common.conf

# Common configurations for several scripts
# This config is not minded to be edited by users
#
# Do not change this unless you know what are you doing!!!

# Load OS metadata
source /etc/os-release

# Author Email
AUTHOR=pavelmc@gmail.com

# APT options:
#  '-y -qq' for automatic and super quiet installs
#  '-y' for noisy but detailed installs
APT_OPTS="-y -qq"
export DEBIAN_FRONTEND=noninteractive 

# OS support matrix
# Ubuntu
OS_DISCONTINUED_U=("bionic" "focal")
OS_LEGACY_U=("jammy")
OS_SUPPORTED_U=("noble")
# Debian
OS_DISCONTINUED_D=("buster")
OS_LEGACY_D=("bullseye")
OS_SUPPORTED_D=("bookworm" "trixie")
# mix
OS_DISCONTINUED=("${OS_DISCONTINUED_U[@]}" "${OS_DISCONTINUED_D[@]}")
OS_LEGACY=("${OS_LEGACY_U[@]}" "${OS_LEGACY_D[@]}")
OS_SUPPORTED=("${OS_SUPPORTED_U[@]}" "${OS_SUPPORTED_D[@]}")
# all supported distros
OS_WORKING_U=("${OS_DISCONTINUED_U[@]}" "${OS_LEGACY_U[@]}" "${OS_SUPPORTED_U[@]}")
OS_WORKING_D=("${OS_DISCONTINUED_D[@]}" "${OS_LEGACY_D[@]}" "${OS_SUPPORTED_D[@]}")
OS_WORKING=("${OS_WORKING_U[@]}" "${OS_WORKING_D[@]}")

# Common deps packages
COMMON_DEPS_PKGS="rsyslog ldap-utils libldap-common dnsutils netcat-traditional openssl ca-certificates wget git gettext-base cron sudo"

#### Pkgs to install for Debian Buster & Bullseye (10/11)
DEBIAN_BASE_PKGS="postfix postfix-pcre postfix-ldap dovecot-core dovecot-pop3d dovecot-imapd dovecot-ldap dovecot-sieve dovecot-managesieved libnet-ldap-perl rsync dnsutils pflogsumm mailutils p7zip-full unrar-free cabextract amavisd-new"

# Pkgs to install for Ubuntu Bionic & Focal (18.04/20.04)
UBUNTU_BASE_PKGS="postfix postfix-pcre postfix-ldap dovecot-core dovecot-pop3d dovecot-imapd dovecot-ldap dovecot-sieve dovecot-managesieved libnet-ldap-perl rsync dnsutils pflogsumm mailutils p7zip-full unrar-free cabextract amavisd-new-postfix p7zip-rar"

### Spamassassin pkgs [olds by default]
DEBIAN_SPAMD_PKGS="spamassassin"
SPAMD_SERVICENAMES="spamassassin"
case "${VERSION_CODENAME}" in
    noble|trixie)
        DEBIAN_SPAMD_PKGS="spamd"
        SPAMD_SERVICENAMES="spamd"
        ;;
esac

### Clamav pkgs
DEBIAN_AV_PKGS="clamav-freshclam clamav-daemon"

### Disclaimer pkgs
DEBIAN_DISCLAIMER_PKGS="altermime"

### HTTP server pkgs
WEBSERVER_PKGS="nginx php-fpm php-dom php-mbstring php-bz2 php-zip php-json php-xml php-net-ldap3 php-ldap php-gd php-exif php-sqlite3 php-tidy fail2ban nftables sqlite3 dbconfig-sqlite3 php-mysql"

### WEBMAILS pkgs
ROUNDCUBE_PKGS="roundcube roundcube-sqlite3 roundcube-plugins-extra roundcube-mysql"
SNAPPY_PKGS=""
SNAPPY_DIR="/var/www/snappymail"

#### Common service names to start/stop (TODO if the same as PKGCOMMON reduce it at the end)
SERVICENAMES="dovecot postfix amavisd-new"

# but for debian 11 and ubuntu 22.04 and onwards amavisd-new is just "amavis"
case "${VERSION_CODENAME}" in
    bullseye|jammy|noble|bookworm|trixie)
        SERVICENAMES="dovecot postfix amavis"
        ;;
esac

### AV service names
AV_SERVICENAMES="clamav-daemon clamav-freshclam"

# Get the var names from the config file
VARS=$(cat mailad.conf | grep -v "#" | sort -r | uniq | cut -d "=" -f 1)

### Special vars that need a special care
# local domain: will be filled on provision.sh script
ESCDOMAIN=""

# National/regional domain to restric some users
ESCNATIONAL=".cu"

# install data for the feedback
INSTFILE=/etc/mailad/installs.data

###########################################
# Common functions
###########################################

# Vars needed for the functions below
PKGS=""
SRVS=""

# Debian-like pkgs already installed check
function already_installed_debs {
    # List of pkgs is dynamically assigned by the code below

    # Check if there is already one of them installed and warn the user about it
    # offering a way to uninstall it
    for p in $(echo $PKGCOMMON | xargs) ; do
        # Test if the pkg is installed
        LIST=$(dpkg -l | grep $p)
        if [ "$LIST" != "" ] ; then
            # Fail, some of the packages are installed
            echo "===> ERROR!"
            echo "     Some of the pkgs we are about to install are already installed"
            echo "     so, this system is dirty and it's not recommended to install it"
            echo "     here; or you can force a purge runnig: 'make install-purge'"
            echo "     and run 'make install' again"
            echo " "
            exit 1
        fi
    done
}

# Debian packages install
function install_debs {
    # Fix ubuntu bug: see https://bugs.launchpad.net/ubuntu/+source/amavisd-new/+bug/251377
    echo "===> Apply Ubuntu fix for some envs [Github runners?]"
    dirs=(/ /usr /bin /sbin /usr/bin /usr/sbin /usr/local /usr/local/bin /usr/local/sbin)
    changed_dirs=()

    for dir in "${dirs[@]}"; do
        if [ -d "$dir" ]; then
            perm=$(stat -c "%a" "$dir" 2>/dev/null)
            if [ "$perm" -eq 777 ]; then
                echo "Changing permissions of $dir from 777 to 755"
                chmod 755 "$dir" && changed_dirs+=("$dir")
            fi
        else
            echo "Notice: $dir does not exist, skipping."
        fi
    done

    # Do it
    export DEBIAN_FRONTEND=noninteractive
    apt-get install ${APT_OPTS} $PKGS 

    # Checking for success
    R=$?
    if [ $R -ne 0 ] ; then
        # Debug
        dervices

        # apt install failed on any way
        echo "==========================================================================="
        echo "ERROR: The update and install of the main software failed, this is mostly"
        echo "       a problem related to a bad configured repository or a not reacheable"
        echo "       one, please fix that and try again."
        echo "==========================================================================="
        echo "       The deps install process will stop now"
        echo "==========================================================================="

        # Exit 1
        exit 1
    fi
}

# Return the pkgs for the AV install if it's enabled
function debian_av_pkgs {
    # Load the config file on demand
    source /etc/mailad/mailad.conf

    # Check for AV
    if [ "$ENABLE_AV" == "yes" -o "$ENABLE_AV" == "Yes" ] ; then
        echo "${DEBIAN_AV_PKGS}"
    fi
}

# Return the pkgs for the spamd install if it's enabled
function debian_spamd_pkgs {
    # Load the config file on demand
    source /etc/mailad/mailad.conf

    # Check for spamd
    if [ "$ENABLE_SPAMD" == "yes" -o "$ENABLE_SPAMD" == "Yes" ] ; then
        echo "${DEBIAN_SPAMD_PKGS}"
    fi
}

# Return the pkgs for disclaimer settings
function debian_disclaimer_pkgs {
    # Load the config file on demand
    source /etc/mailad/mailad.conf

    # Check for spamd
    if [ "$ENABLE_DISCLAIMER" == "yes" -o "$ENABLE_DISCLAIMER" == "Yes" ] ; then
        echo "${DEBIAN_DISCLAIMER_PKGS}"
    fi
}

# Craft the correct set if pkgs
function craft_pkg_list {
    # Just one parameter, the distro name in lowercase

    # Load the config file on demand
    source /etc/mailad/mailad.conf

    # Optional Debian pkgs from the configs
    DAV=$(debian_av_pkgs)
    DSPAMD=$(debian_spamd_pkgs)
    DDISC=$(debian_disclaimer_pkgs)

    case "$1" in
    "debian")
        PKGS="${DEBIAN_BASE_PKGS} $DAV $DSPAMD $DDISC"
        ;;
    "ubuntu")
        PKGS="${UBUNTU_BASE_PKGS} $DAV $DSPAMD $DDISC"
        ;;
    *)
        echo "=== ERROR === Not suported distribution"
        exit 1
        ;;
    esac
}

# Remove the pkgs in debian-like distros
function debian_remove_pkgs {
    # Add an asterisk at the end of the PKGS to wipe al related packages
    P=$(echo "$PKGS" | tr ' ' '\n' | sort | uniq | xargs | sed s/" "/"* "/g)

    # Remove all pkgs letting apt build the tree
    # two times to fix problems with postfix-amavis-new
    apt-get purge $P* ${APT_OPTS}
    apt-get purge $P* ${APT_OPTS}

    # Autoremove some of the pkgs left over
    apt-get autoremove ${APT_OPTS}
}

# Craft the list of services to stop/start/restart, etc
function craft_services {
    # Load local config
    source /etc/mailad/mailad.conf

    # SRV = basic services
    SRVS=${SERVICENAMES}

    # Check for SPAMD
    if [ "$ENABLE_SPAMD" == "yes" -o "$ENABLE_SPAMD" == "Yes" ] ; then
        SRVS="${SRVS} ${SPAMD_SERVICENAMES}"
    fi

    # Check for AV
    if [ "$ENABLE_AV" == "yes" -o "$ENABLE_AV" == "Yes" ] ; then
        SRVS="${SRVS} ${AV_SERVICENAMES}"
    fi
}

# Control the services
function services() {
    # Just one argument: the action (start/stop/reload/etc)

    # Build the dynamic list of services
    craft_services

    # Magic in 1... 2... 3:
    for s in $(echo ${SRVS} | xargs) ; do
        # Do it
        echo "===> Doing $1 with $s..."
        systemctl --no-pager $1 $s
        sleep 2
        systemctl --no-pager status $s
    done
}

# Debug status of the services
function dervices() {
    # no parameters will output to /tests/[service].log
    for s in $(echo ${SRVS} | xargs) ; do
        echo "===> Dumping logs of $s to $(pwd)/tests/$s.log"
        journalctl -xeu $s 2>&1 | tee -a ./tests/$s.log
    done

    # also syslog
    tail -n 500 /var/log/syslog > ./tests/syslog.log
}

# Restore an individual files
function extract() {
    # 3 Arguments
    #   1 - Backup file full path
    #   2 - File to extract
    #   3 - [optional] Alternative path to extract

    BKPFILE="$1"
    FILE="$2"
    ALT="$3"

    # Change dir to root
    cd /

    ISTHERE=$(tar -ztf ${BKPFILE} | grep "$FILE" | grep -v .db)
    if [ "$ISTHERE" == "$FILE" ] ; then
        # It's there
        if [ "$ALT" != "" ] ; then
            # Place it under $ALT
            tar -zxvf ${BKPFILE} ${FILE}
            mv ${FILE} ${ALT}
            echo "Moved to ${ALT}"
        else
            # Place it on the default file path
            tar -zxvf ${BKPFILE} ${FILE}
        fi
    fi
}

# Warn about a not supported dovecot version
function dovecot_version {
    # Just one argument, the dovecot version

    echo "==========================================================================="
    echo "ERROR: Can't locate the dovecot version or it's a not supported one"
    echo "       detected version is: '$1'"
    echo "       and it must be v2.2, v2.3 or v2.4 "
    echo "==========================================================================="
    echo "       The install process will stop now, please fix that"
    echo "==========================================================================="

    # exit
    exit 1
}

# Disable AV services
function disable_av() {
    # No AV, stop services to save resources if not stoped/disabled/masked
    ACTIVE=$(systemctl is-active clamav-freshclam)
    if [ "$ACTIVE" == "active" ] ; then
        # disabling
        systemctl stop clamav-freshclam || true
        systemctl disable clamav-freshclam || true
        systemctl mask clamav-freshclam || true
        echo "===> Disabing Clamav-freshclam as requested by the config"
    fi
    ACTIVE=$(systemctl is-active clamav-daemon)
    if [ "$ACTIVE" == "active" ] ; then
        # disabling
        systemctl stop clamav-daemon || true
        systemctl disable clamav-daemon || true
        systemctl mask clamav-daemon || true
        echo "===> Disabing clamav-daemon as requested by the config"
    fi
}

# Enable AV services
function enable_av() {
    ACTIVE=$(systemctl is-active clamav-freshclam)
    if [ "$ACTIVE" == "inactive" ] ; then
        systemctl unmask clamav-freshclam
        systemctl enable clamav-freshclam
        systemctl restart clamav-freshclam
        echo "===> Enabling Clamav-freshclam as requested by the config"
    fi
    ACTIVE=$(systemctl is-active clamav-daemon)
    if [ "$ACTIVE" == "inactive" ] ; then
        systemctl unmask clamav-daemon
        systemctl enable clamav-daemon
        systemctl restart clamav-daemon
        echo "===> Enabling Clamav-daemon as requested by the config"
    fi
}

# Enable SpamAssasin services
function enable_sa() {
    ACTIVE=$(systemctl is-active ${SPAMD_SERVICENAMES})
    if [ "$ACTIVE" == "inactive" ] ; then
        systemctl unmask ${SPAMD_SERVICENAMES}
        systemctl enable ${SPAMD_SERVICENAMES}
        systemctl restart ${SPAMD_SERVICENAMES}
        echo "===> Enabling SpamAssassin as requested by the config"
    fi
}

# Disable SpamAssasin services
function disable_sa() {
    ACTIVE=$(systemctl is-active ${SPAMD_SERVICENAMES})
    if [ "$ACTIVE" == "active" ] ; then
        systemctl stop ${SPAMD_SERVICENAMES}
        systemctl mask ${SPAMD_SERVICENAMES}
        systemctl disable ${SPAMD_SERVICENAMES}
        echo "===> Disabling SpamAssassin as requested by the config"
    fi
}

# Get the ldap uri based on the file options
# same function on scripts/groups.sh file
function get_ldap_uri {
    # Import local settings
    source /etc/mailad/mailad.conf

    PROTO="ldaps"
    PORT=636
    # detect if NOT secure ldap and change the proto and port of the uri
    if [ "$SECURELDAP" == "" -o "$SECURELDAP" == "no" -o "$SECURELDAP" == "No" ] ; then
        # Use a not secure ldap
        PROTO="ldap"
        PORT=389
    fi

    SOUT=""
    # Fun start here
    for DC in $(echo "${HOSTAD}") ; do
        if [ ! "${SOUT}" ] ; then
            SOUT="${PROTO}://${DC}:${PORT}"
        else
            SOUT="${SOUT} ${PROTO}://${DC}:${PORT}"
        fi
    done

    echo "${SOUT}"
}

# get the SOA server from the list of the HOSTAD or fail if not
function get_soa {
    # Import local settings
    source /etc/mailad/mailad.conf

    # development trick
    if [ "$DOMAIN" = "mailad.cu" ]; then
        echo "$HOSTAD"
        exit 0
    fi

    SOAREC=$(dig SOA $DOMAIN +short)
    if [ -z "$SOAREC" ] ; then
        # fails silently
        echo ""
    else
        # get hostname and IP of the SOA
        HOST=$(echo $SOAREC | awk '{print $1}' | rev | cut -d "." -f 2- | rev)

        # fail safes
        if [ -z "${HOST}" ] ; then
            # fails silently
            echo ""
        fi

        IPSOA=$(dig A $HOST +short)

        if [ -z "${IPSOA}" ] ; then
            # fails silently
            echo ""
        fi

        # testing if the SOA is listed in the HOSTAD var
        for R in $(echo "${HOSTAD}") ; do
            if [ "${R}" == "${HOST}" ] ; then
                # it's a hostname
                echo "${R}"
            fi
            if [ "${R}" == "${IPSOA}" ] ; then
                # it's a IP, fails silently
                echo ""
            fi
        done

        # fails silently
        echo ""
    fi
}

# get the SOA server from the list of the HOSTAD or fail if not
function get_soa_verbose {
    # Import local settings
    source /etc/mailad/mailad.conf

    # development trick
    if [ "$DOMAIN" = "mailad.cu" ]; then
        echo "$HOSTAD"
        exit 0
    fi

    SOAREC=$(dig SOA $DOMAIN +short)
    if [ -z "$SOAREC" ] ; then
        # fail
        echo "================================================================================="
        echo "ERROR!"
        echo "    The DOMAIN you declared in mailad.conf has no SOA record in the actual DNS"
        echo "    That, or your DNS is not configured correctly in this host"
        echo "================================================================================="
        echo " "

        exit 1
    else
        # get hostname and IP of the SOA
        HOST=$(echo $SOAREC | awk '{print $1}' | rev | cut -d "." -f 2- | rev)

        # fail safes
        if [ -z "${HOST}" ] ; then
            echo "================================================================================="
            echo "ERROR!"
            echo "    Strange!? got a SOA record for domain but after parsing to get the host it's"
            echo "    empty!: ${SOAREC} > ${HOST}"
            echo "================================================================================="
            echo " "
            exit 1
        fi

        IPSOA=$(dig A $HOST +short)

        if [ -z "${IPSOA}" ] ; then
            # fail
            echo "================================================================================="
            echo "ERROR!"
            echo "    Strange!? got a SOA record & hostname, but after parsing to get the IP it's"
            echo "    empty!: ${SOAREC} > ${HOST} > ${IPSOA}"
            echo "================================================================================="
            echo " "
            exit 1
        fi

        # testing if the SOA is listed in the HOSTAD var
        RESULT=""
        for R in $(echo "${HOSTAD}") ; do
            if [ "${R}" == "${HOST}" ] ; then
                # it's a hostname
                RESULT="h"
                echo "===> The SOA record is listed as a hostname in HOSTAD!"
                break
            fi
            if [ "${R}" == "${IPSOA}" ] ; then
                # it's a hostname
                RESULT="i"
                echo "===> The SOA record is listed as an IP in HOSTAD!"
                break
            fi
        done

        # test for empty results
        if [ -z "${RESULT}" ] ; then
            # fail
            echo "================================================================================="
            echo "ERROR!"
            echo "    None of the HOSTs in the HOSTAD list is the SOA of the domain, please"
            echo "    check that, you must list the SOA in there!"
            echo ""
            echo "    '${HOSTAD}' vs. ${HOST}"
            echo "================================================================================="
            echo " "
            exit 1
        fi

        #test for IPs
        if [ "${RESULT}" == "i" ] ; then
            # fail
            echo "================================================================================="
            echo "ERROR!"
            echo "    You specified the SOA server in IP format, that's ok, but will broke the"
            echo "    LDAP's SSL certification checking procedure."
            echo ""
            echo "    You must use the a FQDN of that IP in the HOSTAD variable in the"
            echo "    /etc/mailad/mailad.conf file."
            echo ""
            echo "    Use '${HOST}' instead of '${IPSOA}'"
            echo "================================================================================="
            echo " "
            exit 1
        fi
    fi
}

# Send and email using swaks, sender is always $ADMINMAIL
function send_email {
    # Parameters
    # 1- subject
    # 2- recipients
    # 3- file path to body
    FROM=${ADMINMAIL}
    SUBJECT="${1}"
    RECIPIENTS="${2}"
    BODYFILE="${3}"

    # doit:
    cat "${BODYFILE}" | swaks \
        -s 127.0.0.1 \
        --protocol SMTP \
        -t "${RECIPIENTS}" \
        -f "${FROM}" \
        --h-Subject "${SUBJECT}" \
        -ha \
        --body -    
}