X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=mail-setup;h=a0bba6db2b78082d78f54ceffc983b53f482e0b2;hp=5ad953ad3af37b540aea2e2e626a70473c1e3fb0;hb=866a0cbd9127386520def96ff49bdc8424df8112;hpb=0310db0c0589445a132e77f0b7a8fbb5e1ae3082

diff --git a/mail-setup b/mail-setup
index 5ad953a..a0bba6d 100755
--- a/mail-setup
+++ b/mail-setup
@@ -290,31 +290,20 @@ else # begin exim. has debian specific stuff for now
     fi
 
     if [[ -e /p/c/filesystem ]]; then
+        # allow failure of these commands when our internet is down, they are likely not needed,
+        # we check that a valid cert is there already.
         # to put the hostname in the known hosts
-        :
-        #ssh -o StrictHostKeyChecking=no root@li.iankelling.org :
-        #/a/exe/vpn-mk-client-cert -b mail -n mail li.iankelling.org
+        if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then
+            openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/openvpn/mail.crt
+        else
+            # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with
+            # systemd, buuut it can remake the tun device unexpectedly, i got this in the log
+            # after my internet was down for a bit:
+            # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
+            /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org
+        fi
     fi
 
-    cat >/etc/systemd/system/mailroute.service <<EOF
-[Unit]
-# this unit is configured to start and stop whenever $vpn_ser@mail.service
-# does
-Description=Routing for email vpn
-After=network.target
-BindsTo=$vpn_ser@mail.service
-After=$vpn_ser@mail.service
-
-[Service]
-Type=oneshot
-ExecStart=/a/bin/distro-setup/mail-route start
-ExecStop=/a/bin/distro-setup/mail-route stop
-RemainAfterExit=yes
-
-[Install]
-RequiredBy=$vpn_ser@mail.service
-EOF
-
     cat >/etc/systemd/system/offlineimapsync.timer <<'EOF'
 [Unit]
 Description=Run offlineimap-sync once every min
@@ -337,7 +326,6 @@ Type=oneshot
 ExecStart=/a/bin/log-quiet/sysd-mail-once offlineimap-sync /a/bin/distro-setup/offlineimap-sync
 EOF
     systemctl daemon-reload
-    systemctl enable mailroute
 
     # wording of question from dpkg-reconfigure exim4-config
     # 1. internet site; mail is sent and received directly using SMTP
@@ -390,8 +378,21 @@ if [[ $HOSTNAME == $MAIL_HOST ]]; then
     local_mx=mail.iankelling.org
     rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/"
     ${rsync_common}fullchain.pem /etc/exim4/exim.crt
+    ret=$?
     ${rsync_common}privkey.pem /etc/exim4/exim.key
+    new_ret=$?
+    if [[ $ret != $new_ret ]]; then
+       echo "$0: error: differing rsync returns, $ret, $new_ret"
+       exit 1
+    fi
 fi
+if [[ $new_ret != 0 ]]; then
+    if ! openssl x509 -checkend $(( 60 * 60 * 24 * 3 )) -noout -in /etc/exim4/exim.crt; then
+        echo "$0: error!: cert rsync failed and it will expire in less than 3 days"
+        exit 1
+    fi
+fi
+exit 0
 EOF
     chmod 755 $f
 
@@ -416,7 +417,7 @@ OnCalendar=daily
 WantedBy=timers.target
 EOF
     systemctl daemon-reload
-    #systemctl start mailcert
+    systemctl start mailcert
     systemctl restart mailcert.timer
     systemctl enable mailcert.timer
 
@@ -899,63 +900,63 @@ EOF
 
     systemctl restart exim4
 
-fi  #### end if exim4
+        fi  #### end if exim4
 
-# /etc/alias setup is debian specific, and
-# exim config sets up an /etc/alias from root to the postmaster, which i
-# config to ian, as long as there exists an entry for root, or there was
-# no preexisting aliases file. based on the postinst file. postfix
-# won\'t set up a root to $postmaster alias if it\'s already installed.
-# Since postfix is not the greatest, just set it ourselves.
-if [[ $postmaster != root ]]; then
-    sed -i --follow-symlinks -f - /etc/aliases <<EOF
+         # /etc/alias setup is debian specific, and
+         # exim config sets up an /etc/alias from root to the postmaster, which i
+         # config to ian, as long as there exists an entry for root, or there was
+         # no preexisting aliases file. based on the postinst file. postfix
+         # won\'t set up a root to $postmaster alias if it\'s already installed.
+         # Since postfix is not the greatest, just set it ourselves.
+         if [[ $postmaster != root ]]; then
+             sed -i --follow-symlinks -f - /etc/aliases <<EOF
 \$a root: $postmaster
 /^root:/d
 EOF
-    newaliases
-fi
-
-# put spool dir in directory that spans multiple distros.
-# based on http://www.postfix.org/qmgr.8.html and my notes in gnus
-#
-# todo: I\'m suspicious of uids for Debian-exim being the same across
-# distros. It would be good to test this.
-dir=/nocow/$type
-sdir=/var/spool/$type
-# we only do this if our system has $dir
-if [[ -e /nocow && $(readlink -f $sdir) != $dir ]]; then
-    systemctl stop $type
-    if [[ ! -e $dir && -d $sdir ]]; then
-        mv $sdir $dir
-    fi
-    /a/exe/lnf -T $dir $sdir
-fi
-
-systemctl restart $type
-systemctl enable $type
-
-# MAIL_HOST also does radicale, and easier to start and stop it here
-# for when MAIL_HOST changes, so radicale gets the synced files and
-# does not stop us from remounting /o.
-if dpkg -s radicale &>/dev/null; then
-    if [[ $HOSTNAME == $MAIL_HOST ]]; then
-        systemctl restart radicale
-        systemctl enable radicale
-        if [[ -e /etc/logrotate.d/radicale.disabled ]]; then
-            mv /etc/logrotate.d/radicale{.disabled,}
-        fi
-    else
-        systemctl stop radicale
-        systemctl disable radicale
+             newaliases
+         fi
+
+         # put spool dir in directory that spans multiple distros.
+         # based on http://www.postfix.org/qmgr.8.html and my notes in gnus
+         #
+         # todo: I\'m suspicious of uids for Debian-exim being the same across
+         # distros. It would be good to test this.
+         dir=/nocow/$type
+         sdir=/var/spool/$type
+         # we only do this if our system has $dir
+         if [[ -e /nocow && $(readlink -f $sdir) != $dir ]]; then
+             systemctl stop $type
+             if [[ ! -e $dir && -d $sdir ]]; then
+                 mv $sdir $dir
+             fi
+             /a/exe/lnf -T $dir $sdir
+         fi
+
+         systemctl restart $type
+         systemctl enable $type
+
+         # MAIL_HOST also does radicale, and easier to start and stop it here
+         # for when MAIL_HOST changes, so radicale gets the synced files and
+         # does not stop us from remounting /o.
+         if dpkg -s radicale &>/dev/null; then
+             if [[ $HOSTNAME == $MAIL_HOST ]]; then
+                 systemctl restart radicale
+                 systemctl enable radicale
+                 if [[ -e /etc/logrotate.d/radicale.disabled ]]; then
+                     mv /etc/logrotate.d/radicale{.disabled,}
+                 fi
+             else
+                 systemctl stop radicale
+                 systemctl disable radicale
         # weekly logrotate tries to restart radicale even if it's a disabled service in flidas.
         if [[ -e /etc/logrotate.d/radicale ]]; then
             mv /etc/logrotate.d/radicale{,.disabled}
         fi
-    fi
-fi
-exit 0
+        fi
+        fi
+         exit 0
 
-# if I wanted the from address to be renamed and sent to a different address,
-# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical
-# sudo postmap hash:/etc/postfix/recipient_canonical
-# sudo service postfix reload
+         # if I wanted the from address to be renamed and sent to a different address,
+         # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical
+         # sudo postmap hash:/etc/postfix/recipient_canonical
+         # sudo service postfix reload