-# offlineimap uses this too, it is much easier to use one location than to
-# condition it\'s config and postfix\'s config
-case $distro in
- fedora) s lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt ;;
- *) :
-esac
-
-if postfix; then
- # dunno why, but debian installed postfix with builddep emacs
- # but I will just explicitly install it here since
- # I use it for sending mail in emacs.
- if isdeb; then
- s debconf-set-selections <<EOF
-postfix postfix/main_mailer_type select Satellite system
-postfix postfix/mailname string $HOSTNAME
-postfix postfix/relayhost string $relayhost
+cat >/etc/systemd/system/mailclean.service <<EOF
+[Unit]
+Description=Delete and archive old mail files
+After=multi-user.target
+
+[Service]
+User=$u
+Type=oneshot
+ExecStart=/a/bin/log-quiet/sysd-mail-once mailclean /a/bin/distro-setup/mailclean
+EOF
+
+systemctl daemon-reload
+
+# wording of question from dpkg-reconfigure exim4-config
+# 1. internet site; mail is sent and received directly using SMTP
+# 2. mail sent by smarthost; received via SMTP or fetchmail
+# 3. mail sent by smarthost; no local mail
+# 4. local delivery only; not on a network
+# 5. no configuration at this time
+#
+# Note, I have used option 2 in the past for receiving mail
+# from lan hosts, sending external mail via another smtp server.
+#
+# Note, other than configtype, we could set all the options in
+# both types of configs without harm, they would either be
+# ignored or be disabled by other settings, but the default
+# local_interfaces definitely makes things more secure.
+
+# most of these settings get translated into settings
+# in /etc/exim4/update-exim4.conf.conf
+# how /etc/exim4/update-exim4.conf.conf translates into actual exim settings is
+# documented in man update-exim4.conf, which outputs to the config that
+# exim actually reads. except the man page is not perfect, for example,
+# it doesn't document that it sets
+# DCconfig_${dc_eximconfig_configtype}" "1"
+# which is a line from update-exim4.conf, which is a relatively short bash script.
+# mailname setting sets /etc/mailname
+
+debconf-set-selections <<EOF
+exim4-config exim4/use_split_config boolean true
+EOF
+
+source /a/bin/bash_unpublished/source-semi-priv
+mkdir -p /etc/exim4/conf.d/{main,transport,auth,router}
+
+cat >/etc/exim4/rcpt_local_acl <<'EOF'
+# Only hosts we control send to mail.iankelling.org, so make sure
+# they are all authed.
+# Note, if we wanted authed senders for all domains,
+# we could make this condition in acl_check_mail
+deny
+ message = ian trusted domain recepient but no auth
+ !authenticated = *
+ domains = mail.iankelling.org