[Rspamd] use python bootstrapper to start RSPAMD container

data/conf/rspamd/config_templates/dovecot_trusted.map.j2

@@ -0,0 +1,2 @@
+{{ DOVECOT_V4 }}/32
+{{ DOVECOT_V6 }}/128

data/conf/rspamd/config_templates/dqs-rbl.conf.j2

@@ -0,0 +1,179 @@
+{% if SPAMHAUS_DQS_KEY %}
+spamhaus {
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.zen.dq.spamhaus.net";
+    from = false;
+}
+spamhaus_from {
+    from = true;
+    received = false;
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.zen.dq.spamhaus.net";
+    returncodes {
+      SPAMHAUS_ZEN = [ "127.0.0.2", "127.0.0.3", "127.0.0.4", "127.0.0.5", "127.0.0.6", "127.0.0.7", "127.0.0.9", "127.0.0.10", "127.0.0.11" ];
+    }
+}
+spamhaus_authbl_received {
+    # Check if the sender client is listed in AuthBL (AuthBL is *not* part of ZEN)
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.authbl.dq.spamhaus.net";
+    from = false;
+    received = true;
+    ipv6 = true;
+    returncodes {
+      SH_AUTHBL_RECEIVED = "127.0.0.20"
+    }
+}
+spamhaus_dbl {
+    # Add checks on the HELO string
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.dbl.dq.spamhaus.net";
+    helo = true;
+    rdns = true;
+    dkim = true;
+    disable_monitoring = true;
+    returncodes {
+        RBL_DBL_SPAM = "127.0.1.2";
+        RBL_DBL_PHISH = "127.0.1.4";
+        RBL_DBL_MALWARE = "127.0.1.5";
+        RBL_DBL_BOTNET = "127.0.1.6";
+        RBL_DBL_ABUSED_SPAM = "127.0.1.102";
+        RBL_DBL_ABUSED_PHISH = "127.0.1.104";
+        RBL_DBL_ABUSED_MALWARE = "127.0.1.105";
+        RBL_DBL_ABUSED_BOTNET = "127.0.1.106";
+        RBL_DBL_DONT_QUERY_IPS = "127.0.1.255";
+    }
+}
+spamhaus_dbl_fullurls {
+    ignore_defaults = true;
+    no_ip = true;
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.dbl.dq.spamhaus.net";
+    selector = 'urls:get_host'
+    disable_monitoring = true;
+    returncodes {
+        DBLABUSED_SPAM_FULLURLS = "127.0.1.102";
+        DBLABUSED_PHISH_FULLURLS = "127.0.1.104";
+        DBLABUSED_MALWARE_FULLURLS = "127.0.1.105";
+        DBLABUSED_BOTNET_FULLURLS = "127.0.1.106";
+    }
+}
+spamhaus_zrd {
+    # Add checks on the HELO string also for DQS
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.zrd.dq.spamhaus.net";
+    helo = true;
+    rdns = true;
+    dkim = true;
+    disable_monitoring = true;
+    returncodes {
+        RBL_ZRD_VERY_FRESH_DOMAIN = ["127.0.2.2", "127.0.2.3", "127.0.2.4"];
+        RBL_ZRD_FRESH_DOMAIN = [
+          "127.0.2.5", "127.0.2.6", "127.0.2.7", "127.0.2.8", "127.0.2.9", "127.0.2.10", "127.0.2.11", "127.0.2.12", "127.0.2.13", "127.0.2.14", "127.0.2.15", "127.0.2.16", "127.0.2.17", "127.0.2.18", "127.0.2.19", "127.0.2.20", "127.0.2.21", "127.0.2.22", "127.0.2.23", "127.0.2.24"
+        ];
+        RBL_ZRD_DONT_QUERY_IPS = "127.0.2.255";
+    }
+}
+"SPAMHAUS_ZEN_URIBL" {
+  enabled = true;
+  rbl = "{{ SPAMHAUS_DQS_KEY }}.zen.dq.spamhaus.net";
+  resolve_ip = true;
+  checks = ['urls'];
+  replyto = true;
+  emails = true;
+  ipv4 = true;
+  ipv6 = true;
+  emails_domainonly = true;
+  returncodes {
+    URIBL_SBL = "127.0.0.2";
+    URIBL_SBL_CSS = "127.0.0.3";
+    URIBL_XBL = ["127.0.0.4", "127.0.0.5", "127.0.0.6", "127.0.0.7"];
+    URIBL_PBL = ["127.0.0.10", "127.0.0.11"];
+    URIBL_DROP = "127.0.0.9";
+  }
+}
+SH_EMAIL_DBL {
+  ignore_defaults = true;
+  replyto = true;
+  emails_domainonly = true;
+  disable_monitoring = true;
+  rbl = "{{ SPAMHAUS_DQS_KEY }}.dbl.dq.spamhaus.net";
+  returncodes = {
+    SH_EMAIL_DBL = [
+      "127.0.1.2",
+      "127.0.1.4",
+      "127.0.1.5",
+      "127.0.1.6"
+    ];
+    SH_EMAIL_DBL_ABUSED = [
+      "127.0.1.102",
+      "127.0.1.104",
+      "127.0.1.105",
+      "127.0.1.106"
+    ];
+    SH_EMAIL_DBL_DONT_QUERY_IPS = [ "127.0.1.255" ];
+  }
+}
+SH_EMAIL_ZRD {
+  ignore_defaults = true;
+  replyto = true;
+  emails_domainonly = true;
+  disable_monitoring = true;
+  rbl = "{{ SPAMHAUS_DQS_KEY }}.zrd.dq.spamhaus.net";
+  returncodes = {
+    SH_EMAIL_ZRD_VERY_FRESH_DOMAIN = ["127.0.2.2", "127.0.2.3", "127.0.2.4"];
+    SH_EMAIL_ZRD_FRESH_DOMAIN = [
+      "127.0.2.5", "127.0.2.6", "127.0.2.7", "127.0.2.8", "127.0.2.9", "127.0.2.10", "127.0.2.11", "127.0.2.12", "127.0.2.13", "127.0.2.14", "127.0.2.15", "127.0.2.16", "127.0.2.17", "127.0.2.18", "127.0.2.19", "127.0.2.20", "127.0.2.21", "127.0.2.22", "127.0.2.23", "127.0.2.24"
+    ];
+    SH_EMAIL_ZRD_DONT_QUERY_IPS = [ "127.0.2.255" ];
+  }
+}
+"DBL" {
+    # override the defaults for DBL defined in modules.d/rbl.conf
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.dbl.dq.spamhaus.net";
+    disable_monitoring = true;
+}
+"ZRD" {
+    ignore_defaults = true;
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.zrd.dq.spamhaus.net";
+    no_ip = true;
+    dkim = true;
+    emails = true;
+    emails_domainonly = true;
+    urls = true;
+    returncodes = {
+        ZRD_VERY_FRESH_DOMAIN = ["127.0.2.2", "127.0.2.3", "127.0.2.4"];
+        ZRD_FRESH_DOMAIN = ["127.0.2.5", "127.0.2.6", "127.0.2.7", "127.0.2.8", "127.0.2.9", "127.0.2.10", "127.0.2.11", "127.0.2.12", "127.0.2.13", "127.0.2.14", "127.0.2.15", "127.0.2.16", "127.0.2.17", "127.0.2.18", "127.0.2.19", "127.0.2.20", "127.0.2.21", "127.0.2.22", "127.0.2.23", "127.0.2.24"];
+    }
+}
+spamhaus_sbl_url {
+    ignore_defaults = true
+    rbl = "{{ SPAMHAUS_DQS_KEY }}.sbl.dq.spamhaus.net";
+    checks = ['urls'];
+    disable_monitoring = true;
+    returncodes {
+        SPAMHAUS_SBL_URL = "127.0.0.2";
+    }
+}
+
+SH_HBL_EMAIL {
+  ignore_defaults = true;
+  rbl = "_email.{{ SPAMHAUS_DQS_KEY }}.hbl.dq.spamhaus.net";
+  emails_domainonly = false;
+  selector = "from('smtp').lower;from('mime').lower";
+  ignore_whitelist = true;
+  checks = ['emails', 'replyto'];
+  hash = "sha1";
+  returncodes = {
+    SH_HBL_EMAIL = [
+      "127.0.3.2"
+    ];
+  }
+}
+
+spamhaus_dqs_hbl {
+  symbol = "HBL_FILE_UNKNOWN";
+  rbl = "_file.{{ SPAMHAUS_DQS_KEY }}.hbl.dq.spamhaus.net.";
+  selector = "attachments('rbase32', 'sha256')";
+  ignore_whitelist = true;
+  ignore_defaults = true;
+  returncodes {
+    SH_HBL_FILE_MALICIOUS = "127.0.3.10";
+    SH_HBL_FILE_SUSPICIOUS = "127.0.3.15";
+  }
+}
+{% endif %}

data/conf/rspamd/config_templates/external_services.conf.j2

@@ -0,0 +1,16 @@
+{% if SKIP_OLEFY|lower in ['y', 'yes'] %}
+# OLEFY deactivated
+{% else %}
+oletools {
+  # default olefy settings
+  servers = "olefy-mailcow:10055";
+  # needs to be set explicitly for Rspamd < 1.9.5
+  scan_mime_parts = true;
+  # mime-part regex matching in content-type or filename
+  # block all macros
+  extended = true;
+  max_size = 3145728;
+  timeout = 20.0;
+  retransmits = 1;
+}
+{% endif %}

data/conf/rspamd/config_templates/mailcow_networks.map.j2

@@ -0,0 +1,2 @@
+{{ IPV4_NETWORK }}.0/24
+{{ IPV6_NETWORK }}

data/conf/rspamd/config_templates/redis.conf.j2

@@ -0,0 +1,10 @@
+{% if REDIS_SLAVEOF_IP and REDIS_SLAVEOF_PORT %}
+read_servers = "redis-mailcow:6379";
+write_servers = "{{ REDIS_SLAVEOF_IP }}:{{ REDIS_SLAVEOF_PORT }}";
+password = "{{ REDISPASS }}";
+timeout = 10;
+{% else %}
+servers = "redis-mailcow:6379";
+password = "{{ REDISPASS }}";
+timeout = 10;
+{% endif %}

data/conf/rspamd/config_templates/rspamd_trusted.map.j2

@@ -0,0 +1,2 @@
+{{ RSPAMD_V4 }}/32
+{{ RSPAMD_V6 }}/128

data/conf/rspamd/config_templates/worker-controller-password.inc.j2

@@ -0,0 +1 @@
+# Autogenerated by mailcow