From 9ef3a1bfff71570716a6775b58818cb4b8fd4ce5 Mon Sep 17 00:00:00 2001
From: Tagadda <36127788+Tagadda@users.noreply.github.com>
Date: Wed, 19 Jan 2022 20:10:28 +0000
Subject: [PATCH] [enh] Add SNI support to postfix and dovecot

---
 conf/dovecot/dovecot.conf   | 5 +++++
 conf/postfix/main.cf        | 7 +++++--
 conf/postfix/sni            | 2 ++
 hooks/conf_regen/19-postfix | 3 +++
 hooks/conf_regen/25-dovecot | 1 +
 5 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 conf/postfix/sni

diff --git a/conf/dovecot/dovecot.conf b/conf/dovecot/dovecot.conf
index 273bd45dc..72fd71c4d 100644
--- a/conf/dovecot/dovecot.conf
+++ b/conf/dovecot/dovecot.conf
@@ -21,6 +21,11 @@ ssl = required
 
 ssl_cert = </etc/yunohost/certs/{{ main_domain }}/crt.pem
 ssl_key = </etc/yunohost/certs/{{ main_domain }}/key.pem
+{% for domain in domain_list.split() %}{% if domain != main_domain %}
+local_name {{ domain }} {
+  ssl_cert = </etc/yunohost/certs/{{ domain }}/crt.pem
+  ssl_key = </etc/yunohost/certs/{{ domain }}/key.pem
+}{% endif %}{% endfor %}
 
 # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
 ssl_dh = </usr/share/yunohost/ffdhe2048.pem
diff --git a/conf/postfix/main.cf b/conf/postfix/main.cf
index 51e35c85c..4ccb81ce5 100644
--- a/conf/postfix/main.cf
+++ b/conf/postfix/main.cf
@@ -23,8 +23,11 @@ smtpd_use_tls = yes
 
 smtpd_tls_security_level = may
 smtpd_tls_auth_only = yes
-smtpd_tls_cert_file = /etc/yunohost/certs/{{ main_domain }}/crt.pem
-smtpd_tls_key_file = /etc/yunohost/certs/{{ main_domain }}/key.pem
+smtpd_tls_chain_files =
+    /etc/yunohost/certs/{{ main_domain }}/key.pem,
+    /etc/yunohost/certs/{{ main_domain }}/crt.pem
+
+tls_server_chain_sni_maps = hash:/etc/postfix/sni
 
 {% if compatibility == "intermediate" %}
 # generated 2020-08-18, Mozilla Guideline v5.6, Postfix 3.4.14, OpenSSL 1.1.1d, intermediate configuration
diff --git a/conf/postfix/sni b/conf/postfix/sni
new file mode 100644
index 000000000..29ed2e043
--- /dev/null
+++ b/conf/postfix/sni
@@ -0,0 +1,2 @@
+{% for domain in domain_list.split() %}{{ domain }} /etc/yunohost/certs/{{ domain }}/key.pem /etc/yunohost/certs/{{ domain }}/crt.pem
+{% endfor %}
\ No newline at end of file
diff --git a/hooks/conf_regen/19-postfix b/hooks/conf_regen/19-postfix
index e18243508..177ea23e9 100755
--- a/hooks/conf_regen/19-postfix
+++ b/hooks/conf_regen/19-postfix
@@ -46,6 +46,7 @@ do_pre_regen() {
     export main_domain
     export domain_list="$YNH_DOMAINS"
     ynh_render_template "main.cf" "${postfix_dir}/main.cf"
+    ynh_render_template "sni" "${postfix_dir}/sni"
 
     cat postsrsd \
         | sed "s/{{ main_domain }}/${main_domain}/g" \
@@ -73,6 +74,8 @@ do_post_regen() {
         postmap /etc/postfix/sasl_passwd
     fi
 
+    postmap -F hash:/etc/postfix/sni
+
     [[ -z "$regen_conf_files" ]] \
         || { systemctl restart postfix && systemctl restart postsrsd; }
 
diff --git a/hooks/conf_regen/25-dovecot b/hooks/conf_regen/25-dovecot
index 9a51d0363..37c73b6d8 100755
--- a/hooks/conf_regen/25-dovecot
+++ b/hooks/conf_regen/25-dovecot
@@ -18,6 +18,7 @@ do_pre_regen() {
 
     export pop3_enabled="$(yunohost settings get 'pop3.enabled')"
     export main_domain=$(cat /etc/yunohost/current_host)
+    export domain_list="$YNH_DOMAINS"
 
     ynh_render_template "dovecot.conf" "${dovecot_dir}/dovecot.conf"