4 # Check we have the necessary arguments.
5 if [ "$#" -lt 1 ]; then
6 echo 'Need mail for letsencrypt (and optionally old server IP).'
12 config_tree_prefix="${HOME}/config/buster"
13 echo "postfix postfix/main_mailer_type string 'Internet Site'" | debconf-set-selections
14 echo "postfix postfix/mailname string $(hostname -f)" | debconf-set-selections
15 ./install_for_target.sh mail
16 ./copy_dirtree.sh "${config_tree_prefix}/etc_files" "" mail
17 nft -f /etc/nftables.conf
19 # Rebuild aliases DB from /etc/aliases
22 # Update config files without overwriting defaults.
23 cat "${config_tree_prefix}/other_files/append_postfix_main.cf" >> /etc/postfix/main.cf
24 cat "${config_tree_prefix}/other_files/append_postfix_master.cf" >> /etc/postfix/master.cf
25 cat "${config_tree_prefix}/other_files/append_opendkim.conf" >> /etc/opendkim.conf
27 # Set up letsencrypt certificate. We need this for STARTTLS on port
28 # 25/SMTP (some mail servers refuse delivering mails here if no
29 # STARTTLS available) and transport-layer TLS on port 465 (for
30 # user-to-server SMTPS)
31 # TODO: Is it auto-renewed?
32 certbot certonly --standalone --agree-tos --no-eff-email -m "${mail}" -d "$(hostname -f)"
35 selector=$(hostname)$(date +%Y%m%d)
36 opendkim-genkey -d "$(hostname -f)" -D /etc/dkimkeys -s "${selector}"
37 sed -i "s/REPLACE_hostname_ECALPER/$(hostname -f)/g" /etc/opendkim.conf
38 sed -i "s/REPLACE_selector_ECALPER/${selector}/g" /etc/opendkim.conf
40 # Dovecot sieve filtering via LMTP. Without this, mail only gets
41 # delivered to /var/mail/…, with it /var/mail/… remains the fallback
42 # inbox, but all else is sieve-filtered to ~/mail/.
43 cp "${config_tree_prefix}/other_files/dovecot.sieve" /home/plom/.dovecot.sieve
44 chown plom:plom /home/plom/.dovecot.sieve
46 # In addition to our postfix server receiving mails, we funnel mails from a
47 # POP3 account into dovecot via fetchmail. It might make sense to adapt the
48 # ~/.dovecot.sieve to move mails targeted to the fetched mail account to their
50 cp "${config_tree_prefix}/other_files/fetchmailrc" /home/plom/.fetchmailrc
51 chown plom:plom /home/plom/.fetchmailrc
52 chmod 0700 /home/plom/.fetchmailrc
55 cp "${config_tree_prefix}/other_files/pingmailrc" /home/plom/.pingmailrc
56 chown plom:plom /home/plom/.pingmailrc
57 su -lc "cd && git clone https://plomlompom.com/repos/clone/pingmail" plom
59 # Pingmail and fetchmail have some systemd timers waiting. To let systemd
60 # know about them, do this.
61 systemctl daemon-reload
62 systemctl enable --now fetchmail_old_account.timer
63 systemctl enable --now pingmail.timer
65 # To allow IMAPS access.
66 echo "ssl_cert = </etc/letsencrypt/live/$(hostname -f)/fullchain.pem" > /etc/dovecot/conf.d/99-ssl-certs.conf
67 echo "ssl_key = </etc/letsencrypt/live/$(hostname -f)/privkey.pem" >> /etc/dovecot/conf.d/99-ssl-certs.conf
68 password=$(pwgen -s 100 1)
69 echo "plom:${password}" | chpasswd
71 # Get old mail data, shutdown old postfix server.
72 if [ "${old_server}" != "" ]; then
73 cp "${config_tree_prefix}/setup_scripts/prepare_to_meet_server.sh" /home/plom/
74 #chown plom:plom /home/plom/prepare_to_meet_server.sh
75 su -lc "./prepare_to_meet_server.sh ${old_server}" plom
76 read -p'Hit Enter when you are done.' ignore
77 rm /home/plom/prepare_to_meet_server.sh
78 su -lc "scp plom@${old_server}:.dovecot.sieve ~" plom
79 su -lc "scp plom@${old_server}:.fetchmailrc ~" plom
80 su -lc "scp plom@${old_server}:.pingmailrc ~" plom
81 su -lc "ssh plom@${old_server} \"su -lc 'service postfix stop'\"" plom
82 cp "${config_tree_prefix}/setup_scripts/mirror_dir.sh" /home/plom/
83 su -lc "./mirror_dir.sh ${old_server} /home/plom/mail" plom
84 rm /home/plom/mirror_dir.sh
86 chown plom:mail /var/mail/plom
87 chmod 0600 /var/mail/plom
88 su -lc "scp plom@${old_server}:/var/mail/plom /var/mail/plom" plom
91 # Start everything anew to ensure new configurations.
92 service opendkim restart
93 service postfix restart
94 service dovecot restart
96 # Final advice to user.
97 echo "To put into DNS:"
98 cat "/etc/dkimkeys/${selector}.txt"
99 echo "If subdomain, append .subdomain to _domainkeys!"
100 echo "Also ensure DMARC record of 'v=DMARC1; p=none; rua=mailto:plom+dmarc@plomlompom.com;' as TXT entry at _dmarc or, if subdomain, _dmarc.subdomain"
101 echo "Also ensure SPF record of 'v=spf1 mx -all' as TXT entry at @ or subdomain"
102 echo "Also ensure reverse DNS lookup for our IP points to $(hostname -f)"
103 echo "Also ensure MX record of priority 10 for @ or subdomain pointing to $(hostname -f)"
104 echo "IMAPS password for user plom is: ${password}"
107 # - mailutils.conf from old config for pingmail?
109 # todo just for proper mail /sending/:
110 # * how to check IP safety
111 # https://talosintelligence.com/reputation_center/lookup?search=$IP
112 # http://www.anti-abuse.org/multi-rbl-check-results/?host=
113 # https://www.dnsbl.info/dnsbl-database-check.php
114 # note that none of these catch the IPs that gmx etc. reject