# Copyright (C) 2019 Ian Kelling
# SPDX-License-Identifier: AGPL-3.0-or-later
+# todo: auto restart of je on checkrestart
+
# todo: remove old files from bk:/m/md/expertpathologyreview.com/testignore/cur
# todo: run mailping test after running, or otherwise
err expected line in $f not found
fi
sed -i "s,^$badline$,$line," $f
- m ser reload apparmor
+ m systemctl reload apparmor
fi
# note: anything added to nn_progs needs corresponding rm
fi
i /etc/spamassassin/mylocal.cf <<'EOF'
-# the normal local.cf has a bunch of upstream stuff i dont want to mess with
+# this is mylocal.cf because the normal local.cf has a bunch of upstream stuff i dont want to mess with
# /usr/share/doc/exim4-base/README.Debian.gz:
# SpamAssassin's default report should not be used in a add_header
uridnsbl_skip_domain zroe.org
EOF
-
-
# 2020-10-19 remove old file. remove this when all hosts updated
rm -fv /etc/systemd/system/spamddnsfix.{timer,service}
18.4.89.0/24 ; 2603:3005:71a:2e00::/64 ; 209.51.188.0/24 ; 2001:470:142::/48 ; 74.94.156.208/28
EOF
-# This file only exists in the nn config. for bk to accept mail
-# outside the nn, it needs a separate cert
-cat >/etc/exim4/conf.d/main/000_local-nn <<EOF
-MAIN_TLS_CERTIFICATE = /etc/exim4/fullchain.pem
-MAIN_TLS_PRIVATEKEY = /etc/exim4/privkey.pem
-EOF
-
rm -fv /etc/exim4/rcpt_local_acl # old path
i /etc/exim4/conf.d/local_deny_exceptions_acl <<'EOF'
EOF
-i /etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF'
+i /etc/exim4/conf.d/router/900_exim4-config_local_user <<EOF
### router/900_exim4-config_local_user
#################################
# This router matches local user mailboxes. If the router fails, the error
# message is "Unknown user".
-
local_user:
- debug_print = "R: local_user for $local_part@$domain"
+ debug_print = "R: local_user for \$local_part@\$domain"
driver = accept
domains = +local_domains
# ian: default file except where mentioned.
xioE3sYKdjOt+p6mlg3l8+OLtODEFPHDqwIBAg==
-----END DH PARAMETERS-----
EOF
- { cat <<EOF
-# https://ssl-config.mozilla.org
-ssl = required
+ {
+ if [[ $HOSTNAME == $MAIL_HOST ]]; then
+ cat <<'EOF'
ssl_cert = </etc/exim4/fullchain.pem
ssl_key = </etc/exim4/privkey.pem
+EOF
+ else
+ cat <<'EOF'
+ssl_cert = </etc/exim4/exim.crt
+ssl_key = </etc/exim4/exim.key
+EOF
+ fi
+ cat <<EOF
+# https://ssl-config.mozilla.org
+ssl = required
# this is the same as the certbot list, in my cert cronjob, I check if that has changed upstream.
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl_protocols = TLSv1.2
#### begin dl roundcube
# note, im r2e subbed to https://github.com/roundcube/roundcubemail/releases.atom
- v=1.4.8; f=roundcubemail-$v-complete.tar.gz
+ v=1.4.11; f=roundcubemail-$v-complete.tar.gz
cd /a/opt
if [[ -e $f ]]; then
timestamp=$(stat -c %Y $f)
# ** $MAIL_HOST|bk)
$MAIL_HOST|bk)
-
- cat >>/etc/exim4/conf.d/main/000_local-nn <<EOF
+ cat >/etc/exim4/conf.d/main/000_local-nn <<EOF
# MAIN_HARDCODE_PRIMARY_HOSTNAME might mess up the
# smarthost config type, not sure.
# failing message on mail-tester.com:
# I used this to avoid sender verification, didnt work but it still
# makes sense based on the spec.
hosts_treat_as_local = defaultnn.b8.nz
+
+# Outside nn, we get the default cert location from a debian macro,
+# and the cert file is put in place by a certbot hook.
+MAIN_TLS_CERTIFICATE = /etc/exim4/fullchain.pem
+MAIN_TLS_PRIVATEKEY = /etc/exim4/privkey.pem
EOF
/a/exe/cedit defaultnn /etc/hosts <<'EOF' || [[ $? == 1 ]]
# ** $MAIL_HOST)
$MAIL_HOST)
+ i /etc/exim4/conf.d/transport/30_backup_maildir <<EOF
+# modified debian maildir transport
+backup_maildir:
+ driver = appendfile
+ directory = /bu/mnt
+ delivery_date_add
+ envelope_to_add
+ return_path_add
+ maildir_format
+ directory_mode = 0700
+ mode = 0644
+ mode_fail_narrower = false
+ # this makes it so if the directory is unmounted, messages stay in the queue
+ create_directory = false
+EOF
+
+ i /etc/exim4/conf.d/router/890_backup_copy <<EOF
+### router/900_exim4-config_local_user
+#################################
+
+# todo, it would be nice to save sent email too,
+# but its not so important, they still exist in my head.
+backup_copy:
+ driver = accept
+ domains = +local_domains
+ local_parts = ! root : ! testignore
+ # uncomment this when testing, comment the above line
+ #local_parts = ! root : testignore
+ transport = backup_maildir
+ cannot_route_message = Unknown user
+ local_part_suffix = +*
+ local_part_suffix_optional
+ unseen
+ user = $u
+EOF
+
# this avoids some error. i cant remember what. todo:
# test it out and document why/if its needed.
i /etc/exim4/host_local_deny_exceptions <<'EOF'
10.173.8.2 nn.b8.nz
EOF
-
- i /etc/myexim4/conf.d/router/180_vpnmanual <<'EOF'
-# copied from dnslookup, altered domains, added route_list,
-# changed driver, removed ignore_target_hosts since it
-# relies on a later defined macro
-vpnmanual:
- debug_print = "R: dnslookup for $local_part@$domain"
- driver = manualroute
- domains = iankelling.org : zroe.org:r2e.iankelling.org
- transport = remote_smtp
- same_domain_copy_routing = yes
- route_list = * 10.8.0.4
- no_more
-EOF
-
sed -r -f - /etc/init.d/exim4 <<'EOF' | i /etc/init.d/exim4in
s,/etc/default/exim4,/etc/default/exim4in,g
s,/run/exim4/exim.pid,/run/exim4/eximin.pid,g
cat >>/etc/exim4/update-exim4.conf.conf <<EOF
dc_other_hostnames='je.b8.nz'
EOF
-
echo|i /etc/exim4/conf.d/rcpt_local_acl
echo|i /etc/exim4/conf.d/router/880_universal_forward
-
;;
# ** not MAIL_HOST|bk|je
*)
EOF
;;&
bk)
- rm -f /etc/myexim4/conf.d/router/180_vpnmanual
+
# config for the non-nn exim
cat >/etc/myexim4/conf.d/main/000_local-nn <<'EOF'
MAIN_HARDCODE_PRIMARY_HOSTNAME = mail2.iankelling.org
$MAIL_HOST|bk|je)
# start spamassassin/dovecot before exim.
sre dovecot spamassassin
+ # need to wait a bit before restarting exim, else I
+ # get a paniclog entry like: spam acl condition: all spamd servers failed
+ sleep 3
sstart mailclean.timer
;;&
$MAIL_HOST)
;;
esac
-sre exim4
+case $HOSTNAME in
+ $MAIL_HOST)
+ # we manually mount /bu/mnt before starting
+ m systemctl disable exim4
+ m systemctl restart exim4
+ ;;
+ *)
+ sre exim4
+ ;;
+esac
case $HOSTNAME in
bk) sre exim4in ;;
esac
iankelling.org / git / distro-setup / commitdiff