mirror of
https://github.com/mail-in-a-box/mailinabox.git
synced 2025-04-04 00:17:06 +00:00
1f0d2ddb92
This commit will: 1. Change the user account database from sqlite to OpenLDAP 2. Add policyd-spf to postfix for SPF validation 3. Add a test runner with some automated test suites Notes: User account password hashes are preserved. There is a new Roundcube contact list called "Directory" that lists the users in LDAP (MiaB users), similar to what Google Suite does. Users can still change their password in Roundcube. OpenLDAP is configured with TLS, but all remote access is blocked by firewall rules. Manual changes are required to open it for remote access (eg. "ufw allow proto tcp from <HOST> to any port ldaps"). The test runner is started by executing tests/runner.sh. Be aware that it will make changes to your system, including adding new users, domains, mailboxes, start/stop services, etc. It is highly unadvised to run it on a production system! The LDAP schema that supports mail delivery with postfix and dovecot is located in conf/postfix.schema. This file is copied verbatim from the LdapAdmin project (GPL, ldapadmin.org). Instead of including the file in git, it could be referenced by URL and downloaded by the setup script if GPL is an issue or apply for a PEN from IANA. Mangement console and other services should not appear or behave any differently than before.
112 lines
3.9 KiB
Bash
Executable File
112 lines
3.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
source setup/functions.sh
|
|
|
|
echo "Installing Mail-in-a-Box system management daemon..."
|
|
|
|
# DEPENDENCIES
|
|
|
|
# We used to install management daemon-related Python packages
|
|
# directly to /usr/local/lib. We moved to a virtualenv because
|
|
# these packages might conflict with apt-installed packages.
|
|
# We may have a lingering version of acme that conflcits with
|
|
# certbot, which we're about to install below, so remove it
|
|
# first. Once acme is installed by an apt package, this might
|
|
# break the package version and `apt-get install --reinstall python3-acme`
|
|
# might be needed in that case.
|
|
while [ -d /usr/local/lib/python3.4/dist-packages/acme ]; do
|
|
pip3 uninstall -y acme;
|
|
done
|
|
|
|
# duplicity is used to make backups of user data. It uses boto
|
|
# (via Python 2) to do backups to AWS S3. boto from the Ubuntu
|
|
# package manager is too out-of-date -- it doesn't support the newer
|
|
# S3 api used in some regions, which breaks backups to those regions.
|
|
# See #627, #653.
|
|
#
|
|
# virtualenv is used to isolate the Python 3 packages we
|
|
# install via pip from the system-installed packages.
|
|
#
|
|
# certbot installs EFF's certbot which we use to
|
|
# provision free TLS certificates.
|
|
apt_install duplicity python-pip virtualenv certbot
|
|
hide_output pip2 install --upgrade boto
|
|
|
|
# Create a virtualenv for the installation of Python 3 packages
|
|
# used by the management daemon.
|
|
inst_dir=/usr/local/lib/mailinabox
|
|
mkdir -p $inst_dir
|
|
venv=$inst_dir/env
|
|
if [ ! -d $venv ]; then
|
|
hide_output virtualenv -ppython3 $venv
|
|
fi
|
|
|
|
# Upgrade pip because the Ubuntu-packaged version is out of date.
|
|
hide_output $venv/bin/pip install --upgrade pip
|
|
|
|
# Install other Python 3 packages used by the management daemon.
|
|
# The first line is the packages that Josh maintains himself!
|
|
# NOTE: email_validator is repeated in setup/questions.sh, so please keep the versions synced.
|
|
hide_output $venv/bin/pip install --upgrade \
|
|
rtyaml "email_validator>=1.0.0" "exclusiveprocess" \
|
|
flask dnspython python-dateutil \
|
|
"idna>=2.0.0" "cryptography==2.2.2" boto psutil ldap3
|
|
|
|
# CONFIGURATION
|
|
|
|
# Create a backup directory and a random key for encrypting backups.
|
|
mkdir -p $STORAGE_ROOT/backup
|
|
if [ ! -f $STORAGE_ROOT/backup/secret_key.txt ]; then
|
|
$(umask 077; openssl rand -base64 2048 > $STORAGE_ROOT/backup/secret_key.txt)
|
|
fi
|
|
|
|
|
|
# Download jQuery and Bootstrap local files
|
|
|
|
# Make sure we have the directory to save to.
|
|
assets_dir=$inst_dir/vendor/assets
|
|
rm -rf $assets_dir
|
|
mkdir -p $assets_dir
|
|
|
|
# jQuery CDN URL
|
|
jquery_version=2.1.4
|
|
jquery_url=https://code.jquery.com
|
|
|
|
# Get jQuery
|
|
wget_verify $jquery_url/jquery-$jquery_version.min.js 43dc554608df885a59ddeece1598c6ace434d747 $assets_dir/jquery.min.js
|
|
|
|
# Bootstrap CDN URL
|
|
bootstrap_version=3.3.7
|
|
bootstrap_url=https://github.com/twbs/bootstrap/releases/download/v$bootstrap_version/bootstrap-$bootstrap_version-dist.zip
|
|
|
|
# Get Bootstrap
|
|
wget_verify $bootstrap_url e6b1000b94e835ffd37f4c6dcbdad43f4b48a02a /tmp/bootstrap.zip
|
|
unzip -q /tmp/bootstrap.zip -d $assets_dir
|
|
mv $assets_dir/bootstrap-$bootstrap_version-dist $assets_dir/bootstrap
|
|
rm -f /tmp/bootstrap.zip
|
|
|
|
# Create an init script to start the management daemon and keep it
|
|
# running after a reboot.
|
|
cat > $inst_dir/start <<EOF;
|
|
#!/bin/bash
|
|
source $venv/bin/activate
|
|
exec python `pwd`/management/daemon.py
|
|
EOF
|
|
chmod +x $inst_dir/start
|
|
cp --remove-destination conf/mailinabox.service /lib/systemd/system/mailinabox.service # target was previously a symlink so remove it first
|
|
hide_output systemctl link -f /lib/systemd/system/mailinabox.service
|
|
hide_output systemctl daemon-reload
|
|
hide_output systemctl enable mailinabox.service
|
|
|
|
# Perform nightly tasks at 3am in system time: take a backup, run
|
|
# status checks and email the administrator any changes.
|
|
|
|
cat > /etc/cron.d/mailinabox-nightly << EOF;
|
|
# Mail-in-a-Box --- Do not edit / will be overwritten on update.
|
|
# Run nightly tasks: backup, status checks.
|
|
0 3 * * * root (cd `pwd` && management/daily_tasks.sh)
|
|
EOF
|
|
|
|
# Start the management server.
|
|
restart_service mailinabox
|