freedomboneeee/src/freedombone-app-mailpile

378 lines
12 KiB
Plaintext
Raw Permalink Normal View History

2016-11-06 15:03:51 +01:00
#!/bin/bash
2018-04-08 14:30:21 +02:00
# _____ _ _
# | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
# | __| _| -_| -_| . | . | | . | . | | -_|
# |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___|
2016-11-06 15:03:51 +01:00
#
2018-04-08 14:30:21 +02:00
# Freedom in the Cloud
2016-11-06 15:03:51 +01:00
#
# mailpile app
#
# License
# =======
#
2018-01-25 19:35:39 +01:00
# Copyright (C) 2016-2018 Bob Mottram <bob@freedombone.net>
2016-11-06 15:03:51 +01:00
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
2016-11-09 14:15:48 +01:00
VARIANTS="full full-vim mailbox"
2016-11-06 15:03:51 +01:00
IN_DEFAULT_INSTALL=0
SHOW_ON_ABOUT=1
MAILPILE_DOMAIN_NAME=
MAILPILE_CODE=
MAILPILE_ONION_PORT=8103
MAILPILE_REPO="https://github.com/mailpile/Mailpile"
2018-05-16 13:54:04 +02:00
MAILPILE_COMMIT='4f28f1bb55b3b9985f22ab6372d539b1087482dd'
2016-11-06 15:03:51 +01:00
MAILPILE_PORT=33411
2018-05-28 15:47:12 +02:00
MAILPILE_SHORT_DESCRIPTION=$'Email system'
MAILPILE_DESCRIPTION=$'Email system'
MAILPILE_MOBILE_APP_URL=
2016-11-06 15:03:51 +01:00
mailpile_variables=(MAILPILE_REPO
MAILPILE_DOMAIN_NAME
MAILPILE_CODE
ONION_ONLY
DDNS_PROVIDER
2017-08-08 22:16:07 +02:00
DEFAULT_DOMAIN_NAME
2016-11-06 15:03:51 +01:00
MY_USERNAME)
function logging_on_mailpile {
echo -n ''
}
function logging_off_mailpile {
echo -n ''
}
2016-11-06 15:03:51 +01:00
function remove_user_mailpile {
remove_username="$1"
2018-02-27 15:11:56 +01:00
"${PROJECT_NAME}-pass" -u "$remove_username" --rmapp mailpile
2016-11-06 15:03:51 +01:00
}
function add_user_mailpile {
2018-02-27 15:11:56 +01:00
"${PROJECT_NAME}-pass" -u "$1" -a mailpile -p "$2"
2016-11-06 15:03:51 +01:00
}
function install_interactive_mailpile {
2018-02-27 15:11:56 +01:00
if [ ! "$ONION_ONLY" ]; then
2016-11-06 15:03:51 +01:00
ONION_ONLY='no'
fi
if [[ $ONION_ONLY != "no" ]]; then
MAILPILE_DOMAIN_NAME='mailpile.local'
write_config_param "MAILPILE_DOMAIN_NAME" "$MAILPILE_DOMAIN_NAME"
else
function_check interactive_site_details
interactive_site_details "mailpile" "MAILPILE_DOMAIN_NAME" "MAILPILE_CODE"
fi
APP_INSTALLED=1
}
function change_password_mailpile {
2016-11-20 13:37:13 +01:00
echo -n ''
#${PROJECT_NAME}-pass -u $1 -a mailpile -p "$2"
2016-11-06 15:03:51 +01:00
}
function reconfigure_mailpile {
echo -n ''
}
function upgrade_mailpile {
read_config_param "MAILPILE_DOMAIN_NAME"
2017-05-13 18:32:17 +02:00
CURR_COMMIT=$MAILPILE_COMMIT
2018-02-27 15:11:56 +01:00
if grep -q "mailpile commit" "$COMPLETION_FILE"; then
2017-05-13 18:32:17 +02:00
CURR_COMMIT=$(get_completion_param "mailpile commit")
fi
if [[ "$CURR_COMMIT" == "$MAILPILE_COMMIT" ]]; then
return
2017-05-13 18:32:17 +02:00
fi
2016-11-06 15:03:51 +01:00
function_check set_repo_commit
2016-11-06 16:07:15 +01:00
set_repo_commit /var/www/$MAILPILE_DOMAIN_NAME/mail "mailpile commit" "$MAILPILE_COMMIT" $MAILPILE_REPO
2016-12-31 15:49:36 +01:00
2018-02-27 15:11:56 +01:00
cd "/var/www/$MAILPILE_DOMAIN_NAME/mail" || exit 2346836535
pip install -r requirements.txt
2017-05-13 18:32:17 +02:00
2018-02-27 15:11:56 +01:00
chown -R mailpile:mailpile "/var/www/$MAILPILE_DOMAIN_NAME/mail"
systemctl restart mailpile
2016-11-06 15:03:51 +01:00
}
function backup_local_mailpile {
echo -n ''
2016-11-06 15:03:51 +01:00
}
function restore_local_mailpile {
echo -n ''
2016-11-06 15:03:51 +01:00
}
function backup_remote_mailpile {
echo -n ''
2016-11-06 15:03:51 +01:00
}
function restore_remote_mailpile {
echo -n ''
2016-11-06 15:03:51 +01:00
}
function remove_mailpile {
if [ ${#MAILPILE_DOMAIN_NAME} -eq 0 ]; then
return
fi
systemctl stop mailpile
systemctl disable mailpile
rm /etc/systemd/system/mailpile.service
2017-06-10 22:37:50 +02:00
systemctl daemon-reload
2016-11-06 15:03:51 +01:00
read_config_param "MAILPILE_DOMAIN_NAME"
2018-02-27 15:11:56 +01:00
nginx_dissite "$MAILPILE_DOMAIN_NAME"
remove_certs "${MAILPILE_DOMAIN_NAME}"
if [ -f "/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME" ]; then
rm -f "/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME"
2016-11-06 15:03:51 +01:00
fi
2018-02-27 15:11:56 +01:00
if [ -d "/var/www/$MAILPILE_DOMAIN_NAME" ]; then
rm -rf "/var/www/$MAILPILE_DOMAIN_NAME"
fi
function_check remove_ddns_domain
2018-02-27 15:11:56 +01:00
remove_ddns_domain "$MAILPILE_DOMAIN_NAME"
2017-06-12 12:33:54 +02:00
groupdel -f mailpile
userdel -r mailpile
2016-11-06 15:03:51 +01:00
remove_config_param MAILPILE_DOMAIN_NAME
remove_config_param MAILPILE_CODE
function_check remove_onion_service
remove_onion_service mailpile ${MAILPILE_ONION_PORT}
remove_completion_param "install_mailpile"
enable_email_encryption_at_rest
2018-02-27 15:11:56 +01:00
sed -i '/Mailpile/d' "$COMPLETION_FILE"
sed -i '/mailpile/d' "$COMPLETION_FILE"
2016-11-06 15:03:51 +01:00
}
function install_mailpile {
if [ ! $ONION_ONLY ]; then
ONION_ONLY='no'
fi
if [ ! $MAILPILE_DOMAIN_NAME ]; then
echo $'The mailpile domain name was not specified'
exit 63824
fi
apt-get -yq install python-pip python-lxml python-dev libjpeg-dev
2018-05-15 13:23:11 +02:00
apt-get -yq install openssl python-pgpdump python-cryptography libssl-dev
2016-11-06 15:03:51 +01:00
if [ ! -d /var/www/$MAILPILE_DOMAIN_NAME ]; then
mkdir /var/www/$MAILPILE_DOMAIN_NAME
fi
2018-02-27 15:11:56 +01:00
cd "/var/www/$MAILPILE_DOMAIN_NAME" || exit 264826484
2016-11-06 16:07:15 +01:00
if [ -d /var/www/$MAILPILE_DOMAIN_NAME/mail ]; then
rm -rf /var/www/$MAILPILE_DOMAIN_NAME/mail
2016-11-06 15:26:49 +01:00
fi
2017-06-15 13:33:16 +02:00
if [ -d /repos/mailpile ]; then
mkdir mail
2017-06-17 19:37:06 +02:00
cp -r -p /repos/mailpile/. mail
2018-02-27 15:11:56 +01:00
cd mail || exit 245728482
2017-06-15 13:33:16 +02:00
git pull
else
git_clone $MAILPILE_REPO mail
fi
2018-02-27 15:11:56 +01:00
cd mail || exit 246872468
2016-11-06 15:03:51 +01:00
git checkout $MAILPILE_COMMIT -b $MAILPILE_COMMIT
set_completion_param "mailpile commit" "$MAILPILE_COMMIT"
if [ ! -f requirements-dev.txt ]; then
echo $'No python requirements file found'
exit 62382
fi
pip install -r requirements.txt
2016-11-06 16:07:15 +01:00
adduser --system --home=/var/www/$MAILPILE_DOMAIN_NAME/mail/ --group mailpile
2016-11-06 16:31:32 +01:00
adduser mailpile debian-tor
2016-11-13 12:46:02 +01:00
adduser mailpile www-data
2016-12-02 11:51:11 +01:00
adduser mailpile mail
2018-02-27 15:11:56 +01:00
adduser mailpile "$MY_USERNAME"
if [[ "$ONION_ONLY" == 'no' ]]; then
2017-08-08 22:16:07 +02:00
chgrp -R ssl-cert /etc/letsencrypt
chmod -R g=rX /etc/letsencrypt
usermod -a -G ssl-cert mailpile
fi
2016-11-06 16:07:15 +01:00
chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/
2016-11-06 15:03:51 +01:00
# create folders and tags
2016-11-06 16:07:15 +01:00
su -c "cd /var/www/$MAILPILE_DOMAIN_NAME/mail && ./mp --setup" - mailpile
2016-11-06 15:03:51 +01:00
2016-11-14 10:49:01 +01:00
MAILPILE_ONION_HOSTNAME=$(add_onion_service mailpile 80 ${MAILPILE_ONION_PORT})
2018-02-27 15:11:56 +01:00
{ echo '[Unit]';
echo 'Description=Mailpile Email Client';
echo 'After=syslog.target network.target nginx.target';
echo '';
echo '[Service]';
echo 'User=mailpile';
echo 'Group=mailpile';
echo "WorkingDirectory=/var/www/$MAILPILE_DOMAIN_NAME/mail";
2018-03-27 11:58:07 +02:00
echo "ExecStart=/var/www/$MAILPILE_DOMAIN_NAME/mail/mp --www=127.0.0.1:${MAILPILE_PORT} --wait";
2018-02-27 15:11:56 +01:00
echo 'Restart=always';
echo 'RestartSec=10';
echo '';
echo '[Install]';
echo 'WantedBy=multi-user.target'; } > /etc/systemd/system/mailpile.service
2016-11-06 15:03:51 +01:00
chmod +x /etc/systemd/system/mailpile.service
mailpile_nginx_site=/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME
2016-11-06 16:23:38 +01:00
if [[ $ONION_ONLY == "no" ]]; then
function_check nginx_http_redirect
nginx_http_redirect $MAILPILE_DOMAIN_NAME
2018-02-27 15:11:56 +01:00
{ echo 'server {';
echo ' listen 443 ssl;';
echo ' #listen [::]:443 ssl;';
echo " server_name $MAILPILE_DOMAIN_NAME;";
echo '';
echo ' # Security'; } >> $mailpile_nginx_site
2016-11-06 16:23:38 +01:00
function_check nginx_ssl
nginx_ssl $MAILPILE_DOMAIN_NAME
2018-03-05 19:15:29 +01:00
function_check nginx_security_options
nginx_security_options $MAILPILE_DOMAIN_NAME
2016-11-06 16:23:38 +01:00
2018-02-27 15:11:56 +01:00
{ echo ' add_header Strict-Transport-Security max-age=15768000;';
echo '';
echo ' # Logs';
echo ' access_log /dev/null;';
echo ' error_log /dev/null;';
echo '';
echo ' # Root';
echo " root /var/www/$MAILPILE_DOMAIN_NAME/mail;";
echo '';
echo ' location / {'; } >> $mailpile_nginx_site
2016-11-06 15:03:51 +01:00
function_check nginx_limits
nginx_limits $MAILPILE_DOMAIN_NAME '15m'
2018-02-27 15:11:56 +01:00
{ echo " rewrite /(.*) /\$1 break;";
echo " proxy_set_header X-Real-IP \$remote_addr;";
echo " proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;";
echo " proxy_set_header Host \$http_host;";
echo ' proxy_set_header X-NginX-Proxy true;';
echo " proxy_pass http://localhost:${MAILPILE_PORT};";
echo ' proxy_redirect off;';
echo ' }';
echo '}';
echo ''; } >> $mailpile_nginx_site
2016-11-06 16:23:38 +01:00
else
echo -n '' > $mailpile_nginx_site
2016-11-06 15:03:51 +01:00
fi
2018-02-27 15:11:56 +01:00
{ echo 'server {';
echo " listen 127.0.0.1:$MAILPILE_ONION_PORT default_server;";
echo " server_name $MAILPILE_ONION_HOSTNAME;";
echo ''; } >> $mailpile_nginx_site
2018-03-05 19:15:29 +01:00
function_check nginx_security_options
nginx_security_options $MAILPILE_DOMAIN_NAME
2018-02-27 15:11:56 +01:00
{ echo '';
echo ' # Logs';
echo ' access_log /dev/null;';
echo ' error_log /dev/null;';
echo '';
echo ' # Root';
echo " root /var/www/$MAILPILE_DOMAIN_NAME/mail;";
echo '';
echo ' location / {'; } >> $mailpile_nginx_site
2016-11-06 16:23:38 +01:00
function_check nginx_limits
nginx_limits $MAILPILE_DOMAIN_NAME '15m'
2018-02-27 15:11:56 +01:00
{ echo " rewrite /(.*) /\$1 break;";
echo " proxy_set_header X-Real-IP \$remote_addr;";
echo " proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;";
echo " proxy_set_header Host \$http_host;";
echo ' proxy_set_header X-NginX-Proxy true;';
echo " proxy_pass http://localhost:${MAILPILE_PORT};";
echo ' proxy_redirect off;';
echo ' }';
echo '}'; } >> $mailpile_nginx_site
2016-11-06 15:03:51 +01:00
function_check create_site_certificate
if [ ! -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem ]; then
2016-11-06 15:03:51 +01:00
create_site_certificate $MAILPILE_DOMAIN_NAME 'yes'
fi
if [ -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.crt ]; then
mv /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.crt /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem
fi
if [ -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem ]; then
2017-03-18 13:52:11 +01:00
chown root:root /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem
2016-11-13 11:26:58 +01:00
sed -i "s|.crt|.pem|g" /etc/nginx/sites-available/${MAILPILE_DOMAIN_NAME}
2016-11-06 15:03:51 +01:00
fi
if [ -f /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key ]; then
2017-03-18 13:52:11 +01:00
chown root:root /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key
2016-11-06 15:03:51 +01:00
fi
function_check nginx_ensite
nginx_ensite $MAILPILE_DOMAIN_NAME
2018-02-27 15:11:56 +01:00
"${PROJECT_NAME}-pass" -u "$MY_USERNAME" -a mailpile -p "*"
2016-11-06 15:03:51 +01:00
function_check add_ddns_domain
add_ddns_domain $MAILPILE_DOMAIN_NAME
disable_email_encryption_at_rest
2016-11-13 12:46:02 +01:00
# if strict https is enforced then buttons don't work. This is probably a security bug
2016-11-13 21:29:43 +01:00
sed -i "/Content-Security-Policy/d" $mailpile_nginx_site
2016-11-13 12:46:02 +01:00
2016-11-13 21:22:15 +01:00
# link to the administrator's keyring
if [ -d /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg ]; then
mv /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg_orig
fi
2018-02-27 15:11:56 +01:00
cp -r "/home/$MY_USERNAME/.gnupg" "/var/www/$MAILPILE_DOMAIN_NAME/mail/"
2016-11-13 21:22:15 +01:00
chown -R mailpile:mailpile /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg
chmod +x /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg
2017-06-09 21:14:58 +02:00
pip install jinja2==2.9.6
pip install pgpdump==1.5
# turn off ssl in dovecot
sed -i 's|#ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
sed -i 's|ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
# set ssl certs, just in case we want to use them later
2018-02-27 15:11:56 +01:00
if [[ "$ONION_ONLY" == "no" ]]; then
if [ -f "/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem" ]; then
2018-02-03 20:26:31 +01:00
sed -i "s|#ssl_cert =.*|ssl_cert = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem|g" /etc/dovecot/conf.d/10-ssl.conf
sed -i "s|ssl_cert =.*|ssl_cert = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem|g" /etc/dovecot/conf.d/10-ssl.conf
sed -i "s|#ssl_key =.*|ssl_key = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem|g" /etc/dovecot/conf.d/10-ssl.conf
sed -i "s|ssl_key =.*|ssl_key = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem|g" /etc/dovecot/conf.d/10-ssl.conf
fi
2018-02-03 20:22:46 +01:00
groupadd ssl-cert
usermod -a -G ssl-cert dovecot
fi
2017-08-08 22:16:07 +02:00
systemctl restart dovecot
2016-11-06 15:03:51 +01:00
systemctl enable mailpile
systemctl daemon-reload
systemctl start mailpile
systemctl restart nginx
set_completion_param "mailpile domain" "$MAILPILE_DOMAIN_NAME"
APP_INSTALLED=1
}
# NOTE: deliberately no exit 0