Basic cleanup of things now in tpsgi/provisioner

Still need to adapt many things to tpsgi env

Dockerfile

@@ -1,13 +0,0 @@
-FROM troglodyne/base:latest
-
-ARG port=5000
-LABEL description="tCMS: a Perl CMS by Troglodyne LLC"
-
-ADD . /home/tcms
-RUN chown -R tcms /home/tcms
-
-USER tcms
-
-RUN make install
-ENTRYPOINT ["/usr/bin/starman","www/server.psgi"]
-CMD ['-p',$port]

Dockerfile.build

@@ -1,17 +0,0 @@
-FROM ubuntu:21.04
-
-USER root
-RUN useradd tcms
-
-ADD ./Makefile /home/tcms/Makefile
-ADD ./Makefile.PL /home/tcms/Makefile.PL
-RUN mkdir /home/tcms/.tcms
-RUN mkdir -p /home/tcms/www/scripts
-RUN chown -R tcms /home/tcms
-
-WORKDIR /home/tcms
-
-RUN apt-get update
-RUN apt-get upgrade -y
-RUN apt-get install -y make
-RUN make prereq-debian

Installer.mk

@@ -1,11 +1,4 @@
 SHELL := /bin/bash
-SERVER_NAME := $(shell bin/tcms-hostname)
-USER_NAME   := $(shell bin/tcms-hostname --user)
-
-.PHONY: depend
-depend:
-	[ -f "/etc/debian_version" ] && make -f Installer.mk prereq-debs; /bin/true;
-	make -f Installer.mk prereq-perl prereq-frontend
 
 .PHONY: install
 install:
@@ -18,54 +11,6 @@ install:
 	test -d logs || mkdir -p logs
 	$(RM) pod2htmd.tmp;
 
-.PHONY: service-user
-service-user:
-	sudo useradd -MU -s /sbin/nologin -d "$(shell pwd)" $(USER_NAME); /bin/true
-	sudo chown -R $(USER_NAME):$(USER_NAME) .
-	# Can be 760 if you aren't using git features as a developer user that is not the system user.
-	sudo chmod -R 0770 .
-	# For some reason, nginx needs world readability to see the socket, despite having group permissions.
-	# Seems pretty dumb to me, but whatever.  We are locking every single other file away from it & other users.
-	sudo chmod 0755 .
-	sudo chmod 0775 run
-	sudo chown -R $(USER_NAME):www-data run
-	sudo chmod -R 0770 bin/ tcms www/server.psgi
-	sudo -u $(USER_NAME) mkdir 0700 .ssh
-	sudo -u $(USER_NAME) touch .ssh/authorized_keys
-	sudo -u $(USER_NAME) chmod 0600 .ssh/authorized_keys
-
-.PHONY: install-service
-install-service: #service-user
-	sudo systemctl disable $(SERVER_NAME); /bin/true
-	cp service-files/systemd.unit service-files/$(SERVER_NAME).service
-	sed -i 's#__DOMAIN__#$(SERVER_NAME)#g' service-files/$(SERVER_NAME).service
-	sed -i 's#__USER__#$(USER_NAME)#g' service-files/$(SERVER_NAME).service
-	sed -i 's#__REPLACEME__#$(shell pwd)#g' service-files/$(SERVER_NAME).service
-	sudo ln -sr service-files/$(SERVER_NAME).service /usr/lib/systemd/system/$(SERVER_NAME).service; /bin/true
-	sudo systemctl daemon-reload
-	sudo systemctl enable $(SERVER_NAME)
-	sudo systemctl start $(SERVER_NAME)
-
-.PHONY: prereq-debian
-prereq-debian: prereq-debs prereq-perl prereq-frontend prereq-node
-
-.PHONY: prereq-debs
-prereq-debs:
-	sudo apt-get update
-	sudo apt-get install -y sqlite3 nodejs npm libsqlite3-dev libdbd-sqlite3-perl cpanminus starman libxml2 curl cmake \
-		uwsgi uwsgi-plugin-psgi fail2ban nginx certbot postfix dovecot-imapd dovecot-pop3d postgrey spamassassin amavis clamav\
-		opendmarc opendkim opendkim-tools libunbound-dev \
-	    libtext-xslate-perl libplack-perl libconfig-tiny-perl libdatetime-format-http-perl libjson-maybexs-perl          \
-	    libuuid-tiny-perl libcapture-tiny-perl libconfig-simple-perl libdbi-perl libfile-slurper-perl libfile-touch-perl \
-	    libfile-copy-recursive-perl libxml-rss-perl libmodule-install-perl libio-string-perl uuid-dev                    \
-	    libmoose-perl libmoosex-types-datetime-perl libxml-libxml-perl liblist-moreutils-perl libclone-perl libpath-tiny-perl \
-		selinux-utils setools policycoreutils-python-utils policycoreutils selinux-basics auditd \
-		pdns-tools pdns-server pdns-backend-sqlite3 libmagic-dev autotools-dev dh-autoreconf
-
-.PHONY: prereq-perl
-prereq-perl:
-	sudo cpanm -n --installdeps .
-
 .PHONY: prereq-node
 prereq-node:
 	npm i
@@ -97,128 +42,6 @@ reset-remove:
 	rm config/has_users; /bin/true
 	rm config/setup; /bin/true
 
-.PHONY: fail2ban
-fail2ban:
-	cp fail2ban/tcms-jail.tmpl fail2ban/tcms-jail.conf
-	sed -i 's#__LOGDIR__#$(shell pwd)#g' fail2ban/tcms-jail.conf
-	sed -i 's#__DOMAIN__#$(SERVER_NAME)#g' fail2ban/tcms-jail.conf
-	sudo rm /etc/fail2ban/jail.d/$(SERVER_NAME).conf; /bin/true
-	sudo rm /etc/fail2ban/filter.d/$(SERVER_NAME).conf; /bin/true
-	sudo ln -sr fail2ban/tcms-jail.conf   /etc/fail2ban/jail.d/$(SERVER_NAME).conf
-	sudo ln -sr fail2ban/tcms-filter.conf /etc/fail2ban/filter.d/$(SERVER_NAME).conf
-	sudo systemctl reload fail2ban
-
-.PHONY: nginx
-nginx:
-	[ -n "$$SERVER_NAME" ] || ( echo "Please set the SERVER_NAME environment variable before running (e.g. test.test)" && /bin/false )
-	sed 's/\%SERVER_NAME\%/$(SERVER_NAME)/g' nginx/tcms.conf.tmpl > nginx/tcms.conf.intermediate
-	sed 's/\%SERVER_SOCK\%/$(shell pwd)/g' nginx/tcms.conf.intermediate > nginx/tcms.conf
-	rm nginx/tcms.conf.intermediate
-	mkdir run
-	chown $(USER_NAME):www-data run
-	chmod 0770 run
-	sudo mkdir -p '/var/www/$(SERVER_NAME)'
-	sudo mkdir -p '/var/www/mail.$(SERVER_NAME)'
-	sudo mkdir -p '/etc/letsencrypt/live/$(SERVER_NAME)'
-	[ -e "/etc/nginx/sites-enabled/$$SERVER_NAME.conf" ] && sudo rm "/etc/nginx/sites-enabled/$$SERVER_NAME.conf"; /bin/true
-	sudo ln -sr nginx/tcms.conf '/etc/nginx/sites-enabled/$(SERVER_NAME).conf'
-	# Make a self-signed cert FIRST, because certbot has a chicken/egg problem
-	sudo openssl req -x509 -config etc/openssl.conf -nodes -newkey rsa:4096 -subj '/CN=$(SERVER_NAME)' -addext 'subjectAltName=DNS:www.$(SERVER_NAME),DNS:mail.$(SERVER_NAME)' -keyout '/etc/letsencrypt/live/$(SERVER_NAME)/privkey.pem' -out '/etc/letsencrypt/live/$(SERVER_NAME)/fullchain.pem' -days 365
-	sudo systemctl reload nginx
-	# Now run certbot and get that http dcv. We have to do a "gamer move" so that certbot doesn't complain about live dir existing.
-	sudo rm -rf '/etc/letsencrypt/live/$(SERVER_NAME)'
-	sudo certbot certonly --webroot -w '/var/www/$(SERVER_NAME)/' -d '$(SERVER_NAME)' -d 'www.$(SERVER_NAME)' -w '/var/www/mail.$(SERVER_NAME)' -d 'mail.$(SERVER_NAME)'
-	sudo systemctl reload nginx
-
-.PHONY: mail
-mail: dkim dmarc
-	# Dovecot
-	sudo cp /etc/dovecot/conf.d/10-ssl.conf /etc/dovecot/conf.d/10-ssl.conf.orig
-	sudo sed -i 's/^\(ssl_cert\s*=\).*/\1<\/etc\/letsencrypt\/live\/$(SERVER_NAME)\/fullchain.pem/g' /etc/dovecot/conf.d/10-ssl.conf
-	sudo sed -i 's/^\(ssl_key\s*=\).*/\1\<\/etc\/letsencrypt\/live\/$(SERVER_NAME)\/privkey.pem/g' /etc/dovecot/conf.d/10-ssl.conf
-	# Postfix
-	sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.orig
-	sudo sed -i 's/^\(smtpd_tls_cert_file\s*=\).*/\1\/etc\/letsencrypt\/live\/$(SERVER_NAME)\/fullchain.pem/g' /etc/postfix/main.cf
-	sudo sed -i 's/^\(smtpd_tls_key_file\s*=\).*/\1\/etc\/letsencrypt\/live\/$(SERVER_NAME)\/privkey.pem/g' /etc/postfix/main.cf
-	# XXX we should not do these two.
-	sudo sed -i 's/^\(myhostname\s*=\).*/\1$(SERVER_NAME)/g' /etc/postfix/main.cf
-	sudo echo '$(SERVER_NAME)' > /etc/mailname
-	# Configure postfix to put on its socks and shoes.  This all implicitly relies on good defaults in the opendkim/opendmarc packages.
-	sudo postconf -e milter_default_action=accept
-	sudo postconf -e milter_protocol=2
-	sudo postconf -e smtpd_milters=local:opendkim/opendkim.sock,local:opendmarc/opendmarc.sock
-	sudo postconf -e non_smtpd_milters=\$smtpd_milters
-	sudo service postfix reload
-	# TODO setup various mail aliases and so forth, e.g. postmaster@, soa@, the various lists etc
-
-.PHONY: dkim
-dkim:
-	sudo mkdir -p /etc/opendkim/keys/$(SERVER_NAME)
-	sudo opendkim-genkey --directory /etc/opendkim/keys/$(SERVER_NAME) -s mail -d $(SERVER_NAME)
-	sudo openssl rsa -in /etc/opendkim/keys/$(SERVER_NAME)/mail.private -pubout > /tmp/mail.public
-	sudo mv /tmp/mail.public /etc/opendkim/keys/$(SERVER_NAME)/mail.public
-	sudo chown -R opendkim:opendkim /etc/opendkim
-	sudo mail/mongle_dkim_config $(SERVER_NAME)
-	sudo service opendkim enable
-	sudo service opendkim start
-
-.PHONY: dmarc
-dmarc:
-	sudo mail/mongle_dmarc_config $(SERVER_NAME) mail.$(SERVER_NAME)
-	sudo service opendmarc enable
-	sudo service opendmarc start
-
-.PHONY: dns
-dns:
-	cp dns/tcms.tmpl dns/tcms.conf
-	sed -i 's#__DIR__#$(shell pwd)#g' dns/tcms.conf
-	sed -i 's#__DOMAIN__#$(SERVER_NAME)#g' dns/tcms.conf
-	[[ -e /etc/powerdns/pdns.d/$(SERVER_NAME).conf ]] && sudo rm /etc/powerdns/pdns.d/$(SERVER_NAME).conf
-	sudo cp dns/tcms.conf /etc/powerdns/pdns.d/$(SERVER_NAME).conf
-	sudo mkdir /etc/systemd/resolved.conf.d/; /bin/true
-	sudo cp dns/10-disable-stub-resolver.conf /etc/systemd/resolved.conf.d/
-	sudo chown -R systemd-resolve:systemd-resolve /etc/systemd/resolved.conf.d/
-	sudo chmod 0660 /etc/systemd/resolved.conf.d/10-disable-stub-resolver.conf
-	sudo systemctl restart systemd-resolved
-	# Build the zone database and initialize the zone for our domain
-	rm dns/zones.db; /bin/true
-	sqlite3 dns/zones.db < /usr/share/pdns-backend-sqlite3/schema/schema.sqlite3.sql
-	bin/build_zone > dns/default.zone
-	zone2sql --gsqlite --zone=dns/default.zone --zone-name=$(SERVER_NAME) > dns/default.zone.sql
-	sqlite3 dns/zones.db < dns/default.zone.sql
-	# Bind mount our dns/ folder so that pdns can see it in chroot
-	sudo mkdir /var/spool/powerdns/$(SERVER_NAME); /bin/true
-	sudo chown pdns:pdns /var/spool/powerdns/$(SERVER_NAME); /bin/true
-	sudo cp /etc/fstab /tmp/fstab.new
-	sudo chown $(USER) /tmp/fstab.new
-	echo "$(shell pwd)/dns /var/spool/powerdns/$(SERVER_NAME) none defaults,bind 0 0" >> /tmp/fstab.new
-	sort < /tmp/fstab.new | uniq | grep -o '^[^#]*' > /tmp/fstab.new
-	sudo chown root:root /tmp/fstab.new
-	sudo mv /etc/fstab /etc/fstab.bak
-	sudo mv /tmp/fstab.new /etc/fstab
-	sudo mount /var/spool/powerdns/$(SERVER_NAME)
-	# Don't need no bind
-	[[ -e /etc/powerdns/pdns.d/bind.conf ]] && sudo rm /etc/powerdns/pdns.d/bind.conf
-	# Fix broken service configuration
-	sudo dns/configure_pdns
-	sudo chown $(USER_NAME):pdns dns/
-	sudo chown $(USER_NAME):pdns dns/zones.db
-	sudo cp dns/10-powerdns.conf /etc/rsyslog.d/10-powerdns.conf
-	sudo systemctl daemon-reload
-	sudo service rsyslog restart
-	sudo service pdns enable
-	sudo service pdns start
-
 .PHONY: githook
 githook:
 	cp git-hooks/pre-commit .git/hooks
-
-.PHONY: firewall
-firewall:
-	# Remove dopey unauthenticated port for git from /etc/services
-	sudo sed -i '/^git\s/d' /etc/services
-	sudo cp ufw/git ufw/pdns_server /etc/ufw/applications.d
-	sudo ufw/setup-rules
-
-.PHONY: all
-all: prereq-debian install fail2ban nginx mail dns firewall githook

call.pl

@@ -1,23 +0,0 @@
-#!/usr/bin/perl
-# Really only useful for profiling read routes, which is all I want it for.
-
-use strict;
-use warnings;
-
-#Grab our custom routes
-use lib 'lib';
-use TCMS;
-
-my %env = (
-    REQUEST_METHOD => $ARGV[0],
-    PATH_INFO      => $ARGV[1],
-    QUERY_STRING   => $ARGV[2],
-);
-
-my $limit = $ARGV[3] || 1;
-our $app = \&TCMS::app;
-for ( 0 .. $limit ) {
-    my $out = $app->( \%env );
-    print $out->[2][0];
-}
-

dns/10-disable-stub-resolver.conf

@@ -1,4 +0,0 @@
-[Resolve]
-DNS=8.8.8.8
-FallbackDNS=8.8.4.4
-DNSStubListener=no

dns/10-powerdns.conf

@@ -1 +0,0 @@
-local1.* /var/log/pdns.log

dns/configure_pdns

@@ -1,20 +0,0 @@
-#!/usr/bin/env perl
-
-use strict;
-use warnings;
-
-use File::Copy;
-use Config::Simple;
-
-# Fix broken out of the box systemd unit for pdns
-my $service_file = "/usr/lib/systemd/system/pdns.service";
-die "Can't find service file $service_file" unless -f $service_file;
-
-my $cfg = Config::Simple->new($service_file);
-
-#$cfg->param("Service.WorkingDirectory", "/var/spool/powerdns");
-my $invocation = "/usr/sbin/pdns_server --guardian=no --daemon=no --logging-facility=1 --log-timestamp=yes --write-pid=no --chroot";
-$cfg->param("Service.ExecStart", $invocation);
-
-File::Copy::copy($service_file, "$service_file.bak");
-$cfg->save();

dns/tcms.tmpl

@@ -1,3 +0,0 @@
-# tCMS powerdns configuration for __DOMAIN__
-launch=gsqlite3:__DOMAIN__
-gsqlite3-__DOMAIN__-database=__DOMAIN__/zones.db

docker-exfil.sh

@@ -1,11 +0,0 @@
-#!/bin/sh
-docker cp $1:/home/tcms/config $PWD
-docker cp $1:/home/tcms/data $PWD
-docker cp $1:/home/tcms/www/assets $PWD/www
-if [ $user ]
-then
-    chown -R $USER:$USER $PWD/config/
-    chown -R $USER:$USER $PWD/data/
-    chown -R $USER:$USER $PWD/www/assets/
-fi
-docker kill $1

dockerdeploy.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-docker build -t troglodyne/tcms .
-docker run --restart unless-stopped -dp 5000:5000 troglodyne/tcms:latest

etc/openssl.conf

@@ -1,6 +0,0 @@
-# Only here to make self-signed certs work right, see makefile
-[req]
-distinguished_name=dn
-[ dn ]
-[ ext ]
-basicConstraints=CA:TRUE,pathlen:0

fail2ban/tcms-filter.conf

@@ -1,4 +0,0 @@
-[Init]
-datepattern=%%Y-%%m-%%dT%%H:%%M:%%SZ
-[Definition]
-failregex=^ \[INFO\]: RequestId [\d\w-]+ From <HOST> \|nobody\| \w+ 4\d{2} http

fail2ban/tcms-jail.tmpl

@@ -1,8 +0,0 @@
-[__DOMAIN__]
-enabled = true
-port = http,https
-filter = __DOMAIN__
-logpath = __LOGDIR__/logs/tcms.log
-maxretry = 5
-findtime = 60
-bantime  = 600

fulldeploy.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-docker build -t troglodyne/base . -f Dockerfile.build
-./dockerdeploy.sh

images/README.md

@@ -1,17 +0,0 @@
-Containerization
-====
-
-Root is not required to build or run the image.
-
-
-Images can be built like this,
-
-```
-$ buildah unshare ./images/base.sh
-```
-
-Containers can be run like this,
-
-```
-$ podman run -p 0.0.0.0:5000:5000 localhost/tcms
-```

images/base.sh

@@ -1,38 +0,0 @@
-#!/bin/sh
-
-ctr=$(buildah from alpine:latest)
-mnt=$(buildah mount "$ctr")
-
-mkdir -p "$mnt/srv/tcms" "$mnt/tmp/tcms"
-cp -R bin/ config/ data/ www/ lib "$mnt/srv/tcms";
-cp Makefile.PL "$mnt/tmp/tcms/"
-make -C "$mnt/srv/tcms" --makefile "$PWD/Makefile" prereq-frontend reset-dummy-data
-
-buildah run -- $ctr sh <<EOF
-  apk update
-  apk add perl perl-xml-libxml perl-moose perl-datetime perl-dbi perl-dbd-sqlite perl-capture-tiny perl-date-format
-
-	# needed for install
-	apk add curl make musl-dev perl-dev gcc mlocate perl-app-cpanminus
-	cpanm -n --no-wget --curl --installdeps /tmp/tcms/
-	apk del curl make musl-dev perl-dev gcc mlocate perl-app-cpanminus
-EOF
-
-rm -rf \
-	"$mnt/tmp/tcms"       \
-	"$mnt/var/cache/*"    \
-	"$mnt/root/.cpanm"    \
-	"$mnt/usr/share/man/" \
-  "$mnt/usr/local/share/man"
-
-find "$mnt/usr/lib/perl5" -name '*.pod' -delete
-
-buildah config                              \
-  --workingdir "/srv/tcms/"                 \
-	--entrypoint '["/usr/local/bin/starman"]' \
-	--cmd "/srv/tcms/www/server.psgi"         \
-	--port 5000                               \
-	--label "Name=tCMS"                       \
-	--author "George Baugh"                   \
-	"$ctr"
-buildah commit --rm "$ctr" tcms

mail/mongle_dkim_config

@@ -1,99 +0,0 @@
-#!/usr/bin/env perl
-
-use strict;
-use warnings;
-
-no warnings qw{experimental};
-use feature qw{signatures};
-
-use List::Util qw{uniq};
-use Config::Simple;
-use File::Copy;
-use File::Touch;
-use DNS::Unbound;
-use Net::DNS::Packet;
-
-my @domains2add = @ARGV;
-
-my $dkim_config_file   = "/etc/opendkim.conf";
-my $trusted_hosts_file = '/etc/opendkim/TrustedHosts';
-my $keytable_file      = '/etc/opendkim/KeyTable';
-my $signing_table_file = '/etc/opendkim/SigningTable';
-
-DKIM_CONFIG: {
-    my $cfg = Config::Simple->new($dkim_config_file);
-    die "Can't open opendkim config file" unless $cfg;
-
-    $cfg->param('KeyTable',           $keytable_file );
-    $cfg->param('SigningTable',       $signing_table_file);
-    $cfg->param('ExternalIgnoreList', $trusted_hosts_file);
-    $cfg->param('InternalHosts',      $trusted_hosts_file);
-
-    # This way we support signing more than one domain
-    $cfg->delete('Domain');
-    $cfg->delete('KeyFile');
-    $cfg->delete('Selector');
-
-    File::Copy::copy($dkim_config_file, "$dkim_config_file.bak") or die "Could not back up old dkim config";
-    $cfg->save();
-
-    print "OpenDKIM config file ($dkim_config_file) changed.\n";
-}
-
-TRUSTED_HOSTS: {
-    my @hosts = read_lines( $trusted_hosts_file );
-
-    my @ips2add = grep { defined $_ } map {
-        ( domain2ips( $_, "A" ),
-        domain2ips( $_, "AAAA" ) )
-    } @domains2add;
-
-    push(@hosts, "127.0.0.1", "localhost", "::1", @domains2add, @ips2add);
-    @hosts = uniq @hosts;
-
-    backup_and_emit( $trusted_hosts_file, @hosts);
-}
-
-KEY_TABLE: {
-    my @lines = read_lines( $keytable_file );
-
-    push(@lines, (map { "mail._domainkey.$_ $_:mail:/etc/opendkim/keys/$_/mail.private" } @domains2add ) );
-    @lines = uniq @lines;
-
-    backup_and_emit($keytable_file, @lines);
-}
-
-SIGNING_TABLE: {
-    my @lines = read_lines( $signing_table_file );
-
-    push(@lines, (map { "$_ mail._domainkey.$_" } @domains2add ) );
-    @lines = uniq @lines;
-
-    backup_and_emit($signing_table_file, @lines);
-}
-
-sub read_lines( $file ) {
-    File::Touch::touch($file);
-    open(my $fh, '<', $file);
-    my @lines = map { chomp $_; $_ } readline $fh;
-    close $fh;
-    return @lines;
-}
-
-sub backup_and_emit($file, @lines) {
-    File::Copy::copy($file, "$file.bak") or die "Could not back up $file";
-    open(my $wh, '>', $file);
-    foreach my $line (@lines) {
-        print $wh "$line\n";
-    }
-    close $wh;
-    print "$file changed.\n";
-}
-
-sub domain2ips( $domain, $type ) {
-    my $resolver = DNS::Unbound->new();
-
-    my $p = $resolver->resolve( $domain, $type )->answer_packet();
-    my @rrs = Net::DNS::Packet->new( \$p )->answer;
-    return map { $_->address } @rrs;
-}

mail/mongle_dmarc_config

@@ -1,30 +0,0 @@
-#!/usr/bin/env perl
-
-use strict;
-use warnings;
-
-use List::Util qw{uniq};
-use Config::Simple;
-use File::Copy;
-
-my @domains2add = @ARGV;
-
-my $dmarc_config_file = "/etc/opendmarc.conf";
-
-my $cfg = Config::Simple->new($dmarc_config_file);
-die "Can't open opendmarc config file" unless $cfg;
-
-$cfg->param('IgnoreAuthenticatedClients', 'true');
-$cfg->param('RequiredHeaders',            'true');
-$cfg->param('SPFSelfValidate',            'true');
-
-my @authserv = $cfg->param('TrustedAuthservIDs');
-push(@authserv, @domains2add);
-@authserv = uniq @authserv;
-
-$cfg->param('TrustedAuthservIDs', \@authserv);
-
-File::Copy::copy($dmarc_config_file, "$dmarc_config_file.bak") or die "Could not back up old dmarc config";
-$cfg->save();
-
-print "OpenDMARC config file ($dmarc_config_file) changed.\n";

nginx/tcms.conf.tmpl

@@ -1,62 +0,0 @@
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-
-    server_name %SERVER_NAME% www.%SERVER_NAME%;
-
-    ssl_certificate /etc/letsencrypt/live/%SERVER_NAME%/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/%SERVER_NAME%/privkey.pem;
-
-    location / {
-        proxy_pass http://unix:%SERVER_SOCK%/run/tcms.sock:/;
-        proxy_set_header Host            $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
-    }
-
-    location /.well-known/ {
-        root /var/www/%SERVER_NAME%/;
-    }
-
-}
-
-server {
-    listen 80;
-    listen [::]:80;
-
-    server_name %SERVER_NAME% www.%SERVER_NAME%;
-
-    location / {
-        proxy_pass http://unix:%SERVER_SOCK%/run/tcms.sock:/;
-        proxy_set_header Host            $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
-    }
-
-    location /.well-known/ {
-        root /var/www/%SERVER_NAME%/;
-    }
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-
-    server_name mail.%SERVER_NAME%;
-
-    ssl_certificate /etc/letsencrypt/live/%SERVER_NAME%/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/%SERVER_NAME%/privkey.pem;
-
-    location / {
-        root /var/www/mail.%SERVER_NAME%/;
-    }
-}
-
-server {
-    listen 80;
-    listen [::]:80;
-
-    server_name mail.%SERVER_NAME%;
-
-    location / {
-        root /var/www/mail.%SERVER_NAME%/;
-    }
-}

service-files/systemd.unit

@@ -1,16 +0,0 @@
-[Unit]
-Description=tCMS for __DOMAIN__
-Wants=multi-user.target
-After=multi-user.target
-
-[Install]
-WantedBy=multi-user.target
-
-[Service]
-Type=forking
-PIDFile=__REPLACEME__/run/tcms.pid
-ExecStart=__REPLACEME__/tcms
-WorkingDirectory=__REPLACEME__/
-Restart=always
-OOMPolicy=stop
-ExecReload=kill -HUP $MAINPID

tcms

@@ -1,22 +0,0 @@
-#!/bin/bash
-USERNAME=$(bin/tcms-hostname --user)
-echo "tCMS running as user $USERNAME"
-[[ -e run/tcms.pid ]] && sudo pkill -F run/tcms.pid
-sudo www/server.psgi --listen run/tcms.sock --workers 20 --user "$USERNAME" --daemonize --pid run/tcms.pid 
-#--chroot $(pwd)
-
-# Wait until the socket file is ready
-until [ -e run/tcms.sock ]
-do
-    echo "Waiting for sock to be ready..."
-    sleep 1
-done
-
-# Fix ownership of socket so nginx can see it
-sudo chown $USERNAME:www-data run/tcms.sock
-sudo chmod 0770 run/tcms.sock
-
-echo "tCMS running as PID "`cat run/tcms.pid`
-
-# Run reloader process
-#bin/tcms_monitor

tcms-uwsgi

@@ -1,7 +0,0 @@
-#!/bin/bash
-[[ -e run/tcms.pid ]] && pkill -F run/tcms.pid;
-export PSGI_ENGINE='uwsgi'
-uwsgi --ini config/tcms.ini
-sudo chown $USER:www-data run/tcms.sock
-sudo chmod 0770 run/tcms.sock
-echo "tCMS running as PID "`cat run/tcms.pid`

ufw/git

@@ -1,4 +0,0 @@
-[git]
-title=Git SCM
-description=A distributed revision control system
-ports=53|22/tcp

ufw/pdns_server

@@ -1,4 +0,0 @@
-[pdns-server]
-title=PowerDNS Server
-description=a caching nameserver
-ports=53

ufw/setup-rules

@@ -1,49 +0,0 @@
-#!/usr/bin/env perl
-
-use strict;
-use warnings;
-
-use Data::Dumper;
-
-my $DRY_RUN = $ARGV[0] ? 1 : 0;
-
-# Build rules, apply rules.
-
-# Enable every available service.
-# Don't use tCMS on hosts that do anything else.
-my $list = qx{ufw app list};
-my @apps = split(/\n/, $list);
-shift @apps;
-@apps = map { s/^\s+//; $_ } @apps;
-
-# Sane defaults
-my @rules = (
-    [qw{reset}],
-    [qw{enable}],
-    [qw{default deny outgoing}],
-    [qw{default deny incoming}],
-);
-
-# Allow, but rate limit
-foreach my $app (@apps) {
-    push(@rules,
-        ["allow", "out", $app],
-    );
-    # HTTP tends to request lots of stuff simultaneously
-    if ($app =~ m/^Nginx/i) {
-        push(@rules,
-            ["allow", "in", $app]
-        );
-    } else {
-        push(@rules,
-            ["limit", "in", $app],
-        );
-    }
-}
-
-@rules = map { unshift(@{$_}, '--dry-run'); $_ } @rules if $DRY_RUN;
-@rules = map { unshift(@{$_}, 'ufw'); $_ } @rules;
-
-foreach my $rule (@rules) {
-    system(@$rule);
-}