upstream-zulip/zerver/management/commands/email_server.py

import os
import ssl
from typing import Any

from django.core.management.base import BaseCommand, CommandParser
from typing_extensions import override

from zerver.lib.email_mirror_server import parse_listen_address, run_smtp_server


class Command(BaseCommand):
    help = """SMTP server to ingest incoming emails"""

    @override
    def add_arguments(self, parser: CommandParser) -> None:
        parser.add_argument(
            "--listen",
            help="[Port, or address:port, to bind the SMTP server to; "
            "enclose IPv6 addresses in square brackets]",
            default="25",
        )
        parser.add_argument(
            "--user",
            help="User to drop privileges to, if started as root.",
            required=(os.geteuid() == 0),
        )
        parser.add_argument(
            "--group",
            help="Group to drop privileges to, if started as root.",
            required=(os.geteuid() == 0),
        )
        tls_cert: str | None = None
        tls_key: str | None = None
        if os.access("/etc/ssl/certs/zulip.combined-chain.crt", os.R_OK) and os.access(
            "/etc/ssl/private/zulip.key", os.R_OK
        ):
            tls_cert = "/etc/ssl/certs/zulip.combined-chain.crt"
            tls_key = "/etc/ssl/private/zulip.key"
        elif os.access("/etc/ssl/certs/ssl-cert-snakeoil.pem", os.R_OK) and os.access(
            "/etc/ssl/private/ssl-cert-snakeoil.key", os.R_OK
        ):
            tls_cert = "/etc/ssl/certs/ssl-cert-snakeoil.pem"
            tls_key = "/etc/ssl/private/ssl-cert-snakeoil.key"
        parser.add_argument(
            "--tls-cert",
            help="Path to TLS certificate chain file",
            default=tls_cert,
        )
        parser.add_argument(
            "--tls-key",
            help="Path to TLS private key file",
            default=tls_key,
        )

    @override
    def handle(self, *args: Any, **options: Any) -> None:
        host, port = parse_listen_address(options["listen"])
        if options["tls_cert"] and options["tls_key"]:
            tls_context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
            tls_context.load_cert_chain(options["tls_cert"], options["tls_key"])
        else:
            tls_context = None

        run_smtp_server(options["user"], options["group"], host, port, tls_context)