The minimal assumption we have is that /etc/mailpass exists
+
+I've had problems with postfix on debian:
+on stretch, a startup ordering issue caused all mail to fail.
+postfix changed defaults to only use ipv6 dns, causing all my mail to fail.
+I haven't gotten around to getting a non-debian exim
+setup.
+
+
+
-h|--help Print help and exit.
EOF
exit $1
# echo "dmarc dns, name: _dmarc value: v=DMARC1; p=none; rua=mailto:mailauth-reports@$domain"
# # 2017-02 spf policies:
+# # host -t txt lists.fedoraproject.org
# # google ~all, hotmail -all, yahoo: ?all, fastmail ?all
# # i include fastmail\'s settings, per their instructions,
# # and follow their policy. In mail in a box, or similar instructions,
postconf -ev "${MAPFILE[@]}"
}
e() { printf "%s\n" "$*"; }
+pi() { # package install
+ local s f
+ if dpkg -s -- "$@" &> /dev/null; then
+ return 0;
+ fi;
+ while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done
+ f=/var/cache/apt/pkgcache.bin;
+ if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*12 )); then
+ apt-get update
+ fi
+ apt-get -y install --purge --auto-remove "$@"
+}
postmaster=$u
mxhost=mail.iankelling.org
postfix postfix/root_address string $postmaster
EOF
if dpkg -s postfix &>/dev/null; then
+ while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done
dpkg-reconfigure -u -fnoninteractive postfix
else
- apt-get -y install --purge --auto-remove postfix
+ pi postfix
fi
else
source /a/bin/distro-functions/src/package-manager-abstractions
else # begin exim. has debian specific stuff for now
- if ! dpkg -s openvpn &>/dev/null; then
- apt-get -y install --purge --auto-remove openvpn
- fi
+ pi openvpn
if [[ -e /p/c/filesystem ]]; then
+ # allow failure of these commands when our internet is down, they are likely not needed,
+ # we check that a valid cert is there already.
# to put the hostname in the known hosts
- ssh -o StrictHostKeyChecking=no root@li.iankelling.org :
- /a/exe/vpn-mk-client-cert -b mail -n mail li.iankelling.org
+ if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then
+ openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/openvpn/mail.crt
+ else
+ # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with
+ # systemd, buuut it can remake the tun device unexpectedly, i got this in the log
+ # after my internet was down for a bit:
+ # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
+ /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org
+ fi
fi
- cat >/etc/systemd/system/mailroute.service <<EOF
-[Unit]
-# this unit is configured to start and stop whenever $vpn_ser@mail.service
-# does
-Description=Routing for email vpn
-After=network.target
-BindsTo=$vpn_ser@mail.service
-After=$vpn_ser@mail.service
-
-[Service]
-Type=oneshot
-ExecStart=/a/bin/distro-setup/mail-route start
-ExecStop=/a/bin/distro-setup/mail-route stop
-RemainAfterExit=yes
-
-[Install]
-RequiredBy=$vpn_ser@mail.service
-EOF
-
cat >/etc/systemd/system/offlineimapsync.timer <<'EOF'
[Unit]
-Description=Run offlineimap-sync once every 5 mins
+Description=Run offlineimap-sync once every min
[Timer]
-OnCalendar=*:0/5
+OnCalendar=*:0/1
[Install]
WantedBy=timers.target
ExecStart=/a/bin/log-quiet/sysd-mail-once offlineimap-sync /a/bin/distro-setup/offlineimap-sync
EOF
systemctl daemon-reload
- systemctl enable mailroute
# wording of question from dpkg-reconfigure exim4-config
# 1. internet site; mail is sent and received directly using SMTP
local_mx=mail.iankelling.org
rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/"
${rsync_common}fullchain.pem /etc/exim4/exim.crt
+ ret=$?
${rsync_common}privkey.pem /etc/exim4/exim.key
+ new_ret=$?
+ if [[ $ret != $new_ret ]]; then
+ echo "$0: error: differing rsync returns, $ret, $new_ret"
+ exit 1
+ fi
+fi
+if [[ $new_ret != 0 ]]; then
+ if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then
+ echo "$0: error!: cert rsync failed and it will expire in less than 3 days"
+ exit 1
+ fi
fi
+exit 0
EOF
chmod 755 $f
# sieve has the benefit of being supported in postfix and
# proprietary/weird environments, so there is more examples on the
# internet. I was torn about whether to do this or not, meh.
- apt-get -y install --purge --auto-remove \
- dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd
+ pi dovecot-core dovecot-imapd dovecot-sieve dovecot-lmtpd
# if we changed 90-sieve.conf and removed the active part of the
# sieve option, we wouldn\'t need this, but I\'d rather not modify a
# gotta remove this, otherwise the set-selections are completely
# ignored. It woulda been nice if this was documented somewhere!
rm -f /etc/exim4/update-exim4.conf.conf
+ while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done
dpkg-reconfigure -u -fnoninteractive exim4-config
fi
fi
# light version of exim does not have sasl auth support.
- apt-get -y install --purge --auto-remove exim4-daemon-heavy spamassassin
+ pi exim4-daemon-heavy spamassassin
batch_max = 200
EOF
+ cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF'
+# smarthost for fsf mail
+# ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and
+# replaced DCsmarthost with mail.fsf.org
+fsfsmarthost:
+ debug_print = "R: smarthost for $local_part@$domain"
+ driver = manualroute
+ domains = ! +local_domains
+ senders = *@fsf.org
+ transport = remote_smtp_smarthost
+ route_list = * mail.fsf.org byname
+ host_find_failed = ignore
+ same_domain_copy_routing = yes
+ no_more
+EOF
+
+ # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost
+ # i only need .forwards, so just doing that one.
+ cd /etc/exim4/conf.d/router
+ b=userforward_higher_priority
+ # replace the router name so it is unique
+ sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b
# begin setup passwd.client
f=/etc/exim4/passwd.client
done
# end setup passwd.client
- # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost
- # i only need .forwards, so just doing that one.
- cd /etc/exim4/conf.d/router
- b=userforward_higher_priority
- # replace the router name so it is unique
- sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b
+ # by default, only 10 days of logs are kept. increase that.
+ sed -ri 's/^(\s*rotate\s).*/\11000/' /etc/logrotate.d/exim4-base
+
systemctl restart exim4
-fi #### end if exim4
+ fi #### end if exim4
-# /etc/alias setup is debian specific, and
-# exim config sets up an /etc/alias from root to the postmaster, which i
-# config to ian, as long as there exists an entry for root, or there was
-# no preexisting aliases file. based on the postinst file. postfix
-# won\'t set up a root to $postmaster alias if it\'s already installed.
-# Since postfix is not the greatest, just set it ourselves.
-if [[ $postmaster != root ]]; then
- sed -i --follow-symlinks -f - /etc/aliases <<EOF
+ # /etc/alias setup is debian specific, and
+ # exim config sets up an /etc/alias from root to the postmaster, which i
+ # config to ian, as long as there exists an entry for root, or there was
+ # no preexisting aliases file. based on the postinst file. postfix
+ # won\'t set up a root to $postmaster alias if it\'s already installed.
+ # Since postfix is not the greatest, just set it ourselves.
+ if [[ $postmaster != root ]]; then
+ sed -i --follow-symlinks -f - /etc/aliases <<EOF
\$a root: $postmaster
/^root:/d
EOF
- newaliases
-fi
-
-# put spool dir in directory that spans multiple distros.
-# based on http://www.postfix.org/qmgr.8.html and my notes in gnus
-#
-# todo: I\'m suspicious of uids for Debian-exim being the same across
-# distros. It would be good to test this.
-dir=/nocow/$type
-sdir=/var/spool/$type
-# we only do this if our system has $dir
-if [[ -e /nocow && $(readlink -f $sdir) != $dir ]]; then
- systemctl stop $type
- if [[ ! -e $dir && -d $sdir ]]; then
- mv $sdir $dir
- fi
- /a/exe/lnf -T $dir $sdir
-fi
-
-systemctl restart $type
-systemctl enable $type
-
-# MAIL_HOST also does radicale, and easier to start and stop it here
-# for when MAIL_HOST changes, so radicale gets the synced files and
-# does not stop us from remounting /o.
-if dpkg -s radicale &>/dev/null; then
- if [[ $HOSTNAME == $MAIL_HOST ]]; then
- systemctl restart radicale
- systemctl enable radicale
- if [[ -e /etc/logrotate.d/radicale.disabled ]]; then
- mv /etc/logrotate.d/radicale{.disabled,}
- fi
- else
- systemctl stop radicale
- systemctl disable radicale
+ newaliases
+ fi
+
+ # put spool dir in directory that spans multiple distros.
+ # based on http://www.postfix.org/qmgr.8.html and my notes in gnus
+ #
+ # todo: I\'m suspicious of uids for Debian-exim being the same across
+ # distros. It would be good to test this.
+ dir=/nocow/$type
+ sdir=/var/spool/$type
+ # we only do this if our system has $dir
+ if [[ -e /nocow && $(readlink -f $sdir) != $dir ]]; then
+ systemctl stop $type
+ if [[ ! -e $dir && -d $sdir ]]; then
+ mv $sdir $dir
+ fi
+ /a/exe/lnf -T $dir $sdir
+ fi
+
+ systemctl restart $type
+ systemctl enable $type
+
+ # MAIL_HOST also does radicale, and easier to start and stop it here
+ # for when MAIL_HOST changes, so radicale gets the synced files and
+ # does not stop us from remounting /o.
+ if dpkg -s radicale &>/dev/null; then
+ if [[ $HOSTNAME == $MAIL_HOST ]]; then
+ systemctl restart radicale
+ systemctl enable radicale
+ if [[ -e /etc/logrotate.d/radicale.disabled ]]; then
+ mv /etc/logrotate.d/radicale{.disabled,}
+ fi
+ else
+ systemctl stop radicale
+ systemctl disable radicale
# weekly logrotate tries to restart radicale even if it's a disabled service in flidas.
if [[ -e /etc/logrotate.d/radicale ]]; then
mv /etc/logrotate.d/radicale{,.disabled}
fi
- fi
-fi
-exit 0
+ fi
+ fi
+ exit 0
-# if I wanted the from address to be renamed and sent to a different address,
-# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical
-# sudo postmap hash:/etc/postfix/recipient_canonical
-# sudo service postfix reload
+ # if I wanted the from address to be renamed and sent to a different address,
+ # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical
+ # sudo postmap hash:/etc/postfix/recipient_canonical
+ # sudo service postfix reload
iankelling.org / git / distro-setup / blobdiff