From effc74a288ee7e4d0a83bbf3335ba10f95eb7b8a Mon Sep 17 00:00:00 2001
From: Ian Kelling <ian@iankelling.org>
Date: Sun, 21 Jul 2019 20:21:50 -0400
Subject: [PATCH] various email improvements

---
 brc                                |  2 +-
 distro-end                         | 41 ++++++++++++++++++++++++------
 mail-setup                         | 21 ++++++++++-----
 subdir_files/sieve/lists.sieve     |  1 +
 subdir_files/sieve/liststest.sieve |  1 +
 5 files changed, 50 insertions(+), 16 deletions(-)

diff --git a/brc b/brc
index 9e9752c..cdfac01 100644
--- a/brc
+++ b/brc
@@ -2154,7 +2154,7 @@ if [[ $- == *i* ]]; then
 
 
     case $return in
-      0) ps_color="$(get_term_color blue)"
+      0) ps_color="$(get_term_color purple)"
          ps_char='\$'
          ;;
       1) ps_color="$(get_term_color green)"
diff --git a/distro-end b/distro-end
index bc334d6..91ae7e3 100755
--- a/distro-end
+++ b/distro-end
@@ -725,20 +725,45 @@ EOF
       p update
     fi
 
-    # needed for false positive in checkrestart
     s dd of=/etc/apt/preferences.d/debian-goodies <<EOF
 Package: debian-goodies
-Pin: release a=etiona
+Pin: release n=buster
 Pin-Priority: 1005
+EOF
 
-Package: debian-goodies
-Pin: release a=etiona-updates
-Pin-Priority: 1005
 
-Package: debian-goodies
-Pin: release a=etiona-security
-Pin-Priority: 1005
+    s dd of=/etc/apt/preferences.d/flidas-buster <<EOF
+Package: *
+Pin: release n=buster
+Pin-Priority: -100
 EOF
+
+    # stupid buster uses some key algorithm not supported by flidas gpg that apt uses.
+    s dd of=/etc/apt/apt.conf.d/01iank <<'EOF'
+Acquire::AllowInsecureRepositories "true";
+EOF
+
+    t=$(mktemp)
+    cat >$t <<EOF
+deb http://http.us.debian.org/debian buster main
+deb-src http://http.us.debian.org/debian buster main
+
+deb http://security.debian.org/ buster/updates main
+deb-src http://security.debian.org/ buster/updates main
+
+deb http://http.us.debian.org/debian buster-updates main
+deb-src http://http.us.debian.org/debian buster-updates main
+EOF
+    f=/etc/apt/sources.list.d/buster.list
+    if ! diff -q $t $f; then
+      s cp $t $f
+      s chmod 644 $f
+      p update
+    fi
+
+    # newer version needed for false positive in checkrestart
+    p install -y --allow-unauthenticated debian-goodies
+
     ;;
 esac
 
diff --git a/mail-setup b/mail-setup
index 2af69b2..b8440fb 100755
--- a/mail-setup
+++ b/mail-setup
@@ -50,6 +50,8 @@ EOF
 # hamburger -> preferences -> preferences -> advanced tab -> config editor button -> security.ssl.enable_ocsp_must_staple = false
 # background: ovecot does not yet have ocsp stapling support
 # reference: https://community.letsencrypt.org/t/simple-guide-using-lets-encrypt-ssl-certs-with-dovecot/2921
+#
+# for phone, same thing but username alerts, pass in ivy-pass.
 #######
 
 
@@ -69,7 +71,7 @@ EOF
 
 # # dovecot password, i just need 1 as I\'m the only user
 # mkdir /p/c/filesystem/etc/dovecot
-# echo "iank:$(doveadm pw -s ssha256)::::::" >/p/c/filesystem/etc/dovecot/users
+# echo "iank:$(doveadm pw -s ssha256)::::::" >>/p/c/filesystem/etc/dovecot/users
 # conflink
 
 
@@ -197,7 +199,7 @@ pi() { # package install
   apt-get -y install --purge --auto-remove "$@"
 }
 
-postmaster=$u
+postmaster=alerts
 mxhost=mail.iankelling.org
 mxport=587
 forward=$u@$mxhost
@@ -218,11 +220,11 @@ fi
 if [[ $HOSTNAME == $MAIL_HOST ]]; then
   # afaik, these will get ignored because they are routing to my own
   # machine, but rm them is safer
-  rm -f $(eval echo ~$postmaster)/.forward /root/.forward
+  rm -f $(eval echo ~$u)/.forward /root/.forward
 else
   # this can\'t be a symlink and has permission restrictions
   # it might work in /etc/aliases, but this seems more proper.
-  install -m 644 {-o,-g}$postmaster <(e $forward) $(eval echo ~$postmaster)/.forward
+  install -m 644 {-o,-g}$u <(e $forward) $(eval echo ~$u)/.forward
 fi
 
 
@@ -687,10 +689,10 @@ EOF
   # sieve option, we wouldn\'t need this, but I\'d rather not modify a
   # default config if not needed. This won\'t work as a symlink in /a/c
   # unfortunately.
-  sudo -u $postmaster /a/exe/lnf -T sieve/main.sieve $(eval echo ~$postmaster)/.dovecot.sieve
+  sudo -u $u /a/exe/lnf -T sieve/main.sieve $(eval echo ~$u)/.dovecot.sieve
 
+  # we set this later in local.conf
   sed -ri -f - /etc/dovecot/conf.d/10-mail.conf <<'EOF'
-1i mail_location = maildir:/m/md:LAYOUT=fs:INBOX=/m/md/INBOX
 /^\s*mail_location\s*=/d
 EOF
 
@@ -744,11 +746,16 @@ ssl_cert = </etc/exim4/exim.crt
 ssl_key = </etc/exim4/exim.key
 # https://github.com/certbot/certbot/raw/master/certbot-apache/certbot_apache/options-ssl-apache.conf
 # in my cert cronjob, I check if that has changed upstream.
-ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
 
 # ian: added this, more secure, per google etc
 ssl_prefer_server_ciphers = yes
 
+
+mail_location = maildir:/m/%u:LAYOUT=fs:INBOX=/m/%u/INBOX
+mail_uid = iank
+mail_gid = iank
+
 # for debugging info, uncomment these.
 # logs go to syslog and to /var/log/mail.log
 # auth_verbose=yes
diff --git a/subdir_files/sieve/lists.sieve b/subdir_files/sieve/lists.sieve
index dd5bb1a..d17fb1e 100644
--- a/subdir_files/sieve/lists.sieve
+++ b/subdir_files/sieve/lists.sieve
@@ -42,6 +42,7 @@ if anyof (
     header :contains "list-id" "<linux-btrfs.vger.kernel.org>",
     header :contains "list-id" "<linux-fai.uni-koeln.de>",
     header :contains "list-id" "<license-discuss.lists.opensource.org>",
+    header :contains "list-id" "<seagl_organize.googlegroups.com>",
     header :contains "list-id" "<linux-fai-devel.uni-koeln.de>",
     header :contains "list-id" "<linux-libre.fsfla.org>",
     header :contains "list-id" "<maru-os-dev.googlegroups.com>",
diff --git a/subdir_files/sieve/liststest.sieve b/subdir_files/sieve/liststest.sieve
index dd5bb1a..d17fb1e 100644
--- a/subdir_files/sieve/liststest.sieve
+++ b/subdir_files/sieve/liststest.sieve
@@ -42,6 +42,7 @@ if anyof (
     header :contains "list-id" "<linux-btrfs.vger.kernel.org>",
     header :contains "list-id" "<linux-fai.uni-koeln.de>",
     header :contains "list-id" "<license-discuss.lists.opensource.org>",
+    header :contains "list-id" "<seagl_organize.googlegroups.com>",
     header :contains "list-id" "<linux-fai-devel.uni-koeln.de>",
     header :contains "list-id" "<linux-libre.fsfla.org>",
     header :contains "list-id" "<maru-os-dev.googlegroups.com>",
-- 
2.30.2