X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=c313c46da685e41f4381bcadbb9cee071df3be50;hb=c926b55471a48cbcd99607ce1e003da55211d166;hp=7921a22fd0ed262ff47760e9397e5c1293bd6e48;hpb=c12fecb2eb85890400d451732a2acecce5b69bc4;p=distro-setup diff --git a/mail-setup b/mail-setup index 7921a22..c313c46 100755 --- a/mail-setup +++ b/mail-setup @@ -1,5 +1,7 @@ -#!/bin/bash -l -# Copyright (C) 2016 Ian Kelling +#!/bin/bash +set -x + +# Copyright (C) 2019 Ian Kelling # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -13,9 +15,46 @@ # See the License for the specific language governing permissions and # limitations under the License. +# todo: make quick backups of maildir, or deliver to multiple hosts. + set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR +[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@" +if [[ ! $SUDO_USER ]]; then + echo "$0: error: requires running as nonroot or sudo" + exit 1 +fi +u=$SUDO_USER + + +usage() { + cat < preferences -> preferences -> advanced tab -> config editor button -> security.ssl.enable_ocsp_must_staple = false +# background: ovecot does not yet have ocsp stapling support +# reference: https://community.letsencrypt.org/t/simple-guide-using-lets-encrypt-ssl-certs-with-dovecot/2921 +# +# for phone, same thing but username alerts, pass in ivy-pass. +####### + + ####### begin perstent password instructions ###### # # exim passwords: # # for hosts which have all private files I just use the same user @@ -27,12 +66,13 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR # apg -m 50 -x 70 -n 1 -a 1 -M CLN >$f # s sed -i "/^$user:/d" /p/c/filesystem/etc/exim4/passwd # echo "$user:$(mkpasswd -m sha-512 -s <$f)" >>/p/c/filesystem/etc/exim4/passwd -# echo "mail.iankelling.org:$user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass +# # todo: port is no longer used in mailpass, remove it. +# echo "mail.iankelling.org 587 $user:$(<$f)" >> /p/c/machine_specific/$user/filesystem/etc/mailpass # # then run this script, or part of it which uses /etc/mailpass # # dovecot password, i just need 1 as I\'m the only user # mkdir /p/c/filesystem/etc/dovecot -# echo "ian:$(doveadm pw -s ssha256)::::::" >/p/c/filesystem/etc/dovecot/users +# echo "iank:$(doveadm pw -s ssha256)::::::" >>/p/c/filesystem/etc/dovecot/users # conflink @@ -77,13 +117,18 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR # # via the mail-setup scripts # # 2017-02 dmarc policies: +# # host -t txt _dmarc.gmail.com # # yahoo: p=reject, hotmail: p=none, gmail: p=none, fastmail none for legacy reasons -# # gmail will be changing to p=reject, which is expected to cause problems +# # there were articles claiming gmail would be changing +# # to p=reject, in early 2017, which didn\'t happen. I see no sources on them. It\'s +# # expected to cause problems # # with a few old mailing lists, copying theirs for now. +# # echo "dmarc dns, name: _dmarc value: v=DMARC1; p=none; rua=mailto:mailauth-reports@$domain" # # 2017-02 spf policies: -# # google ~all, hotmail -all, yahoo: ?all, fastmail ?all +# # host -t txt lists.fedoraproject.org +# # google ~all, hotmail ~all, yahoo: ?all, fastmail ?all, outlook ~all # # i include fastmail\'s settings, per their instructions, # # and follow their policy. In mail in a box, or similar instructions, # # I\'ve seen recommended to not use a restrictive policy. @@ -104,385 +149,607 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR ####### end persistent dkim instructions ######### -# misc exim notes: -# useful exim docs: -# /usr/share/doc/exim4-base/README.Debian.gz -# /usr/share/doc/exim4-base/spec.txt.gz - -# routers, transports, and authenticators are sections, and you define -# driver instances in those sections, and the manual calls them driver -# types but there is also a more specific "type" of driver, which is specified -# with the driver = some_module setting in the driver. - -# the driver option must precede and private options (options that are -# specific to that driver), so follow example of putting it at beginning. -# The full list of option settings for any particular driver instance, -# including all the defaulted values, can be extracted by making use of -# the -bP command line option. - -# exim clear out message queue. as root: -# adapted from somewhere on stackoverflow. -# ser stop exim4; sleep 1; exim -bp | exiqgrep -i | xargs exim -Mrm; ser start exim4 - -# fastmail has changed their smtp server, but the old one still works, -# I see no reason to bother changing. -# New one is smtp.fastmail.com +e() { printf "%s\n" "$*"; } +pi() { # package install + local f + if dpkg -s -- "$@" &> /dev/null; then + return 0; + fi; + while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done + f=/var/cache/apt/pkgcache.bin; + if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*12 )); then + apt-get update + fi + apt-get -y install --purge --auto-remove "$@" +} + +postmaster=alerts +mxhost=mail.iankelling.org +mxport=587 +forward=$u@$mxhost + +# old setup. left as comment for example +# mxhost=mail.messagingengine.com +# mxport=587 +# forward=ian@iankelling.org + +smarthost="$mxhost::$mxport" # exim + +# trisquel 8 = openvpn, debian stretch = openvpn-client +vpn_ser=openvpn-client +if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then + vpn_ser=openvpn +fi -# test delivery & rewrite settings: -#exim4 -bt ian@localhost +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + # afaik, these will get ignored because they are routing to my own + # machine, but rm them is safer + rm -f $(eval echo ~$u)/.forward /root/.forward +else + # this can\'t be a symlink and has permission restrictions + # it might work in /etc/aliases, but this seems more proper. + install -m 644 {-o,-g}$u <(e $forward) $(eval echo ~$u)/.forward +fi -type=$1 -postfix() { [[ $type == postfix ]]; } -exim() { [[ $type == exim4 ]]; } -if ! exim && ! postfix; then - echo "$1: error: expected exim4 or postfix as first arg" - exit 1 +pi openvpn + +if [[ -e /p/c/filesystem ]]; then + # allow failure of these commands when our internet is down, they are likely not needed, + # we check that a valid cert is there already. + # to put the hostname in the known hosts + if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then + # This just causes failure if our cert is going to expire in the next 30 days. + # Certs I generate last 10 years. + openssl x509 -checkend $(( 60 * 60 * 24 * 30 )) -noout -in /etc/openvpn/mail.crt + else + # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with + # systemd, buuut it can remake the tun device unexpectedly, i got this in the log + # after my internet was down for a bit: + # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. + /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org + fi fi -local_mx=mail.iankelling.org +cat >/etc/systemd/system/mailclean.timer <<'EOF' +[Unit] +Description=Run mailclean daily -host=$local_mx -relayhost="[$host]:25" # postfix -smarthost="$host::25" # exim +[Timer] +OnCalendar=monthly +[Install] +WantedBy=timers.target +EOF -# this was for when I used the exim config type -# "mail sent by smarthost; received via SMTP or fetchmail" -# if [[ $HOSTNAME == $MAIL_HOST ]]; then -# host=mail.messagingengine.com -# relayhost="[$host]:587" # postfix -# smarthost="$host::587" # exim -# fi +cat >/etc/systemd/system/mailclean.service < ~/.forward - e $forward | s tee /root/.forward - # 644 is required. shouldn\'t need changing, but set it just in case. - s chmod 644 ~/.forward /root/.forward -fi -# offlineimap uses this too, it is much easier to use one location than to -# condition it\'s config and postfix\'s config -case $distro in - fedora) s lnf -T ca-certificates.crt /etc/ssl/ca-bundle.trust.crt ;; - *) : -esac - -if postfix; then - # dunno why, but debian installed postfix with builddep emacs - # but I will just explicitly install it here since - # I use it for sending mail in emacs. - if isdeb; then - s debconf-set-selections </etc/exim4/rcpt_local_acl <<'EOF' +# Only hosts we control send to @mail.iankelling.org, so make sure +# they are all authed. +# Note, if we wanted authed senders for all domains, +# we could make this condition in acl_check_mail +deny + message = ian trusted domain recepient but no auth + !authenticated = * + domains = mail.iankelling.org EOF +cat >/etc/exim4/data_local_acl <<'EOF' +# Except for the "condition =", this was +# a comment in the check_data acl. The comment about this not +# being suitable is mostly bs. The only thing related I found was to +# add the condition =, cuz spamassassin has problems with big +# messages and spammers don't bother with big messages, +# but I've increased the size from 10k +# suggested in official docs, and 100k in the wiki example because +# those docs are rather old and I see a 110k spam message +# pretty quickly looking through my spam folder. +warn + condition = ${if < {$message_size}{2000K}} + spam = Debian-exim:true + add_header = X-Spam_score: $spam_score\n\ + X-Spam_score_int: $spam_score_int\n\ + X-Spam_bar: $spam_bar\n\ + X-Spam_report: $spam_report + +#accept +# spf = pass:fail:softfail:none:neutral:permerror:temperror +# dmarc_status = reject:quarantine +# add_header = Reply-to: dmarctest@iankelling.org - s systemctl enable postfix - s systemctl start postfix - fi - # i\'m assuming mail just won\'t work on systems without the sasl_passwd. - postconfin <<'EOF' -smtp_sasl_auth_enable = yes -smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd -smtp_sasl_security_options = noanonymous -smtp_tls_security_level = secure -message_size_limit = 20480000 -smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt -inet_protocols = ipv4 EOF - # msg_size_limit: I ran into a log file not sending cuz of size. double from 10 to 20 meg limit - # inet_protocols: without this, postfix tries an ipv6 lookup then gives - # up and fails. snippet from syslog: type=AAAA: Host not found, try again - - - f=/etc/postfix/sasl_passwd - s rm -f $f - s touch $f - s chmod 600 $f - s cat /etc/mailpass| while read -r domain port pass; do - # format: domain port user:pass - # mailpass is just a name i made up, since postfix and - # exim both use a slightly crazy format to translate to - # each other, it\'s easier to use my own format. - printf "[%s]:%s %s" "$domain" "$port" "${pass/@/#}" | s tee -a $f >/dev/null - done - s postmap hash:/etc/postfix/sasl_passwd - s service postfix reload - -else # exim. has debian specific stuff for now - - - # wording of question from dpkg-reconfigure exim4-config - # 1. internet site; mail is sent and received directly using SMTP - # 2. mail sent by smarthost; received via SMTP or fetchmail - # 3. mail sent by smarthost; no local mail - # 4. local delivery only; not on a network - # 5. no configuration at this time - # - # Note, I have used option 2 in the past for receiving mail - # from lan hosts, sending external mail via another smtp server. - # - # Note, other than configtype, we could set all the options in - # both types of configs without harm, they would either be - # ignored or be disabled by other settings, but the default - # local_interfaces definitely makes things more secure. - - # most of these settings get translated into settings - # in /etc/exim4/update-exim4.conf.conf - # mailname setting sets /etc/mailname - - s debconf-set-selections </etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' +# from 30_exim4-config_examples + +plain_server: +driver = plaintext +public_name = PLAIN +server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}" +server_set_id = $auth2 +server_prompts = : +.ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS +server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}} +.endif EOF - source /a/bin/bash_unpublished/source-semi-priv - exim_main_dir=/etc/exim4/conf.d/main - s mkdir -p exim_main_dir - if [[ $HOSTNAME == $MAIL_HOST ]]; then - # afaik, these will get ignored, routing to my own machine, but rm - # them to make me feel better. - s rm -f ~/.forward /root/.forward +cat >/etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' +### router/900_exim4-config_local_user +################################# + +# This router matches local user mailboxes. If the router fails, the error +# message is "Unknown user". + +local_user: + debug_print = "R: local_user for $local_part@$domain" + driver = accept + domains = +local_domains +# ian: commented this, in conjunction with a dovecot lmtp +# change so I get mail for all users. +# check_local_user + local_parts = ! root + transport = LOCAL_DELIVERY + cannot_route_message = Unknown user +EOF +cat >/etc/exim4/conf.d/transport/30_exim4-config_dovecot_lmtp <<'EOF' +dovecot_lmtp: + driver = lmtp + socket = /var/run/dovecot/lmtp + #maximum number of deliveries per batch, default 1 + batch_max = 200 +EOF - s debconf-set-selections </etc/exim4/host_local_deny_exceptions <<'EOF' +mail.fsf.org +*.posteo.de +EOF -# Please select the mail server configuration type that best meets your needs. +cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' +# smarthost for fsf mail +# ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and +# replaced DCsmarthost with mail.fsf.org +fsfsmarthost: + debug_print = "R: smarthost for $local_part@$domain" + driver = manualroute + domains = ! +local_domains + senders = *@fsf.org + transport = remote_smtp_smarthost + route_list = * mail.fsf.org byname + host_find_failed = ignore + same_domain_copy_routing = yes + no_more +EOF -# Systems with dynamic IP addresses, including dialup systems, should generally be -# configured to send outgoing mail to another machine, called a 'smarthost' for -# delivery because many receiving systems on the Internet block incoming mail from -# dynamic IP addresses as spam protection. -# A system with a dynamic IP address can receive its own mail, or local delivery can be -# disabled entirely (except mail for root and postmaster). +#### begin mail cert setup ### +f=/usr/local/bin/mail-cert-cron +cat >$f <<'EOF' +set -eE -o pipefail +trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR -# 1. internet site; mail is sent and received directly using SMTP -# 2. mail sent by smarthost; received via SMTP or fetchmail -# 3. mail sent by smarthost; no local mail -# 4. local delivery only; not on a network -# 5. no configuration at this time +[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@" -# General type of mail configuration: 1 -exim4-config exim4/dc_eximconfig_configtype select internet site; mail is sent and received directly using SMTP +f=/a/bin/bash_unpublished/source-state +if [[ -e $f ]]; then + source $f +fi +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + local_mx=mail.iankelling.org + rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li.iankelling.org:/etc/letsencrypt/live/$local_mx/" + ${rsync_common}fullchain.pem /etc/exim4/exim.crt + ret=$? + ${rsync_common}privkey.pem /etc/exim4/exim.key + new_ret=$? + if [[ $ret != $new_ret ]]; then + echo "$0: error: differing rsync returns, $ret, $new_ret" + exit 1 + fi +fi +if [[ $new_ret != 0 ]]; then + if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then + echo "$0: error!: cert rsync failed and it will expire in less than 3 days" + exit 1 + fi +fi +exit 0 +EOF +chmod 755 $f +cat >/etc/systemd/system/mailcert.service <<'EOF' +[Unit] +Description=Mail cert rsync +After=multi-user.target +[Service] +Type=oneshot +ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron +EOF -# The 'mail name' is the domain name used to 'qualify' mail addresses without a domain -# name. +cat >/etc/systemd/system/mailcert.timer <<'EOF' +[Unit] +Description=Run mail-cert once a day -# This name will also be used by other programs. It should be the single, fully -# qualified domain name (FQDN). +[Timer] +OnCalendar=daily -# Thus, if a mail address on the local host is foo@example.org, the correct value for -# this option would be example.org. +[Install] +WantedBy=timers.target +EOF +systemctl daemon-reload +systemctl start mailcert +systemctl restart mailcert.timer +systemctl enable mailcert.timer + +##### end mailcert setup ##### + +# comon stuff +cat >/etc/exim4/update-exim4.conf.conf <<'EOF' +# default stuff, i havent checked if its needed +dc_minimaldns='false' +dc_relay_nets='' +CFILEMODE='644' +dc_use_split_config='true' +dc_local_interfaces='' +dc_mailname_in_oh='true' +EOF -# This name won\'t appear on From: lines of outgoing messages if rewriting is enabled. -# System mail name: -exim4-config exim4/mailname string li.iankelling.org +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + # mail.iankelling.org so local imap clients can connect with tls and + # when they happen to not be local. + sed -ri -f - /etc/hosts <<'EOF' +/^127\.0\.1\.1.* mail\.iankelling\.org\b/{p;d} +/^127\.0\.1\.1 /s/ *$/ mail.iankelling.org/ +EOF + /a/exe/cedit mail /etc/dnsmasq-servers.conf <<'EOF' || [[ $? == 1 ]] +server=/mail.iankelling.org/127.0.1.1 +EOF + systemctl reload dnsmasq + # I used to use debconf-set-selections + dpkg-reconfigure, + # which then updates this file + # but the process is slower than updating it directly and then I want to set other things in + # update-exim4.conf.conf, so there's no point. + # The file is documented in man update-exim4.conf, + # except the man page is not perfect, read the bash script to be sure about things. + # The debconf questions output is additional documentation that is not + # easily accessible, but super long, along with the initial default comment in this + # file, so I've saved that into ./mail-notes.conf. -# Please enter a semicolon-separated list of recipient domains for which this machine -# should consider itself the final destination. These domains are commonly called -# 'local domains'. The local hostname (treetowl.lan) and 'localhost' are always added -# to the list given here. + cat >>/etc/exim4/update-exim4.conf.conf < /etc/mailname + + # MAIN_HARDCODE_PRIMARY_HOSTNAME might mess up the + # smarthost config type, not sure. all other settings + # would be unused in that config type. + rm -f /etc/exim4/conf.d/main/000_localmacros # old filename + cat >/etc/exim4/conf.d/main/000_local <$f <<'EOF' +#!/bin/bash +cd /etc +wget -q -N https://publicsuffix.org/list/public_suffix_list.dat +EOF + chmod 755 $f -# Multiple user names need to be separated by spaces. + sed -i --follow-symlinks -f - /etc/aliases </etc/dovecot/conf.d/20-lmtp.conf </etc/dovecot/local.conf </dev/null <<'EOF' -MAIN_TLS_ENABLE = true + ####### end dovecot setup ######## -DKIM_CANON = relaxed -DKIM_SELECTOR = li + # https://selivan.github.io/2017/12/30/systemd-serice-always-restart.html + d=/etc/systemd/system/openvpn@mail + mkdir -p $d + cat >$d/override.conf <<'EOF' +[Service] +Restart=always +# time to sleep before restarting a service +RestartSec=1 -# from comments in -# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 +[Unit] +# StartLimitIntervalSec in recent systemd versions +StartLimitInterval=0 +EOF -# The file is based on the outgoing domain-name in the from-header. -DKIM_DOMAIN = ${lc:${domain:$h_from:}} -# sign if key exists -DKIM_PRIVATE_KEY= ${if exists{/etc/exim4/${dkim_domain}-private.pem} {/etc/exim4/${dkim_domain}-private.pem}} -# failing message on mail-tester.com: -# We check if there is a server (A Record) behind your hostname treetowl. -# You may want to publish a DNS record (A type) for the hostname treetowl or use a different hostname in your mail software -# https://serverfault.com/questions/46545/how-do-i-change-exim4s-primary-hostname-on-a-debian-box -# and this one seemed appropriate from grepping config -MAIN_HARDCODE_PRIMARY_HOSTNAME = li.iankelling.org + systemctl enable mailclean.timer + systemctl start mailclean.timer + systemctl restart $vpn_ser@mail + systemctl enable $vpn_ser@mail + systemctl enable dovecot + systemctl restart dovecot -# normally empty, I set this so I can set the envelope address -# when doing mail redelivery to invoke filters -MAIN_TRUSTED_GROUPS = ian +else # $HOSTNAME != $MAIL_HOST + # remove mail. 2 lines to properly remove whitespace + sed -ri -f - /etc/hosts <<'EOF' +s#^(127\.0\.1\.1 .*) +mail\.iankelling\.org$#\1# +s#^(127\.0\.1\.1 .*)mail\.iankelling\.org +(.*)#\1\2# +EOF -LOCAL_DELIVERY = dovecot_lmtp + echo | /a/exe/cedit mail /etc/dnsmasq-servers.conf || [[ $? == 1 ]] + systemctl reload dnsmasq + + systemctl disable mailclean.timer &>/dev/null ||: + systemctl stop mailclean.timer &>/dev/null ||: + systemctl disable $vpn_ser@mail + systemctl stop $vpn_ser@mail + systemctl disable dovecot ||: + systemctl stop dovecot ||: + # + # + # would only exist because I wrote it i the previous condition, + # it\'s not part of exim + rm -f /etc/exim4/conf.d/main/000_localmacros + cat >>/etc/exim4/update-exim4.conf.conf < /etc/mailname + + # We set this to alerts on MAIL_HOST, but using a user that doesn't exist elsewhere + # is no good. + sed -i --follow-symlinks -f - /etc/aliases </dev/null ||: - s systemctl stop offlineimapsync.timer &>/dev/null ||: - # - # - # would only exist because I wrote it i the previous condition, - # it\'s not part of exim - s rm -f $exim_main_dir/000_localmacros - s debconf-set-selections <>/etc/default/spamassassin +# just noticed this in the config file, seems like a good idea. +sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin +e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin +systemctl start spamassassin +systemctl reload spamassassin - # if we already have it installed, need to reconfigure, without being prompted - if dpkg -s exim4-config &>/dev/null; then - # gotta remove this, otherwise the set-selections are completely - # ignored. It woulda been nice if this was documented somewhere! - s rm -f /etc/exim4/update-exim4.conf.conf - s dpkg-reconfigure -u -fnoninteractive exim4-config - fi - # light version does not have sasl auth support. - pi exim4-daemon-heavy spamassassin - - ##### begin spamassassin config - ser enable spamassassin - # per readme.debian - s sed -i '/^\s*CRON\s*=/d' /etc/default/spamassassin - s tee -a /etc/default/spamassassin <</etc/systemd/system/spamddnsfix.service <<'EOF' [Unit] Description=spamd dns bug fix cronjob @@ -490,7 +757,10 @@ Description=spamd dns bug fix cronjob Type=oneshot ExecStart=/a/bin/distro-setup/spamd-dns-fix EOF - s dd of=/etc/systemd/system/spamddnsfix.timer <<'EOF' +# 2017-09, debian closed the bug on this saying upstream had fixed it. +# remove this when i\'m using the newer package, ie, debian 10, or maybe +# ubuntu 18.04. +cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' [Unit] Description=run spamd bug fix script every 10 minutes @@ -504,110 +774,151 @@ OnUnitActiveSec=550 [Install] WantedBy=timers.target EOF - ser daemon-reload - sgo spamddnsfix.timer - # - ##### end spamassassin config +systemctl daemon-reload +systemctl restart spamddnsfix.timer +systemctl enable spamddnsfix.timer +# +##### end spamassassin config - gitslink # needed to install the execstart files below - s dd of=/etc/systemd/system/mailcert.service <<'EOF' -[Unit] -Description=Mail cert rsync -After=multi-user.target -[Service] -Type=oneshot -ExecStart=/usr/local/bin/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron -EOF - s dd of=/etc/systemd/system/mailcert.timer <<'EOF' -[Unit] -Description=Run mail-cert once a day -[Timer] -OnCalendar=daily -[Install] -WantedBy=timers.target -EOF - ser daemon-reload - ser start mailcert - sgo mailcert.timer - - - # based on a little google and package search, just the dovecot - # packages we need instead of dovecot-common. - # - # dovecot-lmtpd is for exim to deliver to dovecot instead of maildir - # directly. The reason to do this is to use dovecot\'s sieve, which - # has extensions that allow it to be almost equivalent to exim\'s - # filter capabilities, some ways probably better, some worse, and - # sieve has the benefit of being supported in postfix and - # proprietary/weird environments, so there is more examples on the - # internet. I was torn about whether to do this or not, meh. - pi dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd - - # if we changed 90-sieve.conf and removed the active part of the - # sieve option, we wouldn\'t need this, but I\'d rather not modify a - # default config if not needed. This won\'t work as a symlink in /a/c - # unfortunately. - lnf -T sieve/main.sieve ~/.dovecot.sieve - - # we have a few config files which installing exim/dovecot overwrites, - # and might as well have this before reading /etc/mailpass, - # which this sets up too. - conflink - - # begin setup passwd.client - f=/etc/exim4/passwd.client - s rm -f $f - s touch $f - s chmod 640 $f - s chown root:Debian-exim $f - # note: this will go away - s cat /etc/mailpass| while read -r domain port pass; do - # reference: exim4_passwd_client(5) - printf "%s:%s\n" "$domain" "$pass" | s tee -a $f >/dev/null - done - # end setup passwd.client - - # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost - # i only need .forwards, so just doing that one. - cd /etc/exim4/conf.d/router - a=userforward - b=${a}_higher_priority - tmp=$(mktemp) - of=175_$b - # sed to make the router name unique - sed -r s/^\\S+:/$b:/ 600_exim4-config_$a | s dd of=$tmp 2>/dev/null - if ! diff -q $tmp $of &>/dev/null; then - s dd if=$tmp of=$of >/dev/null - fi +# https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost +# i only need .forwards, so just doing that one. +cd /etc/exim4/conf.d/router +b=userforward_higher_priority +# replace the router name so it is unique +sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b +# begin setup passwd.client +f=/etc/exim4/passwd.client +rm -f /etc/exim4/passwd.client +install -m 640 -g Debian-exim /dev/null $f +while read -r domain _ pass; do + # reference: exim4_passwd_client(5) + printf "%s:%s\n" "$domain" "$pass" >>$f +done > /etc/fstab + fi + if ! mountpoint -q $sdir; then + systemctl stop exim4 + if [[ -L $sdir ]]; then + rm $sdir + fi if [[ ! -e $dir && -d $sdir ]]; then - s mv $sdir $dir + mv $sdir $dir + fi + if [[ ! -d $sdir ]]; then + mkdir $sdir + chmod 000 $sdir # only want it to be used when its mounted fi - s lnf -T $dir $sdir + mount $sdir + fi fi -sgo $type -# if I wanted the from address to be renamed and sent to a different address, -# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical -# sudo postmap hash:/etc/postfix/recipient_canonical -# sudo service postfix reload +systemctl restart exim4 +systemctl enable exim4 + + +if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + f=/usr/local/bin/send-test-forward + cat >$f <<'EOF' +#!/bin/bash +echo body_test | mail -s "primary_test $(date +%s) $(date +%Y-%m-%dT%H:%M:%S%z)" iank@posteo.de +EOF + chmod +x $f + + cat >/etc/cron.d/mailtest <&1 | /usr/local/bin/log-once send-test-forward +*/10 * * * * $u /usr/local/bin/mailtest-check 2>&1 | /usr/local/bin/log-once -1 send-test-forward +*/10 * * * * root chmod -R g+rw /m/md/bounces 2>&1 | /usr/local/bin/log-once -1 bounces-chmod +EOF + cp /a/bin/distro-setup/filesystem/usr/local/bin/mailtest-check /usr/local/bin +else + rm -f /etc/cron.d/mailtest +fi + +# MAIL_HOST also does radicale, and easier to start and stop it here +# for when MAIL_HOST changes, so radicale gets the synced files and +# does not stop us from remounting /o. +if dpkg -s radicale &>/dev/null; then + if [[ $HOSTNAME == "$MAIL_HOST" ]]; then + systemctl restart radicale + systemctl enable radicale + if [[ -e /etc/logrotate.d/radicale.disabled ]]; then + mv /etc/logrotate.d/radicale{.disabled,} + fi + else + systemctl stop radicale + systemctl disable radicale + # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. + if [[ -e /etc/logrotate.d/radicale ]]; then + mv /etc/logrotate.d/radicale{,.disabled} + fi + fi +fi +exit 0 +: