From 8052829d2babeda2fc639666cf6b1ee649f283a6 Mon Sep 17 00:00:00 2001
From: Ian Kelling <ian@iankelling.org>
Date: Sun, 28 Jul 2019 20:06:39 -0400
Subject: [PATCH] make local deliveries use smarthost when possible, minor
 fixes

---
 mail-setup | 87 ++++++++++++++++++++++++++++--------------------------
 1 file changed, 45 insertions(+), 42 deletions(-)

diff --git a/mail-setup b/mail-setup
index abe98d9..31841b9 100755
--- a/mail-setup
+++ b/mail-setup
@@ -1,7 +1,7 @@
 #!/bin/bash
 set -x
 
-# Copyright (C) 2016 Ian Kelling
+# Copyright (C) 2019 Ian Kelling
 
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -149,36 +149,6 @@ EOF
 ####### end  persistent dkim instructions #########
 
 
-# misc exim notes:
-# useful exim docs:
-# /usr/share/doc/exim4-base/README.Debian.gz
-# /usr/share/doc/exim4-base/spec.txt.gz
-
-# routers, transports, and authenticators are sections, and you define
-# driver instances in those sections, and the manual calls them driver
-# types but there is also a more specific "type" of driver, which is specified
-# with the driver = some_module setting in the driver.
-
-# the driver option must precede and private options (options that are
-# specific to that driver), so follow example of putting it at beginning.
-
-# The full list of option settings for any particular driver instance,
-# including all the defaulted values, can be extracted by making use of
-# the -bP command line option.
-# exim -bP config_file to see what config file it used
-# exim -bP config to see
-
-# exim clear out message queue. as root:
-# adapted from somewhere on stackoverflow.
-# ser stop exim4; sleep 1; exim -bp | exiqgrep -i | xargs exim -Mrm; ser start exim4
-
-# fastmail has changed their smtp server, but the old one still works,
-# I see no reason to bother changing.
-# New one is smtp.fastmail.com
-
-# test delivery & rewrite settings:
-#exim4 -bt iank@localhost
-
 
 e() { printf "%s\n" "$*"; }
 pi() { # package install
@@ -272,7 +242,7 @@ source /a/bin/bash_unpublished/source-state
 mkdir -p /etc/exim4/conf.d/{main,transport,auth,router}
 
 cat >/etc/exim4/rcpt_local_acl <<'EOF'
-# Only hosts we control send to mail.iankelling.org, so make sure
+# Only hosts we control send to @mail.iankelling.org, so make sure
 # they are all authed.
 # Note, if we wanted authed senders for all domains,
 # we could make this condition in acl_check_mail
@@ -291,13 +261,18 @@ cat >/etc/exim4/data_local_acl <<'EOF'
 # suggested in official docs, and 100k in the wiki example because
 # those docs are rather old and I see a 110k spam message
 # pretty quickly looking through my spam folder.
-  warn
-    condition = ${if < {$message_size}{2000K}}
-    spam = Debian-exim:true
-    add_header = X-Spam_score: $spam_score\n\
-              X-Spam_score_int: $spam_score_int\n\
-              X-Spam_bar: $spam_bar\n\
-              X-Spam_report: $spam_report
+warn
+  condition = ${if < {$message_size}{2000K}}
+  spam = Debian-exim:true
+  add_header = X-Spam_score: $spam_score\n\
+            X-Spam_score_int: $spam_score_int\n\
+            X-Spam_bar: $spam_bar\n\
+            X-Spam_report: $spam_report
+
+#accept
+#  spf = pass:fail:softfail:none:neutral:permerror:temperror
+#  dmarc_status = reject:quarantine
+#  add_header = Reply-to: dmarctest@iankelling.org
 
 EOF
 cat >/etc/exim4/conf.d/auth/29_exim4-config_auth <<'EOF'
@@ -340,6 +315,10 @@ dovecot_lmtp:
         batch_max = 200
 EOF
 
+cat >/etc/exim4/host_local_deny_exceptions <<'EOF'
+mail.fsf.org
+EOF
+
 cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF'
 # smarthost for fsf mail
 # ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and
@@ -435,7 +414,7 @@ if [[ $HOSTNAME == $MAIL_HOST ]]; then
   # mail.iankelling.org so local imap clients can connect with tls and
   # when they happen to not be local.
   sed -ri -f - /etc/hosts <<'EOF'
-/^127\.0\.1\.1.* mail\.iankelling\.org\b/q
+/^127\.0\.1\.1.* mail\.iankelling\.org\b/{p;d}
 /^127\.0\.1\.1 /s/ *$/ mail.iankelling.org/
 EOF
   /a/exe/cedit mail /etc/dnsmasq-servers.conf <<'EOF' || [[ $? == 1 ]]
@@ -553,8 +532,21 @@ CHECK_DATA_VERIFY_HEADER_SENDER = true
 CHECK_RCPT_SPF = true
 CHECK_RCPT_REVERSE_DNS = true
 CHECK_MAIL_HELO_ISSUED = true
+
+MAIN_LOG_SELECTOR = +all
+
+# testing dmarc
+#dmarc_tld_file = /etc/public_suffix_list.dat
 EOF
 
+  f=/etc/cron.daily/refresh-dmarc-tld-file
+  cat >$f <<'EOF'
+#!/bin/bash
+cd /etc
+wget -nv -N https://publicsuffix.org/list/public_suffix_list.dat
+EOF
+  chmod 755 $f
+
 
   ####### begin dovecot setup ########
   # based on a little google and package search, just the dovecot
@@ -692,10 +684,8 @@ EOF
   cat >>/etc/exim4/update-exim4.conf.conf <<EOF
 dc_eximconfig_configtype='satellite'
 dc_smarthost='$smarthost'
-dc_readhost='$(hostname -f)'
 # i dunno if this would ever get used.
 dc_localdelivery='maildir_home'
-dc_hide_mailname=''
 EOF
 
   hostname -f > /etc/mailname
@@ -825,6 +815,17 @@ EOF
   newaliases
 fi
 
+# local mail that bounces to alerts goes to /Maildir
+mkdir -p /m/md/INBOX
+chmod 770 /m/md/INBOX
+if id -g 1000 &>/dev/null; then
+  chgrp 1000 /m/md/INBOX
+  usermod -a -G 1000 Debian-exim
+else
+  chgrp Debian-exim /m/md/INBOX
+fi
+ln -s /m/md/INBOX /Maildir
+
 # put spool dir in directory that spans multiple distros.
 # based on http://www.postfix.org/qmgr.8.html and my notes in gnus
 #
@@ -858,6 +859,8 @@ if [[ -e /nocow ]]; then
   fi
 fi
 
+
+
 systemctl restart exim4
 systemctl enable exim4
 
-- 
2.30.2