From: Ian Kelling Date: Sat, 20 Jul 2019 15:35:35 +0000 (-0400) Subject: remove postfix support since i dont use it X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=commitdiff_plain;h=c8f87d4173949b8d96c9c34e2d2c0730caeba0eb remove postfix support since i dont use it --- diff --git a/distro-begin b/distro-begin index 690bf85..ec39e9d 100755 --- a/distro-begin +++ b/distro-begin @@ -512,12 +512,7 @@ fi ##### setup email -if isdeb; then - mail-setup exim4 -else - # todo: probably broken - mail-setup postfix -fi +mail-setup #### ubuntu nicety if isubuntu; then diff --git a/mail-setup b/mail-setup index 9b30579..c062362 100755 --- a/mail-setup +++ b/mail-setup @@ -30,32 +30,17 @@ u=$SUDO_USER usage() { cat < /dev/null; then - debconf-set-selections </dev/null; then - while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done - dpkg-reconfigure -u -fnoninteractive postfix - else - pi postfix - fi - else - source /a/bin/distro-functions/src/package-manager-abstractions - pi postfix - # Settings from reading the output when installing on debian, - # then seeing which were different in a default install on arch. - # I assume the same works for fedora. - postconfin <>$f - done - postmap hash:/etc/postfix/sasl_passwd - # need restart instead of reload when changing - # inet_protocols - service postfix restart - -else # begin exim. has debian specific stuff for now - - pi openvpn - - if [[ -e /p/c/filesystem ]]; then - # allow failure of these commands when our internet is down, they are likely not needed, - # we check that a valid cert is there already. - # to put the hostname in the known hosts - if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then - # This just causes failure if our cert is going to expire in the next 30 days. - # Certs I generate last 10 years. - openssl x509 -checkend $(( 60 * 60 * 24 * 30 )) -noout -in /etc/openvpn/mail.crt - else - # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with - # systemd, buuut it can remake the tun device unexpectedly, i got this in the log - # after my internet was down for a bit: - # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. - /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org - fi +if [[ -e /p/c/filesystem ]]; then + # allow failure of these commands when our internet is down, they are likely not needed, + # we check that a valid cert is there already. + # to put the hostname in the known hosts + if ! ssh -o StrictHostKeyChecking=no root@li.iankelling.org :; then + # This just causes failure if our cert is going to expire in the next 30 days. + # Certs I generate last 10 years. + openssl x509 -checkend $(( 60 * 60 * 24 * 30 )) -noout -in /etc/openvpn/mail.crt + else + # note, man openvpn implies we could just call mail-route on vpn startup/shutdown with + # systemd, buuut it can remake the tun device unexpectedly, i got this in the log + # after my internet was down for a bit: + # NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device. + /a/exe/vpn-mk-client-cert -b mail -n mail -s /b/ds/mail-route li.iankelling.org fi +fi - cat >/etc/systemd/system/offlineimapsync.timer <<'EOF' +cat >/etc/systemd/system/offlineimapsync.timer <<'EOF' [Unit] Description=Run offlineimap-sync once every min @@ -341,7 +256,7 @@ OnCalendar=*:0/1 WantedBy=timers.target EOF - cat >/etc/systemd/system/offlineimapsync.service </etc/systemd/system/offlineimapsync.service </etc/systemd/system/mailclean.timer <<'EOF' +cat >/etc/systemd/system/mailclean.timer <<'EOF' [Unit] Description=Run mailclean daily @@ -363,7 +278,7 @@ OnCalendar=monthly WantedBy=timers.target EOF - cat >/etc/systemd/system/mailclean.service </etc/systemd/system/mailclean.service </etc/exim4/rcpt_local_acl <<'EOF' +cat >/etc/exim4/rcpt_local_acl <<'EOF' # Only hosts we control send to mail.iankelling.org, so make sure # they are all authed. # Note, if we wanted authed senders for all domains, @@ -418,7 +333,7 @@ deny !authenticated = * domains = mail.iankelling.org EOF - cat >/etc/exim4/data_local_acl <<'EOF' +cat >/etc/exim4/data_local_acl <<'EOF' # Except for the "condition =", this was # a comment in the check_data acl. The comment about this not # being suitable is mostly bs. The only thing related I found was to @@ -437,7 +352,7 @@ EOF X-Spam_report: $spam_report EOF - cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' +cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF' # from 30_exim4-config_examples plain_server: @@ -451,7 +366,7 @@ server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}} .endif EOF - cat >/etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' +cat >/etc/exim4/conf.d/router/900_exim4-config_local_user <<'EOF' ### router/900_exim4-config_local_user ################################# @@ -469,7 +384,7 @@ local_user: transport = LOCAL_DELIVERY cannot_route_message = Unknown user EOF - cat >/etc/exim4/conf.d/transport/30_exim4-config_dovecot_lmtp <<'EOF' +cat >/etc/exim4/conf.d/transport/30_exim4-config_dovecot_lmtp <<'EOF' dovecot_lmtp: driver = lmtp socket = /var/run/dovecot/lmtp @@ -477,7 +392,7 @@ dovecot_lmtp: batch_max = 200 EOF - cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' +cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' # smarthost for fsf mail # ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and # replaced DCsmarthost with mail.fsf.org @@ -494,9 +409,9 @@ fsfsmarthost: EOF - #### begin mail cert setup ### - f=/usr/local/bin/mail-cert-cron - cat >$f <<'EOF' +#### begin mail cert setup ### +f=/usr/local/bin/mail-cert-cron +cat >$f <<'EOF' set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR @@ -526,9 +441,9 @@ if [[ $new_ret != 0 ]]; then fi exit 0 EOF - chmod 755 $f +chmod 755 $f - cat >/etc/systemd/system/mailcert.service <<'EOF' +cat >/etc/systemd/system/mailcert.service <<'EOF' [Unit] Description=Mail cert rsync After=multi-user.target @@ -538,7 +453,7 @@ Type=oneshot ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron EOF - cat >/etc/systemd/system/mailcert.timer <<'EOF' +cat >/etc/systemd/system/mailcert.timer <<'EOF' [Unit] Description=Run mail-cert once a day @@ -548,18 +463,18 @@ OnCalendar=daily [Install] WantedBy=timers.target EOF - systemctl daemon-reload - systemctl start mailcert - systemctl restart mailcert.timer - systemctl enable mailcert.timer +systemctl daemon-reload +systemctl start mailcert +systemctl restart mailcert.timer +systemctl enable mailcert.timer - ##### end mailcert setup ##### +##### end mailcert setup ##### - if [[ $HOSTNAME == $MAIL_HOST ]]; then +if [[ $HOSTNAME == $MAIL_HOST ]]; then - debconf-set-selections < /etc/mailname + echo mail.iankelling.org > /etc/mailname - # MAIN_HARDCODE_PRIMARY_HOSTNAME might mess up the - # smarthost config type, not sure. all other settings - # would be unused in that config type. - rm -f /etc/exim4/conf.d/main/000_localmacros # old filename - cat >/etc/exim4/conf.d/main/000_local </etc/exim4/conf.d/main/000_local </etc/dovecot/conf.d/20-lmtp.conf </etc/dovecot/conf.d/20-lmtp.conf </etc/dovecot/local.conf <<'EOF' + cat >/etc/dovecot/local.conf <<'EOF' # so I can use a different login that my shell login for mail. this is # worth doing solely for the reason that if this login is compromised, # it won't also compromise my shell password. @@ -828,12 +743,12 @@ ssl_prefer_server_ciphers = yes # auth_verbose=yes #mail_debug=yes EOF - ####### end dovecot setup ######## + ####### end dovecot setup ######## - # https://selivan.github.io/2017/12/30/systemd-serice-always-restart.html - d=/etc/systemd/system/openvpn@mail - mkdir -p $d - cat >$d/override.conf <<'EOF' + # https://selivan.github.io/2017/12/30/systemd-serice-always-restart.html + d=/etc/systemd/system/openvpn@mail + mkdir -p $d + cat >$d/override.conf <<'EOF' [Service] Restart=always # time to sleep before restarting a service @@ -844,30 +759,30 @@ RestartSec=1 StartLimitInterval=0 EOF - systemctl enable offlineimapsync.timer - systemctl start offlineimapsync.timer - systemctl enable mailclean.timer - systemctl start mailclean.timer - systemctl restart $vpn_ser@mail - systemctl enable $vpn_ser@mail - systemctl enable dovecot - systemctl restart dovecot - - else # $HOSTNAME != $MAIL_HOST - systemctl disable offlineimapsync.timer &>/dev/null ||: - systemctl stop offlineimapsync.timer &>/dev/null ||: - systemctl disable mailclean.timer &>/dev/null ||: - systemctl stop mailclean.timer &>/dev/null ||: - systemctl disable $vpn_ser@mail - systemctl stop $vpn_ser@mail - systemctl disable dovecot ||: - systemctl stop dovecot ||: - # - # - # would only exist because I wrote it i the previous condition, - # it\'s not part of exim - rm -f /etc/exim4/conf.d/main/000_localmacros - debconf-set-selections </dev/null ||: + systemctl stop offlineimapsync.timer &>/dev/null ||: + systemctl disable mailclean.timer &>/dev/null ||: + systemctl stop mailclean.timer &>/dev/null ||: + systemctl disable $vpn_ser@mail + systemctl stop $vpn_ser@mail + systemctl disable dovecot ||: + systemctl stop dovecot ||: + # + # + # would only exist because I wrote it i the previous condition, + # it\'s not part of exim + rm -f /etc/exim4/conf.d/main/000_localmacros + debconf-set-selections < /etc/mailname + hostname -f > /etc/mailname - fi # end $HOSTNAME != $MAIL_HOST +fi # end $HOSTNAME != $MAIL_HOST - # if we already have it installed, need to reconfigure, without being prompted - if dpkg -s exim4-config &>/dev/null; then - # gotta remove this, otherwise the set-selections are completely - # ignored. It woulda been nice if this was documented somewhere! - rm -f /etc/exim4/update-exim4.conf.conf - while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done - dpkg-reconfigure -u -fnoninteractive exim4-config - fi +# if we already have it installed, need to reconfigure, without being prompted +if dpkg -s exim4-config &>/dev/null; then + # gotta remove this, otherwise the set-selections are completely + # ignored. It woulda been nice if this was documented somewhere! + rm -f /etc/exim4/update-exim4.conf.conf + while fuser /var/lib/dpkg/lock &>/dev/null; do sleep 1; done + dpkg-reconfigure -u -fnoninteractive exim4-config +fi - # i have the spool directory be common to distro multi-boot, so - # we need the uid to be the same. 608 cuz it's kind of in the middle - # of the free system uids. - IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ||:) ||:; unset IFS - IFS=:; read _ _ gid _ < <(getent group Debian-exim ||:) ||:; unset IFS - if [[ ! $uid ]]; then - # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options - adduser --uid 608 --system --group --quiet --home /var/spool/exim4 \ - --no-create-home --disabled-login --force-badname Debian-exim - elif [[ $uid != 608 ]]; then - systemctl stop exim4 ||: - usermod -u 608 Debian-exim - groupmod -g 608 Debian-exim - usermod -g 608 Debian-exim - find / /nocow -xdev -uid $uid -exec chown -h 608 {} + - find / /nocow -xdev -gid $gid -exec chgrp -h 608 {} + - fi +# i have the spool directory be common to distro multi-boot, so +# we need the uid to be the same. 608 cuz it's kind of in the middle +# of the free system uids. +IFS=:; read _ _ uid _ < <(getent passwd Debian-exim ||:) ||:; unset IFS +IFS=:; read _ _ gid _ < <(getent group Debian-exim ||:) ||:; unset IFS +if [[ ! $uid ]]; then + # from /var/lib/dpkg/info/exim4-base.postinst, plus uid and gid options + adduser --uid 608 --system --group --quiet --home /var/spool/exim4 \ + --no-create-home --disabled-login --force-badname Debian-exim +elif [[ $uid != 608 ]]; then + systemctl stop exim4 ||: + usermod -u 608 Debian-exim + groupmod -g 608 Debian-exim + usermod -g 608 Debian-exim + find / /nocow -xdev -uid $uid -exec chown -h 608 {} + + find / /nocow -xdev -gid $gid -exec chgrp -h 608 {} + +fi - # light version of exim does not have sasl auth support. - pi exim4-daemon-heavy spamassassin spf-tools-perl +# light version of exim does not have sasl auth support. +pi exim4-daemon-heavy spamassassin spf-tools-perl - ##### begin spamassassin config - systemctl enable spamassassin - # per readme.debian - sed -i '/^\s*CRON\s*=/d' /etc/default/spamassassin - e CRON=1 >>/etc/default/spamassassin - # just noticed this in the config file, seems like a good idea. - sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin - e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin - systemctl start spamassassin - systemctl reload spamassassin +##### begin spamassassin config +systemctl enable spamassassin +# per readme.debian +sed -i '/^\s*CRON\s*=/d' /etc/default/spamassassin +e CRON=1 >>/etc/default/spamassassin +# just noticed this in the config file, seems like a good idea. +sed -i '/^\s*NICE\s*=/d' /etc/default/spamassassin +e 'NICE="--nicelevel 15"' >>/etc/default/spamassassin +systemctl start spamassassin +systemctl reload spamassassin - cat >/etc/systemd/system/spamddnsfix.service <<'EOF' +cat >/etc/systemd/system/spamddnsfix.service <<'EOF' [Unit] Description=spamd dns bug fix cronjob @@ -932,10 +847,10 @@ Description=spamd dns bug fix cronjob Type=oneshot ExecStart=/a/bin/distro-setup/spamd-dns-fix EOF - # 2017-09, debian closed the bug on this saying upstream had fixed it. - # remove this when i\'m using the newer package, ie, debian 10, or maybe - # ubuntu 18.04. - cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' +# 2017-09, debian closed the bug on this saying upstream had fixed it. +# remove this when i\'m using the newer package, ie, debian 10, or maybe +# ubuntu 18.04. +cat >/etc/systemd/system/spamddnsfix.timer <<'EOF' [Unit] Description=run spamd bug fix script every 10 minutes @@ -949,39 +864,37 @@ OnUnitActiveSec=550 [Install] WantedBy=timers.target EOF - systemctl daemon-reload - systemctl restart spamddnsfix.timer - systemctl enable spamddnsfix.timer - # - ##### end spamassassin config - +systemctl daemon-reload +systemctl restart spamddnsfix.timer +systemctl enable spamddnsfix.timer +# +##### end spamassassin config - # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost - # i only need .forwards, so just doing that one. - cd /etc/exim4/conf.d/router - b=userforward_higher_priority - # replace the router name so it is unique - sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b - # begin setup passwd.client - f=/etc/exim4/passwd.client - rm -f /etc/exim4/passwd.client - install -m 640 -g Debian-exim /dev/null $f - cat /etc/mailpass| while read -r domain port pass; do - # reference: exim4_passwd_client(5) - printf "%s:%s\n" "$domain" "$pass" >>$f - done - # end setup passwd.client +# https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost +# i only need .forwards, so just doing that one. +cd /etc/exim4/conf.d/router +b=userforward_higher_priority +# replace the router name so it is unique +sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b - # by default, only 10 days of logs are kept. increase that. - sed -ri 's/^(\s*rotate\s).*/\11000/' /etc/logrotate.d/exim4-base +# begin setup passwd.client +f=/etc/exim4/passwd.client +rm -f /etc/exim4/passwd.client +install -m 640 -g Debian-exim /dev/null $f +cat /etc/mailpass| while read -r domain port pass; do + # reference: exim4_passwd_client(5) + printf "%s:%s\n" "$domain" "$pass" >>$f +done +# end setup passwd.client - systemctl restart exim4 +# by default, only 10 days of logs are kept. increase that. +sed -ri 's/^(\s*rotate\s).*/\11000/' /etc/logrotate.d/exim4-base -fi #### end if exim4 +systemctl restart exim4 # /etc/alias setup is debian specific, and # exim config sets up an /etc/alias from root to the postmaster, which i @@ -1002,19 +915,19 @@ fi # # todo: I\'m suspicious of uids for Debian-exim being the same across # distros. It would be good to test this. -dir=/nocow/$type -sdir=/var/spool/$type +dir=/nocow/exim4 +sdir=/var/spool/exim4 # we only do this if our system has $dir if [[ -e /nocow && $(readlink -f $sdir) != $dir ]]; then - systemctl stop $type + systemctl stop exim4 if [[ ! -e $dir && -d $sdir ]]; then mv $sdir $dir fi /a/exe/lnf -T $dir $sdir fi -systemctl restart $type -systemctl enable $type +systemctl restart exim4 +systemctl enable exim4 # MAIL_HOST also does radicale, and easier to start and stop it here # for when MAIL_HOST changes, so radicale gets the synced files and @@ -1037,7 +950,3 @@ if dpkg -s radicale &>/dev/null; then fi exit 0 : -# if I wanted the from address to be renamed and sent to a different address, -# echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical -# sudo postmap hash:/etc/postfix/recipient_canonical -# sudo service postfix reload diff --git a/primary-setup b/primary-setup index 4786827..4ce132c 100755 --- a/primary-setup +++ b/primary-setup @@ -33,6 +33,6 @@ else # done fi -mail-setup exim4 +mail-setup exit 0 :