X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=667f0ec47f85a27a14f547b54cd6cfcb691dae03;hb=06a56540b041accaaff795ad57664e368cb07a10;hp=f17b3afe81d5b79f2e203f6b0a92116e0dc630ae;hpb=d6def754cd241538c61456536b52ee51cbd85b42;p=distro-setup diff --git a/mail-setup b/mail-setup index f17b3af..667f0ec 100755 --- a/mail-setup +++ b/mail-setup @@ -3,11 +3,37 @@ # Copyright (C) 2019 Ian Kelling # SPDX-License-Identifier: AGPL-3.0-or-later +# Things I tend to forget. on MAIL_HOST, daemon runs with /etc/exim4/my.conf, +# due to /etc/default/exim4 containing: +# COMMONOPTIONS='-C /etc/exim4/my.conf' +# UPEX4OPTS='-o /etc/exim4/my.conf' +# +# The non-daemon config +# gets generated from this script calling update-exim4.conf -d /etc/myexim4 +# which has log path +# log_file_path = /var/log/exim4/my%s +# +# On non bk|MAIL_HOST, the config and log file are all standard. +# +# eximbackup folder is /bu/md +# it is cleaned up by mail-backup-clean, which is run by btrbk-run + +# shellcheck disable=SC2254 # makes for a lot of unneeded quotes + + # perusing through /el/mainlog without test messages: # &!testignore|jtuttle| # #&! testignore|jtuttle|eximbackup|/usr/sbin/exim4 -bpu +# todo: this message seems to get dropped on the floor, it was due to a missing 2nd colon in +# condition = ${if def:h_fdate:} +# Figure out how to avoid this message being discarded. + +# 2023-09-12 01:41:43 [722371] 1qfw9f-0031v9-0S <= ian@iankelling.org U=iank P=local S=483 id=87cyyogd7t.fsf@iankelling.org T="iank2" from for testignore@amnimal.ninja +# 2023-09-12 01:41:43 [722373] 1qfw9f-0031v9-0S H=nn.b8.nz [10.173.8.2]: SMTP error from remote mail server after pipelined end of data: 451 Temporary local problem - please try later +# 2023-09-12 01:41:43 [722372] 1qfw9f-0031v9-0S == testignore@amnimal.ninja R=smarthost T=remote_smtp_smarthost defer (-46) H=nn.b8.nz [10.173.8.2] DT=0s: SMTP error from remote mail server after pipelined end of data: 451 Temporary local problem - please try later + # todo: check new macro DKIM_TIMESTAMPS # todo: check if REMOTE_SMTP_INTERFACE or REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE can simplify my or fsfs config @@ -287,7 +313,7 @@ fi # * functions & constants -pre="${0##*/}:" +pre="${0##*/}:${SSH_CLIENT:+ $HOSTNAME:}" m() { printf "$pre %s\n" "$*"; "$@"; } e() { printf "$pre %s\n" "$*"; } err() { printf "$pre %s\n" "$*" >&2; exit 1; } @@ -478,6 +504,9 @@ EOF # * clamav +# old file. remove when all hosts updated, 2023-09-11 +rm -fv /etc/exim4/conf.d/clamav_data_acl + m usermod -a -G Debian-exim clamav u /etc/systemd/system/clamav-daemon.service.d/fix.conf </etc/exim4/conf.d/main/30_local <&2 - # rm -fv composer-setup.php - # exit 1 - # fi - # m php composer-setup.php --quiet - # rm -fv composer-setup.php - # m mv composer.phar /usr/local/bin - - # the above method gets composer2, carddav plugin at least doesnt work with that - # yet, it was just released 10-24-2020. - m cd /usr/local/bin - m wget -nv -N https://getcomposer.org/composer-1.phar - chmod +x composer-1.phar + cd /usr/local/bin + EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')" + php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" + ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")" + + if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ] + then + >&2 echo 'ERROR: Invalid installer checksum' + rm composer-setup.php + exit 1 + fi + + php composer-setup.php --quiet + rm composer-setup.php + + # based on error when running composer + mkdir -p /var/www/.composer + chown www-data:www-data /var/www/.composer + ### end composer install rcdirs=(/usr/local/lib/rcexpertpath /usr/local/lib/rcninja) - ncdirs=(/var/www/ncninja) ncdirs=(/var/www/ncexpertpath /var/www/ncninja) # point debian cronjob to our local install, preventing daily cron error @@ -2252,8 +2352,6 @@ if [[ $HOSTNAME == bk ]]; then rcdir=${rcdirs[i]} rcbase=${rcdir##*/} ncdir=${ncdirs[i]} - myncdir=/root/${ncdir##*/} - mkdir -p $myncdir # copied from debians cronjob u /etc/cron.d/$rcbase <$verf @@ -2520,7 +2618,9 @@ EOF for ((i=0; i < ${#bkdomains[@]}; i++)); do domain=${bkdomains[i]} ncdir=${ncdirs[i]} + myncdir=/var/local/${ncdir##*/} ncbase=${ncdir##*/} + mkdir -p $myncdir m cd /var/www if [[ ! -e $ncdir/index.php ]]; then # if we wanted to only install a specific version, use something like @@ -2540,13 +2640,16 @@ EOF m touch $myncdir/done-install fi - # note, strange this happend where updater did not increment the version var, - # mine was stuck on 20. I manually updated it. m cd $ncdir/config - if [[ ! -e $myncdir/config.php-orig ]]; then - m cp -a config.php $myncdir/config.php-orig - fi - cat $myncdir/config.php-orig - >$myncdir/tmp.php <$myncdir/tmp.php <config.php + e running php $myncdir/tmp.php + # note: we leave it around place for debugging + # shellcheck disable=SC2024 # intended + sudo -u www-data php $myncdir/tmp.php >config.php + fi cd $ncdir m sudo -u www-data php occ maintenance:update:htaccess list=$(sudo -u www-data php $ncdir/occ --output=json_pretty app:list) @@ -2646,7 +2751,13 @@ fi ncbase=$1 cd /var/www/$ncbase # https://docs.nextcloud.com/server/22/admin_manual/maintenance/update.html?highlight=updater+phar +# the docs claim this is all you need, which is not true. +# You will go to the web ui and it will say that you need to click a button to update, +# or that you can run occ upgrade m php /var/www/$ncbase/updater/updater.phar -n +# throw a sleep in just because who knows what else is undocumented +sleep 5 +m php occ upgrade EOFOUTER chmod +x /usr/local/bin/ncup @@ -2732,7 +2843,8 @@ case $HOSTNAME in # which will overwrite any existing file u /etc/default/exim4 <<'EOF' QUEUERUNNER='combined' -QUEUEINTERVAL='30m' +# note: this is duplicated in brc2, 10m here is -q10m there. +QUEUEINTERVAL='10m' COMMONOPTIONS='-C /etc/exim4/my.conf' UPEX4OPTS='-o /etc/exim4/my.conf' # i use epanic-clean for alerting if there are bad paniclog entries @@ -2849,29 +2961,10 @@ EOF # ** $MAIL_HOST|bk) $MAIL_HOST|bk) - - # no clamav on je, it has 1.5g memory and clamav uses most of it - u /etc/exim4/conf.d/clamav_data_acl <<'EOF' -warn -!hosts = +iank_trusted -!authenticated = plain_server:login_server -condition = ${if def:malware_name} -remove_header = Subject: -add_header = Subject: [Clamav warning: $malware_name] $h_subject -log_message = heuristic malware warning: $malware_name -EOF - - cat >>/etc/exim4/conf.d/main/000_local <>/etc/exim4/update-exim4.conf.conf <> /etc/exim4/conf.d/data_local_acl <<'EOF' -deny - malware = */defer_ok - !condition = ${if match {$malware_name}{\N^Heuristic\N}} - message = This message was detected as possible malware ($malware_name). -EOF cat >/etc/exim4/conf.d/main/000_local-nn <>/etc/exim4/conf.d/main/000_local <> /etc/exim4/conf.d/data_local_acl <<'EOF' +deny + malware = */defer_ok + !condition = ${if match {$malware_name}{\N^Heuristic\N}} + message = This message was detected as possible malware ($malware_name). + +warn + !hosts = +iank_trusted + !authenticated = * + condition = ${if def:malware_name} + remove_header = Subject: + add_header = Subject: [Clamav warning: $malware_name] $h_subject + log_message = heuristic malware warning: $malware_name + +warn + # fdate = future date. # tdate = temporary date. + condition = ${if def:h_fdate} + remove_header = fdate: + add_header = tdate: + control = freeze +EOF + /a/exe/cedit nn /etc/hosts <<'EOF' || [[ $? == 1 ]] 10.173.8.2 nn.b8.nz @@ -3138,18 +3295,25 @@ EOF ;; # ** not MAIL_HOST|bk|je *) - # this one should be removed for all non mail hosts, but + echo|u /etc/exim4/conf.d/router/155_delay + # this one should be removed for all non mail_hosts. note # bk and je never become mail_host echo|u /etc/exim4/conf.d/router/195_dnslookup_vpn echo|u /etc/exim4/conf.d/router/160_backup_redir echo|u /etc/exim4/conf.d/router/161_backup_redir_nn echo|u /etc/exim4/conf.d/router/185_sentarchive echo|u /etc/exim4/conf.d/router/186_sentarchive_nn + # Note, in general we could submit to smarthosts on non MAIL_HOST. + # however, delayed mail makes this inconvenient, because I + # occasionally want to send an email from a non-MAIL_HOST and then + # turn off that computer or travel with it so it is disconnected. + # It is also probably easier to setup emacs to delay messages, but + # that would mean we need to keep emacs running, this is much + # nicer. echo|u /etc/exim4/conf.d/router/188_exim4-config_smarthost echo|u /etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost echo|u /etc/exim4/conf.d/rcpt_local_acl echo|u /etc/exim4/conf.d/main/000_local-nn - echo|u /etc/exim4/conf.d/clamav_data_acl if $bhost_t; then @@ -3326,7 +3490,6 @@ sentarchive: unseen EOF - u /etc/myexim4/conf.d/router/160_backup_redir <<'EOF' backup_redir: driver = redirect @@ -3343,8 +3506,6 @@ unseen = true errors_to = alerts@iankelling.org EOF - - # for bk, we have a exim4in.service that will do this for us. m update-exim4.conf -d /etc/myexim4 ;; @@ -3422,14 +3583,20 @@ if $reload; then m systemctl daemon-reload fi -# checking bhost_t is redundant, but could help us catch errors. -if $bhost_t || [[ -e /etc/wireguard/wghole.conf ]]; then - # todo: in mail-setup, we have a static list of backup hosts, not *y - m systemctl --now enable wg-quick@wghole +# optimization, this only needs to run once. +if [[ ! -e /sys/class/net/wghole ]]; then + # checking bhost_t is redundant, but could help us catch errors. + if $bhost_t || [[ -e /etc/wireguard/wghole.conf ]]; then + # todo: in mail-setup, we have a static list of backup hosts, not *y + m systemctl --now enable wg-quick@wghole + fi fi -sysd-prom-fail-install epanicclean -m systemctl --now enable epanicclean +# optimization, this only needs to be run once +if [[ ! -e /var/lib/prometheus/node-exporter/exim_paniclog.prom ]]; then + sysd-prom-fail-install epanicclean + m systemctl --now enable epanicclean +fi case $HOSTNAME in je) @@ -3440,8 +3607,11 @@ case $HOSTNAME in ;; esac -m /a/bin/ds/mail-cert-cron -1 -sre mailcert.timer +# optimization, this only needs to run once. +if [[ ! -e /etc/exim4/fullchain.pem ]]; then + m /a/bin/ds/mail-cert-cron -1 + m systemctl --now enable mailcert.timer +fi case $HOSTNAME in $MAIL_HOST|bk) @@ -3463,6 +3633,8 @@ case $HOSTNAME in else m systemctl --now enable $vpnser fi + ;;& + bk) if ! systemctl is-active clamav-daemon >/dev/null; then m systemctl --now enable clamav-daemon out=$(rsync -aiSAX --chown=root:root --chmod=g-s /a/bin/ds/filesystem/etc/systemd/system/epanicclean.service /etc/systemd/system) @@ -3623,6 +3795,9 @@ EOF test_to=${test_tos[0]} for t in ${test_tos[@]:1}; do + if [[ $test_from == *@gnu.org && $t == *@gnu.org ]]; then + continue + fi test_to+=", $t" done case $test_from in