X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=5c5ccae88509f5b3f27badec8d96c92eefb94bad;hb=4e735a2e1807351e4a11f2fe4cda427e18e0d550;hp=f7f1fc56a853dc6c8ddc2a8b8e4e6e51f41cc859;hpb=5e45ae077e790c0e798f09ffad8ecd3cb6c3bb28;p=distro-setup

diff --git a/mail-setup b/mail-setup
index f7f1fc5..5c5ccae 100755
--- a/mail-setup
+++ b/mail-setup
@@ -369,7 +369,7 @@ fi
 bhost_t=false
 case $HOSTNAME in
   $MAIL_HOST) : ;;
-  kd|frodo|x2|x3|kw|sy)
+  kd|frodo|x2|x3|kw|sy|bo)
     bhost_t=true
     ;;
 esac
@@ -483,7 +483,10 @@ case $HOSTNAME in
     ;;
 esac
 
-i /etc/systemd/system/wg-quick@wgmail.service.d/override.conf <<EOF
+case $HOSTNAME in
+  li) : ;;
+  *)
+    i /etc/systemd/system/wg-quick@wgmail.service.d/override.conf <<EOF
 [Unit]
 Requires=mailnn.service
 After=network.target mailnn.service
@@ -495,6 +498,9 @@ PrivateNetwork=true
 # i dont think we need any of these, but it doesnt hurt to stay consistent
 BindPaths=$bindpaths
 EOF
+    ;;
+esac
+
 
 # https://selivan.github.io/2017/12/30/systemd-serice-always-restart.html
 i /etc/systemd/system/mailvpn.service <<EOF
@@ -535,7 +541,7 @@ PrivateNetwork=true
 BindPaths=$bindpaths
 Restart=always
 # time to sleep before restarting a service
-RestartSec=1
+RestartSec=20
 
 [Install]
 WantedBy=multi-user.target
@@ -557,7 +563,7 @@ PrivateNetwork=true
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /a/bin/newns/newns -n 10.173.8 start mail
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /a/bin/newns/newns stop mail
 Restart=always
-RestartSec=10
+RestartSec=20
 
 
 [Install]
@@ -592,7 +598,7 @@ Type=simple
 ExecStart=/usr/local/bin/mailbindwatchdog $vpnser ${nn_progs[@]} unbound.service radicale.service
 Restart=always
 # time to sleep before restarting a service
-RestartSec=1
+RestartSec=10
 
 [Install]
 WantedBy=multi-user.target
@@ -669,7 +675,7 @@ PrivateNetwork=true
 BindPaths=$bindpaths
 
 Restart=always
-RestartSec=1
+RestartSec=20
 EOF
 
     # sooo, there are a few ways to get traffic from the mail network
@@ -720,7 +726,7 @@ PrivateNetwork=true
 BindPaths=$bindpaths
 
 Restart=always
-RestartSec=1
+RestartSec=20
 EOF
     done
     ;;
@@ -846,7 +852,7 @@ awk 'BEGIN { FS = ":" } ; $6 ~ /^\/home/ && $7 !~ /\/nologin$/ { print $1 }' /et
   case $HOSTNAME in
     $MAIL_HOST)
       sed -i "/^user:/d" /etc/aliases
-    ;;
+      ;;
     *)
       if ! grep -q "^$user:" /etc/aliases; then
         echo "$user: root" |m tee -a /etc/aliases
@@ -1271,7 +1277,7 @@ PrivateNetwork=true
 BindPaths=$bindpaths
 Restart=always
 # time to sleep before restarting a service
-RestartSec=1000
+RestartSec=20
 
 [Install]
 # for openvpn
@@ -1418,7 +1424,6 @@ ssl = required
 ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
 ssl_protocols = TLSv1.2
 ssl_prefer_server_ciphers = no
-ssl_dh_parameters_length = 2048
 
 protocol lmtp {
 #per https://wiki2.dovecot.org/Pigeonhole/Sieve/Configuration
@@ -1730,7 +1735,7 @@ if [[ $HOSTNAME == bk ]]; then
 
   #### begin dl roundcube
   # note, im r2e subbed to https://github.com/roundcube/roundcubemail/releases.atom
-  v=1.4.11; f=roundcubemail-$v-complete.tar.gz
+  v=1.4.13; f=roundcubemail-$v-complete.tar.gz
   cd /a/opt
   if [[ -e $f ]]; then
     timestamp=$(stat -c %Y $f)
@@ -1969,7 +1974,7 @@ EOF
   m phpenmod -v php mcrypt imap
   # dpkg says this is required
   m a2enmod proxy_fcgi setenvif
-  fpm=$(dpkg-query -s php-fpm | sed -nr 's/^Depends:.* (php[^ ]*-fpm)( .*|$)/\1/p') # eg: php7.3-fpm
+  fpm=$(dpkg-query -s php-fpm | sed -nr 's/^Depends:.* (php[^ ]*-fpm)( .*|$)/\1/p') # eg: php7.4-fpm
   phpver=$(dpkg-query -s php-fpm | sed -nr 's/^Depends:.* php([^ ]*)-fpm( .*|$)/\1/p')
   m a2enconf $fpm
   # 3 useless guides on php fpm fcgi debian 10 later, i figure out from reading
@@ -2242,7 +2247,6 @@ EOF
 CHECK_RCPT_VERIFY_SENDER = true
 # default config comment says: If you enable this, you might reject legitimate mail,
 # but eggs has had this a long time, so that seems unlikely.
-CHECK_DATA_VERIFY_HEADER_SYNTAX = true
 CHECK_RCPT_SPF = true
 CHECK_RCPT_REVERSE_DNS = true
 CHECK_MAIL_HELO_ISSUED = true
@@ -2372,6 +2376,7 @@ ignore_target_hosts = ${HOSTNAME}wg.b8.nz
 # note changes here also require change in passwd.client
 route_list = * eximbackup.b8.nz
 same_domain_copy_routing = yes
+errors_to = alerts@iankelling.org
 no_more
 EOF
 
@@ -2385,9 +2390,8 @@ backup_remote:
 .endif
   hosts_require_auth = *
   hosts_try_auth = *
-  return_path = alerts@iankelling.org
   envelope_to_add
-  # manual return path because we dont want it to be the envelope sender
+  # manual return path because we want it to be the envelope sender
   # we got not the one we are using in this smtp transport
   headers_add = "Return-path: $sender_address"
 .ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
@@ -2425,10 +2429,10 @@ EOF
 
     # this avoids some error. i cant remember what. todo:
     # test it out and document why/if its needed.
-    i /etc/exim4/host_local_deny_exceptions <<'EOF'
-mail.fsf.org
-*.posteo.de
-EOF
+    #     i /etc/exim4/host_local_deny_exceptions <<'EOF'
+    # mail.fsf.org
+    # *.posteo.de
+    # EOF
 
     # cron email from smarthost hosts will automatically be to
     # USER@FQDN. I redirect that to alerts@, on the smarthosts, but in
@@ -2558,7 +2562,7 @@ StartLimitIntervalSec=0
 [Service]
 Restart=always
 # time to sleep before restarting a service
-RestartSec=1
+RestartSec=20
 EOF
 
     i /etc/default/exim4in <<'EOF'
@@ -2630,7 +2634,10 @@ EOF
     echo | /a/exe/cedit nn /etc/hosts || [[ $? == 1 ]]
     echo | /a/exe/cedit mail /etc/dnsmasq-servers.conf || [[ $? == 1 ]]
 
+
     if $bhost_t; then
+      install -d /bu
+      install -d -g $u -o $u -m 771 /bu/md
       i /etc/exim4/conf.d/transport/30_backup_maildir <<EOF
 # modified debian maildir transport
 backup_maildir:
@@ -2656,12 +2663,23 @@ backup_local:
   transport = backup_maildir
 EOF
 
+      # Bind to wghole to receive mailbackup.
       wgholeip=$(sed -rn 's/^ *Address *= *([^/]+).*/\1/p' /etc/wireguard/wghole.conf)
       cat >>/etc/exim4/update-exim4.conf.conf <<EOF
 dc_other_hostnames='eximbackup.b8.nz'
 dc_local_interfaces='127.0.0.1;::1;$wgholeip'
+EOF
+
+      # wghole & thus exim will fail to start without internet connectivity.
+      i /etc/systemd/system/exim4.service.d/backup.conf <<'EOF'
+[Unit]
+StartLimitIntervalSec=0
 
+[Service]
+Restart=always
+RestartSec=20
 EOF
+
     else
       cat >>/etc/exim4/update-exim4.conf.conf <<EOF
 # Note: If theres like a temporary problem where mail gets sent to
@@ -2669,6 +2687,7 @@ EOF
 # instead of a permanent 5xx.
 dc_local_interfaces='127.0.0.1;::1'
 EOF
+      rm -fv /etc/systemd/system/exim4.service.d/backup.conf
     fi
     cat >>/etc/exim4/update-exim4.conf.conf <<EOF
 dc_eximconfig_configtype='smarthost'
@@ -2694,6 +2713,11 @@ case $HOSTNAME in
   $MAIL_HOST|bk)
     # config for the non-nn exim
     m rsync -ra --delete /etc/exim4/ /etc/myexim4
+    # If we ever wanted to have a separate spool,
+    # we could do it like this.
+    #     cat >>/etc/exim4/conf.d/main/000_local-nn <<'EOF'
+    # spool_directory = /var/spool/myexim4
+    # EOF
     cat >>/etc/myexim4/update-exim4.conf.conf <<'EOF'
 dc_eximconfig_configtype='smarthost'
 dc_smarthost='nn.b8.nz'
@@ -2865,7 +2889,7 @@ sre exim4
 case $HOSTNAME in
   $MAIL_HOST)
     m systemctl --now enable mailbindwatchdog
-  ;;
+    ;;
   *)
     soff mailbindwatchdog
     ;;
@@ -2906,7 +2930,7 @@ EOF
     test_to="testignore@expertpathologyreview.com, testignore@je.b8.nz, testignore@amnimal.ninja, jtuttle@gnu.org"
 
     cat >>/etc/cron.d/mailtest <<EOF
-2   * * * *   $u check-remote-mailqs |& log-once check-remote-mailqs
+2   * * * *   root check-remote-mailqs |& log-once check-remote-mailqs
 EOF
     ;;&
   bk)