From c0d248d18c4d2a8921ef59377c26382abbffe8c3 Mon Sep 17 00:00:00 2001 From: Gustaf Rydholm Date: Tue, 16 Aug 2022 01:21:02 +0200 Subject: Update hugo framework --- static/emailwiz.sh | 339 ++++++++++++++++++++++++++++++++++++++ static/gustafgpg.gpg | 52 ++++++ static/images/git.png | Bin 0 -> 2383 bytes static/images/github.png | Bin 0 -> 23729 bytes static/images/gitlab.png | Bin 0 -> 5468 bytes static/images/landchad.gif | Bin 0 -> 15127 bytes static/images/no-clown-fiesta.png | Bin 0 -> 298973 bytes static/rss.svg | 1 + static/style.css | 98 +++++++++++ 9 files changed, 490 insertions(+) create mode 100755 static/emailwiz.sh create mode 100644 static/gustafgpg.gpg create mode 100644 static/images/git.png create mode 100644 static/images/github.png create mode 100644 static/images/gitlab.png create mode 100644 static/images/landchad.gif create mode 100644 static/images/no-clown-fiesta.png create mode 100644 static/rss.svg create mode 100644 static/style.css (limited to 'static') diff --git a/static/emailwiz.sh b/static/emailwiz.sh new file mode 100755 index 0000000..19bd57f --- /dev/null +++ b/static/emailwiz.sh @@ -0,0 +1,339 @@ +#!/bin/sh + +# THE SETUP + +# Mail will be stored in non-retarded Maildirs because it's $currentyear. This +# makes it easier for use with isync, which is what I care about so I can have +# an offline repo of mail. + +# The mailbox names are: Inbox, Sent, Drafts, Archive, Junk, Trash + +# Use the typical unix login system for mail users. Users will log into their +# email with their passnames on the server. No usage of a redundant mySQL +# database to do this. + +# DEPENDENCIES BEFORE RUNNING + +# 1. Have a Debian system with a static IP and all that. Pretty much any +# default VPS offered by a company will have all the basic stuff you need. This +# script might run on Ubuntu as well. Haven't tried it. If you have, tell me +# what happens. + +# 2. Have a Let's Encrypt SSL certificate for $maildomain. You might need one +# for $domain as well, but they're free with Let's Encypt so you should have +# them anyway. + +# 3. If you've been toying around with your server settings trying to get +# postfix/dovecot/etc. working before running this, I recommend you `apt purge` +# everything first because this script is build on top of only the defaults. +# Clear out /etc/postfix and /etc/dovecot yourself if needbe. + +# NOTE WHILE INSTALLING + +# On installation of Postfix, select "Internet Site" and put in TLD (without +# `mail.` before it). + +echo "Installing programs..." +pacman -S postfix dovecot opendkim spamassassin pigeonhole +# Check if OpenDKIM is installed and install it if not. +which opendkim-genkey >/dev/null 2>&1 || pacman -S opendkim-tools +[ -e /etc/mailname ] || echo "Could not find a mailname in /etc/" && exit 1 +domain="$(cat /etc/mailname)" +subdom=${MAIL_SUBDOM:-mail} +maildomain="$subdom.$domain" +certdir="/etc/letsencrypt/live/$maildomain" + +[ ! -d "$certdir" ] && certdir="$(dirname "$(certbot certificates 2>/dev/null | grep "$maildomain\|*.$domain" -A 2 | awk '/Certificate Path/ {print $3}' | head -n1)")" + +[ ! -d "$certdir" ] && echo "Note! You must first have a Let's Encrypt Certbot HTTPS/SSL Certificate for $maildomain. + +Use Let's Encrypt's Certbot to get that and then rerun this script. + +You may need to set up a dummy $maildomain site in nginx or Apache for that to work." && exit 1 + +# NOTE ON POSTCONF COMMANDS + +# The `postconf` command literally just adds the line in question to +# /etc/postfix/main.cf so if you need to debug something, go there. It replaces +# any other line that sets the same setting, otherwise it is appended to the +# end of the file. + +echo "Configuring Postfix's main.cf..." + +# Change the cert/key files to the default locations of the Let's Encrypt cert/key +postconf -e "smtpd_tls_key_file=$certdir/privkey.pem" +postconf -e "smtpd_tls_cert_file=$certdir/fullchain.pem" +postconf -e "smtp_tls_CAfile=$certdir/cert.pem" + +# Enable, but do not require TLS. Requiring it with other server would cause +# mail delivery problems and requiring it locally would cause many other +# issues. +postconf -e "smtpd_tls_security_level = may" +postconf -e "smtp_tls_security_level = may" + +# TLS required for authentication. +postconf -e "smtpd_tls_auth_only = yes" + +# Exclude obsolete, insecure and obsolete encryption protocols. +postconf -e "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1" +postconf -e "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1" +postconf -e "smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1" +postconf -e "smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1" + +# Exclude suboptimal ciphers. +postconf -e "tls_preempt_cipherlist = yes" +postconf -e "smtpd_tls_exclude_ciphers = aNULL, LOW, EXP, MEDIUM, ADH, AECDH, MD5, DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256, RSA+AES, eNULL" + + +# Here we tell Postfix to look to Dovecot for authenticating users/passwords. +# Dovecot will be putting an authentication socket in /var/spool/postfix/private/auth +postconf -e "smtpd_sasl_auth_enable = yes" +postconf -e "smtpd_sasl_type = dovecot" +postconf -e "smtpd_sasl_path = private/auth" + +# Sender and recipient restrictions +postconf -e "smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination" + +# NOTE: the trailing slash here, or for any directory name in the home_mailbox +# command, is necessary as it distinguishes a maildir (which is the actual +# directories that what we want) from a spoolfile (which is what old unix +# boomers want and no one else). +postconf -e "home_mailbox = Mail/Inbox/" + +# master.cf +echo "Configuring Postfix's master.cf..." + +sed -i "/^\s*-o/d;/^\s*submission/d;/^\s*smtp/d" /etc/postfix/master.cf + +echo "smtp unix - - n - - smtp +smtp inet n - y - - smtpd + -o content_filter=spamassassin +submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt + -o smtpd_sasl_auth_enable=yes + -o smtpd_tls_auth_only=yes +smtps inet n - y - - smtpd + -o syslog_name=postfix/smtps + -o smtpd_tls_wrappermode=yes + -o smtpd_sasl_auth_enable=yes +spamassassin unix - n n - - pipe + user=spamd argv=/usr/bin/vendor_perl/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}" >> /etc/postfix/master.cf + + +# By default, dovecot has a bunch of configs in /etc/dovecot/conf.d/ These +# files have nice documentation if you want to read it, but it's a huge pain to +# go through them to organize. Instead, we simply overwrite +# /etc/dovecot/dovecot.conf because it's easier to manage. You can get a backup +# of the original in /usr/share/dovecot if you want. + +[ -d "/etc/dovecot" ] || mkdir /etc/dovecot +cp /usr/share/doc/dovecot/example-config/dovecot.conf /etc/dovecot/dovecot.conf +cp -r /usr/share/doc/dovecot/example-config/conf.d /etc/dovecot +mv /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.backup.conf + +echo "Creating Dovecot config..." + +openssl dhparam -out /etc/dovecot/dh.pem 4096 + +echo "# Dovecot config +# Note that in the dovecot conf, you can use: +# %u for username +# %n for the name in name@domain.tld +# %d for the domain +# %h the user's home directory + +# If you're not a brainlet, SSL must be set to required. +ssl = required +ssl_cert = <$certdir/fullchain.pem +ssl_key = <$certdir/privkey.pem +ssl_min_protocol = TLSv1.2 +ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED +ssl_prefer_server_ciphers = yes +ssl_dh = /etc/dovecot/dovecot.conf + +# If using an old version of Dovecot, remove the ssl_dl line. +case "$(dovecot --version)" in + 1|2.1*|2.2*) sed -i "/^ssl_dh/d" /etc/dovecot/dovecot.conf ;; +esac + +mkdir -p /var/lib/dovecot/sieve/ + +echo "require [\"fileinto\", \"mailbox\"]; +if header :contains \"X-Spam-Flag\" \"YES\" + { + fileinto \"Junk\"; + }" > /var/lib/dovecot/sieve/default.sieve + +grep -q "^vmail:" /etc/passwd || useradd vmail +chown -R vmail:vmail /var/lib/dovecot +sievec /var/lib/dovecot/sieve/default.sieve + +echo "Preparing user authentication..." +grep -q nullok /etc/pam.d/dovecot || +echo "auth required pam_unix.so nullok +account required pam_unix.so" >> /etc/pam.d/dovecot + +# OpenDKIM + +# A lot of the big name email services, like Google, will automatically reject +# as spam unfamiliar and unauthenticated email addresses. As in, the server +# will flatly reject the email, not even delivering it to someone's Spam +# folder. + +# OpenDKIM is a way to authenticate your email so you can send to such services +# without a problem. + +# Create an OpenDKIM key in the proper place with proper permissions. +echo "Generating OpenDKIM keys..." +mkdir -p /etc/postfix/dkim +opendkim-genkey -D /etc/postfix/dkim/ -d "$domain" -s "$subdom" +chmod g+r /etc/postfix/dkim/* + +# Generate the OpenDKIM info: +echo "Configuring OpenDKIM..." +cp /usr/share/doc/opendkim/opendkim.conf.sample /etc/opendkim/opendkim.conf +grep -q "$domain" /etc/postfix/dkim/keytable 2>/dev/null || +echo "$subdom._domainkey.$domain $domain:$subdom:/etc/postfix/dkim/$subdom.private" >> /etc/postfix/dkim/keytable + +grep -q "$domain" /etc/postfix/dkim/signingtable 2>/dev/null || +echo "*@$domain $subdom._domainkey.$domain" >> /etc/postfix/dkim/signingtable + +grep -q "127.0.0.1" /etc/postfix/dkim/trustedhosts 2>/dev/null || + echo "127.0.0.1 +10.1.0.0/16 +1.2.3.4/24" >> /etc/postfix/dkim/trustedhosts + +# ...and source it from opendkim.conf +grep -q "^KeyTable" /etc/opendkim/opendkim.conf 2>/dev/null || echo "KeyTable file:/etc/postfix/dkim/keytable +SigningTable refile:/etc/postfix/dkim/signingtable +InternalHosts refile:/etc/postfix/dkim/trustedhosts" >> /etc/opendkim/opendkim.conf + +sed -i '/^#Canonicalization/s/simple/relaxed\/simple/' /etc/opendkim/opendkim.conf +sed -i '/^#Canonicalization/s/^#//' /etc/opendkim/opendkim.conf + +sed -i '/Socket/s/^#*/#/' /etc/opendkim/opendkim.conf +grep -q "^Socket\s*inet:12301@localhost" /etc/opendkim/opendkim.conf || echo "Socket inet:12301@localhost" >> /etc/opendkim/opendkim.conf + +# Here we add to postconf the needed settings for working with OpenDKIM +echo "Configuring Postfix with OpenDKIM settings..." +postconf -e "smtpd_sasl_security_options = noanonymous, noplaintext" +postconf -e "smtpd_sasl_tls_security_options = noanonymous" +postconf -e "myhostname = $domain" +postconf -e "milter_default_action = accept" +postconf -e "milter_protocol = 6" +postconf -e "smtpd_milters = inet:127.0.0.1:12301" +postconf -e "non_smtpd_milters = inet:127.0.0.1:12301" +postconf -e "mailbox_command = /usr/lib/dovecot/deliver" + +systemctl daemon-reload + +for x in spamassassin opendkim dovecot postfix; do + printf "Restarting %s..." "$x" + systemctl enable --now "$x" && printf " ...done\\n" +done + +# If ufw is used, enable the mail ports. +ufw status | grep -qw active && { ufw allow 993; ufw allow 465 ; ufw allow 587; ufw allow 25 ;} + +pval="$(tr -d "\n" "$HOME/dns_emailwizard" + +printf "\033[31m + _ _ +| \ | | _____ ___ +| \| |/ _ \ \ /\ / (_) +| |\ | (_) \ V V / _ +|_| \_|\___/ \_/\_/ (_)\033[0m + +Add these three records to your DNS TXT records on either your registrar's site +or your DNS server: +\033[32m +$dkimentry + +$dmarcentry + +$spfentry +\033[0m +NOTE: You may need to omit the \`.$domain\` portion at the beginning if +inputting them in a registrar's web interface. + +Also, these are now saved to \033[34m~/dns_emailwizard\033[0m in case you want them in a file. + +Once you do that, you're done! Check the README for how to add users/accounts +and how to log in." diff --git a/static/gustafgpg.gpg b/static/gustafgpg.gpg new file mode 100644 index 0000000..9352534 --- /dev/null +++ b/static/gustafgpg.gpg @@ -0,0 +1,52 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGHDc8UBEADHJYQmBPaVLmMAM7SNQX3k6Hay3bjujUy6L1dqWfLSvFfb3vc9 +Nq/ifGhjc1xJZTbRt7tIlDEPFMBjA+WXLvlml9ZkJ0mWFzMrXlR92kqILd9bG+G6 +rK+9UPXU6AKnwo3/zdZa6seFuL1v76jWlQuG1NgSV2kuI6r532bXmTY2L7gX+GEN +588uP8VJkN8MhPixHcNCp5xr0qpa18uKEOrVl7bt+BComNDEHyzoaKAIkFscoxqX +uHrAivoxf0h4b3c2O3h22m9jJFOCVIdlJjWDDHBcOYMzK4ACKYktoLrJoUJ1J41v +VQR1SXJ55H95mUlN4o8KwkYLOTO5K2Xbf4p2P6O0Ksz7rVPpZ2mCOQyMGJPs5tJZ +GoPLhTcaQM0sOiae0dluz/BjAB5tvjqP59eI5VTr7wictTh6onvFlL916Au6E3bo +bH34Vm7GQUNbfLWa+M6C3ywTg+J/jYeHYkzbU2q7qvu19f57e4OxxI2VdbQv5gBx +fCZhXOB/JgLNJ4M2LTHv/ja5bDu1WWBBa+pkKt0LYiOKFezcRKvA50Z7RYqB57Yj +l0rNW0gJecqljV2keCuHSUOzFTdsoooWSkoLK1aofune30zSA5kLEx1zfzJdE0x9 +7Scq1M0YfhVoyjcRc/fuAR543n2eT6WqPAJ28Rii5tRufB/BExSWNLAUKwARAQAB +tClHdXN0YWYgUnlkaG9sbSA8Z3VzdGFmLnJ5ZGhvbG1AZ21haWwuY29tPokCUQQT +AQgAOwIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgBYhBJC8V+3TDxOSzZ/TZykh +33Ae4DOUBQJhw3vLAhkBAAoJECkh33Ae4DOUqhUP+wYXo5WBS5VNSAtfp92vpBi/ +Q/S2O9UALBLCNQNl6oRCFrxWKF1dHh2sBKVfjcQTqXOQRW2JppQgwpFvji598M/j +M0yQHnfqzYLwKKHGzmU1/jXF/8ZFb6fertHtEYwHAcd/08xcK1m1U5d+MWhg7uqA +RiwBmAGttfTq3kTxAlU58Ra5R7SA4otdUzByXprTSXxKJf4nfyoe+Aamdm/KkZ9d +qvC0kPzdqx0w32gcU06BKOAWJLyiG1d0oiZkz8hZOOmwaycbhEbHHExTsPn9xu1I +UG5Dqhs6vGt+FBrFKPpAa1+x1O8qtr05QcfBFNOvibJ1qSVbn8lMcCRT3LWd0RkG +rMUwCNu0j3rtA55lEYlrKHSsWX6ksQr4NTOU/2W7wguNjsPyT7N/AK6IwPBbDwvQ +FIMe0y+breQIyB32DmIobMIlDxIQ7Xjjg9x3FFRFrSFuIdjo0c80Aq2NKX+9svIY +E1653vOcXbxWGjIcTxIrPPTXLLrdjUgdtDOjfl/EiFzrCPYSDmrfYhEZz4gV4OhX +t82xC/N6Fnx7n0m6lkSdzaVVhFfjhpPE8jyHxlnb2sjrB+VuhETZ5lXG1BSSEpdL +4/IyuNhx8dzamkqHI1QrYRwZlr1XnLV1qpM4n70BLBew5SvVW5Xo4s/DkTEvHExc +90FuKaXLFlvkQNAw0cU/uQINBGHDc8UBEACraf+XZzymer4AcwgpF2F36h7s004V +XP4sn4U8y6q+t+cIhQ2rLbhHXcIXsWfzarfMyQG0nmv/YlWd0/18FNaVl6w+v3t2 +z/CVgKSoZazCa9Bs+qAPxtzDDa4rLMDN57VW1JXEQ7OqzgvpEK08m5qWaKFWSF7x +GcXZrWABLf+U57FD3cKfrKu9E2irXlACSh0PgRZHJFOU95tkqVHGZa66LumF/ONO +S/SnWtIC13+reHcLuwwiV627N2NMWDcw/9qZKKzFE6IHg4uFDl9fVRYNCJFOHFu+ +9GCXYXbxtmdwkXeh5bhoUFfzr6OWKiMWT2/+iOPboLz4eD0fGwvfoSzLXXI3i2Ux +xOdjkpvrF2jY0LxZNDoifz/OzejfIAJdtSgI2bKamY13hS9vhj1g93moIPefDNdL +k72ixMtY/e/aU5hq/S/q9ANvKVNmSS8inl7YzVXJzeCsevQT7MWrdAU7ifqnWeDR +oI+TxVkJJKlkC7gbCFnIRbxU7lkVZ3zY0CPPOAn1q5Q39XGUjJnUYeNSPdcv7j8F +gAd1S5nUEcwgslBwWiEAaOmADhDVkB8Y53REVfpoVt1IPfOENMp6EIMXX9tijasF +M8qiolcrc03yCZozO8v14LLvdG5YfpsEPh9KvaLYP6hGpbKYUzmMep7K9zUpzCc9 +DVoNxj6WgxViCwARAQABiQI2BBgBCAAgFiEEkLxX7dMPE5LNn9NnKSHfcB7gM5QF +AmHDc8UCGwwACgkQKSHfcB7gM5RqWQ//QiQxdluuBAondfIzFRMhBIx/d05qkUWn +UeaGjbdzKVmbq9NQkklh3CefBXMuQc1El2rMY3tWJPVNaAyJNAwQSDAwTdfR45aD +LdlM7hrP+kPu2kT+EAgXVs/463ZBiQeIMUj7OBLwufJnntsNwpFHEyXFsVloJCq5 +8CgMpam901VhALoQBKIgm/hjb9YFTON1JI/vkfDLJQw5uxN4JKKgVO+O8uLTUKJV +eVVyvp7lwb3r3GSY0fkEH1RHs6xIxo75VfDGov1Y48JheA5YXQx8Ic0IDKkQjECy +bgqW34OVVKCUj8WtOE61dsRQa2tyHUf/egN3tYfoPDttWJQfrJZMlOI0DfmCkO+O +zMNZAlqrjvEGioWS3L9RNphfh3x/4vNbmdfzaSBU2TEZknR58sTQQu2Hci218u+g +GFlRxwPVZiirCZJ/7Efm4u0xlJRMEUAELiSvCozug6yWhf788yRb1ZxcCbOuwNFN +P4aYHKrPFXdJn4NCb9oSFkuBvLzqT/xUqdkoZLv3uJqO8Ik9iuDz2KksHI2uZXyj +RGSRLYmV//aIz5m5DOtwvn1TJOMfOOZA/ii0Q6Oi49Dy16uWLcL8dRHsABJUJcX+ +e7EBHUIC122qWQ6TRKRogrCze8MTDNUJ35G6xF8WCUz1bemHGqZH6QO7Yy8SkP32 +qRMN8HvqPWw= +=ciZM +-----END PGP PUBLIC KEY BLOCK----- diff --git a/static/images/git.png b/static/images/git.png new file mode 100644 index 0000000..51f4ae5 Binary files /dev/null and b/static/images/git.png differ diff --git a/static/images/github.png b/static/images/github.png new file mode 100644 index 0000000..d5dacf8 Binary files /dev/null and b/static/images/github.png differ diff --git a/static/images/gitlab.png b/static/images/gitlab.png new file mode 100644 index 0000000..1e8f7ad Binary files /dev/null and b/static/images/gitlab.png differ diff --git a/static/images/landchad.gif b/static/images/landchad.gif new file mode 100644 index 0000000..302cd26 Binary files /dev/null and b/static/images/landchad.gif differ diff --git a/static/images/no-clown-fiesta.png b/static/images/no-clown-fiesta.png new file mode 100644 index 0000000..8f32f4e Binary files /dev/null and b/static/images/no-clown-fiesta.png differ diff --git a/static/rss.svg b/static/rss.svg new file mode 100644 index 0000000..dfda038 --- /dev/null +++ b/static/rss.svg @@ -0,0 +1 @@ + diff --git a/static/style.css b/static/style.css new file mode 100644 index 0000000..df4b7ed --- /dev/null +++ b/static/style.css @@ -0,0 +1,98 @@ +body { + background: #033 ; + color: brown ; + max-width: 850px ; + margin: auto ; + padding: 0 16px ; + margin-bottom: 500px ; + scrollbar-color: gray #151515; + font-family: sans-serif ; +} + +main { + max-width: 800px ; + margin: auto ; +} + +main > article { + background: #88afa2 ; + color: #151515 ; + margin-bottom: 0 ; + padding: 3.5em ; + border-color: #1e4e76 ; + border-width: 0.25em 0.25em 0.25em .25em ; + border-style: solid ; + text-align: justify; + border-radius: 0 ; + margin: auto ; +} + +img { + max-width: 100% ; +} + +header h1 { + text-align: center ; + text-shadow: 3px 0 black, 3px 3px black, 0 3px black; +} + +h1 { + border-style: solid ; + border-width: 0px 0px 2px 0px ; + text-align: center ; +} + +h2 { + color: #151515 ; + text-align: center ; +} + +footer { + max-width: 300px ; + background: #88afa2 ; + margin-left: auto ; + margin-right: auto ; + margin-top: -4px ; + text-align: center ; + clear: both ; + border-color: #1e4e76 ; + border-width: 0em 0.25em 0.25em 0.25em ; + border-style: solid ; + border-radius: 0 0 0 0 ; +} + +code { + color: #373737 ; + overflow-wrap: break-word ; + font-size: 10pt ; +} + +/* For TAGLIST.HTML */ +.taglist { + text-align: center ; + clear: both ; +} + +/* For NEXTPREV.HTML */ +#nextprev { + /* The container for both the previous and next articles. */ +} + +#prevart { + float: left ; + text-align: left ; +} + +#nextart { + float: right ; + text-align: right ; +} + +#nextart,#prevart { + max-width: 33% ; +} + +table, th, td { + width: 400px ; + border: 1px solid; +} -- cgit v1.2.3-70-g09d2