X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=041ab1d58db145e8ea8a2d8af07a1d60eb4db073;hb=6cc73025405b7a540eec371d1d8f7d9d13d8e019;hp=ea2b1f25ec13763495629935b965799c5e8d044a;hpb=2a1cee2e73d9291dde9af831bbe9e996199b7cbc;p=distro-setup diff --git a/mail-setup b/mail-setup index ea2b1f2..041ab1d 100755 --- a/mail-setup +++ b/mail-setup @@ -4,10 +4,6 @@ # SPDX-License-Identifier: AGPL-3.0-or-later -# todo: install new alertmanager, like new prometheus - -# todo: setup a logrotate for /var/log/mymain and mypanic - # todo: setup an alert for bouncing test emails. # todo: bounces to my fsf mail can come from fsf@iankelling.org, @@ -22,7 +18,6 @@ # todo: harden dovecot. need to do some research. one way is for it to only listen on a wireguard vpn interface, so only clients that are on the vpn can access it. # todo: consider hardening cups listening on 0.0.0.0 # todo: stop/disable local apache, and rpc.mountd, and kdeconnect when not in use. -# todo: check that spamd and unbound only listen locally. # todo: hosts should only allow external mail that is authed and # destined for backup route. it is a minor issue since traffic is @@ -34,10 +29,6 @@ # todo: run mailping test after running, or otherwise # clear out terminal alert -# todo: on bk, dont send email if mailvpn is not up - -# todo: mailtest-check should check on bk too - # todo: disable postgrey # todo: in testforward-check, we should also look @@ -395,6 +386,7 @@ EOF fi # light version of exim does not have sasl auth support. +# note: for bitfolk hosts, unbound has important config with conflink. pi-nostart exim4 exim4-daemon-heavy spamassassin unbound clamav-daemon wireguard # note: pyzor debian readme says you need to run some initialization command @@ -1097,6 +1089,11 @@ bk.b8.nz * F,1d,4m;F,14d,1h eggs.gnu.org * F,1d,4m;F,14d,1h fencepost.gnu.org * F,1d,4m;F,14d,1h +# afaik our retry doesnt need this, but just using everything +mx.amnimal.ninja * F,1d,4m;F,14d,1h +mx.expertpathologyreview.com * F,1d,4m;F,14d,1h + + mail.fsf.org * F,1d,15m;F,14d,1h EOF @@ -1211,6 +1208,7 @@ accept EOF rm -fv /etc/exim4/data_local_acl # old path + i /etc/exim4/conf.d/data_local_acl <<'EOF' # Except for the "condition =", this was # a comment in the check_data acl. The comment about this not @@ -1229,6 +1227,9 @@ warn warn !hosts = +iank_trusted + # They dont send spam, but needed this because + # smarthosts connect with residential ips and thus get flagged as spam. + !authenticated = plain_server:login_server condition = ${if < {$message_size}{5000K}} spam = Debian-exim:true add_header = X-Spam_score_int: $spam_score_int @@ -1238,6 +1239,7 @@ warn add_header = X-Spam_action: $spam_action warn + !authenticated = plain_server:login_server condition = ${if def:malware_name} remove_header = Subject: add_header = Subject: [Clamav warning: $malware_name] $h_subject @@ -2979,6 +2981,27 @@ case $HOSTNAME in # this makes it easier to see which exim is doing what log_file_path = /var/log/exim4/my%s EOF + + cat >/etc/logrotate.d/myexim <<'EOF' +/var/log/exim4/mymain /var/log/exim4/myreject { + daily + missingok + rotate 1000 + delaycompress + notifempty + nocreate +} +/var/log/exim4/mypanic { + size 10M + missingok + rotate 10 + compress + delaycompress + notifempty + nocreate +} +EOF + # If we ever wanted to have a separate spool, # we could do it like this. # cat >>/etc/exim4/conf.d/main/000_local-nn <<'EOF' @@ -3178,18 +3201,36 @@ case $HOSTNAME in # note: cronjob "ian" also does some important monitoring # todo: this will sometimes cause an alert because mailtest-check will run # before we have setup network namespace and spamassassin - cat >/etc/cron.d/mailtest < /etc/exim4/ignore-sent - for t in ${test_tos[@]:1}; do - test_to+=", $t" + rm -f /etc/exim4/ignore-sent + for t in ${test_tos[@]}; do echo $t >> /etc/exim4/ignore-sent done + cat >/usr/local/bin/send-test-forward <<'EOF' #!/bin/bash +# we remove from the queue older than 4.3 minutes since we send every 5 minutes. olds=( $(/usr/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') ) @@ -3227,6 +3277,17 @@ if (( ${#olds[@]} )); then fi EOF for test_from in ${test_froms[@]}; do + + test_to=${test_tos[0]} + for t in ${test_tos[@]:1}; do + test_to+=", $t" + done + case $test_from in + testignore@expertpathologyreview.com) + test_to=testignore@zroe.org + ;; + esac + cat >>/usr/local/bin/send-test-forward <