fixes

diff --git a/brc2 b/brc2
index e392cf5c0a56d56b882bdb126aa7ff5c01185428..486bd25eae4f02c74c7d2fbe62d00c49b645186a 100644 (file)
--- a/brc2
+++ b/brc2
@@ -12,6 +12,8 @@ source /a/bin/distro-setup/path-add-function
 path-add /a/exe
 # add this with absolute paths as needed for better security
 #path-add --end /path/to/node_modules/.bin
+## for yarn, etc
+#path-add --end /usr/lib/node_modules/corepack/shims/
 
 # pip3 --user things go here:
 path-add --end ~/.local/bin

diff --git a/distro-end b/distro-end
index b1b7a9f30f2c69866fb2749e96b3878689c427b5..878a6ab3b6ee1d7fa26faf173fc02e597d80082d 100755 (executable)
--- a/distro-end
+++ b/distro-end
@@ -842,7 +842,9 @@ EOF
     # also would be nice if erc supported
     # https://wiki.znc.in/self-message
     # https://wiki.znc.in/Query_buffers                                                \
-      #
+    #
+    # for geekshed, there was no sasl support as far as I can tell,
+    # so I set to msg nickserv to identify upon connect.
     if ! getent passwd znc > /dev/null; then
       sudo useradd --create-home -d /var/lib/znc --system --shell /sbin/nologin --comment "Account to run ZNC daemon" --user-group znc
     fi
@@ -1548,23 +1550,27 @@ sudo chown -R debian-transmission:debian-transmission /var/lib/transmission-daem
 #
 # Changed the cache-size to 256 mb, reduces disk use.
 # It is a read & write cache.
-sudo ruby <<EOF
+if ! systemctl is-active transmission-daemon-nn &>/dev/null && \
+    ! systemctl is-active transmission-daemon; then
+  sudo ruby <<EOF | sponge /etc/transmission-daemon/settings.json
 require 'json'
 p = '/etc/transmission-daemon/settings.json'
-File.write(p, JSON.pretty_generate(JSON.parse(File.read(p)).merge({
-'rpc-whitelist-enabled' => false,
-'rpc-authentication-required' => false,
-'incomplete-dir' => '$tdir/partial-torrents',
-'incomplete-dir-enabled' => true,
-'download-dir' => '$tdir/torrents',
-"speed-limit-up" => 800,
-"speed-limit-up-enabled" => true,
-"peer-port" => 61486,
-"cache-size-mb" => 256,
-"ratio-limit" => 5.0,
-"ratio-limit-enabled" => false,
-})) + "\n")
+s = {
+  'rpc-whitelist-enabled' => false,
+  'rpc-authentication-required' => false,
+  'incomplete-dir' => '$tdir/partial-torrents',
+  'incomplete-dir-enabled' => true,
+  'download-dir' => '$tdir/torrents',
+  "speed-limit-up" => 800,
+  "speed-limit-up-enabled" => true,
+  "peer-port" => 61486,
+  "cache-size-mb" => 256,
+  "ratio-limit" => 5.0,
+  "ratio-limit-enabled" => false,
+}
+puts(JSON.pretty_generate(JSON.parse(File.read(p)).merge()))
 EOF
+fi
 
 ####### end transmission
 

diff --git a/exim-nn-iptables b/exim-nn-iptables
new file mode 100755 (executable)
index 0000000..119eaf0
--- /dev/null
+++ b/exim-nn-iptables
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+if ! test "$BASH_VERSION"; then echo "error: shell is not bash" >&2; exit 1; fi
+shopt -s inherit_errexit 2>/dev/null ||: # ignore fail in bash < 4.4
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" exit status: $?, PIPESTATUS: ${PIPESTATUS[*]}" >&2' ERR
+
+# This prevents exim from connecting out to an ip not through the vpn.
+# Before this, I had set exim to be BindsTo=wg-quick@wgmail, which
+# generally made sure it wouldn't run unless the vpn ran, and plus I set
+# a specific interface in the main remote smtp transport. However,
+# However, that wasn't bulletproof, exim spec says about "interface: The
+# first interface of the correct type (IPv4 or IPv6) is used for the
+# outgoing connection. If none of them are the correct type, the option
+# is ignored." And then I found out that the BindsTo results in exim
+# never starting if the vpn fails to start the first time, then starts
+# on the systemd automatic restart. Ugh. So, better to use Wants instead
+# and this.
+
+if !/usr/sbin/iptables -C OUTPUT -p tcp -m tcp --dport 25 -o veth1-mail -j REJECT &>/dev/null; then
+ /usr/sbin/iptables -I OUTPUT -p tcp -m tcp --dport 25 -o veth1-mail -j REJECT
+fi
+
+
+if !/usr/sbin/ip6tables -C OUTPUT -p tcp -m tcp --dport 25 -o veth1-mail -j REJECT &>/dev/null; then
+ /usr/sbin/ip6tables -I OUTPUT -p tcp -m tcp --dport 25 -o veth1-mail -j REJECT
+fi

diff --git a/filesystem/etc/letsencrypt/renewal-hooks/deploy/certbot-renew-hook b/filesystem/etc/letsencrypt/renewal-hooks/deploy/certbot-renew-hook
index 0ee609d56582e6593fa16e8e54e6806e204c3ae1..f10f8187a8ba47960a0be8eb22ca0aabc421e73c 100755 (executable)
--- a/filesystem/etc/letsencrypt/renewal-hooks/deploy/certbot-renew-hook
+++ b/filesystem/etc/letsencrypt/renewal-hooks/deploy/certbot-renew-hook
@@ -19,10 +19,6 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 dir=$RENEWED_LINEAGE # long caps vars just bother me
 
 case $dir in
-  /etc/letsencrypt/live/je.b8.nz)
-    install -m 644 $dir/fullchain.pem /etc/node_exporter/fullchain.pem
-    install -m 640 -g node-exp $dir/privkey.pem /etc/node_exporter/privkey.pem
-    ;;
   /etc/letsencrypt/live/iankelling.org)
     cat $dir/{privkey,cert,chain}.pem > /var/lib/znc/znc.pem
     ;;

diff --git a/install-my-scripts b/install-my-scripts
index c6f960af8e029cc9b4d078f3f36e6af29fbff0a2..27c5c4b30bbd8f9e34adc72949c9df8e5b3e97fa 100755 (executable)
--- a/install-my-scripts
+++ b/install-my-scripts
@@ -43,6 +43,7 @@ rsync -t --chmod=755 --chown=root:root switch-mail-host btrbk-run mount-latest-s
       mail-backup-clean \
       iptables-exim \
       ip6tables-exim \
+      exim-nn-iptables \
       /usr/local/bin
 rsync -t --chmod=755 --chown=root:root /a/bin/errhandle/err /usr/local/lib
 

diff --git a/mail-setup b/mail-setup
index 5166faa3a44e1a9009368ee48d9a989cfe3272d2..f47f6ab5e0a431e16a3ce9fc3c3782adf8fc34c7 100755 (executable)
--- a/mail-setup
+++ b/mail-setup
@@ -717,8 +717,12 @@ EOF
     for unit in ${nn_progs[@]}; do
       i /etc/systemd/system/$unit.service.d/nn.conf <<EOF
 [Unit]
-# commented for old openvpn
-Requires=$vpnser
+
+# Wants appears better than requires because with requires,
+# if the vpnser fails to start, this service won't get run at
+# all, even if the vpnser starts on an automatic restart.
+
+Wants=$vpnser
 After=network.target mailnn.service $vpnser
 JoinsNamespaceOf=mailnn.service
 BindsTo=mailnn.service
@@ -1423,13 +1427,10 @@ if mailhost; then
 
   i /etc/systemd/system/radicale.service.d/override.conf <<EOF
 [Unit]
-# this unit is configured to start and stop whenever
-# $vpnser does
 
 After=network.target network-online.target mailnn.service $vpnser
-BindsTo=$vpnser
 
-Wants=network-online.target
+Wants=$vpnser
 JoinsNamespaceOf=mailnn.service
 StartLimitIntervalSec=0
 
@@ -1767,6 +1768,7 @@ EOF
     i /etc/dovecot/dovecot-sql.conf.ext <<'EOF'
 # from mailinabox
 driver = sqlite
+# for je and bk, populated the testignore users for the relevant domains
 connect = /m/rc/users.sqlite
 default_pass_scheme = SHA512-CRYPT
 password_query = SELECT email as user, password FROM users WHERE email='%u';
@@ -1788,6 +1790,8 @@ extra,
 privileges TEXT NOT NULL DEFAULT '');
 EOF
     fi
+    # users.sqlite is saved into /p/c/machine_specific, so update it there!.
+    #
     # example of adding a user:
     # hash: doveadm pw -s SHA512-CRYPT -p passhere
     # sqlite3 /m/rc/users.sqlite <<'EOF'
@@ -2981,6 +2985,9 @@ if [[ -e /nocow ]]; then
 # without local-fs on exim, we get these kind of errors in paniclog on shutdown:
 # Failed to create spool file /var/spool/exim4//input//1jCLxz-0008V4-V9-D: Permission denied
 After=local-fs.target
+
+[Service]
+ExecStartPre=/usr/local/bin/exim-nn-iptables
 EOF
   if ! mountpoint -q $sdir; then
     stopifactive exim4 exim4in

diff --git a/mailtest-check b/mailtest-check
index 7454086099322db19eec59bee04471d555fc297d..3d4d8a4cee7d86ef7af0e02e7b45fcbb38969236 100755 (executable)
--- a/mailtest-check
+++ b/mailtest-check
@@ -57,6 +57,8 @@ fi
 #Nov  8 08:16:05.439 [6080] warn: plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/VBounce.pm: lib/Mail/SpamAssassin/Plugin/VBounce.pm: Permission denied at (eval 60) line 1.
 # i dont know why, i just found the solution online
 cd /m/md
+# TODO, get je to deliver the local mailbox: /m/md/INBOX
+# dovecot appears to setup, i can t be sure.
 
 case $HOSTNAME in
   bk)