X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=mail-setup;h=e753fbe9670ea27f7837b14be795d1ce5d7c95af;hb=c300392f92092b3a89281df462d42710f25d0351;hp=f17b3afe81d5b79f2e203f6b0a92116e0dc630ae;hpb=d6def754cd241538c61456536b52ee51cbd85b42;p=distro-setup diff --git a/mail-setup b/mail-setup index f17b3af..e753fbe 100755 --- a/mail-setup +++ b/mail-setup @@ -3,6 +3,22 @@ # Copyright (C) 2019 Ian Kelling # SPDX-License-Identifier: AGPL-3.0-or-later +# Things I tend to forget. on MAIL_HOST, daemon runs with /etc/exim4/my.conf, +# due to /etc/default/exim4 containing: +# COMMONOPTIONS='-C /etc/exim4/my.conf' +# UPEX4OPTS='-o /etc/exim4/my.conf' +# +# The non-daemon config +# gets generated from this script calling update-exim4.conf -d /etc/myexim4 +# which has log path +# log_file_path = /var/log/exim4/my%s +# +# eximbackup folder is /bu/md +# it is cleaned up by mail-backup-clean, which is run by btrbk-run + +# shellcheck disable=SC2254 # makes for a lot of unneeded quotes + + # perusing through /el/mainlog without test messages: # &!testignore|jtuttle| # @@ -287,7 +303,7 @@ fi # * functions & constants -pre="${0##*/}:" +pre="${0##*/}:${SSH_CLIENT:+ $HOSTNAME:}" m() { printf "$pre %s\n" "$*"; "$@"; } e() { printf "$pre %s\n" "$*"; } err() { printf "$pre %s\n" "$*" >&2; exit 1; } @@ -520,7 +536,7 @@ EOF # Aug 02 21:59:27 sy systemd[1]: wg-quick@wgmail.service: Failed with result 'exit-code'. # Aug 02 21:59:27 sy systemd[1]: Failed to start WireGuard via wg-quick(8) for wgmail. # Aug 02 21:59:47 sy systemd[1]: wg-quick@wgmail.service: Scheduled restart job, restart counter is at 1. -# Aug 02 21:59:47 sy systemd[1]: Stopped WireGuard via wg-quick(8) for wgmail. +# Aug 02 21:95:47 sy systemd[1]: Stopped WireGuard via wg-quick(8) for wgmail. # Aug 02 21:59:47 sy systemd[1]: Starting WireGuard via wg-quick(8) for wgmail... # Aug 02 21:59:47 sy wg-quick[3424]: wg-quick: `wgmail' already exists # Aug 02 21:59:47 sy systemd[1]: wg-quick@wgmail.service: Main process exited, code=exited, status=1/FAILURE @@ -841,6 +857,7 @@ fi u /etc/spamassassin/mylocal.cf <<'EOF' # this is mylocal.cf because the normal local.cf has a bunch of upstream stuff i dont want to mess with + # /usr/share/doc/exim4-base/README.Debian.gz: # SpamAssassin's default report should not be used in a add_header # statement since it contains empty lines. (This triggers e.g. Amavis' @@ -865,6 +882,35 @@ PIDFILE="/var/run/spamd.pid" NICE="--nicelevel 15" CRON=1 EOF + +case $HOSTNAME in + bk) + u /etc/spamassassin/my_thishost.cf <<'EOF' +# note: these are duplicated in exim config +# veth0/1 # bk bk_ip6 +internal_networks 10.173.8.1/32 10.173.8.2/32 85.119.83.50/32 2001:ba8:1f1:f0c9::2 +trusted_networks 10.173.8.1/32 10.173.8.2/32 85.119.83.50/32 2001:ba8:1f1:f0c9::2 +EOF + + ;; + je) + u /etc/spamassassin/my_thishost.cf <<'EOF' +# note: these are duplicated in exim config +# veth0/1 # je je_ipv6 +internal_networks 10.173.8.1/32 10.173.8.2/32 85.119.82.128/32 2001:ba8:1f1:f09d::2/128 +trusted_networks 10.173.8.1/32 10.173.8.2/32 85.119.82.128/32 2001:ba8:1f1:f09d::2/128 +EOF + ;; + *) + u /etc/spamassassin/my_thishost.cf <<'EOF' +# note: these are duplicated in exim config +# veth0/1 # li li_ip6 +internal_networks 10.173.8.1/32 10.173.8.2/32 72.14.176.105/32 2600:3c00::f03c:91ff:fe6d:baf8/128 +trusted_networks 10.173.8.1/32 10.173.8.2/32 72.14.176.105/32 2600:3c00::f03c:91ff:fe6d:baf8/128 +EOF + ;; +esac + ##### end spamassassin config @@ -1245,6 +1291,7 @@ DKIM_SIGN_HEADERS = mime-version:in-reply-to:references:from:date:subject:to domainlist local_hostnames = ! je.b8.nz : ! bk.b8.nz : *.b8.nz : b8.nz +# note: most of these are duplicated in spamassassin config hostlist iank_trusted = <; \ # veth0 10.173.8.1 ; \ @@ -1333,7 +1380,7 @@ u /etc/exim4/conf.d/data_local_acl <<'EOF' # those docs are rather old and I see a 110k spam message # pretty quickly looking through my spam folder. -#warn +warn !hosts = +iank_trusted remove_header = X-Spam_score: X-Spam_score_int : X-Spam_bar : X-Spam_report @@ -2200,27 +2247,28 @@ if [[ $HOSTNAME == bk ]]; then ### begin composer install # https://getcomposer.org/doc/faqs/how-to-install-composer-programmatically.md - # cd $(mktemp -d) - # sum="$(wget -q -O - https://composer.github.io/installer.sig)" - # m php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" - # if [[ $sum != $(php -r "echo hash_file('sha384', 'composer-setup.php');") ]]; then - # echo 'ERROR: Invalid composer installer checksum' >&2 - # rm -fv composer-setup.php - # exit 1 - # fi - # m php composer-setup.php --quiet - # rm -fv composer-setup.php - # m mv composer.phar /usr/local/bin - - # the above method gets composer2, carddav plugin at least doesnt work with that - # yet, it was just released 10-24-2020. - m cd /usr/local/bin - m wget -nv -N https://getcomposer.org/composer-1.phar - chmod +x composer-1.phar + cd /usr/local/bin + EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')" + php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" + ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")" + + if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ] + then + >&2 echo 'ERROR: Invalid installer checksum' + rm composer-setup.php + exit 1 + fi + + php composer-setup.php --quiet + rm composer-setup.php + + # based on error when running composer + mkdir -p /var/www/.composer + chown www-data:www-data /var/www/.composer + ### end composer install rcdirs=(/usr/local/lib/rcexpertpath /usr/local/lib/rcninja) - ncdirs=(/var/www/ncninja) ncdirs=(/var/www/ncexpertpath /var/www/ncninja) # point debian cronjob to our local install, preventing daily cron error @@ -2252,8 +2300,6 @@ if [[ $HOSTNAME == bk ]]; then rcdir=${rcdirs[i]} rcbase=${rcdir##*/} ncdir=${ncdirs[i]} - myncdir=/root/${ncdir##*/} - mkdir -p $myncdir # copied from debians cronjob u /etc/cron.d/$rcbase <$verf @@ -2520,7 +2566,9 @@ EOF for ((i=0; i < ${#bkdomains[@]}; i++)); do domain=${bkdomains[i]} ncdir=${ncdirs[i]} + myncdir=/var/local/${ncdir##*/} ncbase=${ncdir##*/} + mkdir -p $myncdir m cd /var/www if [[ ! -e $ncdir/index.php ]]; then # if we wanted to only install a specific version, use something like @@ -2540,13 +2588,16 @@ EOF m touch $myncdir/done-install fi - # note, strange this happend where updater did not increment the version var, - # mine was stuck on 20. I manually updated it. m cd $ncdir/config - if [[ ! -e $myncdir/config.php-orig ]]; then - m cp -a config.php $myncdir/config.php-orig - fi - cat $myncdir/config.php-orig - >$myncdir/tmp.php <$myncdir/tmp.php <config.php + e running php $myncdir/tmp.php + # note: we leave it around place for debugging + # shellcheck disable=SC2024 # intended + sudo -u www-data php $myncdir/tmp.php >config.php + fi cd $ncdir m sudo -u www-data php occ maintenance:update:htaccess list=$(sudo -u www-data php $ncdir/occ --output=json_pretty app:list) @@ -2646,7 +2699,13 @@ fi ncbase=$1 cd /var/www/$ncbase # https://docs.nextcloud.com/server/22/admin_manual/maintenance/update.html?highlight=updater+phar +# the docs claim this is all you need, which is not true. +# You will go to the web ui and it will say that you need to click a button to update, +# or that you can run occ upgrade m php /var/www/$ncbase/updater/updater.phar -n +# throw a sleep in just because who knows what else is undocumented +sleep 5 +m php occ upgrade EOFOUTER chmod +x /usr/local/bin/ncup @@ -2849,6 +2908,9 @@ EOF # ** $MAIL_HOST|bk) $MAIL_HOST|bk) + cat >>/etc/exim4/update-exim4.conf.conf <