done
} | i /etc/exim4/conf.d/my-dkim-domains
-cat >/etc/exim4/conf.d/transport/11_iank <<'EOF'
+if grep -Fq REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS \
+ /etc/exim4/conf.d/transport/10_exim4-config_transport-macros; then
+ cat >/etc/exim4/conf.d/transport/11_iank <<'EOF'
# This unsets the default macro defined in on t11 in
# /etc/exim4/conf.d/transport/10_exim4-config_transport-macros
# It seems like a very odd choice that this has become
# auth. Oh well.
REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS ==
EOF
+else
+ rm -f /etc/exim4/conf.d/transport/11_iank
+fi
cat >/etc/exim4/conf.d/main/000_local <<'EOF'
MAIN_TLS_ENABLE = true
DKIM_CANON = relaxed
DKIM_SELECTOR = li
-# From comments in
-# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4
-# and its best for this to align https://tools.ietf.org/html/rfc7489#page-8
-# There could be some circumstance when the
-# from: isnt our domain, but the envelope sender is
-# and so still want to sign, but I cant think of any case.
-#DKIM_DOMAIN = ${lc:${domain:$rh_from:}}
-# In t11, we cant do the above anymore because this is tainted data used in a file lookup.
-# /usr/share/doc/exim4/NEWS.Debian.gz suggests to use lookups to untaint data.
-DKIM_DOMAIN = ${lookup {${domain:$rh_from:}}lsearch,ret=key{/etc/exim4/conf.d/my-dkim-domains}}
# The file is based on the outgoing domain-name in the from-header.
# sign if key exists
LOCAL_DENY_EXCEPTIONS_LOCAL_ACL_FILE = /etc/exim4/conf.d/local_deny_exceptions_acl
EOF
+if dpkg --compare-versions "$(dpkg-query -f='${Version}\n' --show exim4)" ge 4.94; then
+ cat >>/etc/exim4/conf.d/main/000_local <<'EOF'
+# In t11, we cant do the old anymore because this is tainted data used in a file lookup.
+# /usr/share/doc/exim4/NEWS.Debian.gz suggests to use lookups to untaint data.
+DKIM_DOMAIN = ${lookup {${domain:$rh_from:}}lsearch,ret=key{/etc/exim4/conf.d/my-dkim-domains}}
+EOF
+else
+ cat >>/etc/exim4/conf.d/main/000_local <<'EOF'
+# From comments in
+# https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4
+# and its best for this to align https://tools.ietf.org/html/rfc7489#page-8
+# There could be some circumstance when the
+# from: isnt our domain, but the envelope sender is
+# and so still want to sign, but I cant think of any case.
+DKIM_DOMAIN = ${lc:${domain:$rh_from:}}
+EOF
+fi
+
rm -fv /etc/exim4/rcpt_local_acl # old path
i /etc/exim4/conf.d/local_deny_exceptions_acl <<'EOF'
EOF
+# It is important for this to exist universally, instead of
+# just on the mail host because if we change mail host and
+# still have something in the queue which was destined for
+# this router, but hosts were unreachable, the routers will
+# be reevaluated on the next retry.
+i /etc/exim4/conf.d/router/890_backup_copy <<EOF
+### router/900_exim4-config_local_user
+#################################
+
+# todo, it would be nice backup sent email too,
+# but its not so important, they still exist in my head
+
+backup_copy:
+driver = manualroute
+domains = eximbackup.b8.nz
+transport = backup_remote
+ignore_target_hosts = ${HOSTNAME}wg.b8.nz
+# note changes here also require change in passwd.client
+route_list = * eximbackup.b8.nz
+same_domain_copy_routing = yes
+errors_to = alerts@iankelling.org
+no_more
+EOF
+
+# exim4-config transports are the same as default except for
+# message_linelength_limit = 2097152
+#
+# TODO: copy the defaults into their own file, and setup a cronjob so
+# that if file.dpkg-dist shows up, and it is different, we get an alert.
+
+i /etc/exim4/conf.d/transport/30_exim4-config_remote_smtp_smarthost <<'EOF'
+### transport/30_exim4-config_remote_smtp_smarthost
+#################################
+
+# This transport is used for delivering messages over SMTP connections
+# to a smarthost. The local host tries to authenticate.
+# This transport is used for smarthost and satellite configurations.
+
+remote_smtp_smarthost:
+ debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
+ driver = smtp
+ message_linelength_limit = 2097152
+ multi_domain
+ hosts_try_auth = <; ${if exists{CONFDIR/passwd.client} \
+ {\
+ ${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$host_address}}\
+ }\
+ {} \
+ }
+.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
+ hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
+ hosts_require_tls = REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES
+ tls_verify_certificates = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS
+ tls_verify_hosts = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS
+.endif
+.ifdef REMOTE_SMTP_HEADERS_REWRITE
+ headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
+.endif
+.ifdef REMOTE_SMTP_RETURN_PATH
+ return_path = REMOTE_SMTP_RETURN_PATH
+.endif
+.ifdef REMOTE_SMTP_HELO_DATA
+ helo_data=REMOTE_SMTP_HELO_DATA
+.endif
+.ifdef TLS_DH_MIN_BITS
+tls_dh_min_bits = TLS_DH_MIN_BITS
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
+tls_certificate = REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY
+tls_privatekey = REMOTE_SMTP_SMARTHOST_PRIVATEKEY
+.endif
+.ifdef REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE
+ headers_remove = REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_PROTOCOL
+ protocol = REMOTE_SMTP_SMARTHOST_PROTOCOL
+.endif
+EOF
+
+i /etc/exim4/conf.d/transport/30_exim4-config_remote_smtp <<'EOF'
+### transport/30_exim4-config_remote_smtp
+#################################
+# This transport is used for delivering messages over SMTP connections.
+
+remote_smtp:
+ debug_print = "T: remote_smtp for $local_part@$domain"
+ driver = smtp
+ message_linelength_limit = 2097152
+.ifdef REMOTE_SMTP_HOSTS_AVOID_TLS
+ hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS
+.endif
+.ifdef REMOTE_SMTP_HEADERS_REWRITE
+ headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
+.endif
+.ifdef REMOTE_SMTP_RETURN_PATH
+ return_path = REMOTE_SMTP_RETURN_PATH
+.endif
+.ifdef REMOTE_SMTP_HELO_DATA
+ helo_data=REMOTE_SMTP_HELO_DATA
+.endif
+.ifdef REMOTE_SMTP_INTERFACE
+ interface = REMOTE_SMTP_INTERFACE
+.endif
+.ifdef DKIM_DOMAIN
+dkim_domain = DKIM_DOMAIN
+.endif
+.ifdef DKIM_IDENTITY
+dkim_identity = DKIM_IDENTITY
+.endif
+.ifdef DKIM_SELECTOR
+dkim_selector = DKIM_SELECTOR
+.endif
+.ifdef DKIM_PRIVATE_KEY
+dkim_private_key = DKIM_PRIVATE_KEY
+.endif
+.ifdef DKIM_CANON
+dkim_canon = DKIM_CANON
+.endif
+.ifdef DKIM_STRICT
+dkim_strict = DKIM_STRICT
+.endif
+.ifdef DKIM_SIGN_HEADERS
+dkim_sign_headers = DKIM_SIGN_HEADERS
+.endif
+.ifdef DKIM_TIMESTAMPS
+dkim_timestamps = DKIM_TIMESTAMPS
+.endif
+.ifdef TLS_DH_MIN_BITS
+tls_dh_min_bits = TLS_DH_MIN_BITS
+.endif
+.ifdef REMOTE_SMTP_TLS_CERTIFICATE
+tls_certificate = REMOTE_SMTP_TLS_CERTIFICATE
+.endif
+.ifdef REMOTE_SMTP_PRIVATEKEY
+tls_privatekey = REMOTE_SMTP_PRIVATEKEY
+.endif
+.ifdef REMOTE_SMTP_HOSTS_REQUIRE_TLS
+ hosts_require_tls = REMOTE_SMTP_HOSTS_REQUIRE_TLS
+.endif
+.ifdef REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE
+ headers_remove = REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE
+.endif
+
+EOF
+
+i /etc/exim4/conf.d/transport/30_backup_remote <<'EOF'
+backup_remote:
+ driver = smtp
+ multi_domain
+ message_linelength_limit = 2097152
+ hosts_require_auth = *
+ hosts_try_auth = *
+ envelope_to_add
+ # manual return path because we want it to be the envelope sender
+ # we got not the one we are using in this smtp transport
+ headers_add = "Return-path: $sender_address"
+.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
+ hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
+ hosts_require_tls = REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES
+ tls_verify_certificates = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS
+ tls_verify_hosts = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOST
+.endif
+.ifdef REMOTE_SMTP_HEADERS_REWRITE
+ headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
+.endif
+.ifdef REMOTE_SMTP_HELO_DATA
+ helo_data=REMOTE_SMTP_HELO_DATA
+.endif
+.ifdef TLS_DH_MIN_BITS
+tls_dh_min_bits = TLS_DH_MIN_BITS
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
+tls_certificate = REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
+.endif
+.ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY
+tls_privatekey = REMOTE_SMTP_SMARTHOST_PRIVATEKEY
+.endif
+.ifdef REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE
+ headers_remove = REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE
+.endif
+EOF
+
i /etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF'
### router/900_exim4-config_local_user
#################################
remote_smtp_vpn:
debug_print = "T: remote_smtp_vpn for $local_part@$domain"
driver = smtp
+ message_linelength_limit = 2097152
.ifdef REMOTE_SMTP_HOSTS_AVOID_TLS
hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS
.endif
smarthost_dkim:
debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
driver = smtp
+ message_linelength_limit = 2097152
multi_domain
hosts_try_auth = <; ${if exists{CONFDIR/passwd.client} \
{\
rcdir=${rcdirs[i]}
rcbase=${rcdir##*/}
ncdir=${ncdirs[i]}
+ myncdir=/root/${ncdir##*/}
+ mkdir -p $myncdir
# copied from debians cronjob
i /etc/cron.d/$rcbase <<EOF
### begin php setup for rc ###
# Enable PHP modules.
m phpenmod -v php mcrypt imap
- # dpkg says this is required
+ # dpkg says this is required.
+ # nextcloud needs these too
m a2enmod proxy_fcgi setenvif
fpm=$(dpkg-query -s php-fpm | sed -nr 's/^Depends:.* (php[^ ]*-fpm)( .*|$)/\1/p') # eg: php7.4-fpm
phpver=$(dpkg-query -s php-fpm | sed -nr 's/^Depends:.* php([^ ]*)-fpm( .*|$)/\1/p')
m rm -f $file
m chown -R www-data.www-data nextcloud
m mv nextcloud $ncdir
+ fi
+
+ if [[ ! -e $myncdir/done-install ]]; then
m cd $ncdir
m sudo -u www-data php occ maintenance:install --database sqlite --admin-user iank --admin-pass $nextcloud_admin_pass
+ m touch $myncdir/done-install
fi
+
# note, strange this happend where updater did not increment the version var,
# mine was stuck on 20. I manually updated it.
m cd $ncdir/config
- if [[ ! -e config.php-orig ]]; then
- m cp -a config.php config.php-orig
+ if [[ ! -e $myncdir/config.php-orig ]]; then
+ m cp -a config.php $myncdir/config.php-orig
fi
- cat config.php-orig - >tmp.php <<EOF
+ cat $myncdir/config.php-orig - >$myncdir/tmp.php <<EOF
# https://docs.nextcloud.com/server/19/admin_manual/configuration_server/email_configuration.html
\$CONFIG["mail_smtpmode"] = "sendmail";
\$CONFIG["mail_smtphost"] = "127.0.0.1";
var_export(\$CONFIG);
fwrite(STDOUT, ";\n");
EOF
- e running php tmp.php
- php tmp.php >config.php
- # leave in place for debugging
- #m rm -f tmp.php
- m sudo -u www-data php $ncdir/occ maintenance:update:htaccess
+ e running php $myncdir/tmp.php
+ # note: we leave it around place for debugging
+ php $myncdir/tmp.php >config.php
+ cd $ncdir
+ m sudo -u www-data php occ maintenance:update:htaccess
list=$(sudo -u www-data php $ncdir/occ --output=json_pretty app:list)
# user_external not compaible with nc 23
for app in contacts calendar; do
if [[ $(printf "%s\n" "$list"| jq ".enabled.$app") == null ]]; then
- m sudo -u www-data php $ncdir/occ app:install $app
+ cd $ncdir
+ m sudo -u www-data php occ app:install $app
fi
done
i /etc/systemd/system/$ncbase.service <<EOF
ncbase=$1
cd /var/www/$ncbase
+# https://docs.nextcloud.com/server/22/admin_manual/maintenance/update.html?highlight=updater+phar
m php /var/www/$ncbase/updater/updater.phar -n
-# just being overly cautious
-sleep 3
-m php occ -n upgrade
EOFOUTER
chmod +x /usr/local/bin/ncup
# which required using a dedicated user, but realized smtp will be
# more reliable and less fuss. If I ever need that again, see the
# history of this file, and bum in brc2.
-
i /etc/exim4/conf.d/router/890_backup_copy <<EOF
-### router/900_exim4-config_local_user
-#################################
-
-# todo, it would be nice to save sent email too,
-# but its not so important, they still exist in my head
-
backup_redir:
driver = redirect
domains = +local_domains
# redirected earlier, so that is just being overly cautious.
local_parts = ! root : ! testignore : ! alerts
unseen = true
-
-backup_copy:
-driver = manualroute
-domains = eximbackup.b8.nz
-transport = backup_remote
-ignore_target_hosts = ${HOSTNAME}wg.b8.nz
-# note changes here also require change in passwd.client
-route_list = * eximbackup.b8.nz
-same_domain_copy_routing = yes
errors_to = alerts@iankelling.org
-no_more
EOF
- i /etc/exim4/conf.d/transport/30_backup_remote <<'EOF'
-backup_remote:
- driver = smtp
- multi_domain
-.ifdef IGNORE_SMTP_LINE_LENGTH_LIMIT
- message_linelength_limit = 1000000
-.endif
- hosts_require_auth = *
- hosts_try_auth = *
- envelope_to_add
- # manual return path because we want it to be the envelope sender
- # we got not the one we are using in this smtp transport
- headers_add = "Return-path: $sender_address"
-.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
- hosts_avoid_tls = REMOTE_SMTP_SMARTHOST_HOSTS_AVOID_TLS
-.endif
-.ifdef REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
- hosts_require_tls = REMOTE_SMTP_SMARTHOST_HOSTS_REQUIRE_TLS
-.endif
-.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES
- tls_verify_certificates = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_CERTIFICATES
-.endif
-.ifdef REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOSTS
- tls_verify_hosts = REMOTE_SMTP_SMARTHOST_TLS_VERIFY_HOST
-.endif
-.ifdef REMOTE_SMTP_HEADERS_REWRITE
- headers_rewrite = REMOTE_SMTP_HEADERS_REWRITE
-.endif
-.ifdef REMOTE_SMTP_HELO_DATA
- helo_data=REMOTE_SMTP_HELO_DATA
-.endif
-.ifdef TLS_DH_MIN_BITS
-tls_dh_min_bits = TLS_DH_MIN_BITS
-.endif
-.ifdef REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
-tls_certificate = REMOTE_SMTP_SMARTHOST_TLS_CERTIFICATE
-.endif
-.ifdef REMOTE_SMTP_SMARTHOST_PRIVATEKEY
-tls_privatekey = REMOTE_SMTP_SMARTHOST_PRIVATEKEY
-.endif
-.ifdef REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE
- headers_remove = REMOTE_SMTP_TRANSPORTS_HEADERS_REMOVE
-.endif
-EOF
-
- # This allows for forward mail to not get most rcpt checks, especially SPF,
+ # This allows for forwarded mail to not get most rcpt checks, especially SPF,
# which would incorrectly get denied.
i /etc/exim4/host_local_deny_exceptions <<'EOF'
mail.fsf.org
--- /dev/null
+#!/bin/bash
+
+if [[ -s /usr/local/lib/err ]]; then
+ source /usr/local/lib/err
+else
+ exit 1
+fi
+
+
+pre="${0##*/}:"
+m() { printf "$pre %s\n" "$*"; "$@"; }
+e() { printf "$pre %s\n" "$*"; }
+err() { printf "$pre %s\n" "$*" >&2; exit 1; }
+i() { # install file
+ local tmp tmpdir dest="$1"
+ local base="${dest##*/}"
+ local dir="${dest%/*}"
+ if [[ $dir != "$base" ]]; then
+ # dest has a directory component
+ mkdir -p "$dir"
+ fi
+ ir=false # i result
+ tmpdir=$(mktemp -d)
+ cat >$tmpdir/"$base"
+ tmp=$(rsync -ic $tmpdir/"$base" "$dest")
+ if [[ $tmp ]]; then
+ printf "%s\n" "$tmp"
+ ir=true
+ if [[ $dest == /etc/systemd/system/* ]]; then
+ touch /var/local/mail-setup-reload
+ reload=true
+ fi
+ fi
+ rm -rf $tmpdir
+}
+setini() {
+ key="$1" value="$2" section="$3"
+ file="/etc/radicale/config"
+ sed -ri "/ *\[$section\]/,/^ *\[[^]]+\]/{/^\s*${key}[[:space:]=]/d};/ *\[$section\]/a $key = $value" "$file"
+}
+soff () {
+ for service; do
+ # ignore services that dont exist
+ if systemctl cat $service &>/dev/null; then
+ m systemctl disable --now $service
+ fi
+ done
+}
+sre() {
+ for service; do
+ m systemctl restart $service
+ m systemctl enable $service;
+ done
+}
+
+
+ncdir=/var/www/ncfsf
+myncdir=/root/ncfsf
+ncbase=${ncdir##*/}
+mkdir $myncdir
+domain=boardfiles.fsf.org
+
+apt-get -y install php-zip apache2 php-fpm
+
+fpm=$(dpkg-query -s php-fpm | sed -nr 's/^Depends:.* (php[^ ]*-fpm)( .*|$)/\1/p') # eg: php7.4-fpm
+phpver=$(dpkg-query -s php-fpm | sed -nr 's/^Depends:.* php([^ ]*)-fpm( .*|$)/\1/p')
+m a2enconf $fpm
+# 3 useless guides on php fpm fcgi debian 10 later, i figure out from reading
+# /etc/apache2/conf-enabled/php7.3-fpm.conf
+# However, on t11,
+# ERROR: Module php8.1 does not exist. just allow it to fail
+m a2dismod php$phpver ||:
+
+# php with fpm doesnt work without this
+m a2enmod proxy_fcgi
+
+
+
+m web-conf - apache2 $domain <<EOF
+### begin nextcloud settings
+Alias /nextcloud "$ncdir/"
+<Directory $ncdir/>
+ Require all granted
+ AllowOverride All
+ Options FollowSymLinks MultiViews
+
+ <IfModule mod_dav.c>
+ Dav off
+ </IfModule>
+
+</Directory>
+
+# based on install checker, links to
+# https://docs.nextcloud.com/server/19/admin_manual/issues/general_troubleshooting.html#service-discovery
+# their example was a bit wrong, I figured it out by adding
+# LogLevel warn rewrite:trace5
+# then watching the apache logs
+
+RewriteEngine on
+RewriteRule ^/\.well-known/host-meta /nextcloud/public.php?service=host-meta [QSA,L]
+RewriteRule ^/\.well-known/host-meta\.json /nextcloud/public.php?service=host-meta-json [QSA,L]
+RewriteRule ^/\.well-known/webfinger /nextcloud/public.php?service=webfinger [QSA,L]
+### end nextcloud settings
+EOF
+
+
+i /etc/php/$phpver/cli/conf.d/30-local.ini <<'EOF'
+apc.enable_cli = 1
+EOF
+
+
+i /etc/php/$phpver/fpm/conf.d/30-local.ini <<'EOF'
+date.timezone = "America/New_York"
+# for nextcloud
+upload_max_filesize = 2000M
+post_max_size = 2000M
+# install checker, nextcloud/settings/admin/overview
+memory_limit = 512M
+EOF
+
+m systemctl restart $fpm
+
+# some of these are based on errors later on.
+m apt-get -y install php-curl php-bz2 php-gmp php-bcmath php-imagick php-apcu php-mbstring php-xml php-gd sqlite3 php-sqlite3
+
+# https://docs.nextcloud.com/server/19/admin_manual/installation/source_installation.html
+cat >/etc/php/$phpver/fpm/pool.d/localwww.conf <<'EOF'
+[www]
+clear_env = no
+EOF
+
+
+
+nextcloud_admin_pass=casHiosidZyFraycs
+
+m cd /var/www
+if [[ ! -e $ncdir/index.php ]]; then
+ # if we wanted to only install a specific version, use something like
+ # file=latest-22.zip
+ file=latest.zip
+ m wget -nv -N https://download.nextcloud.com/server/releases/$file
+ m rm -rf nextcloud
+ m unzip -q $file
+ m rm -f $file
+ m chown -R www-data.www-data nextcloud
+ m mv nextcloud $ncdir
+fi
+
+if [[ ! -e $myncdir/done-install ]]; then
+ m cd $ncdir
+ m sudo -u www-data php occ maintenance:install --database sqlite --admin-user iank --admin-pass $nextcloud_admin_pass
+ m touch $myncdir/done-install
+fi
+
+# note, strange this happend where updater did not increment the version var,
+# mine was stuck on 20. I manually updated it.
+m cd $ncdir/config
+if [[ ! -e $myncdir/config.php-orig ]]; then
+ m cp -a config.php $myncdir/config.php-orig
+fi
+cat $myncdir/config.php-orig - >$myncdir/tmp.php <<EOF
+# https://docs.nextcloud.com/server/19/admin_manual/configuration_server/email_configuration.html
+\$CONFIG["mail_smtpmode"] = "sendmail";
+\$CONFIG["mail_smtphost"] = "127.0.0.1";
+\$CONFIG["mail_smtpport"] = 25;
+\$CONFIG["mail_smtptimeout"] = 10;
+\$CONFIG["mail_smtpsecure"] = "";
+\$CONFIG["mail_smtpauth"] = false;
+\$CONFIG["mail_smtpauthtype"] = "LOGIN";
+\$CONFIG["mail_smtpname"] = "";
+\$CONFIG["mail_smtppassword"] = "";
+\$CONFIG["mail_domain"] = "$domain";
+
+
+# based on installer check
+# https://docs.nextcloud.com/server/19/admin_manual/configuration_server/caching_configuration.html
+\$CONFIG['memcache.local'] = '\OC\Memcache\APCu';
+
+\$CONFIG['overwrite.cli.url'] = 'https://$domain/nextcloud';
+\$CONFIG['htaccess.RewriteBase'] = '/nextcloud';
+\$CONFIG['trusted_domains'] = array (
+ 0 => '$domain',
+ );
+#\$CONFIG[''] = '';
+fwrite(STDOUT, "<?php\n\\\$CONFIG = ");
+var_export(\$CONFIG);
+fwrite(STDOUT, ";\n");
+EOF
+e running php $myncdir/tmp.php
+# note: we leave it around place for debugging
+php $myncdir/tmp.php >config.php
+cd $ncdir
+m sudo -u www-data php occ maintenance:update:htaccess
+i /etc/systemd/system/$ncbase.service <<EOF
+[Unit]
+Description=ncup $ncbase
+After=multi-user.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/ncup $ncbase
+User=www-data
+IOSchedulingClass=idle
+CPUSchedulingPolicy=idle
+EOF
+i /etc/systemd/system/$ncbase.timer <<EOF
+[Unit]
+Description=ncup $ncbase timer
+
+[Timer]
+OnCalendar=Daily
+
+[Install]
+WantedBy=timers.target
+EOF
+systemctl enable --now $ncbase.timer
+i /usr/local/bin/ncup <<'EOFOUTER'
+#!/bin/bash
+
+source /usr/local/lib/err
+
+m() { printf "%s\n" "$*"; "$@"; }
+err-cleanup() {
+ echo failed nextcloud update for $ncbase >&2
+ # -odf or else systemd will kill the background delivery process
+ # and the message will sit in the queue until the next queue run.
+ exim -odf -t <<EOF
+To: alerts@iankelling.org
+From: www-data@$(hostname -f)
+Subject: failed nextcloud update for $ncbase
+
+For logs, run: jr -u $ncbase
+EOF
+}
+
+if [[ $(id -u -n) != www-data ]]; then
+ echo error: running as wrong user: $(id -u -n), expected www-data
+ exit 1
+fi
+
+if [[ ! $1 ]]; then
+ echo error: expected an arg, nextcloud relative base dir
+ exit 1
+fi
+
+ncbase=$1
+cd /var/www/$ncbase
+# https://docs.nextcloud.com/server/22/admin_manual/maintenance/update.html?highlight=updater+phar
+m php /var/www/$ncbase/updater/updater.phar -n
+EOFOUTER
+chmod +x /usr/local/bin/ncup
+
+mkdir -p /var/www/cron-errors
+chown www-data.www-data /var/www/cron-errors
+i /etc/cron.d/$ncbase <<EOF
+PATH=/usr/sbin:/sbin:/usr/bin:/bin:/usr/local/bin
+SHELL=/bin/bash
+# https://docs.nextcloud.com/server/20/admin_manual/configuration_server/background_jobs_configuration.html
+*/5 * * * * www-data php -f $ncdir/cron.php --define apc.enable_cli=1 |& log-once nccron
+EOF
+
+if $reload; then
+ m systemctl daemon-reload
+fi
iankelling.org / git / distro-setup / commitdiff