#!/usr/bin/env bash

clear
echo -e "\n   \033[32mStart Installation of OpenDKIM..\033[m"



# -------------
# - Settings
# -------------

#_src_base_dir="$(realpath $(dirname $0))"
#conf_file="${_src_base_dir}/conf/install_opendkim.conf"

log_file="$(mktemp)"

_opendkim_packages="opendkim opendkim-tools"

opendkim_base_dir="/etc/opendkim"
opendkim_key_dir="${opendkim_base_dir}/keys"
opendkim_conf_file="/etc/opendkim.conf"

postfix_spool_dir="/var/spool/postfix"

opendkim_socket_dir="${postfix_spool_dir}/opendkim"
opendkim_socket_file="${opendkim_socket_dir}/opendkim.sock"

postfix_needs_restart=false
opendkim_needs_restart=false

# -------------
# --- Some functions
# -------------
echononl(){
   echo X\\c > /tmp/shprompt$$
   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
      echo -e -n "$*\\c" 1>&2
   else
       echo -e -n "$*" 1>&2
   fi
   rm /tmp/shprompt$$
}

fatal(){
   echo ""
   echo -e "fatal error: $*"
   echo ""
   echo -e "\t\033[31m\033[1mInstalllation will be interrupted\033[m\033[m"
   echo ""
   exit 1
}

error(){
   echo ""
   echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
   echo ""
}

warn (){
   echo ""
   echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
   echo ""
}

info (){
   echo ""
   echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
   echo ""
}

echo_done() {
   echo -e "\033[80G[ \033[32mdone\033[m ]"
}
echo_ok() {
   echo -e "\033[80G[ \033[32mok\033[m ]"
}
echo_warning() {
   echo -e "\033[80G[ \033[33m\033[1mwarn\033[m ]"
}
echo_failed(){
   echo -e "\033[80G[ \033[1;31mfailed\033[m ]"
}
echo_skipped() {
   echo -e "\033[80G[ \033[37mskipped\033[m ]"
}


# -------------
# - Some pre-installation tasks
# -------------

# - Is 'systemd' supported on this system
# -
if [ "X`which systemd`" = "X" ]; then
   SYSTEMD_EXISTS=false
else
   SYSTEMD_EXISTS=true
fi



# =============
# - Start Installation
# =============

echo ""

# - Synchronise package index files with the repository
# -
echononl "   Synchronise package index files with the repository.."
apt-get update > "$log_file" 2>&1
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
   error "$(cat $log_file)"
fi


# - Install OpenDKIM
# -
echononl "   Install needed debian packages.."
opendkim_packages=""
packages_installed=false
for _pkg in $_opendkim_packages ; do
   if aptitude search "$_pkg" | grep " $_pkg " | grep -e "^i" > /dev/null 2>&1 ; then
      continue
   else
      opendkim_packages="$opendkim_packages $_pkg"
   fi
done
if [[ -n "$opendkim_packages" ]]; then
   DEBIAN_FRONTEND=noninteractive apt-get -y install $opendkim_packages > /dev/null 2> "$log_file"
   packages_installed=true
   opendkim_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
else
   echo_skipped
fi


# - Add user 'postfix' to group 'opendkim'
# -
echononl "   Add user 'postfix' to group 'opendkim'.."
if grep opendkim /etc/group | grep -q postfix 2> /dev/null ; then
   echo_skipped
else
   adduser postfix opendkim > "$log_file" 2>&1
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi


# - Save configuration file from distribution
# -
echononl "   Save configuration file from distribution"
if $packages_installed ; then
   cp -a $opendkim_conf_file $opendkim_conf_file.ORIG 2> "$log_file"
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
else
   echo_skipped
fi


# - Create OpenDKIM configuration
# -
echononl "   Create OpenDKIM configuration"
if [[ -f "$opendkim_conf_file" ]] \
      && grep -i -q -E "^\s*Socket\s+local:$opendkim_socket_file" "$opendkim_conf_file" \
      && grep -i -q -E "^\s*SigningTable.*${opendkim_base_dir}/signing.table" "$opendkim_conf_file" \
      && grep -i -q -E "^\s*KeyTable.*${opendkim_base_dir}/key.table" "$opendkim_conf_file" ; then
   echo_skipped
   warn "OpenDKIM seems already be configured."
else
   cat <<EOF > $opendkim_conf_file 2> $log_file
# Datei $opendkim_conf_file

# Sets the "authserv-id" to use when generating the Authentication-Results:
# header field after verifying a message. The default is to use the name of
# the MTA processing the message. If the string "HOSTNAME" is provided, the
# name of the host running the filter (as returned by the gethostname(3)
# function) will be used.
AuthservID              "DKIM check $(hostname -f)"

# OpenDKIM agiert als Mail Filter (= Milter) in den
# Modi signer (s) und verifier (v) und verwendet eine
# Socket-Datei zur Kommunikation (alternativ: lokaler Port)
Mode                    sv
# Socket                local:/var/run/opendkim/opendkim.sock
# Socket                local:$opendkim_socket_file
# Socket                inet:12345@localhost
Socket                  local:$opendkim_socket_file

# OpenDKIM verwendet diesen Benutzer bzw.
# diese Gruppe
UserID                  opendkim:opendkim
UMask                   002
PidFile                 /var/run/opendkim/opendkim.pid

# OpenDKIM bei Problemen neustarten,
# aber max. 10 mal pro Stunde
AutoRestart             yes
AutoRestartRate         10/1h

# Logging (wenn alles funktioniert eventuell reduzieren)
Syslog                  yes
SyslogSuccess           yes
LogWhy                  yes

# Verfahren, wie Header und Body durch
# OpenDKIM verarbeitet werden sollen.
Canonicalization        relaxed/simple

# interne Mails nicht mit OpenDKIM verarbeiten
ExternalIgnoreList      refile:${opendkim_base_dir}/trusted
InternalHosts           refile:${opendkim_base_dir}/trusted

# welche Verschlüsselungs-Keys sollen für welche
# Domains verwendet werden
# (refile: für Dateien mit regulären Ausdrücke)
SigningTable            refile:${opendkim_base_dir}/signing.table
KeyTable                ${opendkim_base_dir}/key.table

# diesen Signatur-Algorithmus verwenden
SignatureAlgorithm      rsa-sha256

# Always oversign From (sign using actual From and a null From to prevent
# malicious signatures header fields (From and/or others) between the signer
# and the verifier.  From is oversigned by default in the Debian pacakge
# because it is often the identity key used by reputation systems and thus
# somewhat security sensitive.
OversignHeaders         From

# Add an "Authentication-Results:" header field even to unsigned messages
# from domains with no "signs all" policy. The reported DKIM result will be
# "none" in such cases. Normally unsigned mail from non-strict domains does
# not cause the results header field to be added.
AlwaysAddARHeader       yes

# Causes opendkim to fork and exits immediately, leaving the service running
# in the background. The default is "true".
Background              yes

# Sets the DNS timeout in seconds. A value of 0 causes an infinite wait. The
# default is 5. Ignored if not using an asynchronous resolver package. See
# also the NOTES section below.
DNSTimeout              5
EOF
   opendkim_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi


# - Assign ownership to the opendkim user and restrict tthe
# - file permissions:
# -
echononl "   Assign ownership and file permissions.."
chmod u=rw,go=r $opendkim_conf_file 2> $log_file
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
   error "$(cat $log_file)"
fi


# - Create the directories to hold OpenDKIM’s data files, assign 
# - ownership to the opendkim user, and restrict the file 
# - permissions:
# -
echononl "   Create directory '$opendkim_base_dir'"
if [[ -d "$opendkim_base_dir" ]] ; then
   echo_skipped
else
   opendkim_needs_restart=true
   mkdir ${opendkim_base_dir} 2> $log_file
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi
echononl "   Create directory '$opendkim_key_dir'"
if [[ -d "$opendkim_key_dir" ]] ; then
   echo_skipped
else
   opendkim_needs_restart=true
   mkdir $opendkim_key_dir 2> $log_file
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi
echononl "   Set ownership on directory '${opendkim_base_dir}' (recursive).."
chown -R opendkim:opendkim ${opendkim_base_dir} 2> $log_file
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
   error "$(cat $log_file)"
fi
echononl "   Set file-permission on $opendkim_key_dir"
chmod go-rw $opendkim_key_dir 2> $log_file
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
   error "$(cat $log_file)"
fi


# - Create empty files
# -    ${opendkim_base_dir}/signing.table
# -    ${opendkim_base_dir}/key.table
# -
echononl "   Create empty file '${opendkim_base_dir}/signing.table'.."
if [[ -f "${opendkim_base_dir}/signing.table" ]] ; then
   echo_skipped
else
   touch ${opendkim_base_dir}/signing.table 2> $log_file
   opendkim_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi
echononl "   Create empty file '${opendkim_base_dir}/key.table'.."
if [[ -f "${opendkim_base_dir}/key.table" ]] ; then
   echo_skipped
else
   touch ${opendkim_base_dir}/key.table 2> $log_file
   opendkim_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi


# - Create the trusted hosts file ${opendkim_base_dir}/trusted.hosts.
# -
echononl "   Create trusted hosts file '${opendkim_base_dir}/trusted'.."
if [[ -f "${opendkim_base_dir}/trusted" ]] ; then
   echo_skipped
else
   cat <<EOF > ${opendkim_base_dir}/trusted 2> $log_file
127.0.0.1
::1
localhost
$(hostname -f)
EOF
   opendkim_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi


# - Create the OpenDKIM socket directory in Postfix’s work area 
# - and make sure it has the correct ownership:
# -
echononl "   Create the OpenDKIM socket directory in Postfix’s work area.."
if [[ -d "${postfix_spool_dir}/opendkim" ]] ; then
   echo_skipped
else
   mkdir ${postfix_spool_dir}/opendkim 2> $log_file
   opendkim_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
   echononl "   Set ownership on directory '${postfix_spool_dir}/opendkim'.."
   chown opendkim:postfix ${postfix_spool_dir}/opendkim 2> $log_file
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi


# - Edit /etc/default/opendkim
# -
# - Set:
# -    SOCKET="local:${postfix_spool_dir}/opendkim/opendkim.sock"
# -
echononl "   Set 'SOCKET' at file /etc/default/opendkim.."
if grep -q -E "^\s*SOCKET" /etc/default/opendkim 2>/dev/null ; then
   if grep -q -E "^\s*SOCKET.*local:$opendkim_socket_file" /etc/default/opendkim  2>/dev/null ; then
      echo_skipped
   else
      perl -i -n -p -e "s#^\s*SOCKET=.*#SOCKET=\"local:$opendkim_socket_file\"#" /etc/default/opendkim 2> $log_file
      opendkim_needs_restart=true
      if [[ $? -eq 0 ]] ; then
         echo_ok
      else
         echo_failed
         error "$(cat $log_file)"
      fi
   fi
else
   cat <<EOF >>/etc/default/opendkim 2> $log_file
SOCKET="local:$opendkim_socket_file"
EOF
   opendkim_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi


# - Edit /etc/postfix/main.cf and add a section to activate 
# - processing of e-mail through the OpenDKIM daemon:
# -
backup_date="$(date +%Y-%m-%d-%H%M)"
echononl "   Backup existing postfix configuration (main.cf).."
cp -a /etc/postfix/main.cf /etc/postfix/main.cf.$backup_date 2> $log_file
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
   error "$(cat $log_file)"
fi

echononl "   Activate processing of e-mail through the OpenDKIM daemon.."
if grep -q -E "milter_default_action\s*=\s*accept" /etc/postfix/main.cf ; then
   echo_skipped
   warn "Postfix (main.cf) seems already be configured for milters"
   echononl "   Delete previosly saved Postfix configuration.."
   rm /etc/postfix/main.cf.$backup_date 2> $log_file
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
else
   cat <<EOF >> /etc/postfix/main.cf 2> $log_file

# ======= Milter configuration =======

# OpenDKIM

milter_default_action = accept

# Postfix ≥ 2.6 milter_protocol = 6, Postfix ≤ 2.5 milter_protocol = 2
milter_protocol = 6

# Note:
#    We will sign AFTER sending through AmaVIS, just befor sending out. So
#    set 'smtpd_milters =' to an emty string here and add to localhost:10025
#    section in master.cf: 'smtpd_milters=local:/opendkim/opendkim.sock'
#
#    If you want sign mails before sending through AmaVIS, set
#    'smtpd_milters = local:/opendkim/opendkim.sock' here and add to
#    localhost:10025 section in master.cf: 'smtpd_milters='
# 
#smtpd_milters = local:/opendkim/opendkim.sock
smtpd_milters =
non_smtpd_milters = local:/opendkim/opendkim.sock
EOF
   postfix_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi


# - Prevent Postfix from setting the DKIM Header twice (one befor
# - and one after processing amavis
# -
# - To disable milter processing after amavis, add to your master.cf in 
# - the after-amavis section:
# -    127.0.0.1:10025 inet    n       -       -       -       -       smtpd
# -       [...]
# -       -o smtpd_milters=
# -
# - If you want to run the milter after amavis, set in main.cf
# -    smtpd_milters= 
# - to an empty string and add the smtpd_milters configuration to master.cf 
# - (after-section amavis) instead:
# -    -o smtpd_milters=local:/opendkim/opendkim.sock
# -
echononl "   Backup file '/etc/postfix/master.cf'.."
cp -a /etc/postfix/master.cf /etc/postfix/master.cf.$backup_date 2> $log_file
if [[ $? -eq 0 ]] ; then
   echo_ok
else
   echo_failed
   error "$(cat $log_file)"
fi
echononl "   Adjust /etc/postfix/master.cf. Set DKIM after sending throuh AmaVIS.."
_found=false
_changed=false
tmp_master_file="/tmp/postfix_master.cf"
> $tmp_master_file
while IFS='' read -r _line || [[ -n $_line ]] ; do

   if $_found && ! echo "$_line" | grep -i -q -E "^\s*-o" 2> /dev/null ; then
      echo "   -o smtpd_milters=local:/opendkim/opendkim.sock" >> "$tmp_master_file"
      _changed=true
      _found=false
   fi

   if $_found && echo "$_line" | grep -i -q -E "^\s*-o\s+smtpd_milters=\s*" ; then
      _found=false
   fi

   if echo "$_line" | grep -i -q -E "^\s*(127.0.0.1|localhost):10025\s+inet\s+" 2> /dev/null ; then
      _found=true
   fi

   echo "$_line" >> "$tmp_master_file"

done < "/etc/postfix/master.cf"
if $_changed ; then
   cp $tmp_master_file /etc/postfix/master.cf 2> $log_file
   postfix_needs_restart=true
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
else
   echo_skipped
   warn "Postfix (master.cf) seems already be configured."
   echononl "   Delete previosly saved file '/etc/postfix/master.cf'.."
   rm /etc/postfix/master.cf.$backup_date 2> $log_file
   if [[ $? -eq 0 ]] ; then
      echo_ok
   else
      echo_failed
      error "$(cat $log_file)"
   fi
fi
rm -f $tmp_master_file

echo ""

# - Restart OpenDKIM
# - 
echononl "   Restart OpenDKIM.."
if $opendkim_needs_restart ; then
   if $SYSTEMD_EXISTS ; then
      systemctl restart opendkim > $log_file 2>&1
      if [[ $? -eq 0 ]] ; then
         echo_ok
      else
         echo_failed
         error "$(cat $log_file)"
      fi
   else
      /etc/init.d/opendkim restart > $log_file 2>&1
      if [[ $? -eq 0 ]] ; then
         echo_ok
      else
         echo_failed
         error "$(cat $log_file)"
      fi
   fi
else
   echo_skipped
fi


# - Restart Postfix so it starts using OpenDKIM when processing mail:
# -
echononl "   Restart Postfix.."
if $postfix_needs_restart ; then
   if $SYSTEMD_EXISTS ; then
      systemctl restart postfix > $log_file 2>&1
      if [[ $? -eq 0 ]] ; then
         echo_ok
      else
         echo_failed
         error "$(cat $log_file)"
      fi
   else
      /etc/init.d/postfix restart > $log_file 2>&1
      if [[ $? -eq 0 ]] ; then
         echo_ok
      else
         echo_failed
         error "$(cat $log_file)"
      fi
   fi
else
   echo_skipped
fi

echo ""
rm -f "$log_file"
exit 0