "Keine Zone ID für $DOMAIN_NAME gefunden. Bitte stelle sicher, dass die Domain bei Cloudflare registriert ist."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Zone ID für $DOMAIN_NAME: $CF_ZONE_ID"
|
||||||
|
|
||||||
|
# Hilfsfunktion für DNS-Einträge anlegen
|
||||||
|
create_dns_record() {
|
||||||
|
local TYPE=$1
|
||||||
|
local NAME=$2
|
||||||
|
local CONTENT=$3
|
||||||
|
local PROXIED=$4
|
||||||
|
local TTL=$5
|
||||||
|
local PRIORITY=$6 # Neu: MX-Priority
|
||||||
|
|
||||||
|
# Standardwerte für Proxied und TTL setzen, falls nicht angegeben
|
||||||
|
if [ -z "$PROXIED" ]; then
|
||||||
|
PROXIED="false"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$TTL" ]; then
|
||||||
|
TTL=3600 # 1 Stunde
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Erstelle $TYPE-Eintrag für $NAME mit Inhalt $CONTENT..."
|
||||||
|
|
||||||
|
# Json Payload vorbereiten abhängig vom Record-Typ
|
||||||
|
local JSON_DATA=""
|
||||||
|
|
||||||
|
if [ "$TYPE" = "MX" ]; then
|
||||||
|
# Bei MX-Einträgen müssen wir die Priority separat angeben
|
||||||
|
if [ -z "$PRIORITY" ]; then
|
||||||
|
PRIORITY=10 # Standard-Priority, falls nicht angegeben
|
||||||
|
fi
|
||||||
|
|
||||||
|
JSON_DATA="{
|
||||||
|
\"type\": \"$TYPE\",
|
||||||
|
\"name\": \"$NAME\",
|
||||||
|
\"content\": \"$CONTENT\",
|
||||||
|
\"ttl\": $TTL,
|
||||||
|
\"priority\": $PRIORITY,
|
||||||
|
\"proxied\": $PROXIED
|
||||||
|
}"
|
||||||
|
elif [ "$TYPE" = "TXT" ]; then
|
||||||
|
# Bei TXT-Einträgen müssen wir sicherstellen, dass der Inhalt in Anführungszeichen steht
|
||||||
|
# Aber Anführungszeichen innerhalb von JSON müssen escaped werden
|
||||||
|
# Wir entfernen zuerst alle vorhandenen Anführungszeichen und fügen sie dann korrekt hinzu
|
||||||
|
CONTENT=$(echo "$CONTENT" | sed 's/"//g')
|
||||||
|
|
||||||
|
JSON_DATA="{
|
||||||
|
\"type\": \"$TYPE\",
|
||||||
|
\"name\": \"$NAME\",
|
||||||
|
\"content\": \"\\\"$CONTENT\\\"\",
|
||||||
|
\"ttl\": $TTL,
|
||||||
|
\"proxied\": $PROXIED
|
||||||
|
}"
|
||||||
|
else
|
||||||
|
# Für alle anderen Record-Typen (z.B. CNAME)
|
||||||
|
JSON_DATA="{
|
||||||
|
\"type\": \"$TYPE\",
|
||||||
|
\"name\": \"$NAME\",
|
||||||
|
\"content\": \"$CONTENT\",
|
||||||
|
\"ttl\": $TTL,
|
||||||
|
\"proxied\": $PROXIED
|
||||||
|
}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# API-Aufruf an Cloudflare
|
||||||
|
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/dns_records" \
|
||||||
|
-H "Authorization: Bearer $CF_API_TOKEN" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
--data "$JSON_DATA" | jq .
|
||||||
|
}
|
||||||
|
|
||||||
|
# DKIM-Einträge abrufen und bei Cloudflare eintragen
|
||||||
|
echo "DKIM-Tokens abrufen von AWS SES..."
|
||||||
|
DKIM_TOKENS=$(aws ses get-identity-dkim-attributes \
|
||||||
|
--identities ${DOMAIN_NAME} \
|
||||||
|
--region ${AWS_REGION} \
|
||||||
|
--query "DkimAttributes.\"${DOMAIN_NAME}\".DkimTokens" \
|
||||||
|
--output text)
|
||||||
|
|
||||||
|
# Überprüfen, ob DKIM-Tokens abgerufen wurden
|
||||||
|
if [ -z "$DKIM_TOKENS" ]; then
|
||||||
|
echo "Fehler: Konnte DKIM-Tokens nicht abrufen. Ist die Domain bei AWS SES verifiziert?"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Domain-Verifizierungstoken abrufen
|
||||||
|
VERIFICATION_TOKEN=$(aws ses get-identity-verification-attributes \
|
||||||
|
--identities ${DOMAIN_NAME} \
|
||||||
|
--region ${AWS_REGION} \
|
||||||
|
--query "VerificationAttributes.\"${DOMAIN_NAME}\".VerificationToken" \
|
||||||
|
--output text)
|
||||||
|
|
||||||
|
# DKIM-Einträge anlegen
|
||||||
|
echo "DKIM-Einträge anlegen bei Cloudflare..."
|
||||||
|
for TOKEN in ${DKIM_TOKENS}; do
|
||||||
|
create_dns_record "CNAME" "${TOKEN}._domainkey.${DOMAIN_NAME}" "${TOKEN}.dkim.amazonses.com" "false" 3600
|
||||||
|
done
|
||||||
|
|
||||||
|
# Domain-Verifizierungs-TXT-Eintrag anlegen
|
||||||
|
echo "Domain-Verifizierungs-TXT-Eintrag anlegen bei Cloudflare..."
|
||||||
|
create_dns_record "TXT" "_amazonses.${DOMAIN_NAME}" "${VERIFICATION_TOKEN}" "false" 3600
|
||||||
|
|
||||||
|
# MX-Einträge anlegen
|
||||||
|
echo "MX-Einträge anlegen bei Cloudflare..."
|
||||||
|
create_dns_record "MX" "${DOMAIN_NAME}" "inbound-smtp.${AWS_REGION}.amazonaws.com" "false" 3600 10
|
||||||
|
create_dns_record "MX" "mail.${DOMAIN_NAME}" "feedback-smtp.${AWS_REGION}.amazonaws.com" "false" 3600 10
|
||||||
|
|
||||||
|
# SPF-Eintrag anlegen
|
||||||
|
echo "SPF-Eintrag anlegen bei Cloudflare..."
|
||||||
|
create_dns_record "TXT" "mail.${DOMAIN_NAME}" "v=spf1 include:amazonses.com ~all" "false" 3600
|
||||||
|
|
||||||
|
# DMARC-Eintrag anlegen
|
||||||
|
echo "DMARC-Eintrag anlegen bei Cloudflare..."
|
||||||
|
create_dns_record "TXT" "_dmarc.${DOMAIN_NAME}" "v=DMARC1; p=quarantine; pct=100; rua=mailto:postmaster@${DOMAIN_NAME}" "false" 3600
|
||||||
|
|
||||||
|
echo "DNS-Einrichtung abgeschlossen."
|
||||||
|
echo "Es kann bis zu 72 Stunden dauern, bis AWS SES die Domain verifiziert hat."
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
services:
|
|
||||||
dovecot:
|
|
||||||
image: dovecot/dovecot:2.4.0
|
|
||||||
environment:
|
|
||||||
- USER_PASSWORD=test1234
|
|
||||||
- DOVECOT_USER=info@bizmatch.net
|
|
||||||
container_name: dovecot
|
|
||||||
restart: unless-stopped
|
|
||||||
ports:
|
|
||||||
- "143:143" # IMAP
|
|
||||||
- "31143:31143"
|
|
||||||
volumes:
|
|
||||||
- ./config:/etc/dovecot
|
|
||||||
- ./ssl:/etc/dovecot/ssl
|
|
||||||
- ./data/mail:/srv/vmail
|
|
||||||
- ./logs:/var/log
|
|
||||||
# Bei Bedarf: Zugriff auf Caddy-Zertifikate
|
|
||||||
# - /pfad/zu/caddy/certs:/etc/dovecot/ssl:ro
|
|
||||||
networks:
|
|
||||||
- mail_network
|
|
||||||
|
|
||||||
networks:
|
|
||||||
mail_network:
|
|
||||||
driver: bridge
|
|
||||||
Loading…
Reference in New Issue