diff options
31 files changed, 702 insertions, 496 deletions
@@ -42,13 +42,13 @@ $(foreach module,$(ALL_MODULES),$(eval $(call make_module_rule))) $(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule))) .PHONY: install -install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab +install: $(ENV_RULES) $(INSTALL_RULES) install_crontab .PHONY: reinstall -reinstall: reinstall_nginx $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab +reinstall: $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab .PHONY: uninstall -uninstall: uninstall_nginx uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab +uninstall: uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab $(foreach module,$(ALL_MODULES),$(eval $(install_module_rule))) $(foreach module,$(ALL_MODULES),$(eval $(reinstall_module_rule))) @@ -60,5 +60,4 @@ clean: include make/container.mk include make/openrc.mk -include make/nginx.mk include make/crontab.mk diff --git a/ansible/inventory.yml b/ansible/inventory.yml index 317352c..a406a1a 100644 --- a/ansible/inventory.yml +++ b/ansible/inventory.yml @@ -22,3 +22,5 @@ ungrouped: 63326363386631313835306630336535616335336237663831613832663237396661363436643437 3237646663616430340a656137396337303564646333316234623264643963623162623766383131 6338 + mox_checksum: 0KIk721VDR6D_SkRbZ-Vc8-fXe7I + mox_platform: amd64 diff --git a/ansible/playbook.yml b/ansible/playbook.yml index 84e8052..4320e8f 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -1,8 +1,19 @@ -- name: Install dyndns and TLS - hosts: blade-canongate +- name: Install public-facing server + hosts: "{{ services.mox.host }}" become: true roles: - dyndns - tls + - mox + vars_files: + - common.yml + - mox.yml + - network.yml + +- name: Install ln + hosts: "{{ services.ln.host }}" + become: true + roles: + - ln vars_files: - common.yml diff --git a/ansible/roles/dyndns/tasks/main.yml b/ansible/roles/dyndns/tasks/main.yml index 43d627b..144dc7a 100644 --- a/ansible/roles/dyndns/tasks/main.yml +++ b/ansible/roles/dyndns/tasks/main.yml @@ -58,14 +58,14 @@ mode: "644" - name: Install daily crontabs for dyndns (IPv4) - loop: "{{ subdomains }}" + loop: "{{ subdomains | map(attribute='name') }}" ansible.builtin.cron: special_time: daily name: daily crontab for dyndns for {{ item }}.joeac.net (IPv4) job: CACHE_DIR=/var/digitalocean_dyndns CONFIG_DIR=/etc/digitalocean_dyndns dyndns.sh 4 {{ item }}.joeac.net >> /var/log/digitalocean_dyndns/{{ item }}.joeac.net.ipv4.log - name: Install daily crontabs for dyndns (IPv6) - loop: "{{ subdomains }}" + loop: "{{ subdomains | map(attribute='name') }}" ansible.builtin.cron: special_time: daily name: daily crontab for dyndns for {{ item }}.joeac.net (IPv6) diff --git a/ansible/roles/ln/files/public b/ansible/roles/ln/files/public new file mode 120000 index 0000000..d28a74a --- /dev/null +++ b/ansible/roles/ln/files/public @@ -0,0 +1 @@ +../../../../ln/public/
\ No newline at end of file diff --git a/ansible/roles/ln/tasks/main.yml b/ansible/roles/ln/tasks/main.yml new file mode 100644 index 0000000..f600c21 --- /dev/null +++ b/ansible/roles/ln/tasks/main.yml @@ -0,0 +1,7 @@ +- name: Copy public files + ansible.builtin.copy: + src: public/ + dest: "{{ services.ln.root }}/" + owner: joeac.net + group: joeac.net + mode: "664" diff --git a/ansible/roles/mox/files/adminpasswd b/ansible/roles/mox/files/adminpasswd new file mode 100644 index 0000000..4ae1c23 --- /dev/null +++ b/ansible/roles/mox/files/adminpasswd @@ -0,0 +1,8 @@ +$ANSIBLE_VAULT;1.2;AES256;ansible +65636662323138356133613164616233363466373739356565323234613561323133643066343033 +6536306636333265646230383235336161333961656235650a616136636433323438356263623862 +38376366633037353030306434616537666330396435306330383432633664346632373938393736 +6132633134616662340a353566386335333966663263326530333731653461393231636263323232 +34316165653330653535383565353139656237633135303033346437303939643938666634643338 +33373933656434376334656234353537626539613335393764373539313165643237616662633266 +366139613535363636323835336364633037 diff --git a/ansible/roles/mox/files/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem b/ansible/roles/mox/files/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem new file mode 100644 index 0000000..41a9fc8 --- /dev/null +++ b/ansible/roles/mox/files/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem @@ -0,0 +1,96 @@ +$ANSIBLE_VAULT;1.2;AES256;ansible +35663562356239663038353735376163663261373336333064383332646136366532353736653763 +6562353834343931333635356532313631306266333432640a396434313839376161653837343930 +64623264343431373164386536666562373139333064656531653166396530363138343134643737 +3035313064333263360a376531386230346435383964313966636638313439323865393434393838 +65643130353631386261616432353766663239323836363936633030303831346433343738306534 +66613931323832636562333931333936643235333263663161346666336466316163613339393662 +62363966363434646534363865356162633438393466386330313233333537623837623636393239 +65306537353238326163393931383762313764656239326335623730356663386337396130356332 +61303864393637373861303835346661326334396561623939663966303632376665396161346462 +38653862303664316231643861623661333734343933646635623334616231313563636331396235 +33613037396130633939633062666433323438313861376365663234363461313339663061373562 +63303666633134623637383634663161326338383263613061313762663236653761333662326331 +33336132623336353933396637633233613666326239366536613934353136373634633965373633 +37356562633038303162363433313466356534343437303263633764336562666431303539383162 +31393237626130643066383266613735343861326564613933323433633631646630326232636661 +35363931613261326635353666646666643661623539303962326130303163636665383035356232 +65613665306663653962353761393962343236313530303365633132356562393938383034306563 +66363334363862643937323532323734616132376264333936636438333438643464653163323736 +65373639313631656562313362316366616563376236653364636630623735303034333961363466 +38643962366563656439663735613766333237346364336465306162303463316261656565346133 +32343431306534316662366537323430356635633832353163623936353361346561386137393038 +35646563336432396432376338626438303866393033663963663262663137396639626335386363 +62396139366163366539386134396236363237373831616632363930316266383835366230393538 +64336362646136663962393834333539656362343730366335333535363137366138636234383235 +35616537363033343430343663346163646134316265346462313162633334333866646137623139 +31346137636430646136383437666532646361356364333139623837366435363932613461373761 +35656131623932346461346431353364633735333365363133646232383736366134383930666538 +36373761316533666334396435373430396536346433316139386635353562666438316536326166 +39656166333830353338623732656532383936353464366130616365653138656239663461313937 +37663737313635353861363138326232663130353933653939656266393536656432316632623463 +34643630336264656231623966356238633336356632636437303133633338336663396663656634 +65313063663334356139353666373434353139356536336331376138613736346435303732376535 +34666639303965363364653165396530323766326135393665633230386566626364633166343132 +66316262326238666335653637363135363461623936333730643162633461343530323032613563 +38666665313633333362666163653334373337373634303632373932326234373464613335356661 +34373561633063356236316664316339366261613966386466323932343661363432636632393736 +32346534353835333436613134393065646334326461306333343439643662343433323062363634 +34326466366636336262633339646564613432373138643961663636313531323233373036393038 +64323164643664616561653931343765396263313931343063643430663735663936373637663933 +33613636336138363064313064346437643334616435326533343339303130653837376232656530 +31633266626264353061376235613061313430383238316537356637346465363730336438373061 +65373935636433643838373361333738663062333330336463343436616235376266666331383633 +62643262333331306633323432353531366137666336383261333563393436336163666363386539 +36653264663665313333326462653139626666613736666633333065653738633866323962303862 +37343662613736376333383964393366303762646430636263623161303261626465353563306561 +37386432393963643932306630643635333439366164653062616665663366613830333836383433 +37643436323439363938656462383639616363323135396435623439656230643961396561313034 +61353837376261326361373838633334356430383235343262313736376234633165393766383137 +31663065646135633133343939323532616435353061383462356137386335313763386661366636 +34633361623237326132386266616265353738303961336366396334356561633232343035326433 +66303431393932653635653131643534653031396338336662343730616235376338663335626433 +61316137396662636234653638663739633033643563363633363664356637613464303032363466 +38313732626637366564336634316534376364663439356431633663323738346234336632383436 +32616133363665613535663764373330623335653663636563356135346537363332383365383133 +65393234316166623364313463363035386231363238653434613665643961613836616436303163 +34323238313762323937313937386330353962353730366231383462353764613633643663626461 +64363437343333343462646664656636306536326361613063303333373035636239666361393964 +35386164353562396664613936633336323464336562303030356239303335353361326132646534 +30356532313938383632343436373262396561336533396435653236316661356234356664616135 +37353162623538373063656435396563333438376438653266653062626536383763643632643830 +64383634663366353433386332643932326636313765386434343039643931336264636264383162 +31316339333138623838663465653463363565326439366663653765346532396234326166326230 +38343033393664346564363565393637336165393331303964343030656538363630623432313231 +30363131653131613439346362653034383938633933613661333830346633376630623765313736 +66386537376461343030343161313735386233353030306466333136376432633437656432656534 +33613537613739636433613764633030326135353362333332306432646531663162373536633163 +36616135303766353430393933306630353338326163666632383939356334336536323637356465 +39363430333761343931663437383136643331663931623733623538636233633031653135343264 +64623336626334306137303530656264666234353333663230386564313330656663373966383735 +61303634336333656463643436626635363834633465383965306238366262626334643661333637 +63366234396230333432663264323738303062653066653830363630383236376531373235373532 +35383733316465353537653239623936613866653538363164613534646463366464333937323339 +31623036373736616530363138616338623836373939343231613164646337326132653935333636 +61326331333338333161653830356539613164646235333033376530623938616135393631653362 +39653564323139386139613566656538646265386463396232393063386265353931653366653038 +63346534363034333264393631356534303535613564343836623139356433326333646533373162 +63343064356164336333393863666636316639356132303964363834393163373730386539303432 +62323837383466396630353037346231353164333633323330643332313933623366396463646163 +31346131663734383363386437363430316339346363336466383265356663633162323434656534 +35326131333435383065623039303732636334313339316139383031663632323162663830613463 +36333931386339393230633236333661666639383131346165356535666236333831353837386634 +63396264353438326363653563333039636331633230656664666233336633653566333963353038 +61393463646631656236376432643762393030383836356466363563313034623563356162353331 +61633661616133623466666236646330633436663566646531616163393861653565663032306230 +39353333623831313434373136353336636331363861316133346366353633666461366536393236 +31653530313439383133353466666133356433653561363937376434363030356239633830303261 +38353965623337633134636538376235326435323032643739656631333130626335386436316531 +62366232326663623939623132666139333334306334383432366435643337373861373262656237 +31336661623362376162356161313731393733626334613966656466633264333530323961386135 +64306164363763663835363938326437346265613833373562383561626265353766633264623631 +38613034393830383533323236346363396334626332376135326265303364313137343936373233 +39383233343061396631613462323366313261393437313931313766616136333530396534343339 +30346563343839626633366261343931316237306161396135336235643062623638643862346132 +66376639393664613661656439366530353536366232376666333331356637326539616263306237 +313264333731366631643230306130616162 diff --git a/ansible/roles/mox/files/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem b/ansible/roles/mox/files/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem new file mode 100644 index 0000000..71b0b52 --- /dev/null +++ b/ansible/roles/mox/files/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem @@ -0,0 +1,96 @@ +$ANSIBLE_VAULT;1.2;AES256;ansible +31353563393530386631393261306630643364316236373263316265316638626632303637633331 +6139343730333665626138393431336632316234353236370a633130313632396261656264323165 +37393339353966633633643533343833653835386161613566353335626231633663306633356237 +3465376136376135650a623561383831383530353737336339653532633866613233356564333361 +62613166656435336364316530643165313362646639383964313361333936646162376166663431 +31346433343636316163323866666536326464376461316133653732323164626433343435303765 +66646633393138396366393034303866636137636230303663346633333638363563623364663736 +39653036613837616236333432353461376130393739333533613139323132313833376261613638 +31366437643065303563306539373134313262383639613439613363313962383837633135343032 +30636637323564356139653430366666353935343162383831633136633331383830363137393830 +32336432643831353962313736633932623631616365666633663435636639633931643736363736 +34356665636164633266383965366262323463306430363864656532303032376464396239636133 +35393632356136326632373039393432346362623365653861653233623336356132326531646237 +61326264313766356164333064623539333231356466376661613537653438313133323664396636 +30626138656634313138363931366232393832363661373564613266663362383837633331346334 +62346537663534646538323432626134643964316639393731346463626230386232656434653666 +39306632393961336434663466646264353066333063666163636164303935653336383635623138 +35643163666535613035323832353065386131323930356430636539383935343566333561316530 +63353338623461313130376337623239633133333039633032346165366134623837666433366364 +31623733343365393363313866316233663338663833613534346566383130643233663335633637 +30303433336561343133356230333962333834343131616665643066306232636266633437363064 +65346166313134336338316336643361316362386261616266636466633232663439306463383666 +61396438303664646336646132663531393866346130383131326639333462376364663563626437 +62313237623761623862643266366161633735356130623561326337626337386566613637626630 +38333861306536393932363734303465396138323366616262653462393331663463656138306535 +31313831326465356434343334366662633234343662376334653961653632643464623638303739 +32383539346439346632353265333038633836393131666564383836393565643166306262333733 +64323062393734633038666465633265393430303161623134626566646135326530323037326435 +63313832623064336564353030343533353064303237623161393437336339363063656533393631 +38356561343333663665303561323666343566303666323736663061613062356430313362366664 +61373837373861636634373239633931396266653637643162643534313236376463353634663833 +61373430613865373864633736356331633363646236626536666262343635396435646265306530 +39663435646265613865376364643336653139313833666632356664613837643932386235376637 +31316465363964303732663361343631663564336163306337663339323235376436623964366231 +38636132626438653664343733363635616331663833376239393337633164353365633166353765 +63346337653538666330636366646464393934376663656563336665306461363132343536366336 +66613238636665323266373138383335363961616637633961663730386133333933653437393161 +37336331343130656338366331663565653661653937353331386139396163303864646139323263 +64383564653935383364666563346563373831323764306231363034333935383061383535366131 +62393634663762373037356433643938373332333239646537343361653432623933663162353439 +30303037396535653238366439316532626235653230316362333266383738326136376239626564 +34373238353334616632343030323463363539383164353161633330636165366339333864616366 +61633966356230313265383363323532316663333665633934353535623630633961383438656163 +64373431663836663731653438653661666333363039626334343964356433323236386630316261 +35653266343436336235323065363933643438393065323865323639313633333563393763313938 +34383536613264633739343764633938623333646635623031613762626664656633636163383139 +65326138643635613336356639623538323334316564623761633630316531323061363237313937 +32323838646439653336613061643330386432323239653365623762616163623837646637663532 +62326337373534383238323937626339613464303736333566613035653861323239386564336264 +62616134363235653761643632336662323765383233313831663264323965313735396632366665 +31646632646335333336643161393263366433383463393635353834636534326534396363383635 +61633839333439323665623961643839326166393762363439656537363938623564643663646262 +39316435656337666636363531653166343934613666353634393831393034636335376135333462 +34346131323163643036353362346532316662323639316638323463666565373032633932366130 +66636438633634663261643738633437623939613766376230666361386266626261376538343234 +32646433653136326234363434613236326338336339376431353764323739613861366163613764 +39613365393363643864623661316536313539613230626137376435336338323439333537346431 +34373039663165323765353630656531396465343234616462326335326265343366396632316138 +62663237383162646661633461383763613534646131383738373036613964613061343362343839 +66336161366136383463313266376330376239323763663361323761633339333861346162326563 +32643133383736356533306565356634393730303032643466636438386137366265376537613734 +65633538383066383832306436333533373235313235353033366330643236363238343563333361 +62376430623264376564326535663464626235363437613436313564626662313236393037363966 +63653537323734383466303464346362343235356136323463386539636664636561633565323963 +35383237386636343665343432373336633963353936663930626239353562653065666639333434 +63666536303238373337383339616438366466353639346534393163666139376632373936656630 +38646261393936336539363831626539313564646266653635303066653333303134663038363938 +32643339616230323631323836366138643933326162333262663663386136336563383431643464 +34323936366261626336323064636136333430326639373263363333376361376331366133373161 +30613539316663643133346336306362376636663561353138336362333665643461666137306663 +33353664636133303436393730356636396662633632353861363065373539353635343238666437 +32616562616234326137336433343565663761653834316630343236376237333461306233396435 +34323933643630643761363166336237306431633734623466643538363462393163306331386437 +30633835336134373464333563616438663833326565363235643538326239323933366362636666 +61316264643264393731353261616233633265336530343834643835393532643964336430613461 +36366136636266376530626230376135653733333538666639373066353361313064646132656265 +38613530343838393839303132663031346461313235303665386335633332303232353363303136 +32323430653035336664656233643233656431333139633730333466663138363732346465633861 +33326234353062356161373930346430393837323130643066633863316362313339383932326561 +63653930356335313931383565313061313535323230653532623337376335646437396533373561 +38633134313936623935393133633933353032393232636462643665633461626562316637363031 +30336263313638626339366465646230663464616665623836353634323534363832386637643739 +63623262663038653464323733646362313532303532666234323162383764323836353931373334 +37663733306235353334663863393332626364323931323562396131613430633163356338643434 +38373732343937623938666266346230326666666565366465316462656664383361333631383665 +66656562306532633665313730323736313436626263336139386530663835396566653832643337 +30383132613334653264623032343666393530663835393330353430633036636462346666353633 +62373839336466336534363066633036393037306166613261353635303061323234353665623062 +36323834646330303665306532303038323565656265333537353830386337393536376562333930 +62366434666536353533663166663366306334333063623330653562653962346531326263363135 +38313235623539666433333737386233623136643938333766613139393964633032613664396534 +38653037373063383332626164323933346663633863353561316261333739326539626633633738 +61396235366134356461663366656162393935333261353935396635376537303738393130336339 +62636165383364653864303931643531613538303966653335653363343765383033386636303139 +396232353230313962383939636139373931 diff --git a/ansible/roles/mox/files/openrc/mox b/ansible/roles/mox/files/openrc/mox new file mode 100644 index 0000000..56c8daa --- /dev/null +++ b/ansible/roles/mox/files/openrc/mox @@ -0,0 +1,56 @@ +#!/sbin/openrc-run + +description="Run mox email server" +extra_commands="configtest" +description_configtest="Check configuration via \"mox config test\"" + +configtest() +{ + if ! [ -f ~mox/config/mox.conf ]; then + eerror "The config file ~mox/config/mox.conf does not exist!" + return 1 + fi + cd ~mox + if mox config test >&/dev/null; then + einfo "config: ok" + else + eerror "config: error" + return 1 + fi +} + +depend() +{ + need unbound +} + +start() +{ + configtest || return 1 + ebegin "Starting mox" + start-stop-daemon --start \ + --exec /usr/bin/mox \ + --background \ + --chdir ~mox \ + --stdout /var/log/mox.log \ + --stderr /var/log/mox.err.log \ + -- serve + eend $? +} + +stop() +{ + ebegin "Stopping mox" + start-stop-daemon --stop \ + --exec /usr/bin/mox \ + --pidfile /run/mox.pid + eend $? +} + +restart() +{ + ebegin "Restarting mox" + svc_stop + svc_start + eend $? +} diff --git a/ansible/roles/mox/tasks/main.yml b/ansible/roles/mox/tasks/main.yml new file mode 100644 index 0000000..8044262 --- /dev/null +++ b/ansible/roles/mox/tasks/main.yml @@ -0,0 +1,168 @@ +- name: Add mox group + ansible.builtin.group: + name: mox + +- name: Add mox user + ansible.builtin.user: + name: mox + group: mox + groups: + - tls + append: false + +- name: Assign mox as owner of ~mox home directory + register: mox_home_dir + ansible.builtin.file: + path: ~mox + owner: mox + group: mox + mode: "750" + +- name: Create mox configuration directory + register: mox_conf_dir + ansible.builtin.file: + path: ~mox/config/ + owner: mox + group: mox + mode: "770" + +- name: Create DKIM private keys directory + register: mox_dkim_dir + ansible.builtin.file: + path: ~mox/config/dkim + owner: mox + group: mox + mode: "770" + +- name: Install DKIM private key A + register: mox_dkim_a + ansible.builtin.copy: + src: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + dest: ~mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + owner: mox + group: mox + mode: "660" + +- name: Install DKIM private key B + register: mox_dkim_b + ansible.builtin.copy: + src: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + dest: ~mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + owner: mox + group: mox + mode: "660" + +- name: Install adminpasswd + register: mox_adminpasswd + ansible.builtin.copy: + src: adminpasswd + dest: ~mox/config/adminpasswd + owner: mox + group: mox + mode: "660" + +- name: Install mox configuration + register: mox_conf + ansible.builtin.template: + src: mox.conf + dest: ~mox/config/mox.conf + owner: mox + group: mox + mode: "660" + +- name: Install mox domain configuration + register: mox_domain_conf + ansible.builtin.template: + src: domains.conf + dest: ~mox/config/domains.conf + owner: mox + group: mox + mode: "660" + +- name: Create mox data directory + ansible.builtin.file: + path: ~mox/data + state: directory + owner: mox + group: mox + mode: "770" + +- name: Create unbound configuration directory + ansible.builtin.file: + path: /etc/unbound/unbound.conf.d + state: directory + mode: "444" + +- name: Install DNSSEC configuration + register: dnssec_conf + ansible.builtin.template: + src: dnssec.conf + dest: /etc/unbound/unbound.conf.d/dnssec.conf + +- name: Install unbound binary + community.general.apk: + name: unbound + state: present + +- name: Restart unbound service and configure to start on boot + when: dnssec_conf is changed + ansible.builtin.service: + name: unbound + enabled: true + state: restarted + +- name: Start unbound service and configure to start on boot + when: not ( dnssec_conf is changed ) + ansible.builtin.service: + name: unbound + enabled: true + state: started + +- name: Configure networking to point at unbound DNS resolver + ansible.builtin.copy: + content: "nameserver: 127.0.0.1" + dest: /etc/resolv.conf + backup: true + mode: "444" + +- name: Install mox binary + ansible.builtin.get_url: + dest: /usr/bin/mox + mode: "755" + url: "{{ mox_url }}" + +- name: Install mox service + ansible.builtin.copy: + src: openrc/mox + dest: /etc/init.d/mox + mode: "755" + +- name: Restart mox service and configure to start on boot + when: + mox_home_dir is changed + or mox_conf_dir is changed + or mox_dkim_dir is change + or mox_dkim_a is change + or mox_dkim_b is change + or mox_adminpasswd is change + or mox_conf is change + or mox_domain_conf is changed + ansible.builtin.service: + name: mox + enabled: true + state: started + +- name: Start mox service and configure to start on boot + when: not ( + mox_home_dir is changed + or mox_conf_dir is changed + or mox_dkim_dir is change + or mox_dkim_a is change + or mox_dkim_b is change + or mox_adminpasswd is change + or mox_conf is change + or mox_domain_conf is changed ) + ansible.builtin.service: + name: mox + enabled: true + state: started diff --git a/ansible/roles/mox/templates/dnssec.conf b/ansible/roles/mox/templates/dnssec.conf new file mode 100644 index 0000000..de6bf8c --- /dev/null +++ b/ansible/roles/mox/templates/dnssec.conf @@ -0,0 +1,9 @@ +server: + qname-minimisation: yes + interface: 0.0.0.0 + interface: ::0 + access-control: {{ router.lan.ipv4 }} allow + access-control: {{ router.lan.ipv6 }} allow + +remote-control: + control-enable: yes diff --git a/ansible/roles/mox/templates/domains.conf b/ansible/roles/mox/templates/domains.conf new file mode 100644 index 0000000..42a942b --- /dev/null +++ b/ansible/roles/mox/templates/domains.conf @@ -0,0 +1,98 @@ +Domains: + mail.joeac.net: + ClientSettingsDomain: clientsettings.mail.joeac.net + LocalpartCatchallSeparator: + + DKIM: + Selectors: + 2026a: + Expiration: 72h + PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + 2026b: + Expiration: 72h + PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + Sign: + - 2026a + DMARC: + Localpart: dmarcreports + Account: me + Mailbox: DMARC + MTASTS: + PolicyID: 20260705T153220 + Mode: enforce + MaxAge: 24h0m0s + MX: + - mail.joeac.net + TLSRPT: + Localpart: tlsreports + Account: me + Mailbox: TLSRPT +Accounts: + me: + Domain: mail.joeac.net + Destinations: + me@mail.joeac.net: nil + SubjectPass: + Period: 12h0m0s + RejectsMailbox: Rejects + AutomaticJunkFlags: + Enabled: true + JunkMailboxRegexp: ^(junk|spam) + NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects) + JunkFilter: + Threshold: 0.950000 + Params: + Onegrams: true + MaxPower: 0.010000 + TopWords: 10 + IgnoreWords: 0.100000 + RareWords: 2 + NoCustomPassword: true +MonitorDNSBLs: + - zen.spamhaus.org + - bl.spamcop.net + +WebHandlers: + +{% for subdomain in subdomains %} +{% if subdomain.mox_handler != "none" %} + +{% if subdomain.mox_handler == "static" %} + - + LogName: {{ subdomain.name }}.joeac.net + PathRegexp: ^/ + Compress: true + Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %} + WebStatic: + Root: {{ services[subdomain.service].root }} + ListFiles: {{ "directory_listing" in services[subdomain.service] and services[subdomain.service].directory_listing }} + ContinueNotFound: true + + - + LogName: {{ subdomain.name }}.joeac.net + PathRegexp: ^.*[^(.html)]$ + Compress: true + Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %} + WebRedirect: + OrigPathRegexp: ^(.*[^(.html)])$ + ReplacePath: $1/index.html + + - + LogName: {{ subdomain.name }}.joeac.net + PathRegexp: ^/.*/index.html$ + Compress: true + Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %} + WebRedirect: + OrigPathRegexp: ^(.*)/index.html$ + ReplacePath: $1.html + +{% elif subdomain.mox_handler == "forward" %} + LogName: {{ subdomain.name }}.joeac.net + PathRegexp: ^/ + Compress: true + Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %} + WebForward: + URL: http://{{ hostvars[services[subdomain.service].host].ansible_host }}:{{ services[subdomain.service].port }} +{% endif %} + +{% endif %} +{% endfor %} diff --git a/ansible/roles/mox/templates/mox.conf b/ansible/roles/mox/templates/mox.conf new file mode 100644 index 0000000..614c6f6 --- /dev/null +++ b/ansible/roles/mox/templates/mox.conf @@ -0,0 +1,60 @@ +DataDir: ../data +LogLevel: debug +User: mox +Hostname: mail.joeac.net +AdminPasswordFile: adminpasswd +Listeners: + internal: + IPs: + - 127.0.0.1 + - ::1 + Hostname: localhost + MetricsHTTP: + Enabled: true + public: + IPs: +{% if "address" in ansible_facts.default_ipv4 %} + - {{ ansible_facts.default_ipv4.address }} +{% endif %} +{% if "address" in ansible_facts.default_ipv6 %} + - {{ ansible_facts.default_ipv6.address }} +{% endif %} + NATIPs: + - {{ router.wan.ipv4 }} + - {{ router.wan.ipv6 }} + AccountHTTPS: + Enabled: true + AdminHTTPS: + Enabled: true + WebmailHTTPS: + Enabled: true + WebAPIHTTPS: + Enabled: true + AutoconfigHTTPS: + Enabled: true + MTASTSHTTPS: + Enabled: true + WebserverHTTP: + Enabled: true + WebserverHTTPS: + Enabled: true + TLS: + KeyCerts: +{% for subdomain in ( subdomains | map(attribute='name') ) %} + - + CertFile: /etc/letsencrypt/live/{{ subdomain }}.joeac.net/fullchain.pem + KeyFile: /etc/letsencrypt/live/{{ subdomain }}.joeac.net/privkey.pem +{% endfor %} + SMTP: + Enabled: true + Submissions: + Enabled: true + IMAPS: + Enabled: true +Postmaster: + Account: me + Mailbox: Postmaster +HostTLSRPT: + Account: me + Mailbox: TLSRPT + Localpart: tlsreports diff --git a/ansible/roles/tls/tasks/main.yml b/ansible/roles/tls/tasks/main.yml index d26435b..e758fc5 100644 --- a/ansible/roles/tls/tasks/main.yml +++ b/ansible/roles/tls/tasks/main.yml @@ -29,7 +29,7 @@ certbot renew --non-interactive - name: Install missing TLS certificates - loop: "{{ subdomains }}" + loop: "{{ subdomains | map(attribute='name') }}" when: not ( ( item ~ ".joeac.net" ) in ansible_local.certbot.certificates ) ansible.builtin.shell: certbot certonly \ @@ -38,9 +38,33 @@ --domain {% if item == "@" %} joeac.net {% else %} {{ item }}.joeac.net {% endif %} \ --non-interactive +- name: Add joeac.net group + ansible.builtin.group: + name: joeac.net + +- name: Add tls group + ansible.builtin.group: + name: tls + +- name: Add joeac.net user + ansible.builtin.user: + name: joeac.net + group: joeac.net + groups: + - tls + append: false + +- name: Give ownership of /etc/letsencrypt to joeac.net:tls + ansible.builtin.file: + path: /etc/letsencrypt + owner: joeac.net + group: tls + mode: g+rwx + recurse: true + - name: Install daily crontab to renew TLS certificates ansible.builtin.cron: special_time: daily name: daily crontab to renew all TLS certificates near to expiry job: - certbot renew --non-interactive + certbot renew --non-interactive; chown -R joeac.net:tls /etc/letsencrypt diff --git a/ansible/vars/common.yml b/ansible/vars/common.yml index e6dc18c..c21cb61 100644 --- a/ansible/vars/common.yml +++ b/ansible/vars/common.yml @@ -1,10 +1,44 @@ +services: + actualbudget: + port: 5006 + host: pi-broughton + etherpad: + port: 9001 + host: blade-canongate + http: + port: 8080 + host: pi-broughton + ln: + root: /var/ln.joeac.net/public + host: blade-canongate + directory_listing: true + mox: + host: blade-canongate + vaultwarden: + port: 9000 + host: pi-broughton + subdomains: - - "@" - - budget - - docs - - ln - - mail - - autoconfig.mail - - clientsettings.mail - - mta-sts.mail - - pwd + - name: "@" + mox_handler: forward + service: http + - name: budget + mox_handler: forward + service: actualbudget + - name: docs + mox_handler: forward + service: etherpad + - name: ln + mox_handler: static + service: ln + - name: mail + mox_handler: none + - name: autoconfig.mail + mox_handler: none + - name: clientsettings.mail + mox_handler: none + - name: mta-sts.mail + mox_handler: none + - name: pwd + mox_handler: forward + service: vaultwarden diff --git a/ansible/vars/mox.yml b/ansible/vars/mox.yml new file mode 100644 index 0000000..a74acf8 --- /dev/null +++ b/ansible/vars/mox.yml @@ -0,0 +1,4 @@ +mox_version: 0.0.15 +mox_go_version: 1.26.5 +mox_url_base: https://beta.gobuilds.org/github.com/mjl-/mox@v +mox_url: "{{ mox_url_base ~ mox_version ~ '/linux-' ~ mox_platform ~ '-go' ~ mox_go_version ~ '/' ~ mox_checksum ~ '/mox-v' ~ mox_version ~ '-go' ~ mox_go_version }}" diff --git a/ansible/vars/network.yml b/ansible/vars/network.yml new file mode 100644 index 0000000..2943048 --- /dev/null +++ b/ansible/vars/network.yml @@ -0,0 +1,7 @@ +router: + lan: + ipv4: 192.168.0.0/16 # TODO: gather automatically using ip addr + ipv6: fdc9:6aec:7a18::/64 # TODO: gather automatically using ip addr + wan: + ipv4: 217.155.190.42 # TODO: gather automatically using ip addr + ipv6: fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 # TODO: gather automatically using ip addr diff --git a/make/nginx.mk b/make/nginx.mk deleted file mode 100644 index ebfbfd1..0000000 --- a/make/nginx.mk +++ /dev/null @@ -1,75 +0,0 @@ -installed_nginx_sites = $(wildcard /etc/nginx/http.d/*.joeac.net.conf) -installed_nginx_subdomains = $(installed_nginx_sites:/etc/nginx/http.d/%.joeac.net.conf=%) -nginx_subdomains_to_remove = $(filter-out $(NGINX_SUBDOMAINS),$(installed_nginx_subdomains)) -nginx_sites_to_remove = $(nginx_subdomains_to_remove:%=/etc/nginx/http.d/%.joeac.net.conf) -nginx_module_config_template = \ - $(if $(PORT_$(module)),nginx/http.d/reverse_proxy.conf.template) \ - $(if $(PUBLIC_ROOT_DIR_$(module)),nginx/http.d/static.conf.template) -nginx_module_config_template_args = \ - CERTNAME=$(SUBDOMAIN_$(module)).joeac.net \ - DOMAIN=$(if $(filter-out @,$(SUBDOMAIN_$(module))),$(SUBDOMAIN_$(module)).)joeac.net \ - $(if $(PORT_$(module)),PORT=$(PORT_$(module)) HOST=$(HOST_$(module))) \ - $(if $(PUBLIC_ROOT_DIR_$(module)),ROOT="$(PUBLIC_ROOT_DIR_$(module))") - -define install_nginx_module_rule = -.PHONY: install_nginx_$(module) -install_nginx_$(module): $(if $(SUBDOMAIN_$(module)),/etc/nginx/http.d/$(SUBDOMAIN_$(module)).joeac.net.conf) -endef - -define reinstall_nginx_module_rule = -.PHONY: reinstall_nginx_$(module) -reinstall_nginx_$(module): $(if $(SUBDOMAIN_$(module)),/etc/nginx/http.d/$(SUBDOMAIN_$(module)).joeac.net.conf) -endef - -define uninstall_nginx_module_rule = -.PHONY: uninstall_nginx_$(module) -uninstall_nginx_$(module): - $(if $(SUBDOMAIN_$(module)),sudo rm -f /etc/nginx/http.d/$(SUBDOMAIN_$(module)).joeac.net.conf) -endef - -define remove_nginx_site_rule = -remove_$(site): - sudo rm -f $(site) -endef - -define nginx_module_config_rule = -/etc/nginx/http.d/$(SUBDOMAIN_$(module)).joeac.net.conf: $(nginx_module_config_template) /etc/nginx/http.d /etc/nginx/nginx.conf - $(nginx_module_config_template_args) envsubst -i $$< -o $$(notdir $$@).tmp - sudo cp $$(notdir $$@).tmp $$@ - sudo rc-service nginx restart -endef - -$(foreach module,$(ALL_MODULES),$(eval $(install_nginx_module_rule))) -$(foreach module,$(ALL_MODULES),$(eval $(reinstall_nginx_module_rule))) -$(foreach module,$(ALL_MODULES),$(eval $(uninstall_nginx_module_rule))) -$(foreach site,$(nginx_sites_to_remove),$(eval $(remove_nginx_site_rule))) -$(foreach module,$(ALL_NGINX_MODULES),$(eval $(nginx_module_config_rule))) - -/etc/nginx/http.d: - sudo mkdir -p /etc/nginx/http.d - -.PHONY: remove_/etc/nginx/http.d/%.joeac.net.conf -remove_/etc/nginx/http.d/%.joeac.net.conf: - rm -f $(@:remove_%=%) - -.PHONY: install_nginx -install_nginx: /etc/nginx/nginx.conf $(addprefix install_nginx_,$(NGINX_MODULES)) - -.PHONY: reinstall_nginx -reinstall_nginx: /etc/nginx/nginx.conf $(add_prefix reinstall_nginx_,$(NGINX_MODULES)) $(addprefix remove_,$(nginx_sites_to_remove)) - -.PHONY: uninstall_nginx -uninstall_nginx: $(foreach module,$(NGINX_MODULES),uninstall_nginx_$(module)) -ifeq ($(shell test -d /etc/nginx/nginx.joeac.net-backup && echo 1 || echo 0),0) - $(warn No nginx backup config detected: doing nothing) -else - sudo mv /etc/nginx/nginx.joeac.net-backup /etc/nginx/nginx.conf - sudo rc-service nginx restart -endif - -/etc/nginx/nginx.conf: nginx/nginx.conf /etc/nginx/nginx.joeac.net-backup - sudo cp $< $@ - sudo rc-service nginx restart - -/etc/nginx/nginx.joeac.net-backup: - sudo mv /etc/nginx/nginx.conf /etc/nginx/nginx.joeac.net-backup diff --git a/make/vars.mk b/make/vars.mk index d7f9b19..8daf287 100644 --- a/make/vars.mk +++ b/make/vars.mk @@ -7,9 +7,9 @@ IP_ADDR_pi-broughton := 192.168.178.91 IP_ADDR_blade-canongate := 192.168.178.75 MASTER_NODE := blade-canongate IS_MASTER_NODE := $(filter $(MASTER_NODE),$(HOSTNAME)) -MODULES_pi-broughton := actualbudget http smtp vaultwarden ln -MODULES_blade-canongate := etherpad gemini mox mox_clientsettings mox_autoconfig mox_mta_sts -ALL_NGINX_MODULES := actualbudget http vaultwarden ln etherpad mox mox_clientsettings mox_autoconfig mox_mta_sts +MODULES_pi-broughton := actualbudget http smtp vaultwarden +MODULES_blade-canongate := etherpad gemini +ALL_NGINX_MODULES := actualbudget http vaultwarden etherpad NGINX_MODULES := $(if $(IS_MASTER_NODE),$(ALL_NGINX_MODULES)) MODULES := $(MODULES_$(HOSTNAME)) ALL_MODULES := $(sort $(foreach hostname,$(HOSTNAMES),$(MODULES_$(hostname)))) @@ -22,25 +22,14 @@ SUBDOMAIN_actualbudget := budget SUBDOMAIN_http := @ SUBDOMAIN_vaultwarden := pwd SUBDOMAIN_etherpad := docs -SUBDOMAIN_ln := ln -SUBDOMAIN_mox := mail -SUBDOMAIN_mox_autoconfig := autoconfig.mail -SUBDOMAIN_mox_clientsettings := clientsettings.mail -SUBDOMAIN_mox_mta_sts := mta-sts.mail PORT_actualbudget := 5006 PORT_etherpad := 9001 PORT_http := 8080 PORT_gemini := 1965 -PORT_mox := 81 -PORT_mox_autoconfig := $(PORT_mox) -PORT_mox_clientsettings := $(PORT_mox) -PORT_mox_mta_sts := $(PORT_mox) PORT_smtp := 2500 PORT_vaultwarden := 9000 -PUBLIC_ROOT_DIR_ln := /var/ln.joeac.net/public - export ACTUALBUDGET_DATA_DIR := /var/joeac.net-actualbudget/var export ETHERPAD_DATA_DIR := /var/etherpad/var export GEMINI_CERTIFICATES_DIR := /var/joeac.net-gemini/certificates @@ -57,7 +46,6 @@ $(foreach hostname,$(HOSTNAMES),$(foreach module,$(MODULES_$(hostname)),$(eval \ ALL_SUBDOMAINS := $(foreach module,$(ALL_MODULES),$(SUBDOMAIN_$(module))) SUBDOMAINS := $(if $(IS_MASTER_NODE),$(ALL_SUBDOMAINS)) -NGINX_SUBDOMAINS := $(foreach module,$(NGINX_MODULES),$(SUBDOMAIN_$(module))) ENV_RULES := $(foreach module,$(MODULES),$(if $(shell test -d $(module) && echo 1),$(module)/.env)) MAKE_RULES := $(foreach module,$(MAKE_MODULES),make_$(module)) @@ -83,10 +71,3 @@ COMPOSE_CMD := \ LOCAL_SMTP_PORT=$(PORT_smtp) \ $(foreach module,$(ALL_MODULES),$(call capitalise,$(module))_PORT=$(PORT_$(module))) \ podman-compose - -$(foreach module,$(ALL_NGINX_MODULES), \ - $(if $(SUBDOMAIN_$(module)),, \ - $(error $(module) is declared as an nginx module, but SUBDOMAIN_$(module) is not set))) -$(foreach module,$(ALL_NGINX_MODULES), \ - $(if $(PORT_$(module)) $(HOST_$(module)),,$(if $(PUBLIC_ROOT_DIR_$(module)),, \ - $(error $(module) is declared as an nginx module, but neither PUBLIC_ROOT_DIR_$(module), nor both PORT_$(module) and HOST_$(module), are set)))) diff --git a/mox/.gitignore b/mox/.gitignore deleted file mode 100644 index b5c26c3..0000000 --- a/mox/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -config/dkim -config/adminpasswd diff --git a/mox/README.md b/mox/README.md deleted file mode 100644 index 86a609c..0000000 --- a/mox/README.md +++ /dev/null @@ -1,6 +0,0 @@ -# mox - -There are three secrets required for mox. One is the admin password, which -should be stored in config/adminpasswd. The other two are DKIM private keys, -which should be stored in the config/dkim directory. The public parts of these -keys should be exposed in DNS TXT records. diff --git a/mox/config/domains.conf b/mox/config/domains.conf deleted file mode 100644 index 2ea54ec..0000000 --- a/mox/config/domains.conf +++ /dev/null @@ -1,52 +0,0 @@ -Domains: - mail.joeac.net: - ClientSettingsDomain: clientsettings.mail.joeac.net - LocalpartCatchallSeparator: + - DKIM: - Selectors: - 2026a: - Expiration: 72h - PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem - 2026b: - Expiration: 72h - PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem - Sign: - - 2026a - DMARC: - Localpart: dmarcreports - Account: me - Mailbox: DMARC - MTASTS: - PolicyID: 20260705T153220 - Mode: enforce - MaxAge: 24h0m0s - MX: - - mail.joeac.net - TLSRPT: - Localpart: tlsreports - Account: me - Mailbox: TLSRPT -Accounts: - me: - Domain: mail.joeac.net - Destinations: - me@mail.joeac.net: nil - SubjectPass: - Period: 12h0m0s - RejectsMailbox: Rejects - AutomaticJunkFlags: - Enabled: true - JunkMailboxRegexp: ^(junk|spam) - NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects) - JunkFilter: - Threshold: 0.950000 - Params: - Onegrams: true - MaxPower: 0.010000 - TopWords: 10 - IgnoreWords: 0.100000 - RareWords: 2 - NoCustomPassword: true -MonitorDNSBLs: - - zen.spamhaus.org - - bl.spamcop.net diff --git a/mox/config/mox.conf b/mox/config/mox.conf deleted file mode 100644 index 76c3ce7..0000000 --- a/mox/config/mox.conf +++ /dev/null @@ -1,74 +0,0 @@ -DataDir: ../data -LogLevel: debug -User: mox -Hostname: mail.joeac.net -AdminPasswordFile: adminpasswd -Listeners: - internal: - IPs: - - 127.0.0.1 - - ::1 - Hostname: localhost - AccountHTTP: - Enabled: true - Port: 1080 - Forwarded: true - AdminHTTP: - Enabled: true - Port: 1080 - Forwarded: true - WebmailHTTP: - Enabled: true - Port: 1080 - Forwarded: true - WebAPIHTTP: - Enabled: true - Port: 1080 - Forwarded: true - MetricsHTTP: - Enabled: true - AutoconfigHTTPS: - Enabled: true - Port: 81 - NonTLS: true - MTASTSHTTPS: - Enabled: true - Port: 81 - NonTLS: true - WebserverHTTP: - Enabled: true - Port: 81 - public: - IPs: - - 192.168.178.75 - - fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 - NATIPs: - - 217.155.190.42 - - fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 - TLS: - KeyCerts: - - - CertFile: /etc/letsencrypt/live/mail.joeac.net/fullchain.pem - KeyFile: /etc/letsencrypt/live/mail.joeac.net/privkey.pem - - - CertFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/fullchain.pem - KeyFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/privkey.pem - - - CertFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/fullchain.pem - KeyFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/privkey.pem - - - CertFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/fullchain.pem - KeyFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/privkey.pem - SMTP: - Enabled: true - Submissions: - Enabled: true - IMAPS: - Enabled: true -Postmaster: - Account: me - Mailbox: Postmaster -HostTLSRPT: - Account: me - Mailbox: TLSRPT - Localpart: tlsreports diff --git a/mox/dnssec.conf b/mox/dnssec.conf deleted file mode 100644 index 9b8cd35..0000000 --- a/mox/dnssec.conf +++ /dev/null @@ -1,8 +0,0 @@ -server: - auto-trust-anchor-file: /var/lib/unbound/root.key - qname-minimisation: yes - interface: 0.0.0.0 - access-control: 192.168.0.0/16 allow - -remote-control: - control-enable: yes diff --git a/mox/install.mk b/mox/install.mk deleted file mode 100644 index b7ca85b..0000000 --- a/mox/install.mk +++ /dev/null @@ -1,63 +0,0 @@ -.PHONY: install -install: install_unbound install_mox - -.PHONY: reinstall -reinstall: install_unbound install_mox - -.PHONY: install_unbound -install_unbound: /usr/sbin/unbound /etc/resolv.conf /var/lib/unbound/root.key install_unbound_anchor_crontab /etc/unbound/unbound.conf.d/dnssec.conf - -/usr/sbin/unbound: - sudo apk add unbound - sudo rc-update add unbound default - sudo rc-service unbound start - -/etc/resolv.conf: resolv.conf /etc/resolv.conf.joeac.net-backup - sudo cp resolv.conf /etc/resolv.conf - -/etc/resolv.conf.joeac.net-backup: - sudo mv /etc/resolv.conf /etc/resolv.conf.joeac.net-backup - -/var/lib/unbound/root.key: - sudo mkdir -p /var/lib/unbound && sudo unbound-anchor -a /var/lib/unbound/root.key - -UNBOUND_ANCHOR_CRONTAB_ENTRY := @reboot unbound-anchor -a /var/lib/unbound/root.key # managed by joeac.net -IS_CRONTAB_UP_TO_DATE := $(sudo grep "$(UNBOUND_ANCHOR_CRONTAB_ENTRY)" /etc/crontabs/root) -.PHONY: install_unbound_anchor_crontab -install_unbound_anchor_crontab: - $(if $(IS_CRONTAB_UP_TO_DATE),,\ - sudo crontab -l > crontab.tmp; \ - sed -i "s/.*unbound-anchor.*# managed by joeac.net//" crontab.tmp; \ - echo "$(UNBOUND_ANCHOR_CRONTAB_ENTRY)" >> crontab.tmp; \ - sudo crontab crontab.tmp; \ - rm crontab.tmp; \ - ) - -/etc/unbound/unbound.conf.d/dnssec.conf: dnssec.conf - sudo mkdir -p $(dir $@) && sudo cp $< $@ - -DKIM_PRIVATE_KEY_A := ~/mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem -DKIM_PRIVATE_KEY_B := ~/mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem -DKIM_PRIVATE_KEYS := $(DKIM_PRIVATE_KEY_A) $(DKIM_PRIVATE_KEY_B) -MOX_TLS_CERTS := /etc/letsencrypt/live/mail.joeac.net/fullchain.pem /etc/letsencrypt/live/autoconfig.mail.joeac.net/fullchain.pem /etc/letsencrypt/live/clientsettings.mail.joeac.net/fullchain.pem /etc/letsencrypt/live/mta-sts.mail.joeac.net/fullchain.pem -.PHONY: install_mox -install_mox: /usr/local/bin/mox ~/mox/config/mox.conf ~/mox/config/domains.conf ~/mox/config/adminpasswd ~/mox/data $(DKIM_PRIVATE_KEYS) $(MOX_TLS_CERTS) - -MOX_PLATFORM := $(if $(filter armv7% arm32%,$(CPU_ARCH)),arm,amd64) -MOX_VERSION := 0.0.15 -MOX_GO_VERSION := 1.26.4 -MOX_CHECKSUM_amd64_v0.0.15_go1.26.4 := 09OE-1QkNVgmpoRj53mtX9gxoEmY -MOX_CHECKSUM_arm_v0.0.15_go1.26.4 := 038X9nQx6hhai60Fk1BhcP3r6Mew -MOX_CHECKSUM := $(MOX_CHECKSUM_$(MOX_PLATFORM)_v$(MOX_VERSION)_go$(MOX_GO_VERSION)) -MOX_URL_BASE := https://beta.gobuilds.org/github.com/mjl-/mox -MOX_URL := $(MOX_URL_BASE)@v$(MOX_VERSION)/linux-$(MOX_PLATFORM)-go$(MOX_GO_VERSION)/$(MOX_CHECKSUM) -/usr/local/bin/mox: - wget -O- $(MOX_URL) | gzip -d > mox - chmod +x mox - sudo mv mox /usr/local/bin/mox - -~/mox/config/%: config/% - mkdir -p $(dir $@) && cp $< $@ - -~/mox/data: - mkdir -p $@ diff --git a/mox/resolv.conf b/mox/resolv.conf deleted file mode 100644 index b3cb117..0000000 --- a/mox/resolv.conf +++ /dev/null @@ -1 +0,0 @@ -nameserver: 127.0.0.1 diff --git a/nginx/http.d/reverse_proxy.conf.template b/nginx/http.d/reverse_proxy.conf.template deleted file mode 100644 index dc85cef..0000000 --- a/nginx/http.d/reverse_proxy.conf.template +++ /dev/null @@ -1,20 +0,0 @@ -server { - server_name ${DOMAIN}; - location / { - proxy_pass http://${HOST}:${PORT}; - } - listen 443 ssl; - ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem; - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; -} - -server { - if ($$host = ${DOMAIN}) { - return 301 https://$$host$$request_uri; - } - server_name ${DOMAIN}; - listen 80; - return 404; -} diff --git a/nginx/http.d/static.conf.template b/nginx/http.d/static.conf.template deleted file mode 100644 index 4f80be2..0000000 --- a/nginx/http.d/static.conf.template +++ /dev/null @@ -1,22 +0,0 @@ -server { - server_name ${DOMAIN}; - location / { - root ${ROOT}; - try_files $$uri $$uri.html $$uri/index.html =404; - error_page 404 /index.html; - } - listen 443 ssl; - ssl_certificate /etc/letsencrypt/live/${CERTNAME}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/${CERTNAME}/privkey.pem; - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; -} - -server { - if ($$host = ${DOMAIN}) { - return 301 https://$$host$$request_uri; - } # managed by Certbot - server_name ln.joeac.net; - listen 80; - return 404; -} diff --git a/nginx/mime.types b/nginx/mime.types deleted file mode 100644 index 1c00d70..0000000 --- a/nginx/mime.types +++ /dev/null @@ -1,99 +0,0 @@ - -types { - text/html html htm shtml; - text/css css; - text/xml xml; - image/gif gif; - image/jpeg jpeg jpg; - application/javascript js; - application/atom+xml atom; - application/rss+xml rss; - - text/mathml mml; - text/plain txt; - text/vnd.sun.j2me.app-descriptor jad; - text/vnd.wap.wml wml; - text/x-component htc; - - image/avif avif; - image/png png; - image/svg+xml svg svgz; - image/tiff tif tiff; - image/vnd.wap.wbmp wbmp; - image/webp webp; - image/x-icon ico; - image/x-jng jng; - image/x-ms-bmp bmp; - - font/woff woff; - font/woff2 woff2; - - application/java-archive jar war ear; - application/json json; - application/mac-binhex40 hqx; - application/msword doc; - application/pdf pdf; - application/postscript ps eps ai; - application/rtf rtf; - application/vnd.apple.mpegurl m3u8; - application/vnd.google-earth.kml+xml kml; - application/vnd.google-earth.kmz kmz; - application/vnd.ms-excel xls; - application/vnd.ms-fontobject eot; - application/vnd.ms-powerpoint ppt; - application/vnd.oasis.opendocument.graphics odg; - application/vnd.oasis.opendocument.presentation odp; - application/vnd.oasis.opendocument.spreadsheet ods; - application/vnd.oasis.opendocument.text odt; - application/vnd.openxmlformats-officedocument.presentationml.presentation - pptx; - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet - xlsx; - application/vnd.openxmlformats-officedocument.wordprocessingml.document - docx; - application/vnd.wap.wmlc wmlc; - application/wasm wasm; - application/x-7z-compressed 7z; - application/x-cocoa cco; - application/x-java-archive-diff jardiff; - application/x-java-jnlp-file jnlp; - application/x-makeself run; - application/x-perl pl pm; - application/x-pilot prc pdb; - application/x-rar-compressed rar; - application/x-redhat-package-manager rpm; - application/x-sea sea; - application/x-shockwave-flash swf; - application/x-stuffit sit; - application/x-tcl tcl tk; - application/x-x509-ca-cert der pem crt; - application/x-xpinstall xpi; - application/xhtml+xml xhtml; - application/xspf+xml xspf; - application/zip zip; - - application/octet-stream bin exe dll; - application/octet-stream deb; - application/octet-stream dmg; - application/octet-stream iso img; - application/octet-stream msi msp msm; - - audio/midi mid midi kar; - audio/mpeg mp3; - audio/ogg ogg; - audio/x-m4a m4a; - audio/x-realaudio ra; - - video/3gpp 3gpp 3gp; - video/mp2t ts; - video/mp4 mp4; - video/mpeg mpeg mpg; - video/quicktime mov; - video/webm webm; - video/x-flv flv; - video/x-m4v m4v; - video/x-mng mng; - video/x-ms-asf asx asf; - video/x-ms-wmv wmv; - video/x-msvideo avi; -} diff --git a/nginx/nginx.conf b/nginx/nginx.conf deleted file mode 100644 index a46887b..0000000 --- a/nginx/nginx.conf +++ /dev/null @@ -1,33 +0,0 @@ -# /etc/nginx/nginx.conf - -user nginx; -worker_processes auto; -pcre_jit on; -error_log /var/log/nginx/error.log warn; - -events { - worker_connections 1024; -} - -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - server_tokens off; - client_max_body_size 1m; - sendfile on; - tcp_nopush on; - ssl_protocols TLSv1.2 TLSv1.3; - ssl_prefer_server_ciphers on; - ssl_session_cache shared:SSL:2m; - ssl_session_timeout 1h; - gzip on; - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - access_log /var/log/nginx/access.log main; - include /etc/nginx/http.d/*.conf; -} |