freedombone-app-mailpile

#!/bin/bash
#  _____               _           _
# |   __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
# |   __|  _| -_| -_| . | . |     | . | . |   | -_|
# |__|  |_| |___|___|___|___|_|_|_|___|___|_|_|___|
#
#                              Freedom in the Cloud
#
# mailpile app
#
# This is too complicated to configure for the webadmin system
# Needs some way to create an account noninteractively
#
# License
# =======
#
# Copyright (C) 2016-2019 Bob Mottram <bob@freedombone.net>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

VARIANTS="full full-vim mailbox"

APP_CATEGORY=organization

IN_DEFAULT_INSTALL=0
SHOW_ON_ABOUT=1
NOT_IN_WEBADMIN=1
REQUIRES_APP=

MAILPILE_DOMAIN_NAME=
MAILPILE_CODE=
MAILPILE_ONION_PORT=8103
MAILPILE_REPO="https://github.com/mailpile/Mailpile"
MAILPILE_COMMIT='00f5fc57aaa7f19629e8825c5600305bd6ad7929'
MAILPILE_PORT=33411

MAILPILE_SHORT_DESCRIPTION=$'Email system'
MAILPILE_DESCRIPTION=$'Email system'
MAILPILE_MOBILE_APP_URL=

mailpile_variables=(MAILPILE_REPO
                    MAILPILE_DOMAIN_NAME
                    MAILPILE_CODE
                    ONION_ONLY
                    DDNS_PROVIDER
                    DEFAULT_DOMAIN_NAME
                    MY_USERNAME)

function upgrade_distro_mailpile {
    target_distro="$1"

    if [[ "$target_distro" == 'buster' ]]; then
        echo -n ''
    fi
}

function logging_on_mailpile {
    echo -n ''
}

function logging_off_mailpile {
    echo -n ''
}

function remove_user_mailpile {
    remove_username="$1"
    "${PROJECT_NAME}-pass" -u "$remove_username" --rmapp mailpile
    echo "0"
}

function add_user_mailpile {
    # NOTE: this is a single user system
    "${PROJECT_NAME}-pass" -u "$1" -a mailpile -p "$2"
    echo "0"
}

function install_interactive_mailpile {
    if [ ! "$ONION_ONLY" ]; then
        ONION_ONLY='no'
    fi

    if [[ $ONION_ONLY != "no" ]]; then
        MAILPILE_DOMAIN_NAME='mailpile.local'
        write_config_param "MAILPILE_DOMAIN_NAME" "$MAILPILE_DOMAIN_NAME"
    else
        function_check interactive_site_details
        interactive_site_details "mailpile" "MAILPILE_DOMAIN_NAME" "MAILPILE_CODE"
    fi
    APP_INSTALLED=1
}

function change_password_mailpile {
    echo -n ''
    #${PROJECT_NAME}-pass -u $1 -a mailpile -p "$2"
}

function reconfigure_mailpile {
    echo -n ''
}

function upgrade_mailpile {
    read_config_param "MAILPILE_DOMAIN_NAME"

    CURR_COMMIT=$MAILPILE_COMMIT
    if grep -q "mailpile commit" "$COMPLETION_FILE"; then
        CURR_COMMIT=$(get_completion_param "mailpile commit")
    fi
    if [[ "$CURR_COMMIT" == "$MAILPILE_COMMIT" ]]; then
        return
    fi

    function_check set_repo_commit
    set_repo_commit /var/www/$MAILPILE_DOMAIN_NAME/mail "mailpile commit" "$MAILPILE_COMMIT" $MAILPILE_REPO

    cd "/var/www/$MAILPILE_DOMAIN_NAME/mail" || exit 23
    pip install -r requirements.txt

    chown -R mailpile:mailpile "/var/www/$MAILPILE_DOMAIN_NAME/mail"
    systemctl restart mailpile
}

function backup_local_mailpile {
    echo -n ''
}

function restore_local_mailpile {
    echo -n ''
}

function backup_remote_mailpile {
    echo -n ''
}

function restore_remote_mailpile {
    echo -n ''
}

function remove_mailpile {
    if [ ${#MAILPILE_DOMAIN_NAME} -eq 0 ]; then
        return
    fi

    systemctl stop mailpile
    systemctl disable mailpile
    rm /etc/systemd/system/mailpile.service
    systemctl daemon-reload

    read_config_param "MAILPILE_DOMAIN_NAME"
    nginx_dissite "$MAILPILE_DOMAIN_NAME"
    remove_certs "${MAILPILE_DOMAIN_NAME}"
    if [ -f "/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME" ]; then
        rm -f "/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME"
    fi
    if [ -d "/var/www/$MAILPILE_DOMAIN_NAME" ]; then
        rm -rf "/var/www/$MAILPILE_DOMAIN_NAME"
    fi
    function_check remove_ddns_domain
    remove_ddns_domain "$MAILPILE_DOMAIN_NAME"

    groupdel -f mailpile
    userdel -r mailpile

    remove_config_param MAILPILE_DOMAIN_NAME
    remove_config_param MAILPILE_CODE
    function_check remove_onion_service
    remove_onion_service mailpile ${MAILPILE_ONION_PORT}
    remove_completion_param "install_mailpile"

    disable_email_encryption_at_rest

    sed -i '/Mailpile/d' "$COMPLETION_FILE"
    sed -i '/mailpile/d' "$COMPLETION_FILE"
}

function install_mailpile {
    if [ ! $ONION_ONLY ]; then
        ONION_ONLY='no'
    fi

    if [ ! $MAILPILE_DOMAIN_NAME ]; then
        echo $'The mailpile domain name was not specified'
        exit 63
    fi

    increment_app_install_progress

    $INSTALL_PACKAGES python-pip python-lxml python-dev libjpeg-dev

    increment_app_install_progress

    $INSTALL_PACKAGES openssl python-pgpdump python-cryptography libssl-dev

    increment_app_install_progress

    if [ ! -d /var/www/$MAILPILE_DOMAIN_NAME ]; then
        mkdir /var/www/$MAILPILE_DOMAIN_NAME
    fi

    cd "/var/www/$MAILPILE_DOMAIN_NAME" || exit 26
    if [ -d /var/www/$MAILPILE_DOMAIN_NAME/mail ]; then
        rm -rf /var/www/$MAILPILE_DOMAIN_NAME/mail
    fi

    if [ -d /repos/mailpile ]; then
        mkdir mail
        cp -r -p /repos/mailpile/. mail
        cd mail || exit 24
        git pull
    else
        git_clone $MAILPILE_REPO mail
    fi

    increment_app_install_progress

    cd "/var/www/$MAILPILE_DOMAIN_NAME/mail" || exit 63
    git checkout $MAILPILE_COMMIT -b $MAILPILE_COMMIT
    set_completion_param "mailpile commit" "$MAILPILE_COMMIT"

    if [ ! -f requirements-dev.txt ]; then
        echo $'No python requirements file found'
        exit 62
    fi
    pip install -r requirements.txt

    increment_app_install_progress

    adduser --system --home=/var/www/$MAILPILE_DOMAIN_NAME/mail/ --group mailpile

    increment_app_install_progress

    adduser mailpile debian-tor
    adduser mailpile www-data
    adduser mailpile mail
    adduser mailpile "$MY_USERNAME"
    if [[ "$ONION_ONLY" == 'no' ]]; then
        chgrp -R ssl-cert /etc/letsencrypt
        chmod -R g=rX /etc/letsencrypt
        usermod -a -G ssl-cert mailpile
    fi
    chown -R mailpile: /var/www/$MAILPILE_DOMAIN_NAME/mail/

    # create folders and tags
    su -c "cd /var/www/$MAILPILE_DOMAIN_NAME/mail && ./mp --setup" - mailpile

    increment_app_install_progress

    MAILPILE_ONION_HOSTNAME=$(add_onion_service mailpile 80 ${MAILPILE_ONION_PORT})

    increment_app_install_progress

    { echo '[Unit]';
      echo 'Description=Mailpile Email Client';
      echo 'After=syslog.target network.target nginx.target';
      echo '';
      echo '[Service]';
      echo 'User=mailpile';
      echo 'Group=mailpile';
      echo "WorkingDirectory=/var/www/$MAILPILE_DOMAIN_NAME/mail";
      echo "ExecStart=/var/www/$MAILPILE_DOMAIN_NAME/mail/mp --www=127.0.0.1:${MAILPILE_PORT} --wait";
      echo 'Restart=always';
      echo 'RestartSec=10';
      echo 'PrivateTmp=true';
      echo 'PrivateDevices=false';
      echo 'NoNewPrivileges=true';
      echo 'CapabilityBoundingSet=~CAP_SYS_ADMIN';
      echo '';
      echo '[Install]';
      echo 'WantedBy=multi-user.target'; } > /etc/systemd/system/mailpile.service
    chmod +x /etc/systemd/system/mailpile.service

    increment_app_install_progress

    mailpile_nginx_site="/etc/nginx/sites-available/$MAILPILE_DOMAIN_NAME"
    if [[ $ONION_ONLY == "no" ]]; then
        function_check nginx_http_redirect
        nginx_http_redirect $MAILPILE_DOMAIN_NAME
        { echo 'server {';
          echo '  listen 443 ssl;';
          echo '  #listen [::]:443 ssl;';
          echo "  server_name $MAILPILE_DOMAIN_NAME;";
          echo '';
          echo '  # Security'; } >> $mailpile_nginx_site
        function_check nginx_ssl
        nginx_ssl "$MAILPILE_DOMAIN_NAME"

        function_check nginx_security_options
        nginx_security_options "$MAILPILE_DOMAIN_NAME"
        nginx_robots "$MAILPILE_DOMAIN_NAME"

        { echo '  add_header Strict-Transport-Security max-age=15768000;';
          echo '';
          echo '  # Logs';
          echo '  access_log /dev/null;';
          echo '  error_log /dev/null;';
          echo '';
          echo '  # Root';
          echo "  root /var/www/$MAILPILE_DOMAIN_NAME/mail;";
          echo '';
          echo '  location / {'; } >> $mailpile_nginx_site
        function_check nginx_limits
        nginx_limits "$MAILPILE_DOMAIN_NAME" '15m'
        { echo "    rewrite /(.*) /\$1 break;";
          echo "    proxy_set_header X-Real-IP \$remote_addr;";
          echo "    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;";
          echo "    proxy_set_header Host \$http_host;";
          echo '    proxy_set_header X-NginX-Proxy true;';
          echo "    proxy_pass http://localhost:${MAILPILE_PORT};";
          echo '    proxy_redirect off;';
          echo '  }';
          echo '}';
          echo ''; } >> $mailpile_nginx_site
    else
        echo -n '' > $mailpile_nginx_site
    fi
    { echo 'server {';
      echo "    listen 127.0.0.1:$MAILPILE_ONION_PORT default_server;";
      echo '    port_in_redirect off;';
      echo "    server_name $MAILPILE_ONION_HOSTNAME;";
      echo ''; } >> $mailpile_nginx_site
    function_check nginx_security_options
    nginx_security_options "$MAILPILE_DOMAIN_NAME"
    { echo '';
      echo '  # Logs';
      echo '  access_log /dev/null;';
      echo '  error_log /dev/null;';
      echo '';
      echo '  # Root';
      echo "  root /var/www/$MAILPILE_DOMAIN_NAME/mail;";
      echo '';
      echo '  location / {'; } >> $mailpile_nginx_site
    function_check nginx_limits
    nginx_limits "$MAILPILE_DOMAIN_NAME" '15m'
    { echo "    rewrite /(.*) /\$1 break;";
      echo "    proxy_set_header X-Real-IP \$remote_addr;";
      echo "    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;";
      echo "    proxy_set_header Host \$http_host;";
      echo '    proxy_set_header X-NginX-Proxy true;';
      echo "    proxy_pass http://localhost:${MAILPILE_PORT};";
      echo '    proxy_redirect off;';
      echo '  }';
      echo '}'; } >> $mailpile_nginx_site

    increment_app_install_progress

    function_check create_site_certificate
    if [ ! -f "/etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem" ]; then
        create_site_certificate "$MAILPILE_DOMAIN_NAME" 'yes'
    fi

    increment_app_install_progress

    if [ -f "/etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.crt" ]; then
        mv "/etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.crt" "/etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem"
    fi
    if [ -f "/etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem" ]; then
        chown root:root "/etc/ssl/certs/${MAILPILE_DOMAIN_NAME}.pem"
        sed -i "s|.crt|.pem|g" "/etc/nginx/sites-available/${MAILPILE_DOMAIN_NAME}"
    fi
    if [ -f "/etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key" ]; then
        chown root:root "/etc/ssl/private/${MAILPILE_DOMAIN_NAME}.key"
    fi

    function_check nginx_ensite
    nginx_ensite "$MAILPILE_DOMAIN_NAME"

    "${PROJECT_NAME}-pass" -u "$MY_USERNAME" -a mailpile -p "*"

    increment_app_install_progress

    function_check add_ddns_domain
    add_ddns_domain "$MAILPILE_DOMAIN_NAME"

    disable_email_encryption_at_rest

    increment_app_install_progress

    # if strict https is enforced then buttons don't work. This is probably a security bug
    sed -i "/Content-Security-Policy/d" $mailpile_nginx_site

    # link to the administrator's keyring
    if [ -d "/var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg" ]; then
        mv "/var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg" "/var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg_orig"
    fi
    cp -r "/home/$MY_USERNAME/.gnupg" "/var/www/$MAILPILE_DOMAIN_NAME/mail/"
    chown -R mailpile:mailpile "/var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg"
    chmod +x "/var/www/$MAILPILE_DOMAIN_NAME/mail/.gnupg"

    increment_app_install_progress

    pip install jinja2==2.9.6

    increment_app_install_progress

    pip install pgpdump==1.5

    increment_app_install_progress

    # turn off ssl in dovecot
    sed -i 's|#ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf
    sed -i 's|ssl =.*|ssl = no|g' /etc/dovecot/conf.d/10-ssl.conf

    # set ssl certs, just in case we want to use them later
    if [[ "$ONION_ONLY" == "no" ]]; then
        if [ -f "/etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem" ]; then
            sed -i "s|#ssl_cert =.*|ssl_cert = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem|g" /etc/dovecot/conf.d/10-ssl.conf
            sed -i "s|ssl_cert =.*|ssl_cert = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/fullchain.pem|g" /etc/dovecot/conf.d/10-ssl.conf
            sed -i "s|#ssl_key =.*|ssl_key = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem|g" /etc/dovecot/conf.d/10-ssl.conf
            sed -i "s|ssl_key =.*|ssl_key = </etc/letsencrypt/live/${DEFAULT_DOMAIN_NAME}/privkey.pem|g" /etc/dovecot/conf.d/10-ssl.conf
        fi

        groupadd ssl-cert
        usermod -a -G ssl-cert dovecot
    fi

    increment_app_install_progress

    systemctl restart dovecot

    increment_app_install_progress

    systemctl enable mailpile
    systemctl daemon-reload
    systemctl start mailpile

    increment_app_install_progress

    systemctl restart nginx

    set_completion_param "mailpile domain" "$MAILPILE_DOMAIN_NAME"
    APP_INSTALLED=1
}

# NOTE: deliberately no exit 0