X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=573078841cf8072127002fa4143d377e0077c061;hb=0cc08a73110c15c4e7bbb8c8233a6c122c27490e;hp=c3b11d8109ea7577b1d2315f7e55104af8180bba;hpb=b857462732e15f455e41f26e3048a390d7b399c0;p=distro-setup

diff --git a/mail-setup b/mail-setup
index c3b11d8..5730788 100755
--- a/mail-setup
+++ b/mail-setup
@@ -15,10 +15,18 @@ set -x
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# todo: make quick backups of maildir, or deliver to multiple hosts.
+
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
 [[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+if [[ ! $SUDO_USER ]]; then
+  echo "$0: error: requires running as nonroot or sudo"
+  exit 1
+fi
+u=$SUDO_USER
+
 
 usage() {
   cat <<EOF
@@ -49,10 +57,6 @@ if ! exim && ! postfix; then
   usage 1
 fi
 
-if [[ ! $SUDO_USER ]]; then
-  echo "$0: error: requires running as nonroot or sudo"
-fi
-u=$SUDO_USER
 
 
 ####### begin perstent password instructions ######
@@ -241,7 +245,7 @@ if postfix; then
   if command -v apt-get &> /dev/null; then
     debconf-set-selections <<EOF
 postfix postfix/main_mailer_type select Satellite system
-postfix postfix/mailname string $HOSTNAME
+postfix postfix/mailname string $(hostname -f)
 postfix postfix/relayhost string $relayhost
 postfix postfix/root_address string $postmaster
 EOF
@@ -305,7 +309,9 @@ else # begin exim. has debian specific stuff for now
     # we check that a valid cert is there already.
     # to put the hostname in the known hosts
     if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then
-      openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/openvpn/mail.crt
+      # This just causes failure if our cert is going to expire in the next 30 days.
+      # Certs I generate last 10 years.
+      openssl x509 -checkend $(( 60 * 60 * 24 * 30 )) -noout -in /etc/openvpn/mail.crt
     else
       # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with
       # systemd, buuut it can remake the tun device unexpectedly, i got this in the log
@@ -368,8 +374,7 @@ exim4-config exim4/use_split_config boolean true
 EOF
 
   source /a/bin/bash_unpublished/source-semi-priv
-  exim_main_dir=/etc/exim4/conf.d/main
-  mkdir -p $exim_main_dir
+  mkdir -p /etc/exim4/conf.d/main
 
 
 
@@ -475,6 +480,7 @@ exim4-config exim4/dc_eximconfig_configtype select internet site; mail is sent a
 # This name won\'t appear on From: lines of outgoing messages if rewriting is enabled.
 
 # System mail name:
+# iank: see comment elsewhere on mailname
 exim4-config exim4/mailname string mail.iankelling.org
 
 
@@ -482,7 +488,7 @@ exim4-config exim4/mailname string mail.iankelling.org
 
 # Please enter a semicolon-separated list of recipient domains for which this machine
 # should consider itself the final destination. These domains are commonly called
-# 'local domains'. The local hostname (treetowl.lan) and 'localhost' are always added
+# 'local domains'. The local hostname (kd.lan) and 'localhost' are always added
 # to the list given here.
 
 # By default all local domains will be treated identically. If both a.example and
@@ -547,11 +553,13 @@ exim4-config exim4/dc_postmaster string $postmaster
 # Delivery method for local mail: 2
 exim4-config exim4/dc_localdelivery select Maildir format in home directory
 EOF
+    echo mail.iankelling.org > /etc/mailname
+
     # MAIN_HARDCODE_PRIMARY_HOSTNAME might mess up the
     # smarthost config type, not sure. all other settings
     # would be unused in that config type.
-    cat >$exim_main_dir/000_localmacros <<EOF
-# i don't have ipv6 setup for my tunnel yet.
+    cat >/etc/exim4/conf.d/main/000_localmacros <<EOF
+# i don't have ipv6 setup for my vpn tunnel yet.
 disable_ipv6 = true
 
 MAIN_TLS_ENABLE = true
@@ -569,12 +577,12 @@ DKIM_PRIVATE_KEY= \${if exists{/etc/exim4/\${dkim_domain}-private.pem} {/etc/exi
 
 
 # failing message on mail-tester.com:
-# We check if there is a server (A Record) behind your hostname treetowl.
-# You may want to publish a DNS record (A type) for the hostname treetowl or use a different hostname in your mail software
+# We check if there is a server (A Record) behind your hostname kd.
+# You may want to publish a DNS record (A type) for the hostname kd or use a different hostname in your mail software
 # https://serverfault.com/questions/46545/how-do-i-change-exim4s-primary-hostname-on-a-debian-box
 # and this one seemed appropriate from grepping config.
 # I originally set this to li.iankelling.org, but then ended up with errors when li tried to send
-# mail to treetowl, so this should basically be a name that no host has as their
+# mail to kd, so this should basically be a name that no host has as their
 # canonical hostname since the actual host sits behind a nat and changes.
 # Seems logical for this to be the same as mailname.
 MAIN_HARDCODE_PRIMARY_HOSTNAME = mail.iankelling.org
@@ -695,6 +703,19 @@ ssl_prefer_server_ciphers = yes
 EOF
     ####### end dovecot setup ########
 
+    # https://selivan.github.io/2017/12/30/systemd-serice-always-restart.html
+    d=/etc/systemd/system/openvpn@mail
+    mkdir -p $d
+    cat >$d/override.conf <<'EOF'
+[Service]
+Restart=always
+# time to sleep before restarting a service
+RestartSec=1
+
+[Unit]
+# StartLimitIntervalSec in recent systemd versions
+StartLimitInterval=0
+EOF
 
     systemctl enable offlineimapsync.timer
     systemctl start offlineimapsync.timer
@@ -714,14 +735,17 @@ EOF
     #
     # would only exist because I wrote it i the previous condition,
     # it\'s not part of exim
-    rm -f $exim_main_dir/000_localmacros
+    rm -f /etc/exim4/conf.d/main/000_localmacros
     debconf-set-selections <<EOF
 exim4-config exim4/dc_eximconfig_configtype select mail sent by smarthost; no local mail
 exim4-config exim4/dc_smarthost string $smarthost
-# the default, i think is from /etc/mailname. better to set it to
-# whatever the current fqdn is.
+# afaik, on dpkg-reconfigure noninteractive, this sets /etc/mailname if it does not exist.
+# if it does exist, it immediately changes the value to whats in /etc/mailname.
+# So, I don't think there's any point in setting it, but might as well since
+# ignoring what I set here is brain dead and might change.
 exim4-config exim4/mailname string $(hostname -f)
 EOF
+    hostname -f > /etc/mailname
 
   fi # end $HOSTNAME != $MAIL_HOST
 
@@ -737,11 +761,11 @@ EOF
   # i have the spool directory be common to distro multi-boot, so
   # we need the uid to be the same. 608 cuz it's kind of in the middle
   # of the free system uids.
-  IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ); unset IFS
-  IFS=:; read _ _ gid _ < <(getent group Debian-exim ); unset IFS
+  IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ||:) ||:; unset IFS
+  IFS=:; read _ _ gid _ < <(getent group Debian-exim ||:) ||:; unset IFS
   if [[ ! $uid ]]; then
     # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options
-    adduser --uid 608 --gid 608 --system --group --quiet --home /var/spool/exim4 \
+    adduser --uid 608 --system --group --quiet --home /var/spool/exim4 \
 	    --no-create-home --disabled-login --force-badname Debian-exim
   elif [[ $uid != 608 ]]; then
     systemctl stop exim4 ||: