doveauth-http: deploying HTTP route for account creation

chatmaild/pyproject.toml

@@ -6,11 +6,14 @@ build-backend = "setuptools.build_meta"
 name = "chatmaild"
 version = "0.1"
 dependencies = [
-  "aiosmtpd"
+  "aiosmtpd",
+  "flask",
+  "gunicorn",
 ]
 
 [project.scripts]
 doveauth = "chatmaild.doveauth:main"
+doveauth-http = "chatmaild.web:main"
 filtermail = "chatmaild.filtermail:main"
 
 [tool.pytest.ini_options]

chatmaild/src/chatmaild/doveauth-http.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=HTTP endpoint for creating chatmail accounts
+
+[Service]
+ExecStart=/usr/local/bin/gunicorn --timeout 60 -b :3691 -w 1 chatmaild.web:main
+Restart=always
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target

chatmaild/src/chatmaild/doveauth.py

@@ -3,7 +3,6 @@ import os
 import time
 import sys
 import json
-import crypt
 from socketserver import (
     UnixStreamServer,
     StreamRequestHandler,
@@ -12,39 +11,7 @@ from socketserver import (
 import pwd
 
 from .database import Database
-
+from .util import is_allowed_to_create, encrypt_password, get_mail_domain
-NOCREATE_FILE = "/etc/chatmail-nocreate"
-
-
-def encrypt_password(password: str):
-    # https://doc.dovecot.org/configuration_manual/authentication/password_schemes/
-    passhash = crypt.crypt(password, crypt.METHOD_SHA512)
-    return "{SHA512-CRYPT}" + passhash
-
-
-def is_allowed_to_create(user, cleartext_password) -> bool:
-    """Return True if user and password are admissable."""
-    if os.path.exists(NOCREATE_FILE):
-        logging.warning(f"blocked account creation because {NOCREATE_FILE!r} exists.")
-        return False
-
-    if len(cleartext_password) < 10:
-        logging.warning("Password needs to be at least 10 characters long")
-        return False
-
-    parts = user.split("@")
-    if len(parts) != 2:
-        logging.warning(f"user {user!r} is not a proper e-mail address")
-        return False
-    localpart, domain = parts
-
-    if domain == "nine.testrun.org":
-        # nine.testrun.org policy, username has to be exactly nine chars
-        if len(localpart) != 9:
-            logging.warning(f"localpart {localpart!r} has not exactly nine chars")
-            return False
-
-    return True
 
 
 def get_user_data(db, user):
@@ -123,8 +90,7 @@ def main():
     socket = sys.argv[1]
     passwd_entry = pwd.getpwnam(sys.argv[2])
     db = Database(sys.argv[3])
-    with open("/etc/mailname", "r") as fp:
+    mail_domain = get_mail_domain()
-        mail_domain = fp.read().strip()
 
     class Handler(StreamRequestHandler):
         def handle(self):

chatmaild/src/chatmaild/util.py

@@ -0,0 +1,56 @@
+import base64
+import random
+import logging
+import os
+import crypt
+
+
+NOCREATE_FILE = "/etc/chatmail-nocreate"
+
+
+def is_allowed_to_create(user, cleartext_password) -> bool:
+    """Return True if user and password are admissable."""
+    if os.path.exists(NOCREATE_FILE):
+        logging.warning(f"blocked account creation because {NOCREATE_FILE!r} exists.")
+        return False
+
+    if len(cleartext_password) < 10:
+        logging.warning("Password needs to be at least 10 characters long")
+        return False
+
+    parts = user.split("@")
+    if len(parts) != 2:
+        logging.warning(f"user {user!r} is not a proper e-mail address")
+        return False
+    localpart, domain = parts
+
+    if domain == "nine.testrun.org":
+        # nine.testrun.org policy, username has to be exactly nine chars
+        if len(localpart) != 9:
+            logging.warning(f"localpart {localpart!r} has not exactly nine chars")
+            return False
+
+    return True
+
+
+def gen_password():
+    with open("/dev/urandom", "rb") as f:
+        s = f.read(21)
+    return base64.b64encode(s).decode("ascii")[:12]
+
+
+def encrypt_password(password: str):
+    # https://doc.dovecot.org/configuration_manual/authentication/password_schemes/
+    passhash = crypt.crypt(password, crypt.METHOD_SHA512)
+    return "{SHA512-CRYPT}" + passhash
+
+
+def get_mail_domain():
+    with open("/etc/mailname", "r") as fp:
+        return fp.read().strip()
+
+
+def get_valid_email_addr(length=9, chars="2345789acdefghjkmnpqrstuvwxyz"):
+    localpart = "".join(random.choice(chars) for i in range(length))
+    mail_domain = get_mail_domain()
+    return f"{localpart}@{mail_domain}"

chatmaild/src/chatmaild/web.py

@@ -0,0 +1,48 @@
+from flask import Flask, jsonify, request
+import time
+import os
+
+from database import Database
+from util import gen_password, get_valid_email_addr, encrypt_password
+from doveauth import get_user_data
+
+
+def create_app_from_db_path(db_path=None):
+    db = Database(db_path)
+    return create_app_from_db(db)
+
+
+def create_app_from_db(db):
+    app = Flask("chatmaild-http")
+    app.db = db
+
+    @app.route("/", methods=["POST"])
+    def new_email():
+        for i in range(10):
+            addr = get_valid_email_addr()
+            if not get_user_data(db, addr):
+                cleartext_password = gen_password()
+                encrypted_password = encrypt_password(cleartext_password)
+                q = """INSERT INTO users (addr, password, last_login)
+                       VALUES (?, ?, ?)"""
+                with db.write_transaction() as conn:
+                    conn.execute(q, (addr, encrypted_password, int(time.time())))
+                return jsonify(
+                    email=addr,
+                    password=cleartext_password,
+                )
+        return jsonify(
+            type="error",
+            status_code=409,
+            reason="all 10 email addresses we tried are taken"
+        )
+
+    return app
+
+
+def main():
+    """(debugging-only!) serve http account creation Web API on localhost"""
+    db_path = os.getenv("CHATMAIL_DATABASE", "/home/vmail/passdb.sqlite")
+    app = create_app_from_db_path(db_path)
+    if __name__ == "__main__":
+        app.run(debug=True, host="localhost", port=3691)

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -46,6 +46,7 @@ def _install_chatmaild() -> None:
 
         for fn in (
             "doveauth",
+            "doveauth-http",
             "filtermail",
         ):
             files.put(
@@ -245,7 +246,7 @@ def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
     return need_restart
 
 
-def _configure_nginx(domain: str, mail_server: str) -> bool:
+def _configure_nginx(domain: str, debug: bool = False) -> bool:
     """Configures nginx HTTP server."""
     need_restart = False
 
@@ -275,7 +276,7 @@ def _configure_nginx(domain: str, mail_server: str) -> bool:
         user="root",
         group="root",
         mode="644",
-        config={"mail_server": mail_server},
+        config={"domain_name": domain},
     )
     need_restart |= mta_sts_config.changed
 
@@ -333,7 +334,7 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     dovecot_need_restart = _configure_dovecot(mail_server, debug=debug)
     postfix_need_restart = _configure_postfix(mail_domain, debug=debug)
     opendkim_need_restart = _configure_opendkim(mail_domain, dkim_selector)
-    nginx_need_restart = _configure_nginx(mail_domain, mail_server)
+    nginx_need_restart = _configure_nginx(mail_domain)
     mta_sts_need_restart = _install_mta_sts_daemon()
 
     # deploy web pages and info if we have them

deploy-chatmail/src/deploy_chatmail/nginx/mta-sts.txt.j2

@@ -1,4 +1,4 @@
 version: STSv1
 mode: enforce
-mx: {{ config.mail_server }}
+mx: {{ config.domain_name }}
 max_age: 2419200

deploy-chatmail/src/deploy_chatmail/nginx/nginx.conf.j2

@@ -20,6 +20,8 @@ http {
 
 	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
 	ssl_prefer_server_ciphers on;
+	ssl_certificate /var/lib/acme/live/{{ config.domain_name }}/fullchain;
+	ssl_certificate_key /var/lib/acme/live/{{ config.domain_name }}/privkey;
 
 	gzip on;
 
@@ -28,8 +30,6 @@ http {
 		listen [::]:80 default_server;
 		listen 443 ssl default_server;
 		listen [::]:443 ssl default_server;
-        ssl_certificate /var/lib/acme/live/{{ config.domain_name }}/fullchain;
-        ssl_certificate_key /var/lib/acme/live/{{ config.domain_name }}/privkey;
 
 		root /var/www/html;
 
@@ -42,28 +42,10 @@ http {
 			# as directory, then fall back to displaying a 404.
 			try_files $uri $uri/ =404;
 		}
-	}
-	server {
-		listen 80;
-		listen [::]:80;
-		listen 443 ssl;
-		listen [::]:443 ssl;
 
-		root /var/www/html;
+        location /new_email {
-
+            proxy_pass http://localhost:3691/;
-		index index.html index.htm;
+        }
-
-		server_name mta-sts.{{ config.domain_name }};
-
-        ssl_certificate /var/lib/acme/live/mta-sts.{{ config.domain_name }}/fullchain;
-    	ssl_certificate_key /var/lib/acme/live/mta-sts.{{ config.domain_name }}/privkey;
-
-
-		location / {
-			# First attempt to serve request as file, then
-			# as directory, then fall back to displaying a 404.
-			try_files $uri $uri/ =404;
-		}
 	}
 }
 

deploy-chatmail/src/deploy_chatmail/opendkim/opendkim.conf

@@ -20,7 +20,7 @@ Domain			{{ config.domain_name }}
 Selector		{{ config.opendkim_selector }}
 KeyFile		  /etc/dkimkeys/{{ config.opendkim_selector }}.private
 KeyTable          /etc/dkimkeys/KeyTable
-SigningTable      /etc/dkimkeys/SigningTable
+SigningTable      refile:/etc/dkimkeys/SigningTable
 
 # In Debian, opendkim runs as user "opendkim". A umask of 007 is required when
 # using a local socket with MTAs that access the socket as a non-privileged

scripts/generate-dns-zone.sh

@@ -1,6 +1,5 @@
 #!/bin/sh
 : ${CHATMAIL_DOMAIN:=c1.testrun.org}
-: ${CHATMAIL_SERVER:=$CHATMAIL_DOMAIN}
 : ${CHATMAIL_SSH:=$CHATMAIL_DOMAIN}
 
 set -e
@@ -9,22 +8,16 @@ EMAIL="root@$CHATMAIL_DOMAIN"
 ACME_ACCOUNT_URL="$($SSH -- acmetool account-url)"
 
 cat <<EOF
-$CHATMAIL_DOMAIN. MX 10 $CHATMAIL_SERVER.
+$CHATMAIL_DOMAIN. MX 10 $CHATMAIL_DOMAIN.
-$CHATMAIL_DOMAIN. TXT "v=spf1 a:$CHATMAIL_SERVER -all"
+$CHATMAIL_DOMAIN. TXT "v=spf1 a:$CHATMAIL_DOMAIN -all"
 _dmarc.$CHATMAIL_DOMAIN. TXT "v=DMARC1;p=reject;rua=mailto:$EMAIL;ruf=mailto:$EMAIL;fo=1;adkim=r;aspf=r"
-_submission._tcp.$CHATMAIL_SERVER.  SRV 0 1 587 $CHATMAIL_SERVER.
+_submission._tcp.$CHATMAIL_DOMAIN.  SRV 0 1 587 $CHATMAIL_DOMAIN.
-_submissions._tcp.$CHATMAIL_SERVER. SRV 0 1 465 $CHATMAIL_SERVER.
+_submissions._tcp.$CHATMAIL_DOMAIN. SRV 0 1 465 $CHATMAIL_DOMAIN.
-_imap._tcp.$CHATMAIL_SERVER.        SRV 0 1 143 $CHATMAIL_SERVER.
+_imap._tcp.$CHATMAIL_DOMAIN.        SRV 0 1 143 $CHATMAIL_DOMAIN.
-_imaps._tcp.$CHATMAIL_SERVER.       SRV 0 1 993 $CHATMAIL_SERVER.
+_imaps._tcp.$CHATMAIL_DOMAIN.       SRV 0 1 993 $CHATMAIL_DOMAIN.
 $CHATMAIL_DOMAIN. IN CAA 128 issue "letsencrypt.org;accounturi=$ACME_ACCOUNT_URL"
 _mta-sts.$CHATMAIL_DOMAIN. IN TXT "v=STSv1; id=$(date -u '+%Y%m%d%H%M')"
-mta-sts.$CHATMAIL_SERVER. IN CNAME $CHATMAIL_SERVER.
+mta-sts.$CHATMAIL_DOMAIN. IN CNAME $CHATMAIL_DOMAIN.
-_smtp._tls.$CHATMAIL_SERVER. IN TXT "v=TLSRPTv1;rua=mailto:$EMAIL"
+_smtp._tls.$CHATMAIL_DOMAIN. IN TXT "v=TLSRPTv1;rua=mailto:$EMAIL"
 EOF
-if [ "$CHATMAIL_DOMAIN" != "$CHATMAIL_SERVER" ]; then
-cat <<EOF
-mta-sts.$CHATMAIL_DOMAIN. IN CNAME mta-sts.$CHATMAIL_SERVER.
-_smtp._tls.$CHATMAIL_DOMAIN. IN CNAME _smtp._tls.$CHATMAIL_SERVER.
-EOF
-fi
 $SSH opendkim-genzone -F | sed 's/^;.*$//;/^$/d'