Merge branch 'master' into postfix_fixes

2026-03-05 15:57:23 +01:00 · 2019-01-17 12:20:16 -08:00
parent 09fb5eff42 c7659d9053
commit b827d0b21d
49 changed files with 516 additions and 1394 deletions
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -7,7 +7,36 @@
 #########################################################

 if [ -z "$TAG" ]; then
-	TAG=v0.29
+	# If a version to install isn't explicitly given as an environment
+	# variable, then install the latest version. But the latest version
+	# depends on the operating system. Existing Ubuntu 14.04 users need
+	# to be able to upgrade to the latest version supporting Ubuntu 14.04,
+	# in part because an upgrade is required before jumping to Ubuntu 18.04.
+	# New users on Ubuntu 18.04 need to get the latest version number too.
+	#
+	# Also, the system status checks read this script for TAG = (without the
+	# space, but if we put it in a comment it would confuse the status checks!)
+	# to get the latest version, so the first such line must be the one that we
+	# want to display in status checks.
+	if [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' `" == "Ubuntu 18.04 LTS" ]; then
+		# This machine is running Ubuntu 18.04.
+		TAG=v0.40
+
+	elif [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/14\.04\.[0-9]/14.04/' `" == "Ubuntu 14.04 LTS" ]; then
+		# This machine is running Ubuntu 14.04.
+		echo "You are installing the last version of Mail-in-a-Box that will"
+		echo "support Ubuntu 14.04. If this is a new installation of Mail-in-a-Box,"
+		echo "stop now and switch to a machine running Ubuntu 18.04. If you are"
+		echo "upgrading an existing Mail-in-a-Box --- great. After upgrading this"
+		echo "box, please visit https://mailinabox.email for notes on how to upgrade"
+		echo "to Ubuntu 18.04."
+		echo ""
+		TAG=v0.30
+
+	else
+		echo "This script must be run on a system running Ubuntu 18.04 or Ubuntu 14.04."
+		exit
+	fi
 fi

 # Are we running as root?
--- a/setup/dkim.sh
+++ b/setup/dkim.sh
@@ -21,6 +21,11 @@ mkdir -p $STORAGE_ROOT/mail/dkim
 # Not quite sure why.
 echo "127.0.0.1" > /etc/opendkim/TrustedHosts

+# We need to at least create these files, since we reference them later.
+# Otherwise, opendkim startup will fail
+touch /etc/opendkim/KeyTable
+touch /etc/opendkim/SigningTable
+
 if grep -q "ExternalIgnoreList" /etc/opendkim.conf; then
 	true # already done #NODOC
 else
@@ -75,6 +80,9 @@ tools/editconf.py /etc/postfix/main.cf \
 	non_smtpd_milters=\$smtpd_milters \
 	milter_default_action=accept

+# We need to explicitly enable the opendmarc service, or it will not start
+hide_output systemctl enable opendmarc
+
 # Restart services.
 restart_service opendkim
 restart_service opendmarc
--- a/setup/dns.sh
+++ b/setup/dns.sh
@@ -26,6 +26,7 @@ cat > /etc/nsd/nsd.conf << EOF;
 # Do not edit. Overwritten by Mail-in-a-Box setup.
 server:
  hide-version: yes
+  logfile: "/var/log/nsd.log"

  # identify the server (CH TXT ID.SERVER entry).
  identity: ""
@@ -41,6 +42,18 @@ server:

 EOF

+# Add log rotation
+cat > /etc/logrotate.d/nsd <<EOF;
+/var/log/nsd.log {
+  weekly
+  missingok
+  rotate 12
+  compress
+  delaycompress
+  notifempty
+}
+EOF
+
 # Since we have bind9 listening on localhost for locally-generated
 # DNS queries that require a recursive nameserver, and the system
 # might have other network interfaces for e.g. tunnelling, we have
--- a/setup/firstuser.sh
+++ b/setup/firstuser.sh
@@ -4,9 +4,9 @@ if [ -z "`tools/mail.py user`" ]; then
 	# aren't any yet, it'll be empty.

 	# If we didn't ask for an email address at the start, do so now.
-	if [ -z "$EMAIL_ADDR" ]; then
+	if [ -z "${EMAIL_ADDR:-}" ]; then
 		# In an interactive shell, ask the user for an email address.
-		if [ -z "$NONINTERACTIVE" ]; then
+		if [ -z "${NONINTERACTIVE:-}" ]; then
 			input_box "Mail Account" \
 				"Let's create your first mail account.
 				\n\nWhat email address do you want?" \
@@ -47,7 +47,7 @@ if [ -z "`tools/mail.py user`" ]; then
 	fi

 	# Create the user's mail account. This will ask for a password if none was given above.
-	tools/mail.py user add $EMAIL_ADDR $EMAIL_PW
+	tools/mail.py user add $EMAIL_ADDR ${EMAIL_PW:-}

 	# Make it an admin.
 	hide_output tools/mail.py user make-admin $EMAIL_ADDR
--- a/setup/functions.sh
+++ b/setup/functions.sh
@@ -1,3 +1,9 @@
+# Turn on "strict mode." See http://redsymbol.net/articles/unofficial-bash-strict-mode/.
+# -e: exit if any command unexpectedly fails.
+# -u: exit if we have a variable typo.
+# -o pipefail: don't ignore errors in the non-last command in a pipeline 
+set -euo pipefail
+
 function hide_output {
 	# This function hides the output of a command unless the command fails
 	# and returns a non-zero exit code.
@@ -5,11 +11,14 @@ function hide_output {
 	# Get a temporary file.
 	OUTPUT=$(tempfile)

-	# Execute command, redirecting stderr/stdout to the temporary file.
+	# Execute command, redirecting stderr/stdout to the temporary file. Since we
+	# check the return code ourselves, disable 'set -e' temporarily.
+	set +e
 	$@ &> $OUTPUT
+	E=$?
+	set -e

 	# If the command failed, show the output that was captured in the temporary file.
-	E=$?
 	if [ $E != 0 ]; then
 		# Something failed.
 		echo
@@ -75,7 +84,7 @@ function get_publicip_from_web_service {
 	#
 	# Pass '4' or '6' as an argument to this function to specify
 	# what type of address to get (IPv4, IPv6).
-	curl -$1 --fail --silent --max-time 15 icanhazip.com 2>/dev/null
+	curl -$1 --fail --silent --max-time 15 icanhazip.com 2>/dev/null || /bin/true
 }

 function get_default_privateip {
@@ -131,11 +140,10 @@ function get_default_privateip {
 	fi

 	echo $address
-		
 }

 function ufw_allow {
-	if [ -z "$DISABLE_FIREWALL" ]; then
+	if [ -z "${DISABLE_FIREWALL:-}" ]; then
 		# ufw has completely unhelpful output
 		ufw allow $1 > /dev/null;
 	fi
@@ -154,10 +162,13 @@ function input_box {
 	# input_box "title" "prompt" "defaultvalue" VARIABLE
 	# The user's input will be stored in the variable VARIABLE.
 	# The exit code from dialog will be stored in VARIABLE_EXITCODE.
+	# Temporarily turn off 'set -e' because we need the dialog return code.
 	declare -n result=$4
 	declare -n result_code=$4_EXITCODE
+	set +e
 	result=$(dialog --stdout --title "$1" --inputbox "$2" 0 0 "$3")
 	result_code=$?
+	set -e
 }

 function input_menu {
@@ -167,8 +178,10 @@ function input_menu {
 	declare -n result=$4
 	declare -n result_code=$4_EXITCODE
 	local IFS=^$'\n'
+	set +e
 	result=$(dialog --stdout --title "$1" --menu "$2" 0 0 0 $3)
 	result_code=$?
+	set -e
 }

 function wget_verify {
--- a/setup/mail-dovecot.sh
+++ b/setup/mail-dovecot.sh
@@ -26,7 +26,7 @@ source /etc/mailinabox.conf # load global vars
 echo "Installing Dovecot (IMAP server)..."
 apt_install \
 	dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-sqlite sqlite3 \
-	dovecot-sieve dovecot-managesieved dovecot-lucene
+	dovecot-sieve dovecot-managesieved

 # The `dovecot-imapd`, `dovecot-pop3d`, and `dovecot-lmtpd` packages automatically
 # enable IMAP, POP and LMTP protocols.
@@ -112,17 +112,6 @@ tools/editconf.py /etc/dovecot/conf.d/20-imap.conf \
 tools/editconf.py /etc/dovecot/conf.d/20-pop3.conf \
 	pop3_uidl_format="%08Xu%08Xv"

-# Full Text Search - Enable full text search of mail using dovecot's lucene plugin,
-# which *we* package and distribute (dovecot-lucene package).
-tools/editconf.py /etc/dovecot/conf.d/10-mail.conf \
-	mail_plugins="\$mail_plugins fts fts_lucene"
-cat > /etc/dovecot/conf.d/90-plugin-fts.conf << EOF;
-plugin {
-  fts = lucene
-  fts_lucene = whitespace_chars=@.
-}
-EOF
-
 # ### LDA (LMTP)

 # Enable Dovecot's LDA service with the LMTP protocol. It will listen
--- a/setup/mail-postfix.sh
+++ b/setup/mail-postfix.sh
@@ -41,16 +41,8 @@ source /etc/mailinabox.conf # load global vars
 #   always will.
 # * `ca-certificates`: A trust store used to squelch postfix warnings about
 #   untrusted opportunistically-encrypted connections.
-#
-# postgrey is going to come in via the Mail-in-a-Box PPA, which publishes
-# a modified version of postgrey that lets senders whitelisted by dnswl.org
-# pass through without being greylisted. So please note [dnswl's license terms](https://www.dnswl.org/?page_id=9):
-# > Every user with more than 100’000 queries per day on the public nameserver
-# > infrastructure and every commercial vendor of dnswl.org data (eg through
-# > anti-spam solutions) must register with dnswl.org and purchase a subscription.
-
 echo "Installing Postfix (SMTP server)..."
-apt_install postfix postfix-pcre postgrey ca-certificates
+apt_install postfix postfix-sqlite postfix-pcre postgrey ca-certificates

 # ### Basic Settings

@@ -81,6 +73,8 @@ tools/editconf.py /etc/postfix/main.cf \

 # Enable the 'submission' port 587 smtpd server and tweak its settings.
 #
+# * Enable authentication. It's disabled globally so that it is disabled on port 25,
+#   so we need to explicitly enable it here.
 # * Do not add the OpenDMAC Authentication-Results header. That should only be added
 #   on incoming mail. Omit the OpenDMARC milter by re-setting smtpd_milters to the
 #   OpenDKIM milter only. See dkim.sh.
@@ -95,6 +89,7 @@ tools/editconf.py /etc/postfix/main.cf \
 #   emails but we turn this off by setting nested_header_checks empty.
 tools/editconf.py /etc/postfix/master.cf -s -w \
 	"submission=inet n       -       -       -       -       smtpd
+	  -o smtpd_sasl_auth_enable=yes
 	  -o syslog_name=postfix/submission
 	  -o smtpd_milters=inet:127.0.0.1:8891
 	  -o smtpd_tls_security_level=encrypt
@@ -154,7 +149,7 @@ tools/editconf.py /etc/postfix/main.cf \
 # then opportunistic TLS is used. Otherwise the server certificate must match the TLSA records
 # or else the mail bounces. TLSA also requires DNSSEC on the MX host. Postfix doesn't do DNSSEC
 # itself but assumes the system's nameserver does and reports DNSSEC status. Thus this also
-# relies on our local bind9 server being present and `smtp_dns_support_level=dnssec`.
+# relies on our local DNS server (see system.sh) and `smtp_dns_support_level=dnssec`.
 #
 # The `smtp_tls_CAfile` is superflous, but it eliminates warnings in the logs about untrusted certs,
 # which we don't care about seeing because Postfix is doing opportunistic TLS anyway. Better to encrypt,
--- a/setup/mail-users.sh
+++ b/setup/mail-users.sh
@@ -65,11 +65,15 @@ service auth {
 }
 EOF

-# And have Postfix use that service.
+# And have Postfix use that service. We *disable* it here
+# so that authentication is not permitted on port 25 (which
+# does not run DKIM on relayed mail, so outbound mail isn't
+# correct, see #830), but we enable it specifically for the
+# submission port.
 tools/editconf.py /etc/postfix/main.cf \
 	smtpd_sasl_type=dovecot \
 	smtpd_sasl_path=private/auth \
-	smtpd_sasl_auth_enable=yes
+	smtpd_sasl_auth_enable=no

 # ### Sender Validation

--- a/setup/management.sh
+++ b/setup/management.sh
@@ -24,12 +24,12 @@ done
 # S3 api used in some regions, which breaks backups to those regions.
 # See #627, #653.
 #
-# python-virtualenv is used to isolate the Python 3 packages we
+# virtualenv is used to isolate the Python 3 packages we
 # install via pip from the system-installed packages.
 #
 # certbot installs EFF's certbot which we use to
 # provision free TLS certificates.
-apt_install duplicity python-pip python-virtualenv certbot
+apt_install duplicity python-pip virtualenv certbot
 hide_output pip2 install --upgrade boto

 # Create a virtualenv for the installation of Python 3 packages
@@ -87,20 +87,15 @@ rm -f /tmp/bootstrap.zip

 # Create an init script to start the management daemon and keep it
 # running after a reboot.
-rm -f /usr/local/bin/mailinabox-daemon # old path
 cat > $inst_dir/start <<EOF;
 #!/bin/bash
 source $venv/bin/activate
 exec python `pwd`/management/daemon.py
 EOF
 chmod +x $inst_dir/start
-rm -f /etc/init.d/mailinabox
-ln -s $(pwd)/conf/management-initscript /etc/init.d/mailinabox
-hide_output update-rc.d mailinabox defaults
-
-# Remove old files we no longer use.
-rm -f /etc/cron.daily/mailinabox-backup
-rm -f /etc/cron.daily/mailinabox-statuschecks
+hide_output systemctl link conf/mailinabox.service
+hide_output systemctl daemon-reload
+hide_output systemctl enable mailinabox.service

 # Perform nightly tasks at 3am in system time: take a backup, run
 # status checks and email the administrator any changes.
--- a/setup/migrate.py
+++ b/setup/migrate.py
@@ -148,6 +148,40 @@ def migration_11(env):
 		# meh
 		pass

+def migration_12(env):
+	# Upgrading to Carddav Roundcube plugin to version 3+, it requires the carddav_*
+        # tables to be dropped.
+        # Checking that the roundcube database already exists.
+        if os.path.exists(os.path.join(env["STORAGE_ROOT"], "mail/roundcube/roundcube.sqlite")):
+            import sqlite3
+            conn = sqlite3.connect(os.path.join(env["STORAGE_ROOT"], "mail/roundcube/roundcube.sqlite"))
+            c = conn.cursor()
+            # Get a list of all the tables that begin with 'carddav_'
+            c.execute("SELECT name FROM sqlite_master WHERE type = ? AND name LIKE ?", ('table', 'carddav_%'))
+            carddav_tables = c.fetchall()
+            # If there were tables that begin with 'carddav_', drop them
+            if carddav_tables:
+                for table in carddav_tables:
+                    try:
+                        table = table[0]
+                        c = conn.cursor()
+                        dropcmd = "DROP TABLE %s" % table
+                        c.execute(dropcmd)
+                    except:
+                        print("Failed to drop table", table, e)
+            # Save.
+            conn.commit()
+            conn.close()
+
+            # Delete all sessions, requring users to login again to recreate carddav_*
+            # databases
+            conn = sqlite3.connect(os.path.join(env["STORAGE_ROOT"], "mail/roundcube/roundcube.sqlite"))
+            c = conn.cursor()
+            c.execute("delete from session;")
+            conn.commit()
+            conn.close()
+
+
 def get_current_migration():
 	ver = 0
 	while True:
--- a/setup/munin.sh
+++ b/setup/munin.sh
@@ -29,7 +29,7 @@ address 127.0.0.1

 # send alerts to the following address
 contacts admin
-contact.admin.command mail -s "Munin notification ${var:host}" administrator@$PRIMARY_HOSTNAME
+contact.admin.command mail -s "Munin notification \${var:host}" administrator@$PRIMARY_HOSTNAME
 contact.admin.always_send warning critical
 EOF

@@ -44,7 +44,7 @@ tools/editconf.py /etc/munin/munin-node.conf -s \
 	log_level=1

 # Update the activated plugins through munin's autoconfiguration.
-munin-node-configure --shell --remove-also 2>/dev/null | sh
+munin-node-configure --shell --remove-also 2>/dev/null | sh || /bin/true

 # Deactivate monitoring of NTP peers. Not sure why anyone would want to monitor a NTP peer. The addresses seem to change
 # (which is taken care of my munin-node-configure, but only when we re-run it.)
@@ -61,6 +61,14 @@ done
 # Create a 'state' directory. Not sure why we need to do this manually.
 mkdir -p /var/lib/munin-node/plugin-state/

+# Create a systemd service for munin.
+ln -sf $(pwd)/management/munin_start.sh /usr/local/lib/mailinabox/munin_start.sh
+chmod 0744 /usr/local/lib/mailinabox/munin_start.sh
+hide_output systemctl link conf/munin.service
+hide_output systemctl daemon-reload
+hide_output systemctl unmask munin.service
+hide_output systemctl enable munin.service
+
 # Restart services.
 restart_service munin
 restart_service munin-node
--- a/setup/nextcloud.sh
+++ b/setup/nextcloud.sh
@@ -9,29 +9,11 @@ source /etc/mailinabox.conf # load global vars

 echo "Installing Nextcloud (contacts/calendar)..."

-# Keep the php5 dependancies for the owncloud upgrades
-apt_install \
-	dbconfig-common \
-	php5-cli php5-sqlite php5-gd php5-imap php5-curl php-pear php-apc curl libapr1 libtool libcurl4-openssl-dev php-xml-parser \
-	php5 php5-dev php5-gd php5-fpm memcached php5-memcached
+apt-get purge -qq -y owncloud* # we used to use the package manager

-apt-get purge -qq -y owncloud*
-
-apt_install php7.0 php7.0-fpm \
-	php7.0-cli php7.0-sqlite php7.0-gd php7.0-imap php7.0-curl php-pear php-apc curl \
-        php7.0-dev php7.0-gd php7.0-xml php7.0-mbstring php7.0-zip php7.0-apcu php7.0-json php7.0-intl
-
-# Migrate <= v0.10 setups that stored the ownCloud config.php in /usr/local rather than
-# in STORAGE_ROOT. Move the file to STORAGE_ROOT.
-if [ ! -f $STORAGE_ROOT/owncloud/config.php ] \
-	&& [ -f /usr/local/lib/owncloud/config/config.php ]; then
-
-	# Move config.php and symlink back into previous location.
-	echo "Migrating owncloud/config.php to new location."
-	mv /usr/local/lib/owncloud/config/config.php $STORAGE_ROOT/owncloud/config.php \
-		&& \
-	ln -sf $STORAGE_ROOT/owncloud/config.php /usr/local/lib/owncloud/config/config.php
-fi
+apt_install php php-fpm \
+	php-cli php-sqlite3 php-gd php-imap php-curl php-pear curl \
+	php-dev php-gd php-xml php-mbstring php-zip php-apcu php-json php-intl

 InstallNextcloud() {

@@ -75,7 +57,7 @@ InstallNextcloud() {
 	# Make sure permissions are correct or the upgrade step won't run.
 	# $STORAGE_ROOT/owncloud may not yet exist, so use -f to suppress
 	# that error.
-	chown -f -R www-data.www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud
+	chown -f -R www-data.www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud || /bin/true

 	# If this isn't a new installation, immediately run the upgrade script.
 	# Then check for success (0=ok and 3=no upgrade needed, both are success).
@@ -93,157 +75,42 @@ InstallNextcloud() {
 	fi
 }

-# We only install ownCloud intermediate versions to be able to seemlesly upgrade to Nextcloud
-InstallOwncloud() {
+nextcloud_ver=13.0.6
+nextcloud_hash=33e41f476f0e2be5dc7cdb9d496673d9647aa3d6

-	version=$1
-	hash=$2
-
-	echo
-	echo "Upgrading to OwnCloud version $version"
-	echo
-
-	# Remove the current owncloud/Nextcloud
-	rm -rf /usr/local/lib/owncloud
-
-	# Download and verify
-	wget_verify https://download.owncloud.org/community/owncloud-$version.tar.bz2 $hash /tmp/owncloud.tar.bz2
-
-
-	# Extract ownCloud
-	tar xjf /tmp/owncloud.tar.bz2 -C /usr/local/lib
-	rm -f /tmp/owncloud.tar.bz2
-
-	# The two apps we actually want are not in Nextcloud core. Download the releases from
-	# their github repositories.
-	mkdir -p /usr/local/lib/owncloud/apps
-
-	wget_verify https://github.com/owncloud/contacts/releases/download/v1.4.0.0/contacts.tar.gz c1c22d29699456a45db447281682e8bc3f10e3e7 /tmp/contacts.tgz
-	tar xf /tmp/contacts.tgz -C /usr/local/lib/owncloud/apps/
-	rm /tmp/contacts.tgz
-
-	wget_verify https://github.com/nextcloud/calendar/releases/download/v1.4.0/calendar.tar.gz c84f3170efca2a99ea6254de34b0af3cb0b3a821 /tmp/calendar.tgz
-	tar xf /tmp/calendar.tgz -C /usr/local/lib/owncloud/apps/
-	rm /tmp/calendar.tgz
-
-	# Fix weird permissions.
-	chmod 750 /usr/local/lib/owncloud/{apps,config}
-
-	# Create a symlink to the config.php in STORAGE_ROOT (for upgrades we're restoring the symlink we previously
-	# put in, and in new installs we're creating a symlink and will create the actual config later).
-	ln -sf $STORAGE_ROOT/owncloud/config.php /usr/local/lib/owncloud/config/config.php
-
-	# Make sure permissions are correct or the upgrade step won't run.
-	# $STORAGE_ROOT/owncloud may not yet exist, so use -f to suppress
-	# that error.
-	chown -f -R www-data.www-data $STORAGE_ROOT/owncloud /usr/local/lib/owncloud
-
-	# If this isn't a new installation, immediately run the upgrade script.
-	# Then check for success (0=ok and 3=no upgrade needed, both are success).
-	if [ -e $STORAGE_ROOT/owncloud/owncloud.db ]; then
-		# ownCloud 8.1.1 broke upgrades. It may fail on the first attempt, but
-		# that can be OK.
-		sudo -u www-data php5 /usr/local/lib/owncloud/occ upgrade
-		if [ \( $? -ne 0 \) -a \( $? -ne 3 \) ]; then
-			echo "Trying ownCloud upgrade again to work around ownCloud upgrade bug..."
-			sudo -u www-data php5 /usr/local/lib/owncloud/occ upgrade
-			if [ \( $? -ne 0 \) -a \( $? -ne 3 \) ]; then exit 1; fi
-			sudo -u www-data php5 /usr/local/lib/owncloud/occ maintenance:mode --off
-			echo "...which seemed to work."
-		fi
-	fi
-}
-
-owncloud_ver=13.0.6
-owncloud_hash=33e41f476f0e2be5dc7cdb9d496673d9647aa3d6
-
-# Check if Nextcloud dir exist, and check if version matches owncloud_ver (if either doesn't - install/upgrade)
+# Check if Nextcloud dir exist, and check if version matches nextcloud_ver (if either doesn't - install/upgrade)
 if [ ! -d /usr/local/lib/owncloud/ ] \
-        || ! grep -q $owncloud_ver /usr/local/lib/owncloud/version.php; then
+		|| ! grep -q $nextcloud_ver /usr/local/lib/owncloud/version.php; then

 	# Stop php-fpm if running. If theyre not running (which happens on a previously failed install), dont bail.
-	service php7.0-fpm stop &> /dev/null || /bin/true
-	service php5-fpm stop &> /dev/null || /bin/true
+	service php7.2-fpm stop &> /dev/null || /bin/true

 	# Backup the existing ownCloud/Nextcloud.
 	# Create a backup directory to store the current installation and database to
 	BACKUP_DIRECTORY=$STORAGE_ROOT/owncloud-backup/`date +"%Y-%m-%d-%T"`
 	mkdir -p "$BACKUP_DIRECTORY"
 	if [ -d /usr/local/lib/owncloud/ ]; then
-		echo "upgrading ownCloud/Nextcloud to $owncloud_flavor $owncloud_ver (backing up existing installation, configuration and database to directory to $BACKUP_DIRECTORY..."
+		echo "Upgrading Nextcloud --- backing up existing installation, configuration, and database to directory to $BACKUP_DIRECTORY..."
 		cp -r /usr/local/lib/owncloud "$BACKUP_DIRECTORY/owncloud-install"
 	fi
 	if [ -e /home/user-data/owncloud/owncloud.db ]; then
 		cp /home/user-data/owncloud/owncloud.db $BACKUP_DIRECTORY
-        fi
-        if [ -e /home/user-data/owncloud/config.php ]; then
-                cp /home/user-data/owncloud/config.php $BACKUP_DIRECTORY
-        fi
+	fi
+	if [ -e /home/user-data/owncloud/config.php ]; then
+		cp /home/user-data/owncloud/config.php $BACKUP_DIRECTORY
+	fi

-	# We only need to check if we do upgrades when owncloud/Nextcloud was previously installed
+	# If ownCloud or Nextcloud was previously installed....
 	if [ -e /usr/local/lib/owncloud/version.php ]; then
-		if grep -q "OC_VersionString = '8\.1\.[0-9]" /usr/local/lib/owncloud/version.php; then
-			echo "We are running 8.1.x, upgrading to 8.2.11 first"
-			InstallOwncloud 8.2.11 e4794938fc2f15a095018ba9d6ee18b53f6f299c
+		# Database migrations from ownCloud are no longer possible because ownCloud cannot be run under
+		# PHP 7.
+		if grep -q "OC_VersionString = '[89]\." /usr/local/lib/owncloud/version.php; then
+			echo "Upgrades from Mail-in-a-Box prior to v0.26c (dated February 13, 2018) with Nextcloud < 12.0.5 (you have ownCloud 8 or 9) are not supported. Upgrade to Mail-in-a-Box version v0.28 first. Setup aborting."
+			exit 1
 		fi
-
-		# If we are upgrading from 8.2.x we should go to 9.0 first. Owncloud doesn't support skipping minor versions
-		if grep -q "OC_VersionString = '8\.2\.[0-9]" /usr/local/lib/owncloud/version.php; then
-			echo "We are running version 8.2.x, upgrading to 9.0.11 first"
-
-			# We need to disable memcached. The upgrade and install fails
-			# with memcached
-			CONFIG_TEMP=$(/bin/mktemp)
-			php <<EOF > $CONFIG_TEMP && mv $CONFIG_TEMP $STORAGE_ROOT/owncloud/config.php;
-			<?php
-				include("$STORAGE_ROOT/owncloud/config.php");
-
-				\$CONFIG['memcache.local'] = '\OC\Memcache\APCu';
-
-				echo "<?php\n\\\$CONFIG = ";
-				var_export(\$CONFIG);
-				echo ";";
-			?>
-EOF
-			chown www-data.www-data $STORAGE_ROOT/owncloud/config.php
-
-			# We can now install owncloud 9.0.11
-			InstallOwncloud 9.0.11 fc8bad8a62179089bc58c406b28997fb0329337b
-
-			# The owncloud 9 migration doesn't migrate calendars and contacts
-			# The option to migrate these are removed in 9.1
-			# So the migrations should be done when we have 9.0 installed
-			sudo -u www-data php5 /usr/local/lib/owncloud/occ dav:migrate-addressbooks
-			# The following migration has to be done for each owncloud user
-			for directory in $STORAGE_ROOT/owncloud/*@*/ ; do
-				username=$(basename "${directory}")
-				sudo -u www-data php5 /usr/local/lib/owncloud/occ dav:migrate-calendar $username
-			done
-			sudo -u www-data php5 /usr/local/lib/owncloud/occ dav:sync-birthday-calendar
-		fi
-
-		# If we are upgrading from 9.0.x we should go to 9.1 first.
-		if grep -q "OC_VersionString = '9\.0\.[0-9]" /usr/local/lib/owncloud/version.php; then
-			echo "We are running ownCloud 9.0.x, upgrading to ownCloud 9.1.7 first"
-			InstallOwncloud 9.1.7 1307d997d0b23dc42742d315b3e2f11423a9c808
-		fi
-
-		# Newer ownCloud 9.1.x versions cannot be upgraded to Nextcloud 10 and have to be
-		# upgraded to Nextcloud 11 straight away, see:
-		# https://github.com/nextcloud/server/issues/2203
-		# However, for some reason, upgrading to the latest Nextcloud 11.0.7 doesn't
-		# work either. Therefore, we're upgrading to Nextcloud 11.0.0 in the interim.
-		# This should not be a problem since we're upgrading to the latest Nextcloud 12
-		# in the next step.
-		if grep -q "OC_VersionString = '9\.1\.[0-9]" /usr/local/lib/owncloud/version.php; then
-			echo "We are running ownCloud 9.1.x, upgrading to Nextcloud 11.0.0 first"
-			InstallNextcloud 11.0.0 e8c9ebe72a4a76c047080de94743c5c11735e72e
-		fi
-
-		# If we are upgrading from 10.0.x we should go to Nextcloud 11.0 first.
-		if grep -q "OC_VersionString = '10\.0\.[0-9]" /usr/local/lib/owncloud/version.php; then
-			echo "We are running Nextcloud 10.0.x, upgrading to Nextcloud 11.0.7 first"
-			InstallNextcloud 11.0.7 f936ddcb2ae3dbb66ee4926eb8b2ebbddc3facbe
+		if grep -q "OC_VersionString = '10\." /usr/local/lib/owncloud/version.php; then
+			echo "Upgrades from Mail-in-a-Box prior to v0.26c (dated February 13, 2018) with Nextcloud < 12.0.5 (you have ownCloud 10) are not supported. Upgrade to Mail-in-a-Box version v0.28 first. Setup aborting."
+			exit 1
 		fi

 		# If we are upgrading from Nextcloud 11 we should go to Nextcloud 12 first.
@@ -253,7 +120,7 @@ EOF
 		fi
 	fi

-	InstallNextcloud $owncloud_ver $owncloud_hash
+	InstallNextcloud $nextcloud_ver $nextcloud_hash
 fi

 # ### Configuring Nextcloud
@@ -278,10 +145,10 @@ if [ ! -f $STORAGE_ROOT/owncloud/owncloud.db ]; then
  'overwritewebroot' => '/cloud',
  'overwrite.cli.url' => '/cloud',
  'user_backends' => array(
-    array(
-      'class'=>'OC_User_IMAP',
-      'arguments'=>array('{127.0.0.1:993/imap/ssl/novalidate-cert}')
-    )
+	array(
+	  'class'=>'OC_User_IMAP',
+	  'arguments'=>array('{127.0.0.1:993/imap/ssl/novalidate-cert}')
+	)
  ),
  'memcache.local' => '\OC\Memcache\APCu',
  'mail_smtpmode' => 'sendmail',
@@ -377,7 +244,7 @@ if [ \( $? -ne 0 \) -a \( $? -ne 3 \) ]; then exit 1; fi

 # Set PHP FPM values to support large file uploads
 # (semicolon is the comment character in this file, hashes produce deprecation warnings)
-tools/editconf.py /etc/php/7.0/fpm/php.ini -c ';' \
+tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \
 	upload_max_filesize=16G \
 	post_max_size=16G \
 	output_buffering=16384 \
@@ -386,7 +253,7 @@ tools/editconf.py /etc/php/7.0/fpm/php.ini -c ';' \
 	short_open_tag=On

 # Set Nextcloud recommended opcache settings
-tools/editconf.py /etc/php/7.0/cli/conf.d/10-opcache.ini -c ';' \
+tools/editconf.py /etc/php/7.2/cli/conf.d/10-opcache.ini -c ';' \
 	opcache.enable=1 \
 	opcache.enable_cli=1 \
 	opcache.interned_strings_buffer=8 \
@@ -396,12 +263,12 @@ tools/editconf.py /etc/php/7.0/cli/conf.d/10-opcache.ini -c ';' \
 	opcache.revalidate_freq=1

 # Configure the path environment for php-fpm
-tools/editconf.py /etc/php/7.0/fpm/pool.d/www.conf -c ';' \
-        env[PATH]=/usr/local/bin:/usr/bin:/bin
+tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \
+		env[PATH]=/usr/local/bin:/usr/bin:/bin

 # If apc is explicitly disabled we need to enable it
-if grep -q apc.enabled=0 /etc/php/7.0/mods-available/apcu.ini; then
-	tools/editconf.py /etc/php/7.0/mods-available/apcu.ini -c ';' \
+if grep -q apc.enabled=0 /etc/php/7.2/mods-available/apcu.ini; then
+	tools/editconf.py /etc/php/7.2/mods-available/apcu.ini -c ';' \
 		apc.enabled=1
 fi

@@ -423,4 +290,4 @@ chmod +x /etc/cron.hourly/mailinabox-owncloud
 # ```

 # Enable PHP modules and restart PHP.
-restart_service php7.0-fpm
+restart_service php7.2-fpm
--- a/setup/preflight.sh
+++ b/setup/preflight.sh
@@ -7,9 +7,9 @@ if [[ $EUID -ne 0 ]]; then
 	exit
 fi

-# Check that we are running on Ubuntu 14.04 LTS (or 14.04.xx).
-if [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/14\.04\.[0-9]/14.04/' `" != "Ubuntu 14.04 LTS" ]; then
-	echo "Mail-in-a-Box only supports being installed on Ubuntu 14.04, sorry. You are running:"
+# Check that we are running on Ubuntu 18.04 LTS (or 18.04.xx).
+if [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' `" != "Ubuntu 18.04 LTS" ]; then
+	echo "Mail-in-a-Box only supports being installed on Ubuntu 18.04, sorry. You are running:"
 	echo
 	lsb_release -d | sed 's/.*:\s*//'
 	echo
@@ -41,7 +41,7 @@ if [ $TOTAL_PHYSICAL_MEM -lt 750000 ]; then
 fi

 # Check that tempfs is mounted with exec
-MOUNTED_TMP_AS_NO_EXEC=$(grep "/tmp.*noexec" /proc/mounts)
+MOUNTED_TMP_AS_NO_EXEC=$(grep "/tmp.*noexec" /proc/mounts || /bin/true)
 if [ -n "$MOUNTED_TMP_AS_NO_EXEC" ]; then
 	echo "Mail-in-a-Box has to have exec rights on /tmp, please mount /tmp with exec"
 	exit
@@ -53,16 +53,14 @@ if [ -e ~/.wgetrc ]; then
 	exit
 fi

-# Check that we are running on x86_64 or i686, any other architecture is unsupported and
-# will fail later in the setup when we try to install the custom build lucene packages.
-#
-# Set ARM=1 to ignore this check if you have built the packages yourself. If you do this
-# you are on your own!
+# Check that we are running on x86_64 or i686 architecture, which are the only
+# ones we support / test.
 ARCHITECTURE=$(uname -m)
 if [ "$ARCHITECTURE" != "x86_64" ] && [ "$ARCHITECTURE" != "i686" ]; then
-if [ -z "$ARM" ]; then
-	echo "Mail-in-a-Box only supports x86_64 or i686 and will not work on any other architecture, like ARM."
-	echo "Your architecture is $ARCHITECTURE"
-	exit
-fi
+	echo
+	echo "WARNING:"
+	echo "Mail-in-a-Box has only been tested on x86_64 and i686 platform"
+	echo "architectures. Your architecture, $ARCHITECTURE, may not work."
+	echo "You are on your own."
+	echo
 fi
--- a/setup/questions.sh
+++ b/setup/questions.sh
@@ -1,4 +1,4 @@
-if [ -z "$NONINTERACTIVE" ]; then
+if [ -z "${NONINTERACTIVE:-}" ]; then
 	# Install 'dialog' so we can ask the user questions. The original motivation for
 	# this was being able to ask the user for input even if stdin has been redirected,
 	# e.g. if we piped a bootstrapping install script to bash to get started. In that
@@ -25,8 +25,8 @@ if [ -z "$NONINTERACTIVE" ]; then
 fi

 # The box needs a name.
-if [ -z "$PRIMARY_HOSTNAME" ]; then
-	if [ -z "$DEFAULT_PRIMARY_HOSTNAME" ]; then
+if [ -z "${PRIMARY_HOSTNAME:-}" ]; then
+	if [ -z "${DEFAULT_PRIMARY_HOSTNAME:-}" ]; then
 		# We recommend to use box.example.com as this hosts name. The
 		# domain the user possibly wants to use is example.com then.
 		# We strip the string "box." from the hostname to get the mail
@@ -86,30 +86,30 @@ fi
 # If the machine is behind a NAT, inside a VM, etc., it may not know
 # its IP address on the public network / the Internet. Ask the Internet
 # and possibly confirm with user.
-if [ -z "$PUBLIC_IP" ]; then
+if [ -z "${PUBLIC_IP:-}" ]; then
 	# Ask the Internet.
 	GUESSED_IP=$(get_publicip_from_web_service 4)

 	# On the first run, if we got an answer from the Internet then don't
 	# ask the user.
-	if [[ -z "$DEFAULT_PUBLIC_IP" && ! -z "$GUESSED_IP" ]]; then
+	if [[ -z "${DEFAULT_PUBLIC_IP:-}" && ! -z "$GUESSED_IP" ]]; then
 		PUBLIC_IP=$GUESSED_IP

 	# Otherwise on the first run at least provide a default.
-	elif [[ -z "$DEFAULT_PUBLIC_IP" ]]; then
+	elif [[ -z "${DEFAULT_PUBLIC_IP:-}" ]]; then
 		DEFAULT_PUBLIC_IP=$(get_default_privateip 4)

 	# On later runs, if the previous value matches the guessed value then
 	# don't ask the user either.
-	elif [ "$DEFAULT_PUBLIC_IP" == "$GUESSED_IP" ]; then
+	elif [ "${DEFAULT_PUBLIC_IP:-}" == "$GUESSED_IP" ]; then
 		PUBLIC_IP=$GUESSED_IP
 	fi

-	if [ -z "$PUBLIC_IP" ]; then
+	if [ -z "${PUBLIC_IP:-}" ]; then
 		input_box "Public IP Address" \
 			"Enter the public IP address of this machine, as given to you by your ISP.
 			\n\nPublic IP address:" \
-			$DEFAULT_PUBLIC_IP \
+			${DEFAULT_PUBLIC_IP:-} \
 			PUBLIC_IP

 		if [ -z "$PUBLIC_IP" ]; then
@@ -121,27 +121,27 @@ fi

 # Same for IPv6. But it's optional. Also, if it looks like the system
 # doesn't have an IPv6, don't ask for one.
-if [ -z "$PUBLIC_IPV6" ]; then
+if [ -z "${PUBLIC_IPV6:-}" ]; then
 	# Ask the Internet.
 	GUESSED_IP=$(get_publicip_from_web_service 6)
 	MATCHED=0
-	if [[ -z "$DEFAULT_PUBLIC_IPV6" && ! -z "$GUESSED_IP" ]]; then
+	if [[ -z "${DEFAULT_PUBLIC_IPV6:-}" && ! -z "$GUESSED_IP" ]]; then
 		PUBLIC_IPV6=$GUESSED_IP
-	elif [[ "$DEFAULT_PUBLIC_IPV6" == "$GUESSED_IP" ]]; then
+	elif [[ "${DEFAULT_PUBLIC_IPV6:-}" == "$GUESSED_IP" ]]; then
 		# No IPv6 entered and machine seems to have none, or what
 		# the user entered matches what the Internet tells us.
 		PUBLIC_IPV6=$GUESSED_IP
 		MATCHED=1
-	elif [[ -z "$DEFAULT_PUBLIC_IPV6" ]]; then
+	elif [[ -z "${DEFAULT_PUBLIC_IPV6:-}" ]]; then
 		DEFAULT_PUBLIC_IP=$(get_default_privateip 6)
 	fi

-	if [[ -z "$PUBLIC_IPV6" && $MATCHED == 0 ]]; then
+	if [[ -z "${PUBLIC_IPV6:-}" && $MATCHED == 0 ]]; then
 		input_box "IPv6 Address (Optional)" \
 			"Enter the public IPv6 address of this machine, as given to you by your ISP.
 			\n\nLeave blank if the machine does not have an IPv6 address.
 			\n\nPublic IPv6 address:" \
-			$DEFAULT_PUBLIC_IPV6 \
+			${DEFAULT_PUBLIC_IPV6:-} \
 			PUBLIC_IPV6

 		if [ ! $PUBLIC_IPV6_EXITCODE ]; then
@@ -154,10 +154,10 @@ fi
 # Get the IP addresses of the local network interface(s) that are connected
 # to the Internet. We need these when we want to have services bind only to
 # the public network interfaces (not loopback, not tunnel interfaces).
-if [ -z "$PRIVATE_IP" ]; then
+if [ -z "${PRIVATE_IP:-}" ]; then
 	PRIVATE_IP=$(get_default_privateip 4)
 fi
-if [ -z "$PRIVATE_IPV6" ]; then
+if [ -z "${PRIVATE_IPV6:-}" ]; then
 	PRIVATE_IPV6=$(get_default_privateip 6)
 fi
 if [[ -z "$PRIVATE_IP" && -z "$PRIVATE_IPV6" ]]; then
@@ -186,11 +186,11 @@ fi

 # Set STORAGE_USER and STORAGE_ROOT to default values (user-data and /home/user-data), unless
 # we've already got those values from a previous run.
-if [ -z "$STORAGE_USER" ]; then
-	STORAGE_USER=$([[ -z "$DEFAULT_STORAGE_USER" ]] && echo "user-data" || echo "$DEFAULT_STORAGE_USER")
+if [ -z "${STORAGE_USER:-}" ]; then
+	STORAGE_USER=$([[ -z "${DEFAULT_STORAGE_USER:-}" ]] && echo "user-data" || echo "$DEFAULT_STORAGE_USER")
 fi
-if [ -z "$STORAGE_ROOT" ]; then
-	STORAGE_ROOT=$([[ -z "$DEFAULT_STORAGE_ROOT" ]] && echo "/home/$STORAGE_USER" || echo "$DEFAULT_STORAGE_ROOT")
+if [ -z "${STORAGE_ROOT:-}" ]; then
+	STORAGE_ROOT=$([[ -z "${DEFAULT_STORAGE_ROOT:-}" ]] && echo "/home/$STORAGE_USER" || echo "$DEFAULT_STORAGE_ROOT")
 fi

 # Show the configuration, since the user may have not entered it manually.
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -4,7 +4,7 @@

 source setup/functions.sh # load our functions

-# Check system setup: Are we running as root on Ubuntu 14.04 on a
+# Check system setup: Are we running as root on Ubuntu 18.04 on a
 # machine with enough memory? Is /tmp mounted with exec.
 # If not, this shows an error and exits.
 source setup/preflight.sh
@@ -60,8 +60,8 @@ source setup/questions.sh
 # Run some network checks to make sure setup on this machine makes sense.
 # Skip on existing installs since we don't want this to block the ability to
 # upgrade, and these checks are also in the control panel status checks.
-if [ -z "$DEFAULT_PRIMARY_HOSTNAME" ]; then
-if [ -z "$SKIP_NETWORK_CHECKS" ]; then
+if [ -z "${DEFAULT_PRIMARY_HOSTNAME:-}" ]; then
+if [ -z "${SKIP_NETWORK_CHECKS:-}" ]; then
 	source setup/network-checks.sh
 fi
 fi
@@ -106,7 +106,7 @@ source setup/dkim.sh
 source setup/spamassassin.sh
 source setup/web.sh
 source setup/webmail.sh
-source setup/owncloud.sh
+source setup/nextcloud.sh
 source setup/zpush.sh
 source setup/management.sh
 source setup/munin.sh
--- a/setup/system.sh
+++ b/setup/system.sh
@@ -14,6 +14,13 @@ source setup/functions.sh # load our functions
 echo $PRIMARY_HOSTNAME > /etc/hostname
 hostname $PRIMARY_HOSTNAME

+# ### Fix permissions
+
+# The default Ubuntu Bionic image on Scaleway throws warnings during setup about incorrect
+# permissions (group writeable) set on the following directories.
+
+chmod g-w /etc /etc/default /usr
+
 # ### Add swap space to the system

 # If the physical memory of the system is below 2GB it is wise to create a
@@ -37,9 +44,9 @@ hostname $PRIMARY_HOSTNAME
 # for reference

 SWAP_MOUNTED=$(cat /proc/swaps | tail -n+2)
-SWAP_IN_FSTAB=$(grep "swap" /etc/fstab)
-ROOT_IS_BTRFS=$(grep "\/ .*btrfs" /proc/mounts)
-TOTAL_PHYSICAL_MEM=$(head -n 1 /proc/meminfo | awk '{print $2}')
+SWAP_IN_FSTAB=$(grep "swap" /etc/fstab || /bin/true)
+ROOT_IS_BTRFS=$(grep "\/ .*btrfs" /proc/mounts || /bin/true)
+TOTAL_PHYSICAL_MEM=$(head -n 1 /proc/meminfo | awk '{print $2}' || /bin/true)
 AVAILABLE_DISK_SPACE=$(df / --output=avail | tail -n 1)
 if
 	[ -z "$SWAP_MOUNTED" ] &&
@@ -70,7 +77,7 @@ fi

 # ### Add PPAs.

-# We install some non-standard Ubuntu packages maintained by us and other
+# We install some non-standard Ubuntu packages maintained by other
 # third-party providers. First ensure add-apt-repository is installed.

 if [ ! -f /usr/bin/add-apt-repository ]; then
@@ -79,14 +86,7 @@ if [ ! -f /usr/bin/add-apt-repository ]; then
 	apt_install software-properties-common
 fi

-# [Main-in-a-Box's own PPA](https://launchpad.net/~mail-in-a-box/+archive/ubuntu/ppa)
-# holds several .deb packages that we built on our own.
-# One is a replacement for Ubuntu's stock postgrey package that makes
-# some enhancements. The other is dovecot-lucene, a Lucene-based full
-# text search plugin for (and by) dovecot, which is not available in
-# Ubuntu currently.
-
-hide_output add-apt-repository -y ppa:mail-in-a-box/ppa
+# Install the certbot PPA.
 hide_output add-apt-repository -y ppa:certbot/certbot

 # ### Update Packages
@@ -126,23 +126,11 @@ echo Installing system packages...
 apt_install python3 python3-dev python3-pip \
 	netcat-openbsd wget curl git sudo coreutils bc \
 	haveged pollinate unzip \
-	unattended-upgrades cron ntp fail2ban
-
-# ### Add PHP7 PPA
-
-# Nextcloud requires PHP7, we will install the ppa from ubuntu php maintainer Ondřej Surý
-# The PPA is located here https://launchpad.net/%7Eondrej/+archive/ubuntu/php
-# Unattended upgrades are activated for the repository If it appears it's already
-# installed, don't do it again so we can avoid an unnecessary call to apt-get update.
-if [ ! -f /etc/apt/sources.list.d/ondrej-php-trusty.list ]; then
-hide_output add-apt-repository -y ppa:ondrej/php
-apt_add_repository_to_unattended_upgrades LP-PPA-ondrej-php:trusty
-hide_output apt-get update
-fi
+	unattended-upgrades cron ntp fail2ban rsyslog

 # ### Suppress Upgrade Prompts
-# Since Mail-in-a-Box might jump straight to 18.04 LTS, there's no need
-# to be reminded about 16.04 on every login.
+# When Ubuntu 20 comes out, we don't want users to be prompted to upgrade,
+# because we don't yet support it.
 if [ -f /etc/update-manager/release-upgrades ]; then
 	tools/editconf.py /etc/update-manager/release-upgrades Prompt=never
 	rm -f /var/lib/ubuntu-release-upgrader/release-upgrade-available
@@ -162,8 +150,8 @@ fi
 # section) and syslog (see #328). There might be other issues, and it's
 # not likely the user will want to change this, so we only ask on first
 # setup.
-if [ -z "$NONINTERACTIVE" ]; then
-	if [ ! -f /etc/timezone ] || [ ! -z $FIRST_TIME_SETUP ]; then
+if [ -z "${NONINTERACTIVE:-}" ]; then
+	if [ ! -f /etc/timezone ] || [ ! -z ${FIRST_TIME_SETUP:-} ]; then
 		# If the file is missing or this is the user's first time running
 		# Mail-in-a-Box setup, run the interactive timezone configuration
 		# tool.
@@ -189,7 +177,6 @@ fi
 # * DNSSEC signing keys (see `dns.sh`)
 # * our management server's API key (via Python's os.urandom method)
 # * Roundcube's SECRET_KEY (`webmail.sh`)
-# * ownCloud's administrator account password (`owncloud.sh`)
 #
 # Why /dev/urandom? It's the same as /dev/random, except that it doesn't wait
 # for a constant new stream of entropy. In practice, we only need a little
@@ -259,7 +246,7 @@ EOF
 # Various virtualized environments like Docker and some VPSs don't provide #NODOC
 # a kernel that supports iptables. To avoid error-like output in these cases, #NODOC
 # we skip this if the user sets DISABLE_FIREWALL=1. #NODOC
-if [ -z "$DISABLE_FIREWALL" ]; then
+if [ -z "${DISABLE_FIREWALL:-}" ]; then
 	# Install `ufw` which provides a simple firewall configuration.
 	apt_install ufw

@@ -284,45 +271,69 @@ fi #NODOC

 # ### Local DNS Service

-# Install a local DNS server, rather than using the DNS server provided by the
-# ISP's network configuration.
+# Install a local recursive DNS server --- i.e. for DNS queries made by
+# local services running on this machine.
 #
-# We do this to ensure that DNS queries
-# that *we* make (i.e. looking up other external domains) perform DNSSEC checks.
-# We could use Google's Public DNS, but we don't want to create a dependency on
-# Google per our goals of decentralization. `bind9`, as packaged for Ubuntu, has
-# DNSSEC enabled by default via "dnssec-validation auto".
+# (This is unrelated to the box's public, non-recursive DNS server that
+# answers remote queries about domain names hosted on this box. For that
+# see dns.sh.)
 #
-# So we'll be running `bind9` bound to 127.0.0.1 for locally-issued DNS queries
-# and `nsd` bound to the public ethernet interface for remote DNS queries asking
-# about our domain names. `nsd` is configured later.
+# The default systemd-resolved service provides local DNS name resolution. By default it
+# is a recursive stub nameserver, which means it simply relays requests to an
+# external nameserver, usually provided by your ISP or configured in /etc/systemd/resolved.conf.
+#
+# This won't work for us for three reasons.
+#
+# 1) We have higher security goals --- we want DNSSEC to be enforced on all
+#    DNS queries (some upstream DNS servers do, some don't).
+# 2) We will configure postfix to use DANE, which uses DNSSEC to find TLS
+#    certificates for remote servers. DNSSEC validation *must* be performed
+#    locally because we can't trust an unencrypted connection to an external
+#    DNS server.
+# 3) DNS-based mail server blacklists (RBLs) typically block large ISP
+#    DNS servers because they only provide free data to small users. Since
+#    we use RBLs to block incoming mail from blacklisted IP addresses,
+#    we have to run our own DNS server. See #1424.
+#
+# systemd-resolved has a setting to perform local DNSSEC validation on all
+# requests (in /etc/systemd/resolved.conf, set DNSSEC=yes), but because it's
+# a stub server the main part of a request still goes through an upstream
+# DNS server, which won't work for RBLs. So we really need a local recursive
+# nameserver.
+#
+# We'll install `bind9`, which as packaged for Ubuntu, has DNSSEC enabled by default via "dnssec-validation auto".
+# We'll have it be bound to 127.0.0.1 so that it does not interfere with
+# the public, recursive nameserver `nsd` bound to the public ethernet interfaces.
 #
 # About the settings:
 #
-# * RESOLVCONF=yes will have `bind9` take over /etc/resolv.conf to tell
-#   local services that DNS queries are handled on localhost.
 # * Adding -4 to OPTIONS will have `bind9` not listen on IPv6 addresses
 #   so that we're sure there's no conflict with nsd, our public domain
 #   name server, on IPV6.
 # * The listen-on directive in named.conf.options restricts `bind9` to
 #   binding to the loopback interface instead of all interfaces.
-apt_install bind9 resolvconf
+apt_install bind9
 tools/editconf.py /etc/default/bind9 \
-	RESOLVCONF=yes \
 	"OPTIONS=\"-u bind -4\""
 if ! grep -q "listen-on " /etc/bind/named.conf.options; then
 	# Add a listen-on directive if it doesn't exist inside the options block.
 	sed -i "s/^}/\n\tlisten-on { 127.0.0.1; };\n}/" /etc/bind/named.conf.options
 fi
-if [ -f /etc/resolvconf/resolv.conf.d/original ]; then
-	echo "Archiving old resolv.conf (was /etc/resolvconf/resolv.conf.d/original, now /etc/resolvconf/resolv.conf.original)." #NODOC
-	mv /etc/resolvconf/resolv.conf.d/original /etc/resolvconf/resolv.conf.original #NODOC
-fi
+
+# First we'll disable systemd-resolved's management of resolv.conf and its stub server.
+# Breaking the symlink to /run/systemd/resolve/stub-resolv.conf means
+# systemd-resolved will read it for DNS servers to use. Put in 127.0.0.1,
+# which is where bind9 will be running. Obviously don't do this before
+# installing bind9 or else apt won't be able to resolve a server to
+# download bind9 from.
+rm -f /etc/resolv.conf
+tools/editconf.py /etc/systemd/resolved.conf DNSStubListener=no
+echo "nameserver 127.0.0.1" > /etc/resolv.conf

 # Restart the DNS services.

 restart_service bind9
-restart_service resolvconf
+systemctl restart systemd-resolved

 # ### Fail2Ban Service

--- a/setup/web.sh
+++ b/setup/web.sh
@@ -19,10 +19,7 @@ fi

 echo "Installing Nginx (web server)..."

-apt_install nginx php7.0-cli php7.0-fpm
-
-# Set PHP7 as the default
-update-alternatives --set php /usr/bin/php7.0
+apt_install nginx php-cli php-fpm

 rm -f /etc/nginx/sites-enabled/default

@@ -44,19 +41,19 @@ tools/editconf.py /etc/nginx/nginx.conf -s \
 	server_names_hash_bucket_size="128;"

 # Tell PHP not to expose its version number in the X-Powered-By header.
-tools/editconf.py /etc/php/7.0/fpm/php.ini -c ';' \
+tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \
 	expose_php=Off

 # Set PHPs default charset to UTF-8, since we use it. See #367.
-tools/editconf.py /etc/php/7.0/fpm/php.ini -c ';' \
+tools/editconf.py /etc/php/7.2/fpm/php.ini -c ';' \
        default_charset="UTF-8"

 # Switch from the dynamic process manager to the ondemand manager see #1216
-tools/editconf.py /etc/php/7.0/fpm/pool.d/www.conf -c ';' \
+tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \
 	pm=ondemand

 # Bump up PHP's max_children to support more concurrent connections
-tools/editconf.py /etc/php/7.0/fpm/pool.d/www.conf -c ';' \
+tools/editconf.py /etc/php/7.2/fpm/pool.d/www.conf -c ';' \
 	pm.max_children=8

 # Other nginx settings will be configured by the management service
@@ -94,24 +91,9 @@ if [ ! -f $STORAGE_ROOT/www/default/index.html ]; then
 fi
 chown -R $STORAGE_USER $STORAGE_ROOT/www

-# We previously installed a custom init script to start the PHP FastCGI daemon. #NODOC
-# Remove it now that we're using php5-fpm. #NODOC
-if [ -L /etc/init.d/php-fastcgi ]; then
-	echo "Removing /etc/init.d/php-fastcgi, php5-cgi..." #NODOC
-	rm -f /etc/init.d/php-fastcgi #NODOC
-	hide_output update-rc.d php-fastcgi remove #NODOC
-	apt-get -y purge php5-cgi #NODOC
-fi
-
-# Remove obsoleted scripts. #NODOC
-# exchange-autodiscover is now handled by Z-Push. #NODOC
-for f in webfinger exchange-autodiscover; do #NODOC
-	rm -f /usr/local/bin/mailinabox-$f.php #NODOC
-done #NODOC
-
 # Start services.
 restart_service nginx
-restart_service php7.0-fpm
+restart_service php7.2-fpm

 # Open ports.
 ufw_allow http
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -22,25 +22,18 @@ source /etc/mailinabox.conf # load global vars
 echo "Installing Roundcube (webmail)..."
 apt_install \
 	dbconfig-common \
-	php7.0-cli php7.0-sqlite php7.0-mcrypt php7.0-intl php7.0-json php7.0-common php7.0-curl \
-	php7.0-gd php7.0-pspell tinymce libjs-jquery libjs-jquery-mousewheel libmagic1 php7.0-mbstring
-
-apt_get_quiet remove php-mail-mimedecode # no longer needed since Roundcube 1.1.3
-
-# We used to install Roundcube from Ubuntu, without triggering the dependencies #NODOC
-# on Apache and MySQL, by downloading the debs and installing them manually. #NODOC
-# Now that we're beyond that, get rid of those debs before installing from source. #NODOC
-apt-get purge -qq -y roundcube* #NODOC
+	php-cli php-sqlite3 php-intl php-json php-common php-curl \
+	php-gd php-pspell tinymce libjs-jquery libjs-jquery-mousewheel libmagic1 php-mbstring

 # Install Roundcube from source if it is not already present or if it is out of date.
 # Combine the Roundcube version number with the commit hash of plugins to track
 # whether we have the latest version of everything.
-VERSION=1.3.7
-HASH=df0e29d09aae0b7a7ae98023dcd1ae3c6be77cd0
+VERSION=1.3.8
+HASH=90c7900ccf7b2f46fe49c650d5adb9b85ee9cc22
 PERSISTENT_LOGIN_VERSION=dc5ca3d3f4415cc41edb2fde533c8a8628a94c76
 HTML5_NOTIFIER_VERSION=4b370e3cd60dabd2f428a26f45b677ad1b7118d5
-CARDDAV_VERSION=2.0.4
-CARDDAV_HASH=d93f3cfb3038a519e71c7c3212c1d16f5da609a4
+CARDDAV_VERSION=3.0.3
+CARDDAV_HASH=d1e3b0d851ffa2c6bd42bf0c04f70d0e1d0d78f8

 UPDATE_KEY=$VERSION:$PERSISTENT_LOGIN_VERSION:$HTML5_NOTIFIER_VERSION:$CARDDAV_VERSION

@@ -200,5 +193,5 @@ chown www-data:www-data $STORAGE_ROOT/mail/roundcube/roundcube.sqlite
 chmod 664 $STORAGE_ROOT/mail/roundcube/roundcube.sqlite

 # Enable PHP modules.
-phpenmod -v php7.0 mcrypt imap
-restart_service php7.0-fpm
+phpenmod -v php mcrypt imap
+restart_service php7.2-fpm
--- a/setup/zpush.sh
+++ b/setup/zpush.sh
@@ -17,9 +17,9 @@ source /etc/mailinabox.conf # load global vars

 echo "Installing Z-Push (Exchange/ActiveSync server)..."
 apt_install \
-	php7.0-soap php7.0-imap libawl-php php7.0-xsl
+	php-soap php-imap libawl-php php-xsl

-phpenmod -v php7.0 imap
+phpenmod -v php imap

 # Copy Z-Push into place.
 VERSION=2.4.4
@@ -102,7 +102,7 @@ EOF

 # Restart service.

-restart_service php7.0-fpm
+restart_service php7.2-fpm

 # Fix states after upgrade