Encrypt incoming email

install-freedombone.sh

@@ -150,6 +150,9 @@ WIKI_SQLITE_ADDON_HASH="930335e647c7e62f3068689c256ee169fad2426b64f8360685d391ec
 
 GPG_KEYSERVER="hkp://keys.gnupg.net"
 
+# whether to encrypt all incoming email with your public key
+GPG_ENCRYPT_STORED_EMAIL="yes"
+
 # gets set to yes if gpg keys are imported from usb
 GPG_KEYS_IMPORTED="no"
 
@@ -1339,6 +1342,37 @@ function configure_gpg {
   echo 'configure_gpg' >> $COMPLETION_FILE
 }
 
+function encrypt_incoming_email {
+  # encrypts incoming mail using your GPG public key
+  # so even if an attacker gains access to the data at rest they still need
+  # to know your GPG key password to be able to read anything
+  if [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" ]]; then
+      return
+  fi
+  if grep -Fxq "encrypt_incoming_email" $COMPLETION_FILE; then
+      return
+  fi
+  if [[ $GPG_ENCRYPT_STORED_EMAIL != "yes" ]]; then
+      return
+  fi
+  if [ ! -f /usr/bin/gpgit.pl ]; then
+      apt-get -y --force-yes install git
+      cd $INSTALL_DIR
+      git clone https://github.com/mikecardwell/gpgit
+      cd gpgit
+      cp gpgit.pl /usr/bin
+  fi
+
+  # add a procmail rule
+  if ! grep -q "/usr/bin/gpgit.pl" /home/$MY_USERNAME/.procmailrc; then
+      echo '  :0 f' >> /home/$MY_USERNAME/.procmailrc
+      echo "  | /usr/bin/gpgit.pl $MY_USERNAME@$DOMAIN_NAME" >> /home/$MY_USERNAME/.procmailrc
+      chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.procmailrc
+  fi
+  echo 'encrypt_incoming_email' >> $COMPLETION_FILE
+}
+
+
 function email_client {
   if [[ $SYSTEM_TYPE == "$VARIANT_WRITER" || $SYSTEM_TYPE == "$VARIANT_CLOUD" || $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_SOCIAL" || $SYSTEM_TYPE == "$VARIANT_MEDIA" || $SYSTEM_TYPE == "$VARIANT_NONMAILBOX" ]]; then
       return
@@ -3420,6 +3454,7 @@ configure_email
 #spam_filtering
 configure_imap
 configure_gpg
+encrypt_incoming_email
 email_client
 configure_firewall_for_email
 folders_for_mailing_lists