postfwd - docker support [devel]
Author: jpk
Description: postfwd docker support
Keywords: postfwd, postfwd usage, postfwd manual, postfwd docker, docker, postfix, policy, policy delegation, firewall, postfix acl, postfix acls, pfwpolicy, postfw, restrictions, IT-Security, IT-Consulting, Jan, Peter, Kessler

## postfwd docker support [devel]

To run postfwd in a docker container you will need at least version 1.36-devel2. The following examples fetch postfwd from the "testing"-branch at GitHub. Furthermore you can find these versions at the postfwd development page. This will change after the final release of version 1.36+.

1. Get the postfwd docker files:
   - via GitHub:

         git clone https://github.com/postfwd/postfwd --branch testing --single-branch postfwd

   - via postfwd.org:

         wget https://postfwd.org/DEVEL/postfwd-latest.tar.gz && gzip -dc postfwd-latest.tar.gz | tar -xf - && rm postfwd-latest.tar.gz

2. Configure your postfwd ruleset:
   - Change to the postfwd docker sample sub-directory:

         cd postfwd/docker

   - Edit the ruleset `postfwd.cf`

         For reasonable operation the default ruleset should be edited. Refer to the postfwd manual for more information.

3. Build and run the container:
   - Edit the `Dockerfile` and run:

         docker build -t postfwd:testing .
         docker run -v `pwd`/postfwd.cf:/etc/postfwd/postfwd.cf:ro -it postfwd:testing

   - Edit the `docker-compose.yml` file and run:

         docker-compose build --pull
         docker-compose up

### Sample files:

`postfwd.cf` (@GitHub):
    #
    # Sample ruleset for postfwd
    #

    # default: log the request and finish
    id=DEFAULT; action=DUNNO

`Dockerfile` (@GitHub):
    #
    # Sample Dockerfile for postfwd - http://postfwd.org/docker
    #
    # Edit postfwd.cf and use with:
    #
    #   docker build -t postfwd:testing .
    #   docker run -v `pwd`/postfwd.cf:/etc/postfwd/postfwd.cf:ro -it postfwd:testing
    #
    # or with more options (postfwd2 on post 10050):
    #
    #   docker run -v `pwd`/ruleset:/etc/postfwd:ro -e PROG=postfwd2 -e PORT=10050 -it postfwd:testing
    #
    FROM debian:stretch-slim

    LABEL maintainer="Postfwd Docker Testing - http://postfwd.org/docker"

    ##
    ## BUILD ARGS
    ##
    # GitHub postfwd url
    ARG URL=https://github.com/postfwd/postfwd
    # GitHub postfwd branch (currently needs 'testing' for docker)
    ARG BRANCH=testing

    ##
    ## RUNTIME ARGS
    ##
    # use 'postfwd1' or 'postfwd2' to switch between versions
    # go to http://postfwd.org/versions.html for more info
    ENV PROG=postfwd1
    # port for postfwd
    ENV PORT=10040
    # request cache in seconds. use '0' to disable
    ENV CACHE=0
    # additional arguments, see postfwd -h or man page for more
    ENV EXTRA="--no_parent_dns_cache --noidlestats --summary=600"
    # get config file from ARG
    ENV CONF=postfwd.cf

    ##
    ## CONTAINER ARGS
    ##
    # configuration directory
    ENV ETC=/etc/postfwd
    # target for postfwd distribution
    ENV TARGET=/opt/postfwd
    # data directory
    ENV HOME=/var/lib/postfwd
    # user and group for execution
    ENV USER=postfw
    ENV GROUP=postfw

    # install stuff
    RUN apt-get update && apt-get install -y \
        libnet-dns-perl libnet-server-perl \
        libtime-hires-perl libstorable-perl \
        git
    RUN git clone ${URL} --branch ${BRANCH} --single-branch ${TARGET}
    RUN apt-get purge -y --auto-remove git && rm -fR /var/lib/apt/lists/*

    # create stuff
    RUN addgroup --quiet --system ${GROUP}
    RUN adduser --quiet --system --no-create-home --disabled-login --disabled-password \
        --ingroup ${GROUP} --home ${HOME} --shell /bin/false ${USER}
    RUN mkdir -p ${ETC} && chown root:${GROUP} ${ETC} && chmod 0750 ${ETC}
    RUN mkdir -p ${HOME} && chown ${USER}:${GROUP} ${HOME} && chmod 0700 ${HOME}

    # open port
    EXPOSE ${PORT}

    # start postfwd - don't worry about versions: postfwd1 will silently ignore postfwd2-specific arguments
    ENTRYPOINT exec ${TARGET}/sbin/${PROG} --file ${ETC}/${CONF} --user ${USER} --group ${GROUP} \
    	--server_socket tcp:0.0.0.0:${PORT} --cache_socket=unix::${HOME}/postfwd.cache \
    	--pidfile=${HOME}/postfwd.pid --save_rates=${HOME}/postfwd.rates \
    	--cache=${CACHE} ${EXTRA} \
    	--stdout --nodaemon

`docker-compose.yml` (@GitHub):
    #
    # Sample postfwd docker compose file - http://postfwd.org/docker
    #
    # Edit ruleset/postfwd.cf and use with:
    #
    # 	docker-compose build --pull
    #	docker-compose up

    version: '2'

    services:

      postfwd:
        build: .
        environment:
          # use 'postfwd1' or 'postfwd2' to switch between versions
          # go to http://postfwd.org/versions.html for more info
          - PROG=postfwd1
          # port for postfwd
          - PORT=10040
          # configuration file
          - CONF=postfwd.cf
          # request cache in seconds. use '0' to disable
          - CACHE=0
          # additional arguments, see postfwd -h or man page for more
          - EXTRA=--no_parent_dns_cache --noidlestats --summary=600
        restart: always
        ports:
          - 127.0.0.1:10040:10040
        volumes:
          - ./postfwd.cf:/etc/postfwd/postfwd.cf:ro