# Generate a Certificate Authority Certificate
## Generate a CA certificate private key.
$ openssl genrsa -out ca.key 4096

## Generate the CA certificate.
$ openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=TW/ST=Taiwan/L=Taipei/O=example/OU=lab/CN=smtp.example.com" \
 -key ca.key \
 -out ca.crt

# Generate a Server Certificate
## Generate a private key.
$ openssl genrsa -out server.key 4096

## Generate a certificate signing request (CSR).
$ openssl req -sha512 -new \
    -subj "/C=TW/ST=Taiwan/L=Taipei/O=example/OU=lab/CN=smtp.example.com" \
    -key server.key \
    -out server.csr

## Generate an x509 v3 extension file.
$ cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=smtp.example.com
DNS.2=example.com
DNS.3=smtp
EOF

## Use the v3.ext file to generate a certificate for your Harbor host.
$ openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in server.csr \
    -out server.crt

# Install Postfix.
$ sudo zypper -n install postfix

# rename to disable
$ sudo mv /etc/sysconfig/postfix /etc/sysconfig/postfix.org
$ sudo nano -l /etc/postfix/main.cf
# line 114: uncomment and specify domain name
mydomain = lab.com
# line 130: uncomment
myorigin = $mydomain
# line 294: uncomment and specify local network
mynetworks = 192.168.11.0/24
# line 451: uncomment to move Maildir
home_mailbox = Maildir/
# line 714: change
inet_interfaces = all
# line 719: add
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
# line 720: specify hostname
myhostname = lab.com
# line 735
# limit a message size if need (example below means 10M limit)
message_size_limit = 10485760
# line 747: change
smtpd_recipient_restrictions = permit_mynetworks, permit_auth_destination, permit_sasl_authenticated, reject


# Configure SSL/TLS to encrypt connections
# line 782: change
smtpd_use_tls = yes

# line 788: specify certificates
smtpd_tls_cert_file = /home/rancher/smtp/server.crt
smtpd_tls_key_file = /home/rancher/smtp/server.key

# line 793: add
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache

## enable port 587 (submission) in postfix
$ sudo nano /etc/postfix/master.cf
### line: 24 取消註解
submission inet n       -       n       -       -       smtpd

# line 25,26,28: uncomment
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes

# line 43-45: uncomment
submissions     inet  n       -       n       -       -       smtpd
  -o syslog_name=postfix/submissions
  -o smtpd_tls_wrappermode=yes

# line 64: uncomment
tlsmgr    unix  -       -       n       1000?   1       tlsmgr

$ sudo systemctl enable --now postfix

# 本地測試寄信
$ echo "Test Postfix Gmail https://example.com" | mail -s "Postfix Gmail" "<your email address>"

# 在別台機器寄信
$ echo "Test Postfix Gmail 2" | mail -S smtp=192.168.11.85 -s "Postfix Gmail" "andy.wu@suse.com"

# 測試 TLS
$ openssl s_client -starttls smtp -connect smtp.example.com:587

$ kubectl create ns cattle-monitoring-system

$ kubectl -n cattle-monitoring-system create secret generic smtp-tls-secret \
--from-file=tls.crt=/home/rancher/smtp/server.crt \
--from-file=tls.key=/home/rancher/smtp/server.key \
--from-file=ca.crt=/home/rancher/smtp/ca.crt

global:
  resolve_timeout: 5m
route:
  group_by: [Alertname]
  # Send all notifications to me.
  receiver: Mail Alert
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 12h
  routes:
  - match:
      alertname: DemoAlertName
    receiver: 'Mail Alert'

receivers:
- name: Mail Alert
  email_configs:
  - to: <你的 E-mail Address>
    from: rancher@lab.com
    smarthost: smtp.example.com:587 # Your smtp server address
    tls_config:
      ca_file: /etc/alertmanager/secrets/smtp-tls-secret/ca.crt
      cert_file: /etc/alertmanager/secrets/smtp-tls-secret/tls.crt
      key_file: /etc/alertmanager/secrets/smtp-tls-secret/tls.key
    headers:
      From: rancher@lab.com
      Subject: 'Demo ALERT'