ipv6 tunnel

[distro-setup] / mail-setup

diff --git a/mail-setup b/mail-setup
index b97f3b929a5fd4f1f16105d9c8bcadf8c66951e5..11f8dffe089dc81613f83513cbcd5e2562df351d 100755 (executable)
--- a/mail-setup
+++ b/mail-setup
@@ -21,7 +21,7 @@ set -x
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 if [[ ! $SUDO_USER ]]; then
   echo "$0: error: requires running as nonroot or sudo"
   exit 1
@@ -162,7 +162,7 @@ pi() { # package install
   if [[ ! -r $f ]] || (( $(( $(date +%s) - $(stat -c %Y $f ) )) > 60*60*12 )); then
     apt-get update
   fi
-  apt-get -y install --purge --auto-remove "$@"
+  DEBIAN_FRONTEND=noninteractive apt-get -y install --purge --auto-remove "$@"
 }
 
 postmaster=alerts
@@ -177,6 +177,9 @@ forward=$u@$mxhost
 
 smarthost="$mxhost::$mxport" # exim
 
+# light version of exim does not have sasl auth support.
+pi exim4-daemon-heavy spamassassin spf-tools-perl
+
 # trisquel 8 = openvpn, debian stretch = openvpn-client
 vpn_ser=openvpn-client
 if [[ ! -e /lib/systemd/system/openvpn-client@.service ]]; then
@@ -194,7 +197,8 @@ else
 fi
 
 
-pi openvpn
+# light version of exim does not have sasl auth support.
+pi exim4-daemon-heavy spamassassin spf-tools-perl openvpn dnsmasq
 
 if [[ -e /p/c/filesystem ]]; then
   # allow failure of these commands when our internet is down, they are likely not needed,
@@ -345,7 +349,7 @@ cat >$f <<'EOF'
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 f=/a/bin/bash_unpublished/source-state
 if [[ -e $f ]]; then
@@ -398,11 +402,6 @@ systemctl start mailcert
 systemctl restart mailcert.timer
 systemctl enable mailcert.timer
 
-# This symlink is only here to so I can use the
-# fsf mailman ansible role and trick its cert script
-# into doing nothing.
-/a/exe/lnf -T /etc/exim4/exim.crt /etc/letsencrypt/live/$(hostname -f)/fullchain.pem
-
 ##### end mailcert setup #####
 
 # comon stuff
@@ -478,8 +477,6 @@ EOF
 # enable 587 in addition to the default 25, so that
 # i can send mail where port 25 is firewalled by isp
 daemon_smtp_ports = 25 : 587
-# i don't have ipv6 setup for my vpn tunnel yet.
-disable_ipv6 = true
 
 MAIN_TLS_ENABLE = true
 
@@ -699,7 +696,7 @@ EOF
   # it\'s not part of exim
   rm -f /etc/exim4/conf.d/main/000_localmacros
   cat >>/etc/exim4/update-exim4.conf.conf <<EOF
-dc_eximconfig_configtype='satellite'
+dc_eximconfig_configtype='smarthost'
 dc_smarthost='$smarthost'
 # The manpage incorrectly states this will do header rewriting, but
 # that only happens if we have dc_hide_mailname is set.
@@ -740,10 +737,6 @@ elif [[ $uid != 608 ]]; then
 fi
 
 
-# light version of exim does not have sasl auth support.
-pi exim4-daemon-heavy spamassassin spf-tools-perl
-
-
 
 ##### begin spamassassin config
 systemctl enable spamassassin
@@ -890,17 +883,23 @@ systemctl enable exim4
 
 if [[ $HOSTNAME == "$MAIL_HOST" ]]; then
   f=/usr/local/bin/send-test-forward
-  cat >$f <<'EOF'
+  cat >$f <<'EOFOUTER'
 #!/bin/bash
-echo body_test | mail -s "primary_test $(date +%s) $(date +%Y-%m-%dT%H:%M:%S%z)" iank@posteo.de
+/usr/sbin/exim -t <<EOF
+From: ian@iankelling.org
+To: iank@posteo.de
+Subject: primary_test $(date +%s) $(date +%Y-%m-%dT%H:%M:%S%z)
+
+eom
 EOF
+EOFOUTER
   chmod +x $f
 
   cat >/etc/cron.d/mailtest <<EOF
 SHELL=/bin/bash
 # running as user just because no need to run as root
 */10 * * * *   $u $f 2>&1 | /usr/local/bin/log-once send-test-forward
-*/10 * * * *   $u /usr/local/bin/mailtest-check 2>&1 | /usr/local/bin/log-once -1 send-test-forward
+*/10 * * * *   $u /usr/local/bin/mailtest-check 2>&1 | /usr/local/bin/log-once -1 mailtest-check
 */10 * * * *   root chmod -R g+rw /m/md/bounces 2>&1 | /usr/local/bin/log-once -1 bounces-chmod
 EOF
   cp /a/bin/distro-setup/filesystem/usr/local/bin/mailtest-check /usr/local/bin