diff --git a/Vagrantfile b/Vagrantfile index 467fb95e..b1c847d8 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -2,7 +2,7 @@ # vi: set ft=ruby : Vagrant.configure("2") do |config| - config.vm.box = "ubuntu/bionic64" + config.vm.box = "ubuntu/focal64" # Network config: Since it's a mail server, the machine must be connected # to the public web. However, we currently don't want to expose SSH since diff --git a/conf/nginx-top.conf b/conf/nginx-top.conf index 4d888366..d0889e40 100644 --- a/conf/nginx-top.conf +++ b/conf/nginx-top.conf @@ -7,6 +7,6 @@ ## your own --- please do not ask for help from us. upstream php-fpm { - server unix:/var/run/php/php7.2-fpm.sock; + server unix:/var/run/php/php7.4-fpm.sock; } diff --git a/management/backup.py b/management/backup.py index 0a8a021e..c5dcad4a 100755 --- a/management/backup.py +++ b/management/backup.py @@ -247,7 +247,7 @@ def perform_backup(full_backup): if quit: sys.exit(code) - service_command("php7.2-fpm", "stop", quit=True) + service_command("php7.4-fpm", "stop", quit=True) service_command("postfix", "stop", quit=True) service_command("dovecot", "stop", quit=True) @@ -281,7 +281,7 @@ def perform_backup(full_backup): # Start services again. service_command("dovecot", "start", quit=False) service_command("postfix", "start", quit=False) - service_command("php7.2-fpm", "start", quit=False) + service_command("php7.4-fpm", "start", quit=False) # Remove old backups. This deletes all backup data no longer needed # from more than 3 days ago. diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 90521051..f4ab3259 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -18,23 +18,23 @@ if [ -z "$TAG" ]; then # space, but if we put it in a comment it would confuse the status checks!) # to get the latest version, so the first such line must be the one that we # want to display in status checks. - if [ "$(lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' )" == "Ubuntu 18.04 LTS" ]; then - # This machine is running Ubuntu 18.04. - TAG=v0.54 + if [ "$(lsb_release -d | sed 's/.*:\s*//' | sed 's/20\.04\.[0-9]/20.04/' )" == "Ubuntu 20.04 LTS" ]; then + # This machine is running Ubuntu 20.04. + TAG=v0.55 - elif [ "$(lsb_release -d | sed 's/.*:\s*//' | sed 's/14\.04\.[0-9]/14.04/' )" == "Ubuntu 14.04 LTS" ]; then - # This machine is running Ubuntu 14.04. + elif [ "$(lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' )" == "Ubuntu 18.04 LTS" ]; then + # This machine is running Ubuntu 18.04. echo "You are installing the last version of Mail-in-a-Box that will" - echo "support Ubuntu 14.04. If this is a new installation of Mail-in-a-Box," - echo "stop now and switch to a machine running Ubuntu 18.04. If you are" + echo "support Ubuntu 18.04. If this is a new installation of Mail-in-a-Box," + echo "stop now and switch to a machine running Ubuntu 20.04. If you are" echo "upgrading an existing Mail-in-a-Box --- great. After upgrading this" echo "box, please visit https://mailinabox.email for notes on how to upgrade" - echo "to Ubuntu 18.04." + echo "to Ubuntu 20.04." echo "" - TAG=v0.30 + TAG=v0.54 else - echo "This script must be run on a system running Ubuntu 18.04 or Ubuntu 14.04." + echo "This script must be run on a system running Ubuntu 20.04 or Ubuntu 18.04." exit 1 fi fi diff --git a/setup/dns.sh b/setup/dns.sh index b64a6580..29325548 100755 --- a/setup/dns.sh +++ b/setup/dns.sh @@ -10,17 +10,13 @@ source setup/functions.sh # load our functions source /etc/mailinabox.conf # load global vars -# Install the packages. -# -# * nsd: The non-recursive nameserver that publishes our DNS records. -# * ldnsutils: Helper utilities for signing DNSSEC zones. -# * openssh-client: Provides ssh-keyscan which we use to create SSHFP records. -echo "Installing nsd (DNS server)..." -apt_install nsd ldnsutils openssh-client - # Prepare nsd's configuration. - +# We configure nsd before installation as we only want it to bind to some addresses +# and it otherwise will have port / bind conflicts with bind9 used as the local resolver mkdir -p /var/run/nsd +mkdir -p /etc/nsd +mkdir -p /etc/nsd/zones +touch /etc/nsd/zones.conf cat > /etc/nsd/nsd.conf << EOF; # Do not edit. Overwritten by Mail-in-a-Box setup. @@ -40,6 +36,15 @@ server: # See https://www.nlnetlabs.nl/projects/nsd/nsd.conf.5.html. ip-transparent: yes + # Since we have bind9 listening on localhost for locally-generated + # DNS queries that require a recursive name server, and the system + # might have other network interfaces for e.g. tunnelling, we have + # to be specific about the network interfaces that nsd binds to. + ${PRIVATE_IP:+ip-address: $PRIVATE_IP} + ${PRIVATE_IPV6:+ip-address: $PRIVATE_IPV6} + +# Zones created and edited via the management interface get written here +include: /etc/nsd/zones.conf EOF # Add log rotation @@ -54,15 +59,13 @@ cat > /etc/logrotate.d/nsd <> /etc/nsd/nsd.conf; -done - -echo "include: /etc/nsd/zones.conf" >> /etc/nsd/nsd.conf; +# Install the packages. +# +# * nsd: The non-recursive nameserver that publishes our DNS records. +# * ldnsutils: Helper utilities for signing DNSSEC zones. +# * openssh-client: Provides ssh-keyscan which we use to create SSHFP records. +echo "Installing nsd (DNS server)..." +apt_install nsd ldnsutils openssh-client # Create DNSSEC signing keys. diff --git a/setup/nextcloud.sh b/setup/nextcloud.sh index af848344..7a3868dd 100755 --- a/setup/nextcloud.sh +++ b/setup/nextcloud.sh @@ -31,8 +31,8 @@ InstallNextcloud() { echo "Upgrading to Nextcloud version $version" echo - # Download and verify - wget_verify https://download.nextcloud.com/server/releases/nextcloud-$version.zip $hash /tmp/nextcloud.zip + # Download and verify + wget_verify https://download.nextcloud.com/server/releases/nextcloud-$version.zip $hash /tmp/nextcloud.zip # Remove the current owncloud/Nextcloud rm -rf /usr/local/lib/owncloud @@ -51,8 +51,8 @@ InstallNextcloud() { rm /tmp/contacts.tgz wget_verify https://github.com/nextcloud/calendar/releases/download/v$version_calendar/calendar.tar.gz $hash_calendar /tmp/calendar.tgz - tar xf /tmp/calendar.tgz -C /usr/local/lib/owncloud/apps/ - rm /tmp/calendar.tgz + tar xf /tmp/contacts.tgz -C /usr/local/lib/owncloud/apps/ + rm /tmp/contacts.tgz # Starting with Nextcloud 15, the app user_external is no longer included in Nextcloud core, # we will install from their github repository. @@ -123,8 +123,8 @@ fi # from the version currently installed, do the install/upgrade if [ ! -d /usr/local/lib/owncloud/ ] || [[ ! ${CURRENT_NEXTCLOUD_VER} =~ ^$nextcloud_ver ]]; then - # Stop php-fpm if running. If theyre not running (which happens on a previously failed install), dont bail. - service php7.2-fpm stop &> /dev/null || /bin/true + # Stop php-fpm if running. If they are not running (which happens on a previously failed install), dont bail. + service php7.4-fpm stop &> /dev/null || /bin/true # Backup the existing ownCloud/Nextcloud. # Create a backup directory to store the current installation and database to @@ -318,7 +318,7 @@ sudo -u www-data \ # Set PHP FPM values to support large file uploads # (semicolon is the comment character in this file, hashes produce deprecation warnings) -tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \ +tools/editconf.py /etc/php/7.4/fpm/php.ini -c ';' \ upload_max_filesize=16G \ post_max_size=16G \ output_buffering=16384 \ @@ -327,7 +327,7 @@ tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \ short_open_tag=On # Set Nextcloud recommended opcache settings -tools/editconf.py /etc/php/7.2/cli/conf.d/10-opcache.ini -c ';' \ +tools/editconf.py /etc/php/7.4/cli/conf.d/10-opcache.ini -c ';' \ opcache.enable=1 \ opcache.enable_cli=1 \ opcache.interned_strings_buffer=8 \ @@ -337,8 +337,8 @@ tools/editconf.py /etc/php/7.2/cli/conf.d/10-opcache.ini -c ';' \ opcache.revalidate_freq=1 # If apc is explicitly disabled we need to enable it -if grep -q apc.enabled=0 /etc/php/7.2/mods-available/apcu.ini; then - tools/editconf.py /etc/php/7.2/mods-available/apcu.ini -c ';' \ +if grep -q apc.enabled=0 /etc/php/7.4/mods-available/apcu.ini; then + tools/editconf.py /etc/php/7.4/mods-available/apcu.ini -c ';' \ apc.enabled=1 fi @@ -363,4 +363,4 @@ rm -f /etc/cron.hourly/mailinabox-owncloud # ``` # Enable PHP modules and restart PHP. -restart_service php7.2-fpm +restart_service php7.4-fpm diff --git a/setup/preflight.sh b/setup/preflight.sh index 9d2715c5..ca39563a 100644 --- a/setup/preflight.sh +++ b/setup/preflight.sh @@ -7,11 +7,11 @@ if [[ $EUID -ne 0 ]]; then exit 1 fi -# Check that we are running on Ubuntu 18.04 LTS (or 18.04.xx). -if [ "$(lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' )" != "Ubuntu 18.04 LTS" ]; then - echo "Mail-in-a-Box only supports being installed on Ubuntu 18.04, sorry. You are running:" +# Check that we are running on Ubuntu 20.04 LTS (or 20.04.xx). +if [ "$( lsb_release --id --short )" != "Ubuntu" ] || [ "$( lsb_release --release --short )" != "20.04" ]; then + echo "Mail-in-a-Box only supports being installed on Ubuntu 20.04, sorry. You are running:" echo - lsb_release -d | sed 's/.*:\s*//' + lsb_release --description --short echo echo "We can't write scripts that run on every possible setup, sorry." exit 1 diff --git a/setup/system.sh b/setup/system.sh index ed399ba0..a3609fdf 100755 --- a/setup/system.sh +++ b/setup/system.sh @@ -90,12 +90,6 @@ fi # come from there and minimal Ubuntu installs may have it turned off. hide_output add-apt-repository -y universe -# Install the certbot PPA. -hide_output add-apt-repository -y ppa:certbot/certbot - -# Install the duplicity PPA. -hide_output add-apt-repository -y ppa:duplicity-team/duplicity-release-git - # ### Update Packages # Update system packages to make sure we have the latest upstream versions @@ -315,17 +309,18 @@ fi #NODOC # # About the settings: # -# * Adding -4 to OPTIONS will have `bind9` not listen on IPv6 addresses -# so that we're sure there's no conflict with nsd, our public domain -# name server, on IPV6. +# * Changing listen-on-v6 to `none` from `any` will stop `bind9` from listen on IPv6 addresses +# so that we're sure there's no conflict with nsd, our public domain name server, on IPV6. # * The listen-on directive in named.conf.options restricts `bind9` to # binding to the loopback interface instead of all interfaces. # * The max-recursion-queries directive increases the maximum number of iterative queries. # If more queries than specified are sent, bind9 returns SERVFAIL. After flushing the cache during system checks, # we ran into the limit thus we are increasing it from 75 (default value) to 100. apt_install bind9 -tools/editconf.py /etc/default/bind9 \ - "OPTIONS=\"-u bind -4\"" +tools/editconf.py /etc/bind/named.conf.options \ + -s -c '//' \ + ' listen-on-v6={ none; };' +# Unable to use editconfig.py here as `listen-on` should go inside the options `{}` block if ! grep -q "listen-on " /etc/bind/named.conf.options; then # Add a listen-on directive if it doesn't exist inside the options block. sed -i "s/^}/\n\tlisten-on { 127.0.0.1; };\n}/" /etc/bind/named.conf.options diff --git a/setup/web.sh b/setup/web.sh index 4433ff0d..0220950d 100755 --- a/setup/web.sh +++ b/setup/web.sh @@ -46,15 +46,15 @@ tools/editconf.py /etc/nginx/nginx.conf -s \ ssl_protocols="TLSv1.2 TLSv1.3;" # Tell PHP not to expose its version number in the X-Powered-By header. -tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \ +tools/editconf.py /etc/php/7.4/fpm/php.ini -c ';' \ expose_php=Off # Set PHPs default charset to UTF-8, since we use it. See #367. -tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \ +tools/editconf.py /etc/php/7.4/fpm/php.ini -c ';' \ default_charset="UTF-8" # Configure the path environment for php-fpm -tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ +tools/editconf.py /etc/php/7.4/fpm/pool.d/www.conf -c ';' \ env[PATH]=/usr/local/bin:/usr/bin:/bin \ # Configure php-fpm based on the amount of memory the machine has @@ -64,7 +64,7 @@ tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ TOTAL_PHYSICAL_MEM=$(head -n 1 /proc/meminfo | awk '{print $2}' || /bin/true) if [ $TOTAL_PHYSICAL_MEM -lt 1000000 ] then - tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ + tools/editconf.py /etc/php/7.4/fpm/pool.d/www.conf -c ';' \ pm=ondemand \ pm.max_children=8 \ pm.start_servers=2 \ @@ -72,7 +72,7 @@ then pm.max_spare_servers=3 elif [ $TOTAL_PHYSICAL_MEM -lt 2000000 ] then - tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ + tools/editconf.py /etc/php/7.4/fpm/pool.d/www.conf -c ';' \ pm=ondemand \ pm.max_children=16 \ pm.start_servers=4 \ @@ -80,14 +80,14 @@ then pm.max_spare_servers=6 elif [ $TOTAL_PHYSICAL_MEM -lt 3000000 ] then - tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ + tools/editconf.py /etc/php/7.4/fpm/pool.d/www.conf -c ';' \ pm=dynamic \ pm.max_children=60 \ pm.start_servers=6 \ pm.min_spare_servers=3 \ pm.max_spare_servers=9 else - tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \ + tools/editconf.py /etc/php/7.4/fpm/pool.d/www.conf -c ';' \ pm=dynamic \ pm.max_children=120 \ pm.start_servers=12 \ @@ -147,7 +147,7 @@ chown -R $STORAGE_USER $STORAGE_ROOT/www # Start services. restart_service nginx -restart_service php7.2-fpm +restart_service php7.4-fpm # Open ports. ufw_allow http diff --git a/setup/webmail.sh b/setup/webmail.sh index 55fea631..03c0637d 100755 --- a/setup/webmail.sh +++ b/setup/webmail.sh @@ -201,4 +201,4 @@ chmod 664 $STORAGE_ROOT/mail/roundcube/roundcube.sqlite # Enable PHP modules. phpenmod -v php mcrypt imap -restart_service php7.2-fpm +restart_service php7.4-fpm diff --git a/setup/zpush.sh b/setup/zpush.sh index c1c00f2a..f5afcd4c 100755 --- a/setup/zpush.sh +++ b/setup/zpush.sh @@ -102,7 +102,7 @@ EOF # Restart service. -restart_service php7.2-fpm +restart_service php7.4-fpm # Fix states after upgrade diff --git a/tools/owncloud-restore.sh b/tools/owncloud-restore.sh index 4b0ba4de..6adb52b9 100755 --- a/tools/owncloud-restore.sh +++ b/tools/owncloud-restore.sh @@ -26,7 +26,7 @@ if [ ! -f $1/config.php ]; then fi echo "Restoring backup from $1" -service php7.2-fpm stop +service php7.4-fpm stop # remove the current ownCloud/Nextcloud installation rm -rf /usr/local/lib/owncloud/ @@ -45,5 +45,5 @@ chown www-data.www-data $STORAGE_ROOT/owncloud/config.php sudo -u www-data php /usr/local/lib/owncloud/occ maintenance:mode --off -service php7.2-fpm start +service php7.4-fpm start echo "Done"