freedombone-app-mailpile 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377
  1. #!/bin/bash
  2. # _____ _ _
  3. # | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
  4. # | __| _| -_| -_| . | . | | . | . | | -_|
  5. # |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___|
  6. #
  7. # Freedom in the Cloud
  8. #
  9. # mailpile app
  10. #
  11. # License
  12. # =======
  13. #
  14. # Copyright (C) 2016-2018 Bob Mottram <bob@freedombone.net>
  15. #
  16. # This program is free software: you can redistribute it and/or modify
  17. # it under the terms of the GNU Affero General Public License as published by
  18. # the Free Software Foundation, either version 3 of the License, or
  19. # (at your option) any later version.
  20. #
  21. # This program is distributed in the hope that it will be useful,
  22. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  23. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  24. # GNU Affero General Public License for more details.
  25. #
  26. # You should have received a copy of the GNU Affero General Public License
  27. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  28. VARIANTS="full full-vim mailbox"
  29. IN_DEFAULT_INSTALL=0
  30. SHOW_ON_ABOUT=1
  31. MAILPILE_DOMAIN_NAME=
  32. MAILPILE_CODE=
  33. MAILPILE_ONION_PORT=8103
  34. MAILPILE_REPO="https://github.com/mailpile/Mailpile"
  35. MAILPILE_COMMIT='4f28f1bb55b3b9985f22ab6372d539b1087482dd'
  36. MAILPILE_PORT=33411
  37. MAILPILE_SHORT_DESCRIPTION=$'Email system'
  38. MAILPILE_DESCRIPTION=$'Email system'
  39. MAILPILE_MOBILE_APP_URL=
  40. mailpile_variables=(MAILPILE_REPO
  41. MAILPILE_DOMAIN_NAME
  42. MAILPILE_CODE
  43. ONION_ONLY
  44. DDNS_PROVIDER
  45. DEFAULT_DOMAIN_NAME
  46. MY_USERNAME)
  47. function logging_on_mailpile {
  48. echo -n ''
  49. }
  50. function logging_off_mailpile {
  51. echo -n ''
  52. }
  53. function remove_user_mailpile {
  54. remove_username="$1"
  55. "${PROJECT_NAME}-pass" -u "$remove_username" --rmapp mailpile
  56. }
  57. function add_user_mailpile {
  58. "${PROJECT_NAME}-pass" -u "$1" -a mailpile -p "$2"
  59. }
  60. function install_interactive_mailpile {
  61. if [ ! "$ONION_ONLY" ]; then
  62. ONION_ONLY='no'
  63. fi
  64. if [[ $ONION_ONLY != "no" ]]; then
  65. MAILPILE_DOMAIN_NAME='mailpile.local'
  66. write_config_param "MAILPILE_DOMAIN_NAME" "$MAILPILE_DOMAIN_NAME"
  67. else
  68. function_check interactive_site_details
  69. interactive_site_details "mailpile" "MAILPILE_DOMAIN_NAME" "MAILPILE_CODE"
  70. fi
  71. APP_INSTALLED=1
  72. }
  73. function change_password_mailpile {
  74. echo -n ''
  75. #${PROJECT_NAME}-pass -u $1 -a mailpile -p "$2"
  76. }
  77. function reconfigure_mailpile {
  78. echo -n ''
  79. }
  80. function upgrade_mailpile {
  81. read_config_param "MAILPILE_DOMAIN_NAME"
  82. CURR_COMMIT=$MAILPILE_COMMIT
  83. if grep -q "mailpile commit" "$COMPLETION_FILE"; then
  84. CURR_COMMIT=$(get_completion_param "mailpile commit")
  85. fi
  86. if [[ "$CURR_COMMIT" == "$MAILPILE_COMMIT" ]]; then
  87. return
  88. fi
  89. function_check set_repo_commit
  90. set_repo_commit /var/www/$MAILPILE_DOMAIN_NAME/mail "mailpile commit" "$MAILPILE_COMMIT" $MAILPILE_REPO
  91. cd "/var/www/$MAILPILE_DOMAIN_NAME/mail" || exit 2346836535
  92. pip install -r requirements.txt
  93. chown -R mailpile:mailpile "/var/www/$MAILPILE_DOMAIN_NAME/mail"
  94. systemctl restart mailpile
  95. }
  96. function backup_local_mailpile {
  97. echo -n ''
  98. }
  99. function restore_local_mailpile {
  100. echo -n ''
  101. }
  102. function backup_remote_mailpile {
  103. echo -n ''
  104. }
  105. function restore_remote_mailpile {
  106. echo -n ''
  107. }
  108. function remove_mailpile {
  109. if [ ${#MAILPILE_DOMAIN_NAME} -eq 0 ]; then
  110. return
  111. fi
  112. systemctl stop mailpile
  113. systemctl disable mailpile
  114. rm /etc/systemd/system/mailpile.service
  115. systemctl daemon-reload
  116. read_config_param "MAILPILE_DOMAIN_NAME"
  117. nginx_dissite "$MAILPILE_DOMAIN_NAME"
  118. remove_certs "${MAILPILE_DOMAIN_NAME}"
  119. if [ -f "/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME" ]; then
  120. rm -f "/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME"
  121. fi
  122. if [ -d "/var/www/$MAILPILE_DOMAIN_NAME" ]; then
  123. rm -rf "/var/www/$MAILPILE_DOMAIN_NAME"
  124. fi
  125. function_check remove_ddns_domain
  126. remove_ddns_domain "$MAILPILE_DOMAIN_NAME"
  127. groupdel -f mailpile
  128. userdel -r mailpile
  129. remove_config_param MAILPILE_DOMAIN_NAME
  130. remove_config_param MAILPILE_CODE
  131. function_check remove_onion_service
  132. remove_onion_service mailpile ${MAILPILE_ONION_PORT}
  133. remove_completion_param "install_mailpile"
  134. enable_email_encryption_at_rest
  135. sed -i '/Mailpile/d' "$COMPLETION_FILE"
  136. sed -i '/mailpile/d' "$COMPLETION_FILE"
  137. }
  138. function install_mailpile {
  139. if [ ! $ONION_ONLY ]; then
  140. ONION_ONLY='no'
  141. fi
  142. if [ ! $MAILPILE_DOMAIN_NAME ]; then
  143. echo $'The mailpile domain name was not specified'
  144. exit 63824
  145. fi
  146. apt-get -yq install python-pip python-lxml python-dev libjpeg-dev
  147. apt-get -yq install openssl python-pgpdump python-cryptography libssl-dev
  148. if [ ! -d /var/www/$MAILPILE_DOMAIN_NAME ]; then
  149. mkdir /var/www/$MAILPILE_DOMAIN_NAME
  150. fi
  151. cd "/var/www/$MAILPILE_DOMAIN_NAME" || exit 264826484
  152. if [ -d /var/www/$MAILPILE_DOMAIN_NAME/mail ]; then
  153. rm -rf /var/www/$MAILPILE_DOMAIN_NAME/mail
  154. fi
  155. if [ -d /repos/mailpile ]; then
  156. mkdir mail
  157. cp -r -p /repos/mailpile/. mail
  158. cd mail || exit 245728482
  159. git pull
  160. else
  161. git_clone $MAILPILE_REPO mail
  162. fi
  163. cd mail || exit 246872468
  164. git checkout $MAILPILE_COMMIT -b $MAILPILE_COMMIT
  165. set_completion_param "mailpile commit" "$MAILPILE_COMMIT"
  166. if [ ! -f requirements-dev.txt ]; then
  167. echo $'No python requirements file found'
  168. exit 62382
  169. fi
  170. pip install -r requirements.txt
  171. adduser --system --home=/var/www/$MAILPILE_DOMAIN_NAME/mail/ --group mailpile
  172. adduser mailpile debian-tor
  173. adduser mailpile www-data
  174. adduser mailpile mail
  175. adduser mailpile "$MY_USERNAME"
  176. if [[ "$ONION_ONLY" == 'no' ]]; then
  177. chgrp -R ssl-cert /etc/letsencrypt
  178. chmod -R g=rX /etc/letsencrypt
  179. usermod -a -G ssl-cert mailpile
  180. fi
  181. chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/
  182. # create folders and tags
  183. su -c "cd /var/www/$MAILPILE_DOMAIN_NAME/mail && ./mp --setup" - mailpile
  184. MAILPILE_ONION_HOSTNAME=$(add_onion_service mailpile 80 ${MAILPILE_ONION_PORT})
  185. { echo '[Unit]';
  186. echo 'Description=Mailpile Email Client';
  187. echo 'After=syslog.target network.target nginx.target';
  188. echo '';
  189. echo '[Service]';
  190. echo 'User=mailpile';
  191. echo 'Group=mailpile';
  192. echo "WorkingDirectory=/var/www/$MAILPILE_DOMAIN_NAME/mail";
  193. echo "ExecStart=/var/www/$MAILPILE_DOMAIN_NAME/mail/mp --www=127.0.0.1:${MAILPILE_PORT} --wait";
  194. echo 'Restart=always';
  195. echo 'RestartSec=10';
  196. echo '';
  197. echo '[Install]';
  198. echo 'WantedBy=multi-user.target'; } > /etc/systemd/system/mailpile.service
  199. chmod +x /etc/systemd/system/mailpile.service
  200. mailpile_nginx_site=/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME
  201. if [[ $ONION_ONLY == "no" ]]; then
  202. function_check nginx_http_redirect
  203. nginx_http_redirect $MAILPILE_DOMAIN_NAME
  204. { echo 'server {';
  205. echo ' listen 443 ssl;';
  206. echo ' #listen [::]:443 ssl;';
  207. echo " server_name $MAILPILE_DOMAIN_NAME;";
  208. echo '';
  209. echo ' # Security'; } >> $mailpile_nginx_site
  210. function_check nginx_ssl
  211. nginx_ssl $MAILPILE_DOMAIN_NAME
  212. function_check nginx_security_options
  213. nginx_security_options $MAILPILE_DOMAIN_NAME
  214. { echo ' add_header Strict-Transport-Security max-age=15768000;';
  215. echo '';
  216. echo ' # Logs';
  217. echo ' access_log /dev/null;';
  218. echo ' error_log /dev/null;';
  219. echo '';
  220. echo ' # Root';
  221. echo " root /var/www/$MAILPILE_DOMAIN_NAME/mail;";
  222. echo '';
  223. echo ' location / {'; } >> $mailpile_nginx_site
  224. function_check nginx_limits
  225. nginx_limits $MAILPILE_DOMAIN_NAME '15m'
  226. { echo " rewrite /(.*) /\$1 break;";
  227. echo " proxy_set_header X-Real-IP \$remote_addr;";
  228. echo " proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;";
  229. echo " proxy_set_header Host \$http_host;";
  230. echo ' proxy_set_header X-NginX-Proxy true;';
  231. echo " proxy_pass http://localhost:${MAILPILE_PORT};";
  232. echo ' proxy_redirect off;';
  233. echo ' }';
  234. echo '}';
  235. echo ''; } >> $mailpile_nginx_site
  236. else
  237. echo -n '' > $mailpile_nginx_site
  238. fi
  239. { echo 'server {';
  240. echo " listen 127.0.0.1:$MAILPILE_ONION_PORT default_server;";
  241. echo " server_name $MAILPILE_ONION_HOSTNAME;";
  242. echo ''; } >> $mailpile_nginx_site
  243. function_check nginx_security_options
  244. nginx_security_options $MAILPILE_DOMAIN_NAME
  245. { echo '';
  246. echo ' # Logs';
  247. echo ' access_log /dev/null;';
  248. echo ' error_log /dev/null;';
  249. echo '';
  250. echo ' # Root';
  251. echo " root /var/www/$MAILPILE_DOMAIN_NAME/mail;";
  252. echo '';
  253. echo ' location / {'; } >> $mailpile_nginx_site
  254. function_check nginx_limits
  255. nginx_limits $MAILPILE_DOMAIN_NAME '15m'
  256. { echo " rewrite /(.*) /\$1 break;";
  257. echo " proxy_set_header X-Real-IP \$remote_addr;";
  258. echo " proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;";
  259. echo " proxy_set_header Host \$http_host;";
  260. echo ' proxy_set_header X-NginX-Proxy true;';
  261. echo " proxy_pass http://localhost:${MAILPILE_PORT};";
  262. echo ' proxy_redirect off;';
  263. echo ' }';
  264. echo '}'; } >> $mailpile_nginx_site
  265. function_check create_site_certificate
  266. if [ ! -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem ]; then
  267. create_site_certificate $MAILPILE_DOMAIN_NAME 'yes'
  268. fi
  269. if [ -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.crt ]; then
  270. mv /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.crt /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem
  271. fi
  272. if [ -f /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem ]; then
  273. chown root:root /etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem
  274. sed -i "s|.crt|.pem|g" /etc/nginx/sites-available/${MAILPILE_DOMAIN_NAME}
  275. fi
  276. if [ -f /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key ]; then
  277. chown root:root /etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key
  278. fi
  279. function_check nginx_ensite
  280. nginx_ensite $MAILPILE_DOMAIN_NAME
  281. "${PROJECT_NAME}-pass" -u "$MY_USERNAME" -a mailpile -p "*"
  282. function_check add_ddns_domain
  283. add_ddns_domain $MAILPILE_DOMAIN_NAME
  284. disable_email_encryption_at_rest
  285. # if strict https is enforced then buttons don't work. This is probably a security bug
  286. sed -i "/Content-Security-Policy/d" $mailpile_nginx_site
  287. # link to the administrator's keyring
  288. if [ -d /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg ]; then
  289. mv /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg_orig
  290. fi
  291. cp -r "/home/$MY_USERNAME/.gnupg" "/var/www/$MAILPILE_DOMAIN_NAME/mail/"
  292. chown -R mailpile:mailpile /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg
  293. chmod +x /var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg
  294. pip install jinja2==2.9.6
  295. pip install pgpdump==1.5
  296. # turn off ssl in dovecot
  297. sed -i 's|#ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
  298. sed -i 's|ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
  299. # set ssl certs, just in case we want to use them later
  300. if [[ "$ONION_ONLY" == "no" ]]; then
  301. if [ -f "/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem" ]; then
  302. sed -i "s|#ssl_cert =.*|ssl_cert = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem|g" /etc/dovecot/conf.d/10-ssl.conf
  303. sed -i "s|ssl_cert =.*|ssl_cert = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem|g" /etc/dovecot/conf.d/10-ssl.conf
  304. sed -i "s|#ssl_key =.*|ssl_key = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem|g" /etc/dovecot/conf.d/10-ssl.conf
  305. sed -i "s|ssl_key =.*|ssl_key = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem|g" /etc/dovecot/conf.d/10-ssl.conf
  306. fi
  307. groupadd ssl-cert
  308. usermod -a -G ssl-cert dovecot
  309. fi
  310. systemctl restart dovecot
  311. systemctl enable mailpile
  312. systemctl daemon-reload
  313. systemctl start mailpile
  314. systemctl restart nginx
  315. set_completion_param "mailpile domain" "$MAILPILE_DOMAIN_NAME"
  316. APP_INSTALLED=1
  317. }
  318. # NOTE: deliberately no exit 0