freedombone-app-mailpile 16KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # mailpile app
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2016 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. VARIANTS="full full-vim mailbox"
  31. IN_DEFAULT_INSTALL=0
  32. SHOW_ON_ABOUT=1
  33. MAILPILE_DOMAIN_NAME=
  34. MAILPILE_CODE=
  35. MAILPILE_ONION_PORT=8103
  36. MAILPILE_REPO="https://github.com/mailpile/Mailpile"
  37. MAILPILE_COMMIT='6f56fe4ad736c8e385bea658454bed110d08c60d'
  38. MAILPILE_PORT=33411
  39. mailpile_variables=(MAILPILE_REPO
  40. MAILPILE_DOMAIN_NAME
  41. MAILPILE_CODE
  42. ONION_ONLY
  43. DDNS_PROVIDER
  44. MY_USERNAME)
  45. function logging_on_mailpile {
  46. echo -n ''
  47. }
  48. function logging_off_mailpile {
  49. echo -n ''
  50. }
  51. function remove_user_mailpile {
  52. remove_username="$1"
  53. ${PROJECT_NAME}-pass -u $remove_username --rmapp mailpile
  54. }
  55. function add_user_mailpile {
  56. ${PROJECT_NAME}-pass -u $1 -a mailpile -p "$2"
  57. }
  58. function install_interactive_mailpile {
  59. if [ ! $ONION_ONLY ]; then
  60. ONION_ONLY='no'
  61. fi
  62. if [[ $ONION_ONLY != "no" ]]; then
  63. MAILPILE_DOMAIN_NAME='mailpile.local'
  64. write_config_param "MAILPILE_DOMAIN_NAME" "$MAILPILE_DOMAIN_NAME"
  65. else
  66. function_check interactive_site_details
  67. interactive_site_details "mailpile" "MAILPILE_DOMAIN_NAME" "MAILPILE_CODE"
  68. fi
  69. APP_INSTALLED=1
  70. }
  71. function change_password_mailpile {
  72. echo -n ''
  73. #${PROJECT_NAME}-pass -u $1 -a mailpile -p "$2"
  74. }
  75. function reconfigure_mailpile {
  76. echo -n ''
  77. }
  78. function upgrade_mailpile {
  79. read_config_param "MAILPILE_DOMAIN_NAME"
  80. CURR_COMMIT=$MAILPILE_COMMIT
  81. if grep -q "mailpile commit" $COMPLETION_FILE; then
  82. CURR_COMMIT=$(get_completion_param "mailpile commit")
  83. fi
  84. if [[ "$CURR_COMMIT" == "$MAILPILE_COMMIT" ]]; then
  85. return
  86. fi
  87. function_check set_repo_commit
  88. set_repo_commit /var/www/$MAILPILE_DOMAIN_NAME/mail "mailpile commit" "$MAILPILE_COMMIT" $MAILPILE_REPO
  89. cd /var/www/$MAILPILE_DOMAIN_NAME/mail
  90. pip install -r requirements.txt
  91. chown -R mailpile:mailpile /var/www/$MAILPILE_DOMAIN_NAME/mail
  92. }
  93. function backup_local_mailpile {
  94. if [ ! -f /etc/systemd/system/mailpile.service ]; then
  95. return
  96. fi
  97. MAILPILE_DOMAIN_NAME='mailpile.local'
  98. if grep -q "mailpile domain" $COMPLETION_FILE; then
  99. MAILPILE_DOMAIN_NAME=$(get_completion_param "mailpile domain")
  100. fi
  101. source_directory=/var/www/${MAILPILE_DOMAIN_NAME}/mail/.local
  102. if [ -d $source_directory ]; then
  103. systemctl stop mailpile
  104. function_check backup_directory_to_usb
  105. backup_directory_to_usb $source_directory mailpile
  106. systemctl start mailpile
  107. fi
  108. }
  109. function restore_local_mailpile {
  110. if [ ! -f /etc/systemd/system/mailpile.service ]; then
  111. return
  112. fi
  113. MAILPILE_DOMAIN_NAME='mailpile.local'
  114. if grep -q "mailpile domain" $COMPLETION_FILE; then
  115. MAILPILE_DOMAIN_NAME=$(get_completion_param "mailpile domain")
  116. fi
  117. if [ $MAILPILE_DOMAIN_NAME ]; then
  118. systemctl stop mailpile
  119. temp_restore_dir=/root/tempmailpile
  120. restore_directory_from_usb $temp_restore_dir mailpile
  121. if [ -d /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local ]; then
  122. mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous
  123. fi
  124. temp_source_dir=$(find ${temp_restore_dir} -name ".local")
  125. cp -r ${temp_source_dir} /var/www/${MAILPILE_DOMAIN_NAME}/mail/
  126. if [ ! "$?" = "0" ]; then
  127. if [ -d mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous ]; then
  128. if [ -d /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous ]; then
  129. rm -rf /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous
  130. fi
  131. mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local
  132. fi
  133. backup_unmount_drive
  134. exit 3685
  135. fi
  136. rm -rf ${temp_restore_dir}
  137. chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/
  138. if [ -d /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME} ]; then
  139. ln -s /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME}/privkey.pem /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key
  140. ln -s /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME}/fullchain.pem /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem
  141. fi
  142. systemctl start mailpile
  143. fi
  144. }
  145. function backup_remote_mailpile {
  146. if [ ! -f /etc/systemd/system/mailpile.service ]; then
  147. return
  148. fi
  149. MAILPILE_DOMAIN_NAME='mailpile.local'
  150. if grep -q "mailpile domain" $COMPLETION_FILE; then
  151. MAILPILE_DOMAIN_NAME=$(get_completion_param "mailpile domain")
  152. fi
  153. source_directory=/var/www/${MAILPILE_DOMAIN_NAME}/mail/.local
  154. if [ -d $source_directory ]; then
  155. systemctl stop mailpile
  156. function_check backup_directory_to_usb
  157. backup_directory_to_friend $source_directory mailpile
  158. systemctl start mailpile
  159. fi
  160. }
  161. function restore_remote_mailpile {
  162. if [ ! -f /etc/systemd/system/mailpile.service ]; then
  163. return
  164. fi
  165. MAILPILE_DOMAIN_NAME='mailpile.local'
  166. if grep -q "mailpile domain" $COMPLETION_FILE; then
  167. MAILPILE_DOMAIN_NAME=$(get_completion_param "mailpile domain")
  168. fi
  169. if [ $MAILPILE_DOMAIN_NAME ]; then
  170. systemctl stop mailpile
  171. temp_restore_dir=/root/tempmailpile
  172. restore_directory_from_friend $temp_restore_dir mailpile
  173. if [ -d /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local ]; then
  174. mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous
  175. fi
  176. temp_source_dir=$(find ${temp_restore_dir} -name ".local")
  177. cp -r ${temp_source_dir} /var/www/${MAILPILE_DOMAIN_NAME}/mail/
  178. if [ ! "$?" = "0" ]; then
  179. if [ -d mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous ]; then
  180. mv /var/www/${MAILPILE_DOMAIN_NAME}/mail/.previous /var/www/${MAILPILE_DOMAIN_NAME}/mail/.local
  181. fi
  182. backup_unmount_drive
  183. exit 36732
  184. fi
  185. rm -rf ${temp_restore_dir}
  186. chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/
  187. if [ -d /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME} ]; then
  188. ln -s /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME}/privkey.pem /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key
  189. ln -s /etc/letsencrypt/live/${MAILPILE_DOMAIN_NAME}/fullchain.pem /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem
  190. fi
  191. systemctl start mailpile
  192. fi
  193. }
  194. function remove_mailpile {
  195. if [ ${#MAILPILE_DOMAIN_NAME} -eq 0 ]; then
  196. return
  197. fi
  198. systemctl stop mailpile
  199. systemctl disable mailpile
  200. rm /etc/systemd/system/mailpile.service
  201. systemctl daemon-reload
  202. read_config_param "MAILPILE_DOMAIN_NAME"
  203. nginx_dissite $MAILPILE_DOMAIN_NAME
  204. remove_certs ${MAILPILE_DOMAIN_NAME}
  205. if [ -f /etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME ]; then
  206. rm -f /etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME
  207. fi
  208. if [ -d /var/www/$MAILPILE_DOMAIN_NAME ]; then
  209. rm -rf /var/www/$MAILPILE_DOMAIN_NAME
  210. fi
  211. function_check remove_ddns_domain
  212. remove_ddns_domain $MAILPILE_DOMAIN_NAME
  213. groupdel -f mailpile
  214. userdel -r mailpile
  215. remove_config_param MAILPILE_DOMAIN_NAME
  216. remove_config_param MAILPILE_CODE
  217. function_check remove_onion_service
  218. remove_onion_service mailpile ${MAILPILE_ONION_PORT}
  219. remove_completion_param "install_mailpile"
  220. enable_email_encryption_at_rest
  221. sed -i '/Mailpile/d' $COMPLETION_FILE
  222. sed -i '/mailpile/d' $COMPLETION_FILE
  223. }
  224. function install_mailpile {
  225. if [ ! $ONION_ONLY ]; then
  226. ONION_ONLY='no'
  227. fi
  228. if [ ! $MAILPILE_DOMAIN_NAME ]; then
  229. echo $'The mailpile domain name was not specified'
  230. exit 63824
  231. fi
  232. apt-get -yq install python-pip python-lxml python-dev libjpeg-dev
  233. if [ ! -d /var/www/$MAILPILE_DOMAIN_NAME ]; then
  234. mkdir /var/www/$MAILPILE_DOMAIN_NAME
  235. fi
  236. cd /var/www/$MAILPILE_DOMAIN_NAME
  237. if [ -d /var/www/$MAILPILE_DOMAIN_NAME/mail ]; then
  238. rm -rf /var/www/$MAILPILE_DOMAIN_NAME/mail
  239. fi
  240. if [ -d /repos/mailpile ]; then
  241. mkdir mail
  242. cp -r -p /repos/mailpile/. mail
  243. cd mail
  244. git pull
  245. else
  246. git_clone $MAILPILE_REPO mail
  247. fi
  248. cd mail
  249. git checkout $MAILPILE_COMMIT -b $MAILPILE_COMMIT
  250. set_completion_param "mailpile commit" "$MAILPILE_COMMIT"
  251. if [ ! -f requirements-dev.txt ]; then
  252. echo $'No python requirements file found'
  253. exit 62382
  254. fi
  255. pip install -r requirements.txt
  256. adduser --system --home=/var/www/$MAILPILE_DOMAIN_NAME/mail/ --group mailpile
  257. adduser mailpile debian-tor
  258. adduser mailpile www-data
  259. adduser mailpile mail
  260. adduser mailpile $MY_USERNAME
  261. chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/
  262. # create folders and tags
  263. su -c "cd /var/www/$MAILPILE_DOMAIN_NAME/mail && ./mp --setup" - mailpile
  264. MAILPILE_ONION_HOSTNAME=$(add_onion_service mailpile 80 ${MAILPILE_ONION_PORT})
  265. echo '[Unit]' > /etc/systemd/system/mailpile.service
  266. echo 'Description=Mailpile Email Client' >> /etc/systemd/system/mailpile.service
  267. echo 'After=syslog.target network.target nginx.target' >> /etc/systemd/system/mailpile.service
  268. echo '' >> /etc/systemd/system/mailpile.service
  269. echo '[Service]' >> /etc/systemd/system/mailpile.service
  270. echo 'User=mailpile' >> /etc/systemd/system/mailpile.service
  271. echo 'Group=mailpile' >> /etc/systemd/system/mailpile.service
  272. echo "WorkingDirectory=/var/www/$MAILPILE_DOMAIN_NAME/mail" >> /etc/systemd/system/mailpile.service
  273. echo "ExecStart=/var/www/$MAILPILE_DOMAIN_NAME/mail/mp --www=0.0.0.0:${MAILPILE_PORT} --wait" >> /etc/systemd/system/mailpile.service
  274. echo 'Restart=always' >> /etc/systemd/system/mailpile.service
  275. echo 'RestartSec=10' >> /etc/systemd/system/mailpile.service
  276. echo '' >> /etc/systemd/system/mailpile.service
  277. echo '[Install]' >> /etc/systemd/system/mailpile.service
  278. echo 'WantedBy=multi-user.target' >> /etc/systemd/system/mailpile.service
  279. chmod +x /etc/systemd/system/mailpile.service
  280. mailpile_nginx_site=/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME
  281. if [[ $ONION_ONLY == "no" ]]; then
  282. function_check nginx_http_redirect
  283. nginx_http_redirect $MAILPILE_DOMAIN_NAME
  284. echo 'server {' >> $mailpile_nginx_site
  285. echo ' listen 443 ssl;' >> $mailpile_nginx_site
  286. echo ' listen [::]:443 ssl;' >> $mailpile_nginx_site
  287. echo " server_name $MAILPILE_DOMAIN_NAME;" >> $mailpile_nginx_site
  288. echo '' >> $mailpile_nginx_site
  289. echo ' # Security' >> $mailpile_nginx_site
  290. function_check nginx_ssl
  291. nginx_ssl $MAILPILE_DOMAIN_NAME
  292. function_check nginx_disable_sniffing
  293. nginx_disable_sniffing $MAILPILE_DOMAIN_NAME
  294. echo ' add_header Strict-Transport-Security max-age=15768000;' >> $mailpile_nginx_site
  295. echo '' >> $mailpile_nginx_site
  296. echo ' # Logs' >> $mailpile_nginx_site
  297. echo ' access_log /dev/null;' >> $mailpile_nginx_site
  298. echo ' error_log /dev/null;' >> $mailpile_nginx_site
  299. echo '' >> $mailpile_nginx_site
  300. echo ' # Root' >> $mailpile_nginx_site
  301. echo " root /var/www/$MAILPILE_DOMAIN_NAME/mail;" >> $mailpile_nginx_site
  302. echo '' >> $mailpile_nginx_site
  303. echo ' location / {' >> $mailpile_nginx_site
  304. function_check nginx_limits
  305. nginx_limits $MAILPILE_DOMAIN_NAME '15m'
  306. echo ' rewrite /(.*) /$1 break;' >> $mailpile_nginx_site
  307. echo ' proxy_set_header X-Real-IP $remote_addr;' >> $mailpile_nginx_site
  308. echo ' proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;' >> $mailpile_nginx_site
  309. echo ' proxy_set_header Host $http_host;' >> $mailpile_nginx_site
  310. echo ' proxy_set_header X-NginX-Proxy true;' >> $mailpile_nginx_site
  311. echo " proxy_pass http://localhost:${MAILPILE_PORT};" >> $mailpile_nginx_site
  312. echo ' proxy_redirect off;' >> $mailpile_nginx_site
  313. echo ' }' >> $mailpile_nginx_site
  314. echo '' >> $mailpile_nginx_site
  315. nginx_keybase ${MAILPILE_DOMAIN_NAME}
  316. echo '}' >> $mailpile_nginx_site
  317. echo '' >> $mailpile_nginx_site
  318. else
  319. echo -n '' > $mailpile_nginx_site
  320. fi
  321. echo 'server {' >> $mailpile_nginx_site
  322. echo " listen 127.0.0.1:$MAILPILE_ONION_PORT default_server;" >> $mailpile_nginx_site
  323. echo " server_name $MAILPILE_ONION_HOSTNAME;" >> $mailpile_nginx_site
  324. echo '' >> $mailpile_nginx_site
  325. function_check nginx_disable_sniffing
  326. nginx_disable_sniffing $MAILPILE_DOMAIN_NAME
  327. echo '' >> $mailpile_nginx_site
  328. echo ' # Logs' >> $mailpile_nginx_site
  329. echo ' access_log /dev/null;' >> $mailpile_nginx_site
  330. echo ' error_log /dev/null;' >> $mailpile_nginx_site
  331. echo '' >> $mailpile_nginx_site
  332. echo ' # Root' >> $mailpile_nginx_site
  333. echo " root /var/www/$MAILPILE_DOMAIN_NAME/mail;" >> $mailpile_nginx_site
  334. echo '' >> $mailpile_nginx_site
  335. echo ' location / {' >> $mailpile_nginx_site
  336. function_check nginx_limits
  337. nginx_limits $MAILPILE_DOMAIN_NAME '15m'
  338. echo ' rewrite /(.*) /$1 break;' >> $mailpile_nginx_site
  339. echo ' proxy_set_header X-Real-IP $remote_addr;' >> $mailpile_nginx_site
  340. echo ' proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;' >> $mailpile_nginx_site
  341. echo ' proxy_set_header Host $http_host;' >> $mailpile_nginx_site
  342. echo ' proxy_set_header X-NginX-Proxy true;' >> $mailpile_nginx_site
  343. echo " proxy_pass http://localhost:${MAILPILE_PORT};" >> $mailpile_nginx_site
  344. echo ' proxy_redirect off;' >> $mailpile_nginx_site
  345. echo ' }' >> $mailpile_nginx_site
  346. echo '' >> $mailpile_nginx_site
  347. nginx_keybase ${MAILPILE_DOMAIN_NAME}
  348. echo '}' >> $mailpile_nginx_site
  349. function_check create_site_certificate
  350. if [ ! -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem ]; then
  351. create_site_certificate $MAILPILE_DOMAIN_NAME 'yes'
  352. fi
  353. if [ -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.crt ]; then
  354. mv /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.crt /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem
  355. fi
  356. if [ -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem ]; then
  357. chown root:root /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem
  358. sed -i "s|.crt|.pem|g" /etc/nginx/sites-available/${MAILPILE_DOMAIN_NAME}
  359. fi
  360. if [ -f /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key ]; then
  361. chown root:root /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key
  362. fi
  363. function_check nginx_ensite
  364. nginx_ensite $MAILPILE_DOMAIN_NAME
  365. ${PROJECT_NAME}-pass -u $MY_USERNAME -a mailpile -p "*"
  366. function_check add_ddns_domain
  367. add_ddns_domain $MAILPILE_DOMAIN_NAME
  368. disable_email_encryption_at_rest
  369. # if strict https is enforced then buttons don't work. This is probably a security bug
  370. sed -i "/Content-Security-Policy/d" $mailpile_nginx_site
  371. # link to the administrator's keyring
  372. if [ -d /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg ]; then
  373. mv /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg_orig
  374. fi
  375. cp -r /home/$MY_USERNAME/.gnupg /var/www/$MAILPILE_DOMAIN_NAME/mail/
  376. chown -R mailpile:mailpile /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg
  377. chmod +x /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg
  378. pip install jinja2==2.9.6
  379. pip install pgpdump==1.5
  380. systemctl enable mailpile
  381. systemctl daemon-reload
  382. systemctl start mailpile
  383. systemctl restart nginx
  384. set_completion_param "mailpile domain" "$MAILPILE_DOMAIN_NAME"
  385. APP_INSTALLED=1
  386. }
  387. # NOTE: deliberately no exit 0