#!/bin/bash
######系統配合
#下載ISO檔
#https://ftp.ubuntu-tw.org/ubuntu-releases/26.04.1/ 安裝
######鄭亮星 jls@mail.jls.idv.tw , jls550225@gmail.com , jls@acfs.tw
####安裝 Postfix DKIM
ETH0=$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '1p')
IP=$(ifconfig $ETH0 |grep 'inet ' |awk '{print $2}')
DOMAINNAME=$(/bin/hostname -d)
DATE=$(date "+%Y%m%d%H")

###### MTA-STS
cp -arf /etc/bind/$DOMAINNAME /etc/bind/$DOMAINNAME-$DATE
cat >> /etc/bind/$DOMAINNAME << EOF
mta-sts		IN	A	$IP
_mta-sts	IN	TXT	"v=STSv1; id=$(date "+%Y%m%d%H%M%S")"	
_smtp._tls	IN	TXT	"v=TLSRPTv1; rua=mailto:root@$DOMAINNAME"
_dmarc		IN	TXT	"v=DMARC1; p=none; sp=quarantine; rua=mailto:root@$DOMAINNAME; ruf=mailto:root@$DOMAINNAME"
EOF
mkdir -p /var/www/mta-sts/.well-known
cat > /var/www/mta-sts/.well-known/mta-sts.txt << EOF
version: STSv1
mode:  testing
mx: $DOMAINNAME
mx: *.$DOMAINNAME
mx: dns.$DOMAINNAME
mx: mail.$DOMAINNAME
max_age: 86400
EOF

apt install -y opendkim opendkim-tools
cp -arf /etc/postfix/main.cf /etc/postfix/main.cf-$DATE
cat >> /etc/postfix/main.cf << EOF
##### DKIM
milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891
EOF
opendkim-genkey -t -s dkim -d $DOMAINNAME
mv dkim.private /etc/postfix/dkim.key
chmod 660 /etc/postfix/dkim.key
chown root:opendkim /etc/postfix/dkim.key
cat dkim.txt >> /etc/bind/$DOMAINNAME
cp -arf /etc/apache2/sites-available/http_80.conf /etc/apache2/sites-available/http_80.conf-$DATE
cat >> /etc/apache2/sites-available/http_80.conf << EOF
#------------------------------------------------------------------------------------------------------------------------
<VirtualHost *:80>
  ServerAdmin root@$DOMAINNAME
  DocumentRoot /var/www/mta-sts
  ServerName mta-sts.$DOMAINNAME
  ErrorDocument 403 "403 Forbidden - This site is used to specify the MTA-STS policy for this domain, please see '/.well-known/mta-sts.txt'. If you were not expecting to see this, please use https://www.$DOMAINNAME instead."
  RewriteEngine On
  RewriteOptions IgnoreInherit
  RewriteRule !^/.well-known/mta-sts.txt - [L,R=403]
  DirectoryIndex index.html index.php index.htm index.php3

#       <FilesMatch \.php$>
####    From the Apache version 2.4.10 and above, use the SetHandler to run PHP as a fastCGI process server
#            SetHandler "proxy:unix:/run/php/php7.4-fpm.sock|fcgi://localhost"
#       </FilesMatch>
#  CBandSpeed 40960 200 200
#  CBandRemoteSpeed 40960kb/s 100 100
#  CBandLimit 10000Mb
#  CBandPeriod 4W
#  CBandScoreboard /var/log/scoreboard/motioneye.$DOMAINNAME
#  CBandScoreFlushPeriod /var/log/scoreboard/motioneye.$DOMAINNAME
#  CBandExceededURL http://$DOMAINNAME/cband_error.html
</VirtualHost>
EOF
cp -arf /etc/apache2/sites-available/https_443.conf /etc/apache2/sites-available/https_443.conf-$DATE
cat >> /etc/apache2/sites-available/https_443.conf << EOF
#------------------------------------------------------------------------------------------------------------------------
<VirtualHost _default_:443>
  ServerAdmin root@$DOMAINNAME
  DocumentRoot /var/www/mta-sts
  ServerName mta-sts.$DOMAINNAME
  ErrorDocument 403 "403 Forbidden - This site is used to specify the MTA-STS policy for this domain, please see '/.well-known/mta-sts.txt'. If you were not expecting to see this, please use https://www.$DOMAINNAME instead."
  RewriteEngine On
  RewriteOptions IgnoreInherit
  RewriteRule !^/.well-known/mta-sts.txt - [L,R=403]
  DirectoryIndex index.html index.php index.htm index.php3

#       <FilesMatch \.php$>
####    From the Apache version 2.4.10 and above, use the SetHandler to run PHP as a fastCGI process server
#            SetHandler "proxy:unix:/run/php/php7.4-fpm.sock|fcgi://localhost"
#       </FilesMatch>
#  CBandSpeed 40960 200 200
#  CBandRemoteSpeed 40960kb/s 100 100
#  CBandLimit 10000Mb
#  CBandPeriod 4W
#  CBandScoreboard /var/log/scoreboard/motioneye.$DOMAINNAME
#  CBandScoreFlushPeriod /var/log/scoreboard/motioneye.$DOMAINNAME
#  CBandExceededURL https://$DOMAINNAME/cband_error.html
</VirtualHost>
EOF
cp -arf /etc/opendkim.conf /etc/opendkim.conf-$DATE
cat > /etc/opendkim.conf << EOF
# This is a basic configuration for signing and verifying. It can easily be
# adapted to suit a basic installation. See opendkim.conf(5) and
# /usr/share/doc/opendkim/examples/opendkim.conf.sample for complete
# documentation of available configuration parameters.

Syslog			yes
SyslogSuccess		yes
#LogWhy			no

# Common signing and verification parameters. In Debian, the "From" header is
# oversigned, because it is often the identity key used by reputation systems
# and thus somewhat security sensitive.
Canonicalization	relaxed/simple
#Mode			sv
#SubDomains		no
OversignHeaders		From

# Signing domain, selector, and key (required). For example, perform signing
# for domain "example.com" with selector "2020" (2020._domainkey.example.com),
# using the private key stored in /etc/dkimkeys/example.private. More granular
# setup options can be found in /usr/share/doc/opendkim/README.opendkim.
Domain			*
Selector		dkim
KeyFile			/etc/postfix/dkim.key

# In Debian, opendkim runs as user "opendkim". A umask of 007 is required when
# using a local socket with MTAs that access the socket as a non-privileged
# user (for example, Postfix). You may need to add user "postfix" to group
# "opendkim" in that case.
UserID			opendkim
UMask			007

# Socket for the MTA connection (required). If the MTA is inside a chroot jail,
# it must be ensured that the socket is accessible. In Debian, Postfix runs in
# a chroot in /var/spool/postfix, therefore a Unix socket would have to be
# configured as shown on the last line below.
#Socket			local:/run/opendkim/opendkim.sock
Socket			inet:8891@localhost
#Socket			inet:8891
#Socket			local:/var/spool/postfix/opendkim/opendkim.sock

PidFile			/run/opendkim/opendkim.pid

# Hosts for which to sign rather than verify, default is 127.0.0.1. See the
# OPERATION section of opendkim(8) for more information.
#InternalHosts		192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12

# The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided
# by the package dns-root-data.
TrustAnchorFile		/usr/share/dns/root.key
#Nameservers		127.0.0.1
EOF
cp -arf /etc/default/opendkim /etc/default/opendkim-$DATE
cat > /etc/default/opendkim << EOF
# NOTE: This is a legacy configuration file. It is not used by the opendkim
# systemd service. Please use the corresponding configuration parameters in
# /etc/opendkim.conf instead.
#
# Previously, one would edit the default settings here, and then execute
# /lib/opendkim/opendkim.service.generate to generate systemd override files at
# /etc/systemd/system/opendkim.service.d/override.conf and
# /etc/tmpfiles.d/opendkim.conf. While this is still possible, it is now
# recommended to adjust the settings directly in /etc/opendkim.conf.
#
#DAEMON_OPTS=""
# Change to /var/spool/postfix/run/opendkim to use a Unix socket with
# postfix in a chroot:
#RUNDIR=/var/spool/postfix/run/opendkim
RUNDIR=/run/opendkim
#
# Uncomment to specify an alternate socket
# Note that setting this will override any Socket value in opendkim.conf
# default:
#SOCKET=local:$RUNDIR/opendkim.sock
# listen on all interfaces on port 54321:
#SOCKET=inet:54321
# listen on loopback on port 12345:
SOCKET="inet:8891@localhost"
# listen on 192.0.2.1 on port 12345:
#SOCKET=inet:12345@192.0.2.1
USER=opendkim
GROUP=opendkim
PIDFILE=$RUNDIR/$NAME.pid
EXTRAAFTER=
EOF
systemctl daemon-reload
systemctl restart named.service
systemctl restart apache2.service
systemctl enable opendkim.service
systemctl restart opendkim.service
systemctl restart postfix.service