sudo apt update
sudo apt upgrade
sudo apt install wireguard
mkdir wgkeys
cd wgkeys
umask 077
wg genkey > server_private.key
wg pubkey > server_public.key < server_private.key
wg genkey > client_private.key
wg pubkey > client_public.key < client_private.key
cd
sudo nano /etc/wireguard/wg0.conf
sudo wg-quick up wg0
sudo wg-quick down wg0
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo ufw allow aaaaa/udp

[Interface]
# virtual IP address for server
Address = 192.168.123.200/24

# port for wireguard .  any number available
ListenPort = aaaaa

# server_private.key
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxx

# nat mantra
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# client_public.key
PublicKey = yyyyyyyyyyyyyyyyyyyyyyyyyyy

# virtual IP address in VPN for client 
# allowed virtual IP
AllowedIPs = 192.168.123.100/32

[Interface]
# client_private.key
PrivateKey = zzzzzzzzzzzzzzzzzzzzzzzzzzz

# virtual IP for client
Address = 192.168.123.100/24

[Peer]
# server_public.key
PublicKey = vvvvvvvvvvvvvvvvvvvvvvvvv

# set virtual IP address for VPN server as allowed IPs
AllowedIPs = 192.168.123.200/32,192.168.123.0/24

# set url and port
Endpoint = mydomain:aaaaa

sudo apt install postfix
sudo nano /etc/postfix/main.cf
sudo apt install mailutils
sudo apt install dovecot-imapd

sudo maildirmake.dovecot /etc/skel/Maildir
sudo maildirmake.dovecot /etc/skel/Maildir/.Drafts
sudo maildirmake.dovecot /etc/skel/Maildir/.Sent
sudo maildirmake.dovecot /etc/skel/Maildir/.Spam
sudo maildirmake.dovecot /etc/skel/Maildir/.Trash
sudo maildirmake.dovecot /etc/skel/Maildir/.Templates

sudo nano /etc/postfix/main.cf

myhostname = example.com
mydomain = example.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24
inet_protocols = ipv4
home_mailbox = Maildir/

#  以下追加
mailbox_command =
smtpd_helo_restrictions =
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_invalid_helo_hostname,
        reject_non_fqdn_helo_hostname,
        reject_unknown_helo_hostname,
        check_helo_access hash:/etc/postfix/helo_access
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes

sudo nano /etc/postfix/helo_access

aaa.bb.cc.ddd  REJECT        # aaa.bb.cc.ddd はexample.comのIPアドレス
# example.com   REJECT
smtp.example.com   REJECT
mail.example.com   REJECT

sudo nano /etc/postfix/master.cf

587      inet  n       -       y       -       -       smtpd     #smtpを587にした

sudo nano /etc/dovecot/dovecot.conf

listen = *

sudo nano /etc/dovecot/conf.d/10-mail.conf

mail_location = ~/Maildir

sudo nano /etc/dovecot/conf.d/10-master.conf

service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }

service auth {
        unix_listener /var/spool/postfix/private/auth {
                mode = 0660
                user = postfix
                group = postfix
        }
}

sudo nano /etc/dovecot/conf.d/10-auth.conf

disable_plaintext_auth = no
auth_mechanisms = plain login

sudo nano /etc/dovecot/conf.d/10-ssl.conf

ssl = yes

ssl_cert = </etc/dovecot/dovecot.pem       #  private/ を消すことに注意
ssl_key = </etc/dovecot/private/dovecot.pem　　# .keyを.pemにすることに注意

ssl_min_protocols = TLSv1.2

sudo adduser testuser

printf '\0%s\0%s' 'testuser' 'password' | openssl base64
cd /etc/dovecot
sudo openssl req -new -x509 -nodes -config /usr/share/dovecot/dovecot-openssl.cnf -out dovecot.pem -keyout private/dovecot.pem -days 365