diff --git a/.forgejo/workflows/playing-around.yaml b/.forgejo/workflows/playing-around.yaml index 24789ae..bfee772 100644 --- a/.forgejo/workflows/playing-around.yaml +++ b/.forgejo/workflows/playing-around.yaml @@ -1,47 +1,9 @@ -on: - push: - branches: - - stage +on: [push] jobs: - build: + print-content: runs-on: docker - environment: ${{ github.ref_name }} - steps: - - name: Checkout code + - name: checkout code uses: actions/checkout@v4 - - - name: Setup Node.js - uses: https://code.forgejo.org/actions/setup-node@v4 - with: - node-version: "22" - - - name: Install dependencies - run: npm ci - - - name: Build Astro project - run: npm run build - - - name: Deploy dist to dist-${{ github.ref_name }} - run: | - git config user.name "forgejo-actions[bot]" - git config user.email "forgejo-actions[bot]@users.noreply.local" - - git checkout --orphan temp-build - git rm -rf . - - git add dist - git commit -m "Update dist/ [skip ci]" - - git push \ - https://x-access-token:${{ secrets.GITHUB_TOKEN }}@${{ github.server_url#https:// }}/{{ github.repository }} \ - temp-build:dist-${{ github.ref_name }} \ - --force - - - name: Trigger deployment webhook - env: - DEPLOY_WEBHOOK: ${{ secrets.COOLIFY_STAGE_DEPLOY_WEBHOOK }} - DEPLOY_TOKEN: ${{ secrets.COOLIFY_STAGE_DEPLOY_TOKEN }} - run: | - curl -v "$DEPLOY_WEBHOOK" \ - --header "Authorization: Bearer $DEPLOY_TOKEN" + - name: list directory contents + run: ls -la diff --git a/README.md b/README.md index 26e60e8..b4c182f 100644 --- a/README.md +++ b/README.md @@ -1,30 +1,18 @@ # ISPmail guide -This repository contains the ISPmail guide as found on workaround.org. +This repository holds the ISPmail guide as found on workaround.org. -The web site is built the static site generator [Starlight](https://starlight.astro.build) which creates beautiful -documentation with table of contents, a search function and customizable widgets. +It was built using the static site generator [Starlight](https://starlight.astro.build). -The illustrations were created using DrawIO. The flip-book-style diagrams on the _big picture_ page were created using: +More information on how to contribute will follow. +# Software used + +Static site generator: https://starlight.astro.build/ + +Diagrams/Illustrations: + +- DrawIO - https://github.com/pascal-brand38/astro-splide - https://pascal-brand38.github.io/astro-dev/packages/astro-splide/ - https://splidejs.com/guides/options/ - -## Contributing - -Feel free to clone this repository (the _prod_ branch) and make changes. You will need NodeJS to create the HTML from -the sources: - -```sh -apt install nodejs -npm i -npm run dev -``` - -Merge requests are always welcome. Typo fixes and rephrasing are always welcome because I am not a native english -speaker. If you want to contribute or change larger sections please talk to me first. - -Or just create an _issue_ here on Github so that I know what needs fixing. - -…[Christoph](mailto:ispmail@christoph-haas.de) diff --git a/astro.config.mjs b/astro.config.mjs index 4619eb2..8e4eaac 100644 --- a/astro.config.mjs +++ b/astro.config.mjs @@ -8,26 +8,8 @@ import remarkSmartypants from "remark-smartypants"; // https://astro.build/config export default defineConfig({ site: "https://workaround.org", - redirects: { - "/ispmail-trxie/imap/": "/ispmail-trixie/imap/", - "/ispmail-trxie/anti-spoofing-dkim-spf": "/ispmail-trixie/anti-spoofing-dkim-spf", - "/ispmail-trxie/catch-all": "/ispmail-trixie/catch-all", - "/ispmail-trxie/quotas": "/ispmail-trixie/quotas", - "/ispmail-trxie/going-live": "/ispmail-trixie/going-live", - }, integrations: [ starlight({ - head: [ - { - tag: "script", - attrs: { - src: "https://rybbit.workaround.org/api/script.js", - "data-site-id": "1", - async: true, - defer: true, - }, - }, - ], expressiveCode: { frames: { removeCommentsWhenCopyingTerminalFrames: false, // keep the commented lines when copying shell snippets @@ -73,17 +55,17 @@ export default defineConfig({ }, }), // https://github.com/felix-berlin/astro-matomo - // matomo({ - // enabled: import.meta.env.PROD, // Only load in production - // host: "https://matomo.workaround.org/", - // setCookieDomain: "*.workaround.org", - // trackerUrl: "js/", // defaults to matomo.php - // srcUrl: "js/", // defaults to matomo.js - // siteId: 1, - // heartBeatTimer: 5, - // disableCookies: true, - // debug: false, - // }), + matomo({ + enabled: import.meta.env.PROD, // Only load in production + host: "https://matomo.workaround.org/", + setCookieDomain: "*.workaround.org", + trackerUrl: "js/", // defaults to matomo.php + srcUrl: "js/", // defaults to matomo.js + siteId: 1, + heartBeatTimer: 5, + disableCookies: true, + debug: false, + }), sitemap(), ], diff --git a/drawio/big-picture.drawio b/drawio/big-picture.drawio index 6800b7e..e73dbe9 100644 --- a/drawio/big-picture.drawio +++ b/drawio/big-picture.drawio @@ -1,34 +1,34 @@ - + - + - + - + - + - + - + - + - + - + - + @@ -37,40 +37,40 @@ - + - + - + - + - + - + - + - + - + - + - + - + @@ -78,25 +78,25 @@ - + - + - + - + - + - + @@ -104,16 +104,16 @@ - + - + - + - + @@ -122,16 +122,16 @@ - + - + - + - + @@ -140,19 +140,19 @@ - + - + - + - + - + @@ -161,19 +161,19 @@ - + - + - + - + - + @@ -182,19 +182,19 @@ - + - + - + - + - + @@ -203,22 +203,22 @@ - + - + - + - + - + - + @@ -227,19 +227,19 @@ - + - + - + - + - + @@ -248,25 +248,25 @@ - + - + - + - + - + - + - + @@ -278,22 +278,22 @@ - + - + - + - + - + - + @@ -307,25 +307,25 @@ - + - + - + - + - + - + - + @@ -337,25 +337,25 @@ - + - + - + - + - + - + - + @@ -369,46 +369,46 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -416,22 +416,22 @@ - + - + - + - + - + - + @@ -443,25 +443,25 @@ - + - + - + - + - + - + - + @@ -475,25 +475,25 @@ - + - + - + - + - + - + @@ -502,61 +502,61 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + diff --git a/public/big-picture-receive/01.svg b/public/big-picture-receive/01.svg index b81ca4c..8f8ccbe 100644 --- a/public/big-picture-receive/01.svg +++ b/public/big-picture-receive/01.svg @@ -1,3 +1,3 @@ -
Other
mail server
Other...
I would like to send an email to john@example.com
I would like to send an email to j...
\ No newline at end of file +
Other
mail server
Other...
I would like to send an email to john@example.com
I would like to send an email to j...
\ No newline at end of file diff --git a/public/big-picture-receive/02.svg b/public/big-picture-receive/02.svg index 6831ec9..ac055cd 100644 --- a/public/big-picture-receive/02.svg +++ b/public/big-picture-receive/02.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
What is the MX record for the domain example.com?
What is the MX re...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
What is the MX record for the domain example.com?
What is the MX re...
\ No newline at end of file diff --git a/public/big-picture-receive/03.svg b/public/big-picture-receive/03.svg index b4c8b40..c480263 100644 --- a/public/big-picture-receive/03.svg +++ b/public/big-picture-receive/03.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
smtp01.example.net
smtp01.example.net
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
smtp01.example.net
smtp01.example.net
\ No newline at end of file diff --git a/public/big-picture-receive/04.svg b/public/big-picture-receive/04.svg index 203357b..19589eb 100644 --- a/public/big-picture-receive/04.svg +++ b/public/big-picture-receive/04.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
What are the A and AAAAA records for smtp01.example.net?
What are the A and AA...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
What are the A and AAAAA records for smtp01.example.net?
What are the A and AA...
\ No newline at end of file diff --git a/public/big-picture-receive/05.svg b/public/big-picture-receive/05.svg index d04d3e4..767508a 100644 --- a/public/big-picture-receive/05.svg +++ b/public/big-picture-receive/05.svg @@ -1,3 +1,3 @@ -
Name server
(DNS)
Name server...
Other
mail server
Other...
A: 100.17.195.84
AAAA: 2001:876:18:5::ce
A: 100.17.195.84...
\ No newline at end of file +
Name server
(DNS)
Name server...
Other
mail server
Other...
A: 100.17.195.84
AAAA: 2001:876:18:5::ce
A: 100.17.195.84...
\ No newline at end of file diff --git a/public/big-picture-receive/06.svg b/public/big-picture-receive/06.svg index af43a7e..3eba5f0 100644 --- a/public/big-picture-receive/06.svg +++ b/public/big-picture-receive/06.svg @@ -1,3 +1,3 @@ -
SMTP
(TCP port 25)
SMTP...
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file +
SMTP
(TCP port 25)
SMTP...
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file diff --git a/public/big-picture-receive/07.svg b/public/big-picture-receive/07.svg index e248e60..b789615 100644 --- a/public/big-picture-receive/07.svg +++ b/public/big-picture-receive/07.svg @@ -1,3 +1,3 @@ -
220 smtp01.example.net
ESMTP Postfix
220 smtp01.example.net...
Postfix
mail server
Postfix...
Other
mail server
Other...
Nice to see you.
Nice to see you.
\ No newline at end of file +
220 smtp01.example.net
ESMTP Postfix
220 smtp01.example.net...
Postfix
mail server
Postfix...
Other
mail server
Other...
Nice to see you.
Nice to see you.
\ No newline at end of file diff --git a/public/big-picture-receive/08.svg b/public/big-picture-receive/08.svg index 4eb096c..3c7531e 100644 --- a/public/big-picture-receive/08.svg +++ b/public/big-picture-receive/08.svg @@ -1,3 +1,3 @@ -
EHLO remoteserver
EHLO remoteserver
Postfix
mail server
Postfix...
Other
mail server
Other...
Hi, my name is "remoteserver"
Hi, my name is "remot...
\ No newline at end of file +
EHLO remoteserver
EHLO remoteserver
Postfix
mail server
Postfix...
Other
mail server
Other...
Hi, my name is "remoteserver"
Hi, my name is "remot...
\ No newline at end of file diff --git a/public/big-picture-receive/09.svg b/public/big-picture-receive/09.svg index 6c79fc9..3eb2182 100644 --- a/public/big-picture-receive/09.svg +++ b/public/big-picture-receive/09.svg @@ -1,3 +1,3 @@ -
250-smtp01.example.com
250-SIZE 40000000
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-smtp01.example.com...
Postfix
mail server
Postfix...
Other
mail server
Other...
These are the features that I support.
These are the features...
\ No newline at end of file +
250-smtp01.example.com
250-SIZE 40000000
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-smtp01.example.com...
Postfix
mail server
Postfix...
Other
mail server
Other...
These are the features that I support.
These are the features...
\ No newline at end of file diff --git a/public/big-picture-receive/10.svg b/public/big-picture-receive/10.svg index a5fc61f..21fc955 100644 --- a/public/big-picture-receive/10.svg +++ b/public/big-picture-receive/10.svg @@ -1,3 +1,3 @@ -
STARTTLS
STARTTLS
Postfix
mail server
Postfix...
Other
mail server
Other...
Let us switch to encrypted communication
Let us switch to encr...
\ No newline at end of file +
STARTTLS
STARTTLS
Postfix
mail server
Postfix...
Other
mail server
Other...
Let us switch to encrypted communication
Let us switch to encr...
\ No newline at end of file diff --git a/public/big-picture-receive/11.svg b/public/big-picture-receive/11.svg index 96e7d27..2a4441a 100644 --- a/public/big-picture-receive/11.svg +++ b/public/big-picture-receive/11.svg @@ -1,3 +1,3 @@ -
MAIL FROM: <someone@else.com>
MAIL FROM: <someone@else.com>
Postfix
mail server
Postfix...
Other
mail server
Other...
I have an email from someone@else.com
I have an email from...
\ No newline at end of file +
MAIL FROM: <someone@else.com>
MAIL FROM: <someone@else.com>
Postfix
mail server
Postfix...
Other
mail server
Other...
I have an email from someone@else.com
I have an email from...
\ No newline at end of file diff --git a/public/big-picture-receive/12.svg b/public/big-picture-receive/12.svg index 5f4a28a..4da2ab0 100644 --- a/public/big-picture-receive/12.svg +++ b/public/big-picture-receive/12.svg @@ -1,3 +1,3 @@ -
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file +
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
\ No newline at end of file diff --git a/public/big-picture-receive/13.svg b/public/big-picture-receive/13.svg index 4ea1440..b19a405 100644 --- a/public/big-picture-receive/13.svg +++ b/public/big-picture-receive/13.svg @@ -1,3 +1,3 @@ -
RCPT TO: <john@example.org>
RCPT TO: <john@example.org>
Postfix
mail server
Postfix...
Other
mail server
Other...
That email is meant for john@example.org
That email is meant f...
\ No newline at end of file +
RCPT TO: <john@example.org>
RCPT TO: <john@example.org>
Postfix
mail server
Postfix...
Other
mail server
Other...
That email is meant for john@example.org
That email is meant f...
\ No newline at end of file diff --git a/public/big-picture-receive/14.svg b/public/big-picture-receive/14.svg index 3d44682..8eec544 100644 --- a/public/big-picture-receive/14.svg +++ b/public/big-picture-receive/14.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Is example.org our domain?
Is example.org o...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Is example.org our domain?
Is example.org o...
\ No newline at end of file diff --git a/public/big-picture-receive/15.svg b/public/big-picture-receive/15.svg index 4c93635..e64758b 100644 --- a/public/big-picture-receive/15.svg +++ b/public/big-picture-receive/15.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_domains table
Yes, I found it in...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_domains table
Yes, I found it in...
\ No newline at end of file diff --git a/public/big-picture-receive/16.svg b/public/big-picture-receive/16.svg index 470b01b..163078f 100644 --- a/public/big-picture-receive/16.svg +++ b/public/big-picture-receive/16.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
And is john@example.org a known user?
And is john@example.or...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
And is john@example.org a known user?
And is john@example.or...
\ No newline at end of file diff --git a/public/big-picture-receive/17.svg b/public/big-picture-receive/17.svg index 33bca2a..886c091 100644 --- a/public/big-picture-receive/17.svg +++ b/public/big-picture-receive/17.svg @@ -1,3 +1,4 @@ + -
Postfix
mail server
Postfix...
Other
mail server
Other...
MariaDB
database
MariaDB...
Yes, I found it in my virtual_users table
Yes, I found it in my...
\ No newline at end of file +
Postfix
mail server
Other
mail server
MariaDB
database
Yes, I found it in my virtual_users table
\ No newline at end of file diff --git a/public/big-picture-receive/18.svg b/public/big-picture-receive/18.svg index 74d239b..c30a144 100644 --- a/public/big-picture-receive/18.svg +++ b/public/big-picture-receive/18.svg @@ -1,3 +1,3 @@ -
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
Looks good.
Looks good.
\ No newline at end of file +
Ok
Ok
Postfix
mail server
Postfix...
Other
mail server
Other...
Looks good.
Looks good.
\ No newline at end of file diff --git a/public/big-picture-receive/19.svg b/public/big-picture-receive/19.svg index a91c7ab..cb513b5 100644 --- a/public/big-picture-receive/19.svg +++ b/public/big-picture-receive/19.svg @@ -1,3 +1,3 @@ -
DATA
DATA
Postfix
mail server
Postfix...
Other
mail server
Other...
Let me send you the email now
Let me send you t...
\ No newline at end of file +
DATA
DATA
Postfix
mail server
Postfix...
Other
mail server
Other...
Let me send you the email now
Let me send you t...
\ No newline at end of file diff --git a/public/big-picture-receive/20.svg b/public/big-picture-receive/20.svg index fd0f66f..8645424 100644 --- a/public/big-picture-receive/20.svg +++ b/public/big-picture-receive/20.svg @@ -1,3 +1,3 @@ -
TCP port 11332
TCP port 11332
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
Do you think this email is spam?
Do you think this...
\ No newline at end of file +
TCP port 11332
TCP port 11332
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
Do you think this email is spam?
Do you think this...
\ No newline at end of file diff --git a/public/big-picture-receive/21.svg b/public/big-picture-receive/21.svg index 4316f8d..9375170 100644 --- a/public/big-picture-receive/21.svg +++ b/public/big-picture-receive/21.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
A few minor issues but the email seems legit
A few minor issues...
\ No newline at end of file +
Postfix
mail server
Postfix...
Other
mail server
Other...
rspamd
Spam check
rspamd...
A few minor issues but the email seems legit
A few minor issues...
\ No newline at end of file diff --git a/public/big-picture-receive/22.svg b/public/big-picture-receive/22.svg index 1302dd3..3543078 100644 --- a/public/big-picture-receive/22.svg +++ b/public/big-picture-receive/22.svg @@ -1,3 +1,3 @@ -
250 2.0.0 Ok: queued as 7855B7FD86
250 2.0.0 Ok: queued as 7855B7FD86
Postfix
mail server
Postfix...
Other
mail server
Other...
Thanks. I will deliver it.
Thanks. I will d...
\ No newline at end of file +
250 2.0.0 Ok: queued as 7855B7FD86
250 2.0.0 Ok: queued as 7855B7FD86
Postfix
mail server
Postfix...
Other
mail server
Other...
Thanks. I will deliver it.
Thanks. I will d...
\ No newline at end of file diff --git a/public/big-picture-receive/23.svg b/public/big-picture-receive/23.svg index 07935e8..609be6e 100644 --- a/public/big-picture-receive/23.svg +++ b/public/big-picture-receive/23.svg @@ -1,3 +1,4 @@ + -
LMTP
LMTP
Postfix
mail server
Postfix...
Please save this new email for john@example.org
Please save this new e...
Dovecot
IMAP server
Dovecot...
\ No newline at end of file +
LMTP
Postfix
mail server
Please save this new email for john@example.org
Dovecot
IMAP server
\ No newline at end of file diff --git a/public/big-picture-receive/24.svg b/public/big-picture-receive/24.svg index 8a5c994..49fcf86 100644 --- a/public/big-picture-receive/24.svg +++ b/public/big-picture-receive/24.svg @@ -1,3 +1,3 @@ -
Postfix
mail server
Postfix...
Dovecot
IMAP server
Dovecot...
/var/vmail
/var/vmail
Alright. Saving to disk.
Alright. Saving...
\ No newline at end of file +
Postfix
mail server
Postfix...
Dovecot
IMAP server
Dovecot...
/var/vmail
/var/vmail
Alright. Saving to disk.
Alright. Saving...
\ No newline at end of file diff --git a/public/ispmail.sh b/public/ispmail.sh deleted file mode 100755 index 814fe47..0000000 --- a/public/ispmail.sh +++ /dev/null @@ -1,991 +0,0 @@ -#!/bin/bash -e -# -# Installer for ISPmail servers -# Copyright © 2025 Christoph Haas -# -# License: Creative Commons BY-NC-SA license -# -# Version 0.1 -# 2025-12-14 -# - -usage() { - echo "Usage: $0 -f fqdn" - exit 1 -} - -FQDN="" - -while getopts "f:h" opt; do - case "$opt" in - f) FQDN="$OPTARG" ;; - h) usage ;; - *) usage ;; - esac -done - - - -############ pre flight check ############ - -pre_flight() { - # Check for root - if [[ $EUIA -ne 0 ]]; then - echo "❌ You must run this script as root." - exit 1 - fi - - # Check for Trixie - DEBIAN_VERSION=$(cut -d'.' -f1 /etc/debian_version) - if [[ "$DEBIAN_VERSION" -ne 13 ]]; then - echo "❌ Sorry, this installer only works on Debian 13/Trixie." - exit 10 - fi - - # FQDN needs to be given as an option - if [[ $FQDN = "" ]]; then - echo "❌ You must specify your FQDN using the '-f' option." - exit 1 - fi -} - - -############## Intro ############## - -intro() { -cat < /etc/letsencrypt/cli.ini << 'EOF' -# Restart services after renewing a certificate -post-hook = systemctl reload postfix dovecot apache2 - -# Because we are using logrotate for greater flexibility, disable the -# internal certbot logrotation. -max-log-backups = 0 - -# Adjust interactive output regarding automated renewal -preconfigured-renewal = True -EOF -} - -############# Postfix ############### - -postfix_config() { - cat > /etc/postfix/mariadb-virtual-mailbox-domains.cf << EOF -user = mailserver -password = MAILSERVER-PASSWORD-HERE -hosts = 127.0.0.1 -dbname = mailserver -query = SELECT 1 FROM virtual_domains WHERE name='%s' -EOF - - cat > /etc/postfix/mariadb-virtual-alias-maps.cf << EOF -user = mailserver -password = MAILSERVER-PASSWORD-HERE -hosts = 127.0.0.1 -dbname = mailserver -query = SELECT destination FROM virtual_aliases WHERE source='%s' -EOF - - cat > /etc/postfix/mariadb-virtual-mailbox-maps.cf << EOF -user = mailserver -password = MAILSERVER-PASSWORD-HERE -hosts = 127.0.0.1 -dbname = mailserver -query = SELECT 1 FROM virtual_users WHERE email='%s' -EOF - - postconf virtual_mailbox_domains=mysql:/etc/postfix/mariadb-virtual-mailbox-domains.cf - postconf virtual_mailbox_maps=mysql:/etc/postfix/mariadb-virtual-mailbox-maps.cf - postconf virtual_alias_maps=mysql:/etc/postfix/mariadb-virtual-alias-maps.cf - - chown root:postfix /etc/postfix/mariadb-*.cf - chmod o= /etc/postfix/mariadb-*.cf - - # Postfix check - RES=$(postmap -q example.org mysql:/etc/postfix/mariadb-virtual-mailbox-domains.cf) - if [[ $RES -ne 1 ]]; then - echo "❌ The mariadb-virtual-mailbox-domains.cf mapping failed." - exit 10 - fi - - RES=$(postmap -q jack@example.org mysql:/etc/postfix/mariadb-virtual-alias-maps.cf) - if [[ $RES != 'john@example.org' ]]; then - echo "❌ The mariadb-virtual-alias-maps.cf mapping failed." - exit 10 - fi - - RES=$(postmap -q john@example.org mysql:/etc/postfix/mariadb-virtual-mailbox-maps.cf) - if [[ $RES -ne 1 ]]; then - echo "❌ The mariadb-virtual-mailbox-maps.cf mapping failed." - exit 10 - fi - - echo "✅ Mappings work." -} - -############# Dovecot ############### - -dovecot_config() { - groupadd -f --system vmail - id -a vmail 2>/dev/null >/dev/null || useradd --system --gid vmail vmail - mkdir -p /var/vmail - chown -R vmail:vmail /var/vmail - chmod u=rwx,g=rx,o= /var/vmail - - sed -i '/!include/s/^/#/' /etc/dovecot/conf.d/10-auth.conf - - cat > /etc/dovecot/conf.d/99-ispmail-mail.conf << EOF -mail_driver = maildir -mail_home = /var/vmail/%{user | domain}/%{user | username} -mail_path = ~/Maildir -mail_uid = vmail -mail_gid = vmail -mail_inbox_path = ~/Maildir/ -EOF - - cat > /etc/dovecot/conf.d/99-ispmail-master.conf << EOF -service auth { - unix_listener /var/spool/postfix/private/dovecot-auth { - mode = 0660 - user = postfix - group = postfix - } -} -EOF - - cat > /etc/dovecot/conf.d/99-ispmail-ssl.conf << EOF -ssl = required -ssl_server_cert_file = /etc/letsencrypt/live/$FQDN/fullchain.pem -ssl_server_key_file = /etc/letsencrypt/live/$FQDN/privkey.pem -EOF - - cat > /etc/dovecot/conf.d/99-ispmail-lmtp-username-format.conf << EOF -protocol lmtp { - auth_username_format = -} -EOF - - cat > /etc/dovecot/conf.d/99-ispmail-sql.conf << EOF -sql_driver = mysql - -mysql /var/run/mysqld/mysqld.sock { - user = mailserver - password = 'MAILSERVER-PASSWORD-HERE' - dbname = mailserver - host = 127.0.0.1 -} - -userdb sql { - query = SELECT email as user FROM virtual_users WHERE email='%{user}' - iterate_query = SELECT email as user FROM virtual_users -} - -passdb sql { - query = SELECT password FROM virtual_users where email='%{user}' -} -EOF - - # fix permissions - chown root:root /etc/dovecot/conf.d/99-ispmail-sql.conf - chmod go= /etc/dovecot/conf.d/99-ispmail-sql.conf - - cat > /etc/dovecot/conf.d/99-ispmail-managesieve.conf << EOF -service managesieve-login { - # Listen only on localhost - inet_listener sieve { - listen= 127.0.0.1 - port = 4190 - } - - # Disable the deprecated listener - inet_listener sieve_deprecated { - port = 0 - } -} -EOF - - systemctl restart dovecot - - # Check if running - systemctl is-active --quiet dovecot.service - if [[ $? -ne 0 ]]; then - echo "❌ Dovecot failed to start properly." - exit 10 - fi - echo "✅ Dovecot is running fine." - - # Check query - JOHNS_MAILDIR=$(doveadm user john@example.org | grep ^mail_path | cut -f2) - if [[ $JOHNS_MAILDIR != '/var/vmail/example.org/john/Maildir' ]]; then - echo "❌ Could not find John's mail_path." - exit 10 - fi - echo "✅ Lookup works." -} - -############# LMTP ############### - -lmtp_config() { -# Add an LMTP listening socket in Dovecot - cat > /etc/dovecot/conf.d/99-ispmail-lmtp-listener.conf << EOF -service lmtp { - # Used internally by Dovecot - unix_listener lmtp { - } - - # Listen to LMTP connections from Postfix - unix_listener /var/spool/postfix/private/dovecot-lmtp { - mode = 0600 - user = postfix - group = postfix - } -} -EOF - - # Restart Dovecot - systemctl restart dovecot - - postconf virtual_transport=lmtp:unix:private/dovecot-lmtp - - # Testing delivery - echo Testing email delivery internally. - if [[ -d /var/vmail/example.org/john/Maildir/new/ ]]; then - rm -f /var/vmail/example.org/john/Maildir/new/* - fi - swaks --server localhost --to john@example.org --tls --silent - - DELIVERY=0 - for i in $(seq 1 50); do - NUM_FILES=$(ls -1 /var/vmail/example.org/john/Maildir/new/ | wc -l) - if [[ $NUM_FILES -eq 1 ]]; then - DELIVERY=1 - break - fi - - sleep 0.2 - done - - if [[ $DELIVERY -eq 0 ]]; then - echo "❌ Mail delivery to john@example.org failed." - exit 10 - fi - echo "✅ Test successful." -} - -############ APACHE ############# - -apache_config() { - cat > /etc/apache2/sites-available/000-default-le-ssl.conf << EOF - - ServerAdmin postmaster@$FQDN - ServerName $FQDN - DocumentRoot /var/lib/roundcube/public_html - - ErrorLog \${APACHE_LOG_DIR}/error.log - CustomLog \${APACHE_LOG_DIR}/access.log combined - - SSLCertificateFile /etc/letsencrypt/live/$FQDN/fullchain.pem - SSLCertificateKeyFile /etc/letsencrypt/live/$FQDN/privkey.pem - Include /etc/letsencrypt/options-ssl-apache.conf - Include /etc/roundcube/apache.conf - - - Require all granted - - - RewriteEngine On - RewriteRule ^/rspamd$ /rspamd/ [R,L] - RewriteRule ^/rspamd/(.*) http://localhost:11334/\$1 [P,L] - -EOF - - # Enable the required Apache modules - a2enmod proxy_http -q - a2enmod rewrite -q - - # Restart Apache - systemctl restart apache2 - # Check if running - systemctl is-active --quiet apache2.service - if [[ $? -ne 0 ]]; then - echo "❌ Apache has not started properly." - exit 10 - fi - echo "✅ Apache is running fine." - - # Set imap_host and smtp_host in /etc/roundcube/config.inc.php - sed -i "s|^\s*\$config\['imap_host'\]\s*=.*|\$config['imap_host'] = 'tls://$FQDN:143';|" /etc/roundcube/config.inc.php - sed -i "s|^\s*\$config\['smtp_host'\]\s*=.*|\$config['smtp_host'] = 'tls://$FQDN:587';|" /etc/roundcube/config.inc.php - - # Check if web interface is loading - curl -s https://$FQDN | grep title | grep -q "Roundcube Webmail" - if [[ $? -ne 0 ]]; then - echo "❌ Webmail interface is not reachable at https://$FQDN" - exit 10 - fi -} - -############ Relaying ############# - -relaying_setup() { - postconf -M submission/inet="submission inet n - y - - smtpd" - postconf -P "submission/inet/syslog_name=postfix/submission" - postconf -P "submission/inet/smtpd_tls_security_level=encrypt" - postconf -P "submission/inet/smtpd_sasl_auth_enable=yes" - postconf -P "submission/inet/smtpd_sasl_type=dovecot" - postconf -P "submission/inet/smtpd_sasl_path=private/dovecot-auth" - postconf -P "submission/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject" - postconf -P "submission/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject" - - postconf -M submissions/inet="submissions inet n - y - - smtpd" - postconf -P "submissions/inet/syslog_name=postfix/submissions" - postconf -P "submissions/inet/smtpd_tls_wrappermode=yes" - postconf -P "submissions/inet/smtpd_sasl_auth_enable=yes" - postconf -P "submissions/inet/smtpd_sasl_type=dovecot" - postconf -P "submissions/inet/smtpd_sasl_path=private/dovecot-auth" - postconf -P "submissions/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject" - postconf -P "submissions/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject" - - postfix reload 2>/dev/null - - postconf smtp_tls_security_level=encrypt - postconf smtpd_tls_security_level=encrypt - postconf smtp_tls_mandatory_protocols=">=TLSv1.2" - postconf smtpd_tls_mandatory_protocols=">=TLSv1.2" - postconf smtp_tls_mandatory_ciphers=high - postconf smtpd_tls_mandatory_ciphers=high - postconf smtpd_tls_cert_file=/etc/letsencrypt/live/$FQDN/fullchain.pem - postconf smtpd_tls_key_file=/etc/letsencrypt/live/$FQDN/privkey.pem - - # Create a mapping configuration from the user to themself - cat > /etc/postfix/mariadb-email2email.cf << EOF -user = mailserver -password = MAILSERVER-PASSWORD-HERE -hosts = 127.0.0.1 -dbname = mailserver -query = SELECT email FROM virtual_users WHERE email='%s' -EOF - - # Fix permissions - chown root:postfix /etc/postfix/mariadb-email2email.cf - chmod u=rw,g=r,o= /etc/postfix/mariadb-email2email.cf - - # Tell Postfix to use this mapping - postconf smtpd_sender_login_maps=mysql:/etc/postfix/mariadb-email2email.cf - - # Test spoofing - set +e - swaks --server localhost:587 \ - --from brunhilde@example.org \ - --to list@example.com \ - --tls \ - --auth-user john@example.org \ - --auth-password summersun \ - --silent 3 - - if [[ $? -ne 24 ]]; then - echo "❌ Forged sender spoofing test failed." - exit 10 - fi - set -e - echo "✅ Forged sender spoofing successfully rejected." - - # Test with proper email - set +e - swaks --server localhost:587 \ - --from john@example.org \ - --to list@example.com \ - --tls \ - --auth-user john@example.org \ - --auth-password summersun \ - --silent 3 - - if [[ $? -ne 0 ]]; then - echo "❌ Relaying of proper email failed." - exit 10 - fi - set -e - echo "✅ Relay test okay." - - # Submission plaintext test - set +e - swaks --server localhost:587 \ - --from john@example.org \ - --to lisa@example.com \ - --silent 3 - if [[ $? -ne 23 ]]; then - echo "❌ Relaying over submission without STARTTLS was accepted." - exit 10 - fi - set -e - echo "✅ Plaintext auth refused via submission port." - - # Submission encryption but no auth test - set +e - swaks --server localhost:587 \ - --from john@example.org \ - --to lisa@example.com \ - -tls \ - --silent 3 - if [[ $? -ne 24 ]]; then - echo "❌ Relaying over submission with STARTTLS but without auth was accepted." - exit 10 - fi - set -e - echo "✅ Encrypted non-auth refused via submission port." - - # Test encryption and auth over submission - set +e - swaks --server localhost:587 \ - --from john@example.org \ - --to lisa@example.com \ - -tls \ - --auth-user john@example.org \ - --auth-password summersun \ - --silent 3 - if [[ $? -ne 0 ]]; then - echo "❌ Relaying over submission with STARTTLS and auth failed." - exit 10 - fi - set -e - echo "✅ Encrypted and authenticated relaying over submission works." - - # Test encryption and auth over submissions - set +e - swaks --server localhost:465 \ - --from john@example.org \ - --to lisa@example.com \ - --tls-on-connect \ - --auth-user john@example.org \ - --auth-password summersun \ - --silent 3 - if [[ $? -ne 0 ]]; then - echo "❌ Relaying over submissions with STARTTLS and auth failed." - exit 10 - fi - set -e - echo "✅ Encrypted and authenticated relaying over submissions works." -} - -############ IMAP ############## - -imap_test() { - # Test IMAP access - apt-get -qq install fetchmail - cat > ~/.fetchmailrc </dev/null - rm ~/.fetchmailrc - if [[ $? -ne 0 ]]; then - echo "❌ IMAP connection failed" - exit 10 - fi - set -e - echo "✅ IMAP connection test successful." -} - -############ rspamd ############# - -rspamd_config() { - postconf smtpd_milters=inet:127.0.0.1:11332 - postconf non_smtpd_milters=inet:127.0.0.1:11332 - postconf inet_protocols=all - systemctl restart postfix - - cat > /tmp/gtube.txt < /etc/dovecot/conf.d/99-ispmail-sieve-movetojunk.conf << 'EOF' -sieve_script spam-to-junk-folder { - driver = file - type = after - path = /etc/dovecot/sieve/spam-to-junk-folder.sieve -} - -# Enable the execution of Sieve rules when Postfix sends an email to Dovecot over LMTP -protocol lmtp { - mail_plugins { - sieve = yes - } -} - -# Make sure that every user has a Junk folder and is subscribed to it -namespace inbox { - mailbox Junk { - special_use = \Junk - auto = subscribe - } -} -EOF - - # Restart Dovecot - systemctl reload dovecot - - # Create the directory for Sieve files - mkdir -p /etc/dovecot/sieve - - # Create the Sieve script to move Spam mails to the user's Junk folder - cat > /etc/dovecot/sieve/spam-to-junk-folder.sieve << 'EOF' -require ["fileinto"]; - -if header :contains "X-Spam" "Yes" { - fileinto "Junk"; - stop; -} -EOF - - # Make the sieve script machine-readable - sievec /etc/dovecot/sieve/spam-to-junk-folder.sieve 2>/dev/null - - # Create a config file to enable automatic spam training - cat > /etc/rspamd/local.d/classifier-bayes.conf << 'EOF' -# Store training data in the Redis database -servers = "127.0.0.1:6379"; -backend = "redis"; - -# Enable automatic training -autolearn = true; # if rspamd is sure that an email is spam, it will be learned -min_learns = 200; # do not trust the data before at least 200 mails have been learned -EOF - - # Restart rspamd - #systemctl restart rspamd - - cat > /etc/dovecot/conf.d/99-ispmail-imapsieve.conf << 'EOF' -# Enable the imap_sieve plugin -protocol imap { - mail_plugins { - imap_sieve = yes - } -} - -# Allow the use of the pipe plugin to send mails to shell scripts -sieve_plugins { - sieve_extprograms = yes - sieve_imapsieve = yes -} - -sieve_global_extensions { - vnd.dovecot.pipe = yes -} - -# Where to look for Sieve scripts that use the Pipe functionality -sieve_pipe_bin_dir = /etc/dovecot/sieve - -# Moved into Junk? -> Learn as spam. -mailbox Junk { - sieve_script spam { - type = before - cause = copy - path = /etc/dovecot/sieve/learn-spam.sieve - } -} - -# Moved out of Junk? -> Learn as ham. -imapsieve_from Junk { - sieve_script ham { - type = before - cause = copy - path = /etc/dovecot/sieve/learn-ham.sieve - } -} -EOF - - # Create spam learning script - cat > /etc/dovecot/sieve/learn-spam.sieve << 'EOF' -require ["vnd.dovecot.pipe", "copy", "imapsieve"]; -pipe :copy "rspamd-learn-spam.sh"; -EOF - - # Create ham learning script - cat > /etc/dovecot/sieve/learn-ham.sieve << 'EOF' -require ["vnd.dovecot.pipe", "copy", "imapsieve", "variables"]; -pipe :copy "rspamd-learn-ham.sh"; -EOF - - # Compile the Sieve scripts - systemctl reload dovecot - sievec /etc/dovecot/sieve/learn-spam.sieve 2>/dev/null - sievec /etc/dovecot/sieve/learn-ham.sieve 2>/dev/null - - # Fix permissions - chmod u=rw,go= /etc/dovecot/sieve/learn-{spam,ham}.{sieve,svbin} - chown vmail:vmail /etc/dovecot/sieve/learn-{spam,ham}.{sieve,svbin} - - # Create the shell script for learning spam - cat > /etc/dovecot/sieve/rspamd-learn-spam.sh << 'EOF' -#!/bin/sh -# Receives an email from Dovecot's Sieve script and pipe it into rspamc -exec /usr/bin/rspamc learn_spam -EOF - - # Create the shell script for learning ham - cat > /etc/dovecot/sieve/rspamd-learn-ham.sh << 'EOF' -#!/bin/sh -# Receives an email from Dovecot's Sieve script and pipe it into rspamc -exec /usr/bin/rspamc learn_ham -EOF - - # Fix permissions of the shell scripts - chmod u=rwx,go= /etc/dovecot/sieve/rspamd-learn-{spam,ham}.sh - chown vmail:vmail /etc/dovecot/sieve/rspamd-learn-{spam,ham}.sh - - cat > /etc/dovecot/conf.d/99-ispmail-sieve-debug.conf << 'EOF' -# Enable detailed logging of Sieve scripts -log_debug=category=sieve -EOF - - cat > /etc/dovecot/conf.d/99-ispmail-autoexpunge.conf << 'EOF' -# Remove mails from the Junk and Trash folders after 30 days -mailbox Junk { - special_use = \Junk - auto = subscribe - mailbox_autoexpunge = 30d -} -mailbox Trash { - special_use = \Trash - auto = subscribe - mailbox_autoexpunge = 30d -} - -# Make expunging more efficient -mailbox_list_index = yes -mail_always_cache_fields = date.save -EOF - - # Restart Dovecot - systemctl restart dovecot - - # Generate a random password that is 15 characters long - RSPAMD_PW=$(pwgen 15 1) - - # Create a hash of that password - HASH=$(rspamadm pw -p $RSPAMD_PW) - - # Add the hashed password to rspamd's configuration - echo "password = \"$HASH\"" > /etc/rspamd/local.d/worker-controller.inc - - # Restart rspamd - systemctl reload rspamd - - echo "✅ rspamd set up" -} - -############ Show summary at the end ############# - -dkim_config() { - postconf smtpd_milters=inet:127.0.0.1:11332 - postconf non_smtpd_milters=inet:127.0.0.1:11332 - - # Create the directory - mkdir -p /var/lib/rspamd/dkim - - # Fix permissions - chown _rspamd:_rspamd /var/lib/rspamd/dkim - - # Tell rspamd to look up selectors in our mapping file - cat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF' -path = "/var/lib/rspamd/dkim/$domain.$selector.key"; -selector_map = "/etc/rspamd/dkim_selectors.map"; -EOF - - # TODO: create a key for $FQDN and test it - - # Restart rspamd - systemctl restart rspamd - - echo "✅ DKIM signing ready to use" -} - -############ Catch-all aliases ############# - -catchall_config() { - # Create the john-to-himself mapping - cat > /etc/postfix/mariadb-email2email.cf << EOF -user = mailserver -password = MAILSERVER-PASSWORD-HERE -hosts = 127.0.0.1 -dbname = mailserver -query = SELECT email FROM virtual_users WHERE email='%s' -EOF - - # Fix the permissions of that file - chgrp postfix /etc/postfix/mariadb-*.cf - chmod u=rw,g=r,o= /etc/postfix/mariadb-*.cf - - # Add the new mapping to the virtual_alias_maps - # (The order is not important. Postfix will check all mapping files.) - postconf virtual_alias_maps=mysql:/etc/postfix/mariadb-virtual-alias-maps.cf,mysql:/etc/postfix/mariadb-email2email.cf - - result=$(postmap -q john@example.org mysql:/etc/postfix/mariadb-email2email.cf) - - if [[ $result != "john@example.org" ]]; then - echo "❌ email2email mapping for catch-all aliases do not work properly" - exit 10 - fi - set -e - echo "✅ Catch-all aliases ready to use." -} - -############ Going-live ############# - -going_live() { - # Create two random passwords - PW_MAILADMIN=$(pwgen -s 32 1) - PW_MAILSERVER=$(pwgen -s 32 1) - - # Replace the dummy passwords - sed -i "s|MAILADMIN-PASSWORD-HERE|$PW_MAILADMIN|g" /etc/roundcube/plugins/password/config.inc.php - - sed -i "s|MAILSERVER-PASSWORD-HERE|$PW_MAILSERVER|g" \ - /etc/dovecot/conf.d/99-ispmail-sql.conf \ - /etc/postfix/mariadb-virtual-mailbox-maps.cf \ - /etc/postfix/mariadb-virtual-mailbox-domains.cf \ - /etc/postfix/mariadb-virtual-alias-maps.cf \ - /etc/postfix/mariadb-email2email.cf - - # Restart the services - systemctl restart postfix dovecot - - # Update MariaDB user passwords - mariadb <Christoph Haas since 2003. All content on workaround.org can be used under the terms of the Creative Commons BY-NC-SA license. - Penguin image based on AI art because I suck at drawing. Imprints and legal notice.. + Penguin image based on AI art because I suck at drawing. diff --git a/src/content/docs/imprints.mdx b/src/content/docs/imprints.mdx deleted file mode 100644 index 82789bc..0000000 --- a/src/content/docs/imprints.mdx +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Legal Notice / Imprints ---- - -## Responsible for Content - -``` -Christoph Haas -c/o Online-Impressum.de #5172 -Europaring 90 -53757 Sankt Augustin -Germany -``` - -Contact: postmaster@christoph-haas.de or christoph.haas@gmail.com or via -[contact form](https://mein.online-impressum.de/workaround-org/) - -## Liability for Content - -As a service provider, I am responsible for my own content on these pages under German law § 7 (1) Telemediengesetz. -However, I do not guarantee the accuracy, completeness, or timeliness of the content. - -## Liability for External Links - -This website contains links to external third-party websites over which I have no control. Therefore, I cannot assume -any liability for such external content. - -## Open-Source Notice - -The source code of this project is published under an open-source license. Details can be found in the respective -repository at https://github.com/Signum/ispmail-workaround-org diff --git a/src/content/docs/ispmail-trixie/100-start.md b/src/content/docs/ispmail-trixie/100-start.md index 3ab3144..eb31456 100644 --- a/src/content/docs/ispmail-trixie/100-start.md +++ b/src/content/docs/ispmail-trixie/100-start.md @@ -23,8 +23,7 @@ server. limit is the size of your disk. - Have a **webmail** interface so users can access their emails securely from any location using a web browser. - Let your users fetch email using **IMAP** and send email through your servers using **SMTP**. -- Add automatic cryptographic signatures using **DKIM** to outgoing emails to prove that you are the owner of your - domain. +- Add automatic cryptographic signatures using DKIM to outgoing emails to prove that you are the owner of your domain. - Allow users to manage server-based **filter rules**. Distribute incoming emails to different folders. Forward copies. Or send out-of-office notifications. - Mitigate **brute force** attacks. @@ -52,10 +51,9 @@ server. - An **internet domain** (or several) to receive emails for. You need to be able to set A, MX and TXT records for that domain. You should also be able to set PTR records for your IP address because some mail servers on the internet require you to have matching forward and reverse DNS records. -- **Patience**. We will proceed slowly and after every step ensure that you are still on track. Don’t hurry and skip - parts even if they appear confusing at first. If you get lost just submit your question at the bottom of any page - throughout this guide and help is on the way. Or join the - [chat channel](https://riot.im/app/#/room/#ispmail:matrix.org). +- **Patience**. We will proceed slowly and after every step ensure that are still on track. Don’t hurry and skip parts + even if they appear confusing at first. If you get lost just submit your question at the bottom of any page throughout + this guide and help is on the way. Or join the [chat channel](https://riot.im/app/#/room/#ispmail:matrix.org). ## What this is not about diff --git a/src/content/docs/ispmail-trixie/110-upgrading.mdx b/src/content/docs/ispmail-trixie/110-upgrading.mdx index 4f0732f..ac4d7d1 100644 --- a/src/content/docs/ispmail-trixie/110-upgrading.mdx +++ b/src/content/docs/ispmail-trixie/110-upgrading.mdx @@ -77,32 +77,18 @@ mariadb mailserver < mailserver.sql Obviously any database changes on the old server from now on will have to be done on the new server as well until the migration is done. -## Weak password schemes - -Please check if any of your users have hashed passwords that are considered -[weak](https://doc.dovecot.org/2.4.2/core/config/auth/schemes.html) by Dovecot. Those passwords using a `PLAIN-MD5` -scheme are not accepted by Dovecot by default. But you can enable them again using: - -```sh -cat > 99-ispmail-weak-schemes.conf << EOF -auth_allow_weak_schemes = yes -EOF -``` - -Your users should change their passwords using Roundcube. That way a new hash with a more secure schema is created. - ## Roundcube contacts If your users are using Roundcube as a webmail interface then you should migrate their data like their contact lists. Dump the SQL from the old server: -```sh +``` mariadb-dump roundcube > roundcube.sql ``` Copy that file to the new server and import it: -```sh +``` mariadb roundcube < roundcube.sql ``` @@ -117,15 +103,7 @@ UPDATE users SET mail_host='new.mail.server'; ## Migrate rspamd spam training data If you have been using rspamd with the Redis backend then copy over the Redis database from your previous server. - -Stop rspamd on both the old and the new server. Then: - -```sh -rsync -va oldserver:/var/lib/redis/ /var/lib/redis/ -``` - -Once the redis database is started again on the new server, `rspamc stat` should show you that the training data is -found. +Details are found in the rspamd chapter. ## Migrate the Maildirs hot @@ -151,10 +129,9 @@ need to copy emails from another server where you only have IMAP access but cann Copy over everything in /etc/letsencrypt and /var/lib/rspamd/dkim from your old to the new server. -```sh -rsync -va oldserver:/etc/letsencrypt/archive/ /etc/letsencrypt/archive/ +``` +rsync -va oldserver:/etc/letsencrypt/ /etc/letsencrypt/ rsync -va oldserver:/var/lib/rspamd/dkim/ /var/lib/rspamd/dkim/ -rsync -v oldserver:/etc/rspamd/dkim_selectors.map /etc/rspamd ``` ## Downtime @@ -167,7 +144,7 @@ You told your users about the downtime, right? The time has come? Okay. Shut dow copied consistently.) Let’s synchronize again. *rsync* will only copy those files that have changed which makes it much faster than the first sync. On your new server run: -```sh +``` rsync -va --delete oldserver:/var/vmail/ /var/vmail/ ``` @@ -200,13 +177,3 @@ postconf soft_bounce=no ## Shut down the old server If possible do a final backup of the old server. If users are not complaining then dismiss the old system after a week. - -## Further issues - -You may see error messages like: - -``` -Error: sieve: binary /var/vmail/example.org/user/.dovecot.svbin: read: binary stored with different major version 2.0 (!= 3.0; automatically fixed when re-compiled) -``` - -You may need to run `sievec` on those files. diff --git a/src/content/docs/ispmail-trixie/155-database.mdx b/src/content/docs/ispmail-trixie/155-database.mdx index e56131e..887499c 100644 --- a/src/content/docs/ispmail-trixie/155-database.mdx +++ b/src/content/docs/ispmail-trixie/155-database.mdx @@ -46,7 +46,7 @@ CREATE DATABASE mailserver; ## Create the database users -In this section you will create the basic database called `mailserver` and two users: +In this section you will create the basic database `mailserver` and two users: | User | Permissions | Purpose | | :--------- | :---------- | :--------------------------------------------------------- | diff --git a/src/content/docs/ispmail-trixie/158-certbot.mdx b/src/content/docs/ispmail-trixie/158-certbot.mdx index 6a06987..59081d3 100644 --- a/src/content/docs/ispmail-trixie/158-certbot.mdx +++ b/src/content/docs/ispmail-trixie/158-certbot.mdx @@ -109,17 +109,7 @@ It is important that services that use the certificate load the new certificate command will create a file `/etc/letsencrypt/cli.ini` that handles it: ```sh title="Run this on your server" -cat > /etc/letsencrypt/cli.ini << 'EOF' -# Restart services after renewing a certificate -post-hook = systemctl reload postfix dovecot apache2 - -# Because we are using logrotate for greater flexibility, disable the -# internal certbot logrotation. -max-log-backups = 0 - -# Adjust interactive output regarding automated renewal -preconfigured-renewal = True -EOF +echo > /etc/letsencrypt/cli.ini "post-hook = systemctl reload postfix dovecot apache2" ``` Perfect. You won't have to worry about the certificate again. diff --git a/src/content/docs/ispmail-trixie/165-dovecot.mdx b/src/content/docs/ispmail-trixie/165-dovecot.mdx index d6aa83d..8f99d78 100644 --- a/src/content/docs/ispmail-trixie/165-dovecot.mdx +++ b/src/content/docs/ispmail-trixie/165-dovecot.mdx @@ -42,7 +42,7 @@ for our purpose. The `/etc/dovecot/conf.d/10-auth.conf` file is dealing with authentication. At the end of this file you will find a list of authentication backends that Dovecot ships with. By default it will use _system users_ (those from /etc/passwd). But -we want to use the MariaDB database backend. Please comment out all include statements: +we want to use the MariaDB database backend. Please comment all all include statements: ```text title="Edit your /etc/dovecot/conf.d/10-auth.conf" #!include auth-system.conf.ext @@ -113,8 +113,8 @@ to authenticate your users which is relevant later when we set up _relaying_. Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS between the users and your mail server. You need to tell Dovecot where to find these files. Also set [ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent -that someone sends their password without encryption. Again we will create a new file `99-ispmail-ssl.conf` to override -the defaults. +that someone sends their password without encryption. Again we will create a new file `99-ispmail-master.conf` to +override the defaults. ```sh title="Run this on your server" -postconf smtp_tls_security_level=encrypt -postconf smtpd_tls_security_level=encrypt -postconf smtp_tls_mandatory_protocols=">=TLSv1.2" -postconf smtpd_tls_mandatory_protocols=">=TLSv1.2" -postconf smtp_tls_mandatory_ciphers=high -postconf smtpd_tls_mandatory_ciphers=high +postconf smtp_tls_security_level=may +postconf smtpd_tls_security_level=may postconf smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.org/fullchain.pem postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem ``` @@ -156,24 +152,12 @@ postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem What it means: - **smtp_tls_security_level**: \ - Enforce encrypted _outgoing_ SMTP connections. + Allow encrypted _outgoing_ SMTP connections but do not enforce it. - **smtpd_tls_security_level**: \ - Enforce encrypted _incoming_ SMTP connections. -- **smtp_tls_mandatory_protocols** / **smtpd_tls_mandatory_protocols**: \ - Only allow recommended versions of [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security). Version 1.2 has been - introduced 2008. Version 1.3 is from 2018. -- **smtp_tls_mandatory_ciphers** / **smtpd_tls_mandatory_ciphers**: \ - The list of encryption algorithms that you allow for communnication. Default is _medium_. + Allow encrypted _incoming_ SMTP connections but do not enforce it. - **smtpd_tls_cert_file** and **smtpd_tls_key_file**: \ Where to find the private key and certificate for encryption. - - Please note that configuration in `main.cf` applies to all Postfix services. So the above configuration enabled encryption for both server-to-server and human-to-server (`submission`) services. The `smtpd_sasl_auth_enable` will only be set for the `submission` service to enable authentication there.[^1] @@ -219,7 +203,7 @@ EOF chown root:postfix /etc/postfix/mariadb-email2email.cf chmod u=rw,g=r,o= /etc/postfix/mariadb-email2email.cf -# Tell Postfix to use this mapping +# Tell Postfix to use thi smapping postconf smtpd_sender_login_maps=mysql:/etc/postfix/mariadb-email2email.cf ``` @@ -277,13 +261,6 @@ If you want to allow that, create a new \*.cf file with a mapping query like thi - - ## Test it ### No encryption, no authentication diff --git a/src/content/docs/ispmail-trixie/190-imap.mdx b/src/content/docs/ispmail-trixie/190-imap.mdx index daa8e90..0c03eff 100644 --- a/src/content/docs/ispmail-trixie/190-imap.mdx +++ b/src/content/docs/ispmail-trixie/190-imap.mdx @@ -1,7 +1,7 @@ --- title: IMAP lastUpdated: 2025-11-01 -slug: ispmail-trixie/imap +slug: ispmail-trxie/imap sidebar: order: 190 --- diff --git a/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx b/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx index 4fabc91..372ee84 100644 --- a/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx +++ b/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx @@ -1,7 +1,7 @@ --- title: Prevent spoofing using DKIM and SPF lastUpdated: 2025-11-01 -slug: ispmail-trixie/anti-spoofing-dkim-spf +slug: ispmail-trxie/anti-spoofing-dkim-spf sidebar: order: 310 --- @@ -311,11 +311,11 @@ You could either just send an email from your mail client (or Roundcube) through address. Or you could use swaks. Use your own addresses and password of course: ```sh title="Run this on your server" -swaks --server localhost:587 \ - --from some.address@example.org \ - --to some.external.address@example.net \ - -tls \ - --auth-user some.address@example.org \ +swaks --server localhost:587 + --from some.address@example.org + --to some.external.address@example.net + -tls + --auth-user some.address@example.org --auth-password your_secreet_password ``` diff --git a/src/content/docs/ispmail-trixie/320-catchall.mdx b/src/content/docs/ispmail-trixie/320-catchall.mdx index 035be82..1866912 100644 --- a/src/content/docs/ispmail-trixie/320-catchall.mdx +++ b/src/content/docs/ispmail-trixie/320-catchall.mdx @@ -1,7 +1,7 @@ --- title: Catch-all addresses lastUpdated: 2025-11-02 -slug: ispmail-trixie/catch-all +slug: ispmail-trxie/catch-all sidebar: order: 320 --- diff --git a/src/content/docs/ispmail-trixie/330-quotas.mdx b/src/content/docs/ispmail-trixie/330-quotas.mdx index 84f465f..d9f055b 100644 --- a/src/content/docs/ispmail-trixie/330-quotas.mdx +++ b/src/content/docs/ispmail-trixie/330-quotas.mdx @@ -1,320 +1,15 @@ --- title: Quotas lastUpdated: 2025-11-01 -slug: ispmail-trixie/quotas +slug: ispmail-trxie/quotas sidebar: order: 330 --- import { Aside } from "@astrojs/starlight/components"; - - -To use the automated installer: - -```sh -wget https://workaround.org/ispmail.sh -chmod +x ispmail.sh -./ispmail.sh -f example.org -``` - -Use your main FQDN instead of **example.org**. It will become the main host name for Roundcube, rspamd, SMTP, IMAP and -will be taken as the common name for the Let's Encrypt certificate. - -This script is something new. So please report your experience while using it down in the comments.