X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=04e96617a20a85c64b1b550dea1e51673f13717f;hb=f0a35267f28e274ef3c2f63ffc20a26ca864e37c;hp=afbc1945d553102a2aaef46f22a85194b20e0ed3;hpb=aeb3f88455a90def90a645a7b5567d55dda18339;p=distro-setup diff --git a/mail-setup b/mail-setup index afbc194..04e9661 100755 --- a/mail-setup +++ b/mail-setup @@ -27,6 +27,15 @@ Setup exim4 / postfix / dovecot The minimal assumption we have is that /etc/mailpass exists + +I've had problems with postfix on debian: +on stretch, a startup ordering issue caused all mail to fail. +postfix changed defaults to only use ipv6 dns, causing all my mail to fail. +I haven't gotten around to getting a non-debian exim +setup. + + + -h|--help Print help and exit. EOF exit $1 @@ -117,6 +126,7 @@ u=$SUDO_USER # echo "dmarc dns, name: _dmarc value: v=DMARC1; p=none; rua=mailto:mailauth-reports@$domain" # # 2017-02 spf policies: +# # host -t txt lists.fedoraproject.org # # google ~all, hotmail -all, yahoo: ?all, fastmail ?all # # i include fastmail\'s settings, per their instructions, # # and follow their policy. In mail in a box, or similar instructions, @@ -176,6 +186,18 @@ postconfin() { postconf -ev "${MAPFILE[@]}" } e() { printf "%s\n" "$*"; } +pi() { # package install + local s f + if dpkg -s -- "$@" &> /dev/null; then + return 0; + fi; + while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done + f=/var/cache/apt/pkgcache.bin; + if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*12 )); then + apt-get update + fi + apt-get -y install --purge --auto-remove "$@" +} postmaster=$u mxhost=mail.iankelling.org @@ -224,9 +246,10 @@ postfix postfix/relayhost string $relayhost postfix postfix/root_address string $postmaster EOF if dpkg -s postfix &>/dev/null; then + while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done dpkg-reconfigure -u -fnoninteractive postfix else - apt-get -y install --purge --auto-remove postfix + pi postfix fi else source /a/bin/distro-functions/src/package-manager-abstractions @@ -275,41 +298,29 @@ EOF else # begin exim. has debian specific stuff for now - if ! dpkg -s openvpn &>/dev/null; then - apt-get -y install --purge --auto-remove openvpn - fi + pi openvpn if [[ -e /p/c/filesystem ]]; then + # allow failure of these commands when our internet is down, they are likely not needed, + # we check that a valid cert is there already. # to put the hostname in the known hosts - ssh -o StrictHostKeyChecking=no root@li.iankelling.org : - /a/exe/vpn-mk-client-cert -b mail -n mail li.iankelling.org + if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then + openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/openvpn/mail.crt + else + # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with + # systemd, buuut it can remake the tun device unexpectedly, i got this in the log + # after my internet was down for a bit: + # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. + /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org + fi fi - cat >/etc/systemd/system/mailroute.service </etc/systemd/system/offlineimapsync.timer <<'EOF' [Unit] -Description=Run offlineimap-sync once every 5 mins +Description=Run offlineimap-sync once every min [Timer] -OnCalendar=*:0/5 +OnCalendar=*:0/1 [Install] WantedBy=timers.target @@ -326,7 +337,6 @@ Type=oneshot ExecStart=/a/bin/log-quiet/sysd-mail-once offlineimap-sync /a/bin/distro-setup/offlineimap-sync EOF systemctl daemon-reload - systemctl enable mailroute # wording of question from dpkg-reconfigure exim4-config # 1. internet site; mail is sent and received directly using SMTP @@ -379,8 +389,21 @@ if [[ $HOSTNAME == $MAIL_HOST ]]; then local_mx=mail.iankelling.org rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/" ${rsync_common}fullchain.pem /etc/exim4/exim.crt + ret=$? ${rsync_common}privkey.pem /etc/exim4/exim.key + new_ret=$? + if [[ $ret != $new_ret ]]; then + echo "$0: error: differing rsync returns, $ret, $new_ret" + exit 1 + fi +fi +if [[ $new_ret != 0 ]]; then + if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then + echo "$0: error!: cert rsync failed and it will expire in less than 3 days" + exit 1 + fi fi +exit 0 EOF chmod 755 $f @@ -597,8 +620,7 @@ EOF # sieve has the benefit of being supported in postfix and # proprietary/weird environments, so there is more examples on the # internet. I was torn about whether to do this or not, meh. - apt-get -y install --purge --auto-remove \ - dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd + pi dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd # if we changed 90-sieve.conf and removed the active part of the # sieve option, we wouldn\'t need this, but I\'d rather not modify a @@ -708,6 +730,7 @@ EOF # gotta remove this, otherwise the set-selections are completely # ignored. It woulda been nice if this was documented somewhere! rm -f /etc/exim4/update-exim4.conf.conf + while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done dpkg-reconfigure -u -fnoninteractive exim4-config fi @@ -730,7 +753,7 @@ EOF fi # light version of exim does not have sasl auth support. - apt-get -y install --purge --auto-remove exim4-daemon-heavy spamassassin + pi exim4-daemon-heavy spamassassin @@ -850,6 +873,28 @@ dovecot_lmtp: batch_max = 200 EOF + cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' +# smarthost for fsf mail +# ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and +# replaced DCsmarthost with mail.fsf.org +fsfsmarthost: + debug_print = "R: smarthost for $local_part@$domain" + driver = manualroute + domains = ! +local_domains + senders = *@fsf.org + transport = remote_smtp_smarthost + route_list = * mail.fsf.org byname + host_find_failed = ignore + same_domain_copy_routing = yes + no_more +EOF + + # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost + # i only need .forwards, so just doing that one. + cd /etc/exim4/conf.d/router + b=userforward_higher_priority + # replace the router name so it is unique + sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b # begin setup passwd.client f=/etc/exim4/passwd.client @@ -861,71 +906,68 @@ EOF done # end setup passwd.client - # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost - # i only need .forwards, so just doing that one. - cd /etc/exim4/conf.d/router - b=userforward_higher_priority - # replace the router name so it is unique - sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b + # by default, only 10 days of logs are kept. increase that. + sed -ri 's/^(\s*rotate\s).*/\11000/' /etc/logrotate.d/exim4-base + systemctl restart exim4 -fi #### end if exim4 + fi #### end if exim4 -# /etc/alias setup is debian specific, and -# exim config sets up an /etc/alias from root to the postmaster, which i -# config to ian, as long as there exists an entry for root, or there was -# no preexisting aliases file. based on the postinst file. postfix -# won\'t set up a root to $postmaster alias if it\'s already installed. -# Since postfix is not the greatest, just set it ourselves. -if [[ $postmaster != root ]]; then - sed -i --follow-symlinks -f - /etc/aliases </dev/null; then - if [[ $HOSTNAME == $MAIL_HOST ]]; then - systemctl restart radicale - systemctl enable radicale - if [[ -e /etc/logrotate.d/radicale.disabled ]]; then - mv /etc/logrotate.d/radicale{.disabled,} - fi - else - systemctl stop radicale - systemctl disable radicale + newaliases + fi + + # put spool dir in directory that spans multiple distros. + # based on http://www.postfix.org/qmgr.8.html and my notes in gnus + # + # todo: I\'m suspicious of uids for Debian-exim being the same across + # distros. It would be good to test this. + dir=/nocow/$type + sdir=/var/spool/$type + # we only do this if our system has $dir + if [[ -e /nocow && $(readlink -f $sdir) != $dir ]]; then + systemctl stop $type + if [[ ! -e $dir && -d $sdir ]]; then + mv $sdir $dir + fi + /a/exe/lnf -T $dir $sdir + fi + + systemctl restart $type + systemctl enable $type + + # MAIL_HOST also does radicale, and easier to start and stop it here + # for when MAIL_HOST changes, so radicale gets the synced files and + # does not stop us from remounting /o. + if dpkg -s radicale &>/dev/null; then + if [[ $HOSTNAME == $MAIL_HOST ]]; then + systemctl restart radicale + systemctl enable radicale + if [[ -e /etc/logrotate.d/radicale.disabled ]]; then + mv /etc/logrotate.d/radicale{.disabled,} + fi + else + systemctl stop radicale + systemctl disable radicale # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. if [[ -e /etc/logrotate.d/radicale ]]; then mv /etc/logrotate.d/radicale{,.disabled} fi - fi -fi -exit 0 + fi + fi + exit 0 -# if I wanted the from address to be renamed and sent to a different address, -# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical -# sudo postmap hash:/etc/postfix/recipient_canonical -# sudo service postfix reload + # if I wanted the from address to be renamed and sent to a different address, + # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical + # sudo postmap hash:/etc/postfix/recipient_canonical + # sudo service postfix reload