SA_ENABLE = yes
PROCMAIL_ENABLE = yes
SPAMCBIN=/usr/bin/spamc
SA_SPAMD_USER = spamd
SA_SCORE_REJECT = 50
SA_ABUSE_ADDR = idem84@me.com
EXIMBIN=/usr/sbin/exim
log_selector =  \
        +all_parents \
        +lost_incoming_connection \
        +received_sender \
        +received_recipients \
        +tls_cipher +tls_peerdn \
        +smtp_confirmation \
        +smtp_syntax_error \
        +smtp_protocol_error
  
# CONFDIR=__ISP_CONFDIR__
# daemon_smtp_port = 25:465
# tls_certificate = CONFDIR/certificate.crt
# tls_privatekey = CONFDIR/certificate.key
# tls_on_connect_ports = 465

.ifdef SA_ENABLE
spamd_address = 127.0.0.1 783
.endif

.ifdef MAILMAN_ENABLE
MAILMAN_HOME=__MAILMAN_HOME__
MAILMAN_WRAP=__MAILMAN_WRAP__
MAILMAN_USER=__MAILMAN_USER__
MAILMAN_GROUP=__MAILMAN_GROUP__
.endif

trusted_groups = mgrsecure
trusted_users = apache

# Èíòåðôåéñû íà êîòîðûõ âèñèò exim

local_interfaces = 127.0.0.1 : 185.25.116.72

helo_allow_chars = "_"

domainlist local_domains = lsearch;/etc/exim/domains
domainlist dummy_domains =
hostlist relay_from_hosts = 127.0.0.1 : 185.25.116.72 : 178.248.65.170 : 178.248.64.245 : 178.248.64.243 : 178.248.69.58

domainlist relay_to_domains = lsearch;/etc/exim/domains
exim_user = exim
exim_group = exim

.ifdef VIRUS_SCAN
av_scanner = clamd:/var/run/clamav/clamd.socket
.endif

never_users = root
host_lookup = *
rfc1413_hosts = *
rfc1413_query_timeout = 0s
ignore_bounce_errors_after = 2d
timeout_frozen_after = 7d
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
acl_not_smtp = acl_check_not_smtp

begin acl

    acl_check_not_smtp:
        warn    ratelimit    = ${lookup{$sender_ident}lsearch*{/etc/exim/ratelimits}} / 1h / strict / $sender_ident
                log_message    = Sender rate $sender_rate / $sender_rate_period
                condition    = ${if match_local_part{$sender_ident}{lsearch;/etc/exim/ratelimits} {yes}{no}}

        deny    ratelimit    = ${lookup{$sender_ident}lsearch*{/etc/exim/ratelimits}} / 1h / leaky / $sender_ident
                log_message    = Sender rate $sender_rate / $sender_rate_period
                condition    = ${if match_local_part{$sender_ident}{lsearch;/etc/exim/ratelimits} {yes}{no}}

        warn    ratelimit    = ${lookup{$sender_address_local_part}lsearch*{/etc/exim/ratelimits}} / 1h / strict / $sender_address_local_part
                log_message    = Sender rate $sender_rate / $sender_rate_period
                condition    = ${if match_local_part{$sender_address_local_part}{lsearch;/etc/exim/ratelimits} {yes}{no}}
                
        deny    message        = Sender rate overlimit - $sender_rate / $sender_rate_period
                ratelimit    = ${lookup{$sender_address_local_part}lsearch*{/etc/exim/ratelimits}} / 1h / leaky / $sender_address_local_part
                condition    = ${if match_local_part{$sender_address_local_part}{lsearch;/etc/exim/ratelimits} {yes}{no}}

        accept
    
    
    acl_check_rcpt:
        accept    domains = +local_domains : +relay_to_domains
                condition = ${lookup{$sender_address}wildlsearch{/etc/exim/whitelist}{yes}{no}}
                set acl_m6 = whitelisted
                logwrite = Accepted from $sender_address to $local_part@$domain by whitelist.

        accept    domains = +local_domains : +relay_to_domains
                hosts = net-lsearch;/etc/exim/whitelist
                set acl_m6 = whitelisted
                logwrite = Accepted from $sender_address to $local_part@$domain by whitelist.

        deny    condition = ${lookup{$sender_address}wildlsearch{/etc/exim/blacklist}{yes}{no}}
                set acl_m6 = blacklisted
                logwrite = Rejected from $sender_address to $local_part@$domain by blacklist.

        deny    hosts = net-lsearch;/etc/exim/blacklist
                set acl_m6 = blacklisted
                logwrite = Rejected from $sender_address to $local_part@$domain by blacklist.
        
        deny    message       = Restricted characters in address
                domains       = +local_domains
                local_parts   = ^[.] : ^.*[@%!/|]

        deny    message       = Restricted characters in address
                domains       = !+local_domains
                local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

        accept  local_parts   = postmaster
                verify        = recipient
                domains       = +local_domains

        require verify        = sender

        # check ratelimits by emails
        warn    authenticated    = *
                set acl_c0        = group${extract{2}{:}{${lookup{$authenticated_id}lsearch{/etc/exim/passwd}}}}
                ratelimit        = ${lookup{$acl_c0}lsearch*{/etc/exim/ratelimits}} / 1h / strict / $acl_c0
                ratelimit        = ${lookup{$authenticated_id}lsearch*{/etc/exim/ratelimits}} / 1h / strict / $authenticated_id
                log_message     = Authenticated sender rate $sender_rate / $sender_rate_period
                condition        = ${if match_local_part{$authenticated_id}{lsearch;/etc/exim/ratelimits} {yes}{no}}
        deny    authenticated    = *
                ratelimit        = ${lookup{$authenticated_id}lsearch*{/etc/exim/ratelimits}} / 1h / leaky / $authenticated_id
                log_message        = Authenticated sender rate $sender_rate / $sender_rate_period
                condition        = ${if match_local_part{$authenticated_id}{lsearch;/etc/exim/ratelimits} {yes}{no}}
        # check ratelimits by group
        warn    authenticated    = *
                set acl_c0        = group${extract{2}{:}{${lookup{$authenticated_id}lsearch{/etc/exim/passwd}}}}
                ratelimit        = ${lookup{$acl_c0}lsearch*{/etc/exim/ratelimits}} / 1h / strict / $acl_c0
                log_message        = Authenticated group ($acl_c0) rate $sender_rate / $sender_rate_period
                condition        = ${if match_local_part{$acl_c0}{lsearch;/etc/exim/ratelimits} {yes}{no}}
        deny    authenticated    = *
                set acl_c0        = group${extract{2}{:}{${lookup{$authenticated_id}lsearch{/etc/exim/passwd}}}}
                ratelimit        = ${lookup{$acl_c0}lsearch*{/etc/exim/ratelimits}} / 1h / leaky / $acl_c0
                log_message        = Authenticated group ($acl_c0) rate $sender_rate / $sender_rate_period
                condition        = ${if match_local_part{$acl_c0}{lsearch;/etc/exim/ratelimits} {yes}{no}}

.ifdef VIRUS_SCAN
        warn set acl_m3 = no
        
        warn set acl_m3 = ok
            condition        = ${lookup{$domain}lsearch{/usr/local/ispmgr/etc/clamav_domain} {yes}{no}}

.endif

.ifdef POSTGREY_SOCKET
        defer log_message = greylisted host $sender_host_address
            set acl_m0  = request=smtpd_access_policy\nprotocol_state=RCPT\nprotocol_name=${uc:$received_protocol}\nhelo_name=$sender_helo_name\nclient_address=$sender_host_address\nclient_name=$sender_host_name\nsender=$sender_address\nrecipient=$local_part@$domain\ninstance=$sender_host_address/$sender_address/$local_part@$domain\n\n
            set acl_m0  = ${sg{${readsocket{POSTGREY_SOCKET}{$acl_m0}{5s}{}{action=DUNNO}}}{action=}{}}
            message     = ${sg{$acl_m0}{^\\w+\\s*}{}}
            condition   = ${if eq{${uc:${substr{0}{5}{$acl_m0}}}}{DEFER}{true}{false}}
.endif

        accept  hosts         = +relay_from_hosts
                #control       = submission

        accept  authenticated = *
                condition     = ${if eq{${extract{5}{:}{${lookup{$authenticated_id}lsearch{/etc/exim/passwd}}}}}{no} {yes}{no}}
                condition     = ${if eq{${extract{3}{:}{${lookup{${domain:$authenticated_id}}lsearch{/etc/exim/domains}}}}}{no} {yes}{no}}
                control       = submission/domain=

        deny    message       = rejected because $sender_host_address is in a black list at $dnslist_domain\\n$dnslist_text
                dnslists      = ${readfile {/etc/exim/dnsblists}{:}} 

        require message       = relay not permitted
                domains       = +local_domains : +relay_to_domains

        require verify        = recipient

        accept

    acl_check_data:
.ifdef VIRUS_SCAN
        warn condition = ${if eq{$acl_m3}{ok} {yes}{no}}
            add_header = X-Scanned-By: ${extract{1}{/}{${readsocket{/var/run/clamav/clamd.socket}{VERSION}{1s}{} {unscanned}}}}; $tod_full\n

        deny message = This message contains virus ($malware_name)
            hosts   = *
            demime  = *
            malware = *
            log_message = Rejected: this message contains virus ($malware_name)
            condition = ${if eq{$acl_m3}{ok}{yes}{no}}
.endif
.ifdef SA_ENABLE
        warn
            !authenticated = *
            hosts = !+relay_from_hosts
            condition = ${if < {$message_size}{100K}}
            spam       = SA_SPAMD_USER:true/defer_ok
            add_header = X-Spam_score: $spam_score\n\
                    X-Spam_score_int: $spam_score_int\n\
                    X-Spam_bar: $spam_bar\n\
                    X-Spam_report: $spam_report
            set acl_m_spam_score_int = $spam_score_int
            logwrite = From $sender_address to $recipients X-Spam_score: $acl_m_spam_score_int.

        deny
            condition = ${if !eq{$acl_m_spam_score_int}{} {yes}{no}}
            condition = ${if >{$acl_m_spam_score_int}{SA_SCORE_REJECT} {yes}{no}}
            message = Content analisis tool detect spam (from $sender_address to $recipients). Contact SA_ABUSE_ADDR.
.endif

        accept

begin routers
    dnslookup:
        driver = dnslookup
        domains = !+dummy_domains
        transport = remote_smtp
        ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
        self = pass
        no_more

    disabled_domains:
        driver = redirect
        condition = ${extract{3}{:}{${lookup{$domain}lsearch{/etc/exim/domains}}}}
        allow_fail = yes
        data = :fail: Domain disabled
        no_more

    disabled_users:
        driver = redirect
        condition = ${extract{5}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}
        allow_fail = yes
        data = :fail: User disabled
        no_more

    local_domains:
        driver = redirect
        data = ${quote_local_part:$local_part}@${extract{1}{:}{${lookup{$domain}lsearch{/etc/exim/domains}}}}
        cannot_route_message = Unknown user
        no_more

    group_aliases:
        driver = redirect
        data = ${extract{1}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/aliases}}}}
        condition = ${if and{\
                        {exists{/etc/exim/aliases}}\
                        {eq {${extract{2}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/aliases}}}}} {group} }\
                    } {yes} {no} }
        redirect_router = a_dnslookup
        pipe_transport = address_pipe

    aliases:
        driver = redirect
        data = ${extract{1}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/aliases}}}}
        condition = ${if exists{/etc/exim/aliases} {yes} {no} }
        pipe_transport = address_pipe

    local_users:
        driver = redirect
        condition = ${lookup {$local_part@$domain} lsearch {/etc/exim/passwd} {yes} {no} }
        data = $local_part@$domain
        redirect_router = autoreplay

.ifdef MAILMAN_ENABLE
    mailman:
        driver = accept
        require_files = MAILMAN_HOME/lists/$local_part/config.pck
        local_part_suffix_optional
        local_part_suffix = -bounces : -bounces+* : -confirm+* : -join : -leave : -owner : -request : -admin : -subscribe : -unsubscribe
        transport = mailman

    mailman_isp:
        driver = accept
        require_files = MAILMAN_HOME/lists/$local_part-$domain/config.pck
        local_part_suffix_optional
        local_part_suffix = -bounces : -bounces+* : -confirm+* : -join : -leave : -owner : -request : -admin : -subscribe : -unsubscribe
        transport = mailman_isp
.endif

    catchall_for_domains:
        driver = redirect
        headers_add = X-redirected: yes
        data = ${extract{2}{:}{${lookup{$domain}lsearch{/etc/exim/domains}}}}
        file_transport = local_delivery

    unknown_users:
        driver = redirect
        allow_fail = yes
        data = :fail: Unknown user
        no_more

    autoreplay:
        driver = accept
        condition = ${if exists{${extract{4}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}/message.txt} {yes} {no}}
        retry_use_local_part
        transport = address_reply
        unseen

.ifdef PROCMAIL_ENABLE
    procmail:
        no_verify
        driver = accept
        transport = procmail_pipe
        condition = ${if exists{${extract{4}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}/.procmailrc} {yes} {no}}
        transport_home_directory = ${extract{4}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}
.endif

    localuser:
        driver = accept
        transport = local_delivery

# Same routers without autoreplay

    a_dnslookup:
        driver = dnslookup
        domains = !+dummy_domains
        transport = remote_smtp
        ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
        self = pass
        no_more

    a_disabled_domains:
        driver = redirect
        condition = ${extract{3}{:}{${lookup{$domain}lsearch{/etc/exim/domains}}}}
        allow_fail = yes
        data = :fail: Domain disabled
        no_more

    a_disabled_users:
        driver = redirect
        condition = ${extract{5}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}
        allow_fail = yes
        data = :fail: User disabled
        no_more

    a_local_domains:
        driver = redirect
        data = ${quote_local_part:$local_part}@${extract{1}{:}{${lookup{$domain}lsearch{/etc/exim/domains}}}}
        cannot_route_message = Unknown user
        redirect_router = a_dnslookup
        no_more

    a_aliases:
        driver = redirect
        data = ${extract{1}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/aliases}}}}
        condition = ${if exists{/etc/exim/aliases} {yes} {no} }
        redirect_router = a_dnslookup
        pipe_transport = address_pipe

.ifdef PROCMAIL_ENABLE
    a_procmail:
        no_verify
        driver = accept
        transport = procmail_pipe
        condition = ${if exists{${extract{4}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}/.procmailrc} {yes} {no}}
        transport_home_directory = ${extract{4}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}
.endif

    a_local_users:
        driver = accept
        transport = local_delivery
        condition = ${lookup {$local_part@$domain} lsearch {/etc/exim/passwd} {yes} {no} }

.ifdef MAILMAN_ENABLE
    a_mailman:
        driver = accept
        require_files = MAILMAN_HOME/lists/$local_part/config.pck
        local_part_suffix_optional
        local_part_suffix = -bounces : -bounces+* : -confirm+* : -join : -leave : -owner : -request : -admin : -subscribe : -unsubscribe
        transport = mailman

    a_mailman_isp:
        driver = accept
        require_files = MAILMAN_HOME/lists/$local_part-$domain/config.pck
        local_part_suffix_optional
        local_part_suffix = -bounces : -bounces+* : -confirm+* : -join : -leave : -owner : -request : -admin : -subscribe : -unsubscribe
        transport = mailman_isp
.endif

    a_catchall_for_domains:
        driver = redirect
        headers_add = X-redirected: yes
        data = ${extract{2}{:}{${lookup{$domain}lsearch{/etc/exim/domains}}}}
        file_transport = local_delivery
        redirect_router = a_dnslookup

begin transports
    remote_smtp:
        driver = smtp
        interface = <;${extract{1}{:}{${lookup{$sender_address_domain}lsearch{/etc/exim/domainips}}}}
  
    local_delivery:
        driver = appendfile
.ifdef MAILDIR_ENABLE
        maildir_format = true
        maildir_use_size_file = true
        create_directory = true
        directory_mode = 700
        directory = ${extract{4}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}/.maildir
.endif
.ifndef MAILDIR_ENABLE
        file = ${extract{4}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}/mbox
.endif
        delivery_date_add
        envelope_to_add
        return_path_add
        mode = 0660
        quota = ${extract{3}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}M
        quota_warn_threshold = 75%
        use_lockfile = no
        no_mode_fail_narrower
        user = ${extract{1}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}
        group = ${extract{2}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}
                          
    address_pipe:
        driver = pipe
        ignore_status
        return_output
        use_shell
                                    
    address_reply:
        driver = autoreply
        headers = ${readfile{${extract{4}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}/message.txt}}
        to = $sender_address

.ifdef MAILMAN_ENABLE
    mailman_isp: 
        driver = pipe
        command = MAILMAN_WRAP '${if def:local_part_suffix {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} {post}}' $local_part-$domain
        current_directory = MAILMAN_HOME
        home_directory = MAILMAN_HOME
        user = MAILMAN_USER
        group = MAILMAN_GROUP

    mailman:
        driver = pipe
        command = MAILMAN_WRAP '${if def:local_part_suffix {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} {post}}' $local_part
        current_directory = MAILMAN_HOME
        home_directory = MAILMAN_HOME
        user = MAILMAN_USER
        group = MAILMAN_GROUP
.endif

.ifdef PROCMAIL_ENABLE
    procmail_pipe:
        driver = pipe
        environment = "HOME=$home"
        command = "/usr/bin/procmail HOME=$home"
        return_path_add
        delivery_date_add
        envelope_to_add
        check_string = "From "
        escape_string = ">From "
        user = ${extract{1}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}
        group = ${extract{2}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/passwd}}}}
.endif

begin retry
*        *        F,2h,15m; G,16h,1h,1.5; F,4d,6h

begin rewrite
.ifdef MAILMAN_ENABLE
    \N^(.*<)?([^<]*)@([^>]*).*$\N   "${if exists{MAILMAN_HOME/lists/${sg{$2}{-$3.*}{-$3}}/config.pck} {${sg{$0} {-$3} {}}} {$0} }" S
    \N^(.*<)?([^<]*)@([^>]*).*$\N   "${if exists{MAILMAN_HOME/lists/${sg{$2}{-$3.*}{-$3}}/config.pck} {${sg{$0} {-$3} {}}} {$0} }"
.endif

begin authenticators


cram:
  driver = cyrus_sasl
  public_name = CRAM-MD5
  server_set_id = $1

plain:
  driver = cyrus_sasl
  public_name = PLAIN
  server_set_id = $1

login:
  driver = cyrus_sasl
  public_name = LOGIN
  server_set_id = $1