2 # I, Ian Kelling, follow the GNU license recommendations at
3 # https://www.gnu.org/licenses/license-recommendations.en.html. They
4 # recommend that small programs, < 300 lines, be licensed under the
5 # Apache License 2.0. This file contains or is part of one or more small
6 # programs. If a small program grows beyond 300 lines, I plan to switch
9 # Copyright 2024 Ian Kelling
11 # Licensed under the Apache License, Version 2.0 (the "License");
12 # you may not use this file except in compliance with the License.
13 # You may obtain a copy of the License at
15 # http://www.apache.org/licenses/LICENSE-2.0
17 # Unless required by applicable law or agreed to in writing, software
18 # distributed under the License is distributed on an "AS IS" BASIS,
19 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20 # See the License for the specific language governing permissions and
21 # limitations under the License.
24 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
26 [[ $EUID == 0 ]] ||
exec sudo
-E "${BASH_SOURCE[0]}" "$@"
30 # For first run, accept host key. Note, known_hosts is saved in /p.
32 opt
=(-e 'ssh -oStrictHostKeyChecking=no')
41 f
=/a
/bin
/bash_unpublished
/source-state
43 # shellcheck source=/a/bin/bash_unpublished/source-state
50 if $interactive && (( ret
>=1 )); then
51 echo "$0: ERROR: exit $ret on: $*"
55 # note: when certificate is expired, you will get this in /var/log/mail.log when k-9 mail tries to fetch:
56 # imap-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000416:SSL routines::sslv3 alert certificate unknown: SSL alert number 46 (no auth attempts in 0 secs): user=<>, rip=redacted, lip=10.8.0.4, TLS handshaking: SSL_accept() failed: error:0A000416:SSL routines::sslv3 alert certificate unknown: SSL alert number 46, session=<EsdzzmAWosNKXpza
60 # ||: is to allow for temporary connection issues.
61 try rsync
"${opt[@]}" -ogtL --chown=root
:Debian-exim
--chmod=640 \
62 root@li.iankelling.org
:/etc
/letsencrypt
/live
/mail.iankelling.org
/{fullchain.pem
,privkey.pem
} /etc
/exim4
63 if ! openssl x509
-checkend $
(( 60 * 60 * 24 * 3 )) -noout -in /etc
/exim
4/fullchain.pem
; then
64 echo "$0: error!: cert rsync failed and it will expire in less than 3 days"
70 # note: exim spec, 5.3 command line option -bd says that all files except
71 # .include "are reread each time they are used."