X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=e12149f114bc06b0b79bc980359cb6dd743f8b8d;hb=56c55d8e02cdd6ec67d2fe53cc03785d8876442e;hp=a026f069efa4e1217a3e5d2245efc82fb047e83a;hpb=4b3f043829a57215e1251122a8ab0019b717ca8d;p=distro-setup diff --git a/mail-setup b/mail-setup index a026f06..e12149f 100755 --- a/mail-setup +++ b/mail-setup @@ -3,7 +3,6 @@ # Copyright (C) 2019 Ian Kelling # SPDX-License-Identifier: AGPL-3.0-or-later -# todo: setup a logrotate for /var/log/mymain and mypanic # todo: setup an alert for bouncing test emails. @@ -19,7 +18,6 @@ # todo: harden dovecot. need to do some research. one way is for it to only listen on a wireguard vpn interface, so only clients that are on the vpn can access it. # todo: consider hardening cups listening on 0.0.0.0 # todo: stop/disable local apache, and rpc.mountd, and kdeconnect when not in use. -# todo: check that spamd and unbound only listen locally. # todo: hosts should only allow external mail that is authed and # destined for backup route. it is a minor issue since traffic is @@ -392,6 +390,7 @@ EOF fi # light version of exim does not have sasl auth support. +# note: for bitfolk hosts, unbound has important config with conflink. pi-nostart exim4 exim4-daemon-heavy spamassassin unbound clamav-daemon wireguard # note: pyzor debian readme says you need to run some initialization command @@ -1077,11 +1076,11 @@ rm -fv /etc/exim4/conf.d/retry/37_retry cat >/etc/exim4/conf.d/retry/17_retry <<'EOF' # Retry fast for my own domains -iankelling.org * F,1d,10m;F,14d,1h -amnimal.ninja * F,1d,10m;F,14d,1h -expertpathologyreview.com * F,1d,10m;F,14d,1h -je.b8.nz * F,1d,10m;F,14d,1h -zroe.org * F,1d,10m;F,14d,1h +iankelling.org * F,1d,4m;F,14d,1h +amnimal.ninja * F,1d,4m;F,14d,1h +expertpathologyreview.com * F,1d,4m;F,14d,1h +je.b8.nz * F,1d,4m;F,14d,1h +zroe.org * F,1d,4m;F,14d,1h eximbackup.b8.nz * F,1d,4m;F,14d,1h # The spec says the target domain will be used for temporary host errors, @@ -1092,6 +1091,13 @@ defaultnn.b8.nz * F,1d,4m;F,14d,1h mx.iankelling.org * F,1d,4m;F,14d,1h bk.b8.nz * F,1d,4m;F,14d,1h eggs.gnu.org * F,1d,4m;F,14d,1h +fencepost.gnu.org * F,1d,4m;F,14d,1h + +# afaik our retry doesnt need this, but just using everything +mx.amnimal.ninja * F,1d,4m;F,14d,1h +mx.expertpathologyreview.com * F,1d,4m;F,14d,1h + + mail.fsf.org * F,1d,15m;F,14d,1h EOF @@ -2974,6 +2980,27 @@ case $HOSTNAME in # this makes it easier to see which exim is doing what log_file_path = /var/log/exim4/my%s EOF + + cat >/etc/logrotate.d/myexim <<'EOF' +/var/log/exim4/mymain /var/log/exim4/myreject { + daily + missingok + rotate 1000 + delaycompress + notifempty + nocreate +} +/var/log/exim4/mypanic { + size 10M + missingok + rotate 10 + compress + delaycompress + notifempty + nocreate +} +EOF + # If we ever wanted to have a separate spool, # we could do it like this. # cat >>/etc/exim4/conf.d/main/000_local-nn <<'EOF' @@ -3179,12 +3206,32 @@ PATH=/usr/bin:/bin:/usr/local/bin MAILTO=daylert@iankelling.org */5 * * * * $u send-test-forward |& log-once send-test-forward */10 * * * * root chmod -R g+rw /m/md/bounces |& log-once -1 bounces-chmod -*/5 * * * * root timeout 290 mailtest-check slow |& log-once -4 mailtest-check +# todo: delete, this is old +#*/5 * * * * root timeout 290 mailtest-check slow |& log-once -1 mailtest-check # if a bounce happened yesterday, dont let it slip through the cracks 8 1 * * * root export MAILTO=alerts@iankelling.org; [[ -s /var/log/exim4/mainlog.1 ]] && awk '\$5 == "**"' /var/log/exim4/mainlog.1 EOF + + m sudo rsync -ahhi --chown=root:root --chmod=0755 \ /b/ds/mailtest-check /b/ds/check-remote-mailqs /usr/local/bin/ + cat >/etc/systemd/system/mailtest-check.service <<'EOF' +[Unit] +Description=mailtest-check +After=local-fs.target +StartLimitIntervalSec=0 + +[Service] +Type=simple +ExecStart=/usr/local/bin/mailtest-check slow +Restart=always +RestartSec=60 + +[Install] +WantedBy=graphical.target +EOF + sysd-prom-fail-install mailtest-check + sre mailtest-check ;;& $MAIL_HOST) test_froms=(ian@iankelling.org z@zroe.org iank@gnu.org) @@ -3196,24 +3243,33 @@ EOF EOF ;;& bk) - test_froms=(testignore@expertpathologyreview.com testignore@amnimal.ninja) - test_tos=(testignore@iankelling.org testignore@zroe.org testignore@je.b8.nz) + test_froms=(testignore@amnimal.ninja testignore@expertpathologyreview.com) + test_tos=(testignore@iankelling.org testignore@je.b8.nz) + # We dont need to send from different addresses to the same + # address. this breaks down our nice elegant logic of building up + # froms and tos , so I just handle expertpath in a special case + # below and set the to: to be testignore@zroe.org. If we did sent + # that way, it would also mess up our mailtest-check logic that + # finds which messages to check. + # for example: from testignore@amnimal.ninja to: testignore@iankelling.org testignore@zroe.org + # that would become 2 messages and we'd only check 1. ;;& je) test_froms=(testignore@je.b8.nz) test_tos=(testignore@iankelling.org testignore@zroe.org testignore@expertpathologyreview.com testignore@amnimal.ninja) ;;& $MAIL_HOST|bk|je) - test_to=${test_tos[0]} - # dont put these test messages into the sent folder or else it will + + # Dont put these test messages into the sent folder or else it will # overwhelm it, plus i dont want to save a copy at all. - echo $test_to > /etc/exim4/ignore-sent - for t in ${test_tos[@]:1}; do - test_to+=", $t" + rm -f /etc/exim4/ignore-sent + for t in ${test_tos[@]}; do echo $t >> /etc/exim4/ignore-sent done + cat >/usr/local/bin/send-test-forward <<'EOF' #!/bin/bash +# we remove from the queue older than 4.3 minutes since we send every 5 minutes. olds=( $(/usr/sbin/exiqgrep -o 260 -i -r '^(testignore@(iankelling\.org|zroe\.org|expertpathologyreview\.com|amnimal\.ninja|je\.b8\.nz)|jtuttle@gnu\.org)$') ) @@ -3222,6 +3278,17 @@ if (( ${#olds[@]} )); then fi EOF for test_from in ${test_froms[@]}; do + + test_to=${test_tos[0]} + for t in ${test_tos[@]:1}; do + test_to+=", $t" + done + case $test_from in + testignore@expertpathologyreview.com) + test_to=testignore@zroe.org + ;; + esac + cat >>/usr/local/bin/send-test-forward <