From 7f94df0eb6002f4fd05ab3fc2d61e94a92ef5a1a Mon Sep 17 00:00:00 2001
From: Ian Kelling <ian@iankelling.org>
Date: Thu, 18 Apr 2024 14:24:26 -0400
Subject: [PATCH] various fixes

---
 brc2               |  2 +-
 btrbk-run          |  5 ++++-
 check-subvol-stale |  2 +-
 distro-end         |  5 ++++-
 mail-cert-cron     | 21 +++++++++++++++++++--
 mail-setup         | 11 ++++++-----
 6 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/brc2 b/brc2
index a28d7b7..aa370ac 100644
--- a/brc2
+++ b/brc2
@@ -2950,7 +2950,7 @@ mdenable() {
 
   two=false
   case $1 in
-    -2) two=true shift ;;
+    -2) two=true; shift ;;
   esac
 
   for md; do
diff --git a/btrbk-run b/btrbk-run
index 7a22d42..93e8dab 100644
--- a/btrbk-run
+++ b/btrbk-run
@@ -542,7 +542,10 @@ if ! $pull_reexec && [[ $source ]] && $pulla ; then
   fi
 fi
 
-
+# todo: check if we have no snapshots yet, because I always want to run
+# archive instead of run. Likely, I should give an error unless a cli
+# override is passed. perhaps check-subvol-stale could give the error.
+# see the error message "no snapshots found" in that file.
 if ! $fast; then
   # if our mountpoints are from stale snapshots,
   # it doesn't make sense to do a backup.
diff --git a/check-subvol-stale b/check-subvol-stale
index af7c60e..9b5e88d 100644
--- a/check-subvol-stale
+++ b/check-subvol-stale
@@ -162,7 +162,7 @@ for d; do
     mapfile -t snaps <$tmpf
   else
     # no snapshots yet
-    # TODO: make this an error and override with a cli flag
+    # TODO: consider making this an error and override with a cli flag
     echo "$0: warning: no snapshots found at $root_dir/btrbk/$subvol_dir.20*. this is expected for a brand new volume"
     continue
   fi
diff --git a/distro-end b/distro-end
index d81950c..77cfa4b 100755
--- a/distro-end
+++ b/distro-end
@@ -194,8 +194,11 @@ EOF
     if $doupdate; then
       tmpdir=$(mktemp -d)
       cd $tmpdir
+      # otherwise we get a warning message:
+      # W: Download is performed unsandboxed as root as file '/tmp/tmp.UwxbPFG3CZ/debian-archive-keyring_2021.1.1+deb11u1_all.deb' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)
+      chmod 775 .
       p download debian-archive-keyring
-      s dpkg -i debian-archive-keyring
+      s dpkg -i ./debian-archive-keyring*
       p update
       cd -
       rm -rf $tmpdir
diff --git a/mail-cert-cron b/mail-cert-cron
index 01fb689..b69bc28 100755
--- a/mail-cert-cron
+++ b/mail-cert-cron
@@ -25,10 +25,16 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
 [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
+interactive=false
 case $1 in
   # For first run, accept host key. Note, known_hosts is saved in /p.
   -1)
     opt=(-e 'ssh -oStrictHostKeyChecking=no')
+    shift
+    ;;
+  -i)
+    interactive=true
+    shift
     ;;
 esac
 
@@ -38,11 +44,22 @@ if [[ -e $f ]]; then
   source $f
 fi
 
+try() {
+  local ret=0
+  "$@" || ret=$?
+  if $interactive && (( ret >=1 )); then
+    echo "$0: ERROR: exit $ret on: $*"
+  fi
+}
+
+# note: when certificate is expired, you will get this in /var/log/mail.log when k-9 mail tries to fetch:
+# imap-login: Disconnected: Connection closed: SSL_accept() failed: error:0A000416:SSL routines::sslv3 alert certificate unknown: SSL alert number 46 (no auth attempts in 0 secs): user=<>, rip=redacted, lip=10.8.0.4, TLS handshaking: SSL_accept() failed: error:0A000416:SSL routines::sslv3 alert certificate unknown: SSL alert number 46, session=<EsdzzmAWosNKXpza
+
 case $HOSTNAME in
   $MAIL_HOST|bk)
     # ||: is to allow for temporary connection issues.
-    rsync "${opt[@]}" -ogtL --chown=root:Debian-exim --chmod=640 \
-          root@li.iankelling.org:/etc/letsencrypt/live/mail.iankelling.org/{fullchain.pem,privkey.pem} /etc/exim4 ||:
+    try rsync "${opt[@]}" -ogtL --chown=root:Debian-exim --chmod=640 \
+          root@li.iankelling.org:/etc/letsencrypt/live/mail.iankelling.org/{fullchain.pem,privkey.pem} /etc/exim4
     if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/fullchain.pem; then
       echo "$0: error!: cert rsync failed and it will expire in less than 3 days"
       exit 1
diff --git a/mail-setup b/mail-setup
index 9c46689..36b3ab5 100755
--- a/mail-setup
+++ b/mail-setup
@@ -2105,7 +2105,7 @@ EOF
     # Having backups of indexes is a waste of space. This also means we
     # don't send them around with btrbk, I think it is probably
     # preferable use a bit more cpu to recalculate indexes.
-    install -d -o iank -g iank /var/dovecot-indexes
+    install -d -m 700 -o iank -g iank /var/dovecot-indexes
     cat >>/etc/dovecot/local.conf <<EOF
 
 
@@ -2118,9 +2118,10 @@ mail_cache_max_size = 50M
 !include conf.d/auth-passwdfile.conf.ext
 
 # ian: %u is used for alerts user vs iank
+# https://doc.dovecot.org/configuration_manual/mail_location/Maildir/
 mail_location = maildir:/m/%u:LAYOUT=fs:INBOX=/m/%u/INBOX:INDEX=/var/dovecot-indexes/%u
-mail_uid = $u
-mail_gid = $u
+mail_uid = iank
+mail_gid = iank
 
 protocol lmtp {
 # For a normal setup with exim, we need something like this, which
@@ -3803,8 +3804,8 @@ case $HOSTNAME in
 esac
 
 # optimization, this only needs to run once.
-if [[ ! -e /etc/exim4/fullchain.pem ]]; then
-  m /a/bin/ds/mail-cert-cron -1
+if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/fullchain.pem; then
+  m /a/bin/ds/mail-cert-cron -1 -i
   m systemctl --now enable mailcert.timer
 fi
 
-- 
2.30.2