Debian 11 clean install script

eryx · 2022-07-15T09:13:35+00:00

Hi all, I've build a script to install grommunio from scratch on a fresh Debian 11 installation. Missing is currently still grommunio-antispam. The rest wor...

eryx

Ok, with some fixes the first tun now looks good. If somebody has time please try it out. Also I added the fix for the folder rights for the dav and sync log folders

crpb

Uhh, that was either fast or simpler as i thought now :-)

https://github.com/eryx12o45/grommunio-setup/tree/create_extended_setup_script

#zfs create rpool/var/lib/gromox
cd /usr/local/share/
git clone --branch=create_extended_setup_script https://github.com/eryx12o45/grommunio-setup.git
ln -s /usr/local/share/grommunio-setup/setup.sh /usr/local/sbin/grommunio-setup
grommunio-setup

*whistle*

#Aktiviere alle grommunio/gromox-Dienste
find /lib/systemd/system -iname '*grom*' -exec systemctl enable --now {} \;
# Lizenz-Import via Admin-GUI
chown grommunio /etc/grommunio-admin-common/license
# https://community.grommunio.com/d/447-debian-11-clean-install-script/37
echo -n "/run/mysqld\t/var/spool/postfix/run/mysqld\tbind\tdefaults,bind\t0\t0\n" |tee -a /etc/fstab
reboot
systemctl enable --now redis@grommunio.service
#SQLITE3 needed for grommunio-spam-run as i recall
apt-get install --yes sqlite3
#GROMMUNIO-INDEX
mkdir /root/rpmconv
cd /root/rpmconv
apt-get install --yes alien
wget https://download.grommunio.com/community/openSUSE_Leap_15.3/grommunio-index-0.1.11.8787c3c-lp153.17.1.x86_64.rpm
alien grommunio-index-0.1.11.8787c3c-lp153.17.1.x86_64.rpm
dpkg -i grommunio-index_0.1.11.8787c3c-1_amd64.deb
systemctl enable --now grommunio-index.service
systemctl enable --now grommunio-index.timer
grommunio-index-run.sh

After those commands and a few of my own stuff like those...

OCSP für ACME-CERT

https://github.com/crpb/grommunio/blob/main/setup/nginx-ocsp.sh

RELAYHOST-Krempel

https://github.com/crpb/grommunio/tree/main/setup/postfix

with hash:/etc/postfix/sasl_passwd instead of lmdb...

[x] Domain Added
[x] License installed
[x] LDAP-Configured
[x] LDAP-Downsync worked
[x] Postfix Basic-Relay configured...
[x] Mails to external Recipient WEBMAIL
[x] Mails between local Mailboxes WEBMAIL
[x] Mailbox-Full-Permissions WEBMAIL
[x] Send-As-Permissions WEBMAIL

System-Mails

apt-get install postix-pcre
postconf smtp_generic_maps=pcre:/etc/postfix/generic
printf "/root(.*)/\tgromi@%s\n" "$(grommunio-admin domain query --filter ID=1 domainname)" >> /etc/postfix/generic
printf "root:\tSERVERMAILS@SERVERMAILS.TLD\n" >> /etc/aliases
postalias /etc/aliases
postfix reload
usermod --comment "$(dnsdomainname |cut -d. -f1 |tr 'a-z' 'A-z')-GROMI-ROOT" root

eryx

Cool, thanks @crpb for verifying.

So as far as I see the automated enabling of those service isn't working as intended, missing sqlite3 and maybe adding the index service this looks quite ok I guess

eryx

Ok, I've merged the script now. I've added a bunch of your (@crpb) stuff and also info to the README and also added iptables and settings rules for it (as in the original there was also a firewall configuration).

https://github.com/eryx12o45/grommunio-setup

sbudach

eryx

I just tried the new script and this doesn't work:

# shellcheck disable=SC2028
echo -n "/run/mysqld\t/var/spool/postfix/run/mysqld\tbind\tdefaults,bind\t0\t0\n" | tee -a /etc/fstab
mount /var/spool/postfix/run/mysqld >>"${LOGFILE}" 2>&1

The tabs don't get expanded and render the line broken.

crpb

sbudach

Ahh sorry, copied wrong line from one of my many tmux-windows :p

echo -e "/run/mysqld\t/var/spool/postfix/run/mysqld\tbind\tdefaults,bind\t0\t0" | tee -a /etc/fstab

Tested this time for sure

root@gromi-zfs ~ # cat /etc/fstab 
# UNCONFIGURED FSTAB FOR BASE SYSTEM
/dev/disk/by-uuid/7C6A-485B /boot/efi vfat defaults 0 0
root@gromi-zfs ~ # echo -e "/run/mysqld\t/var/spool/postfix/run/mysqld\tbind\tdefaults,bind\t0\t0" |tee -a /etc/fstab
/run/mysqld     /var/spool/postfix/run/mysqld   bind    defaults,bind   0       0
root@gromi-zfs ~ # cat /etc/fstab 
# UNCONFIGURED FSTAB FOR BASE SYSTEM
/dev/disk/by-uuid/7C6A-485B /boot/efi vfat defaults 0 0
/run/mysqld     /var/spool/postfix/run/mysqld   bind    defaults,bind   0       0
root@gromi-zfs ~ #

And i think i used echo instead of printf here because my shell in this test-system wasn't setup correctly...
But with echo -e Shellcheck doesn't have anything to say.

sbudach

crpb

Yes, echo -en would do it. I created a PR for that.

eryx

yeah I also fixed some other stuff where the order was wrong which caused some services to not start and not get enabled. I will try this out now. I think this should fix all the issues :-) Thanks for your feedback @sbudach and @crpb

eryx

there are still some errors, which I will try to look into later:

cp: cannot create regular file '/etc/pki/trust/anchors/': No such file or directory Updating certificates in /etc/ssl/certs... 0 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d... done.

eryx

ok iptables is now also working and all services should be started and enabled during installation without a problem. There is a kind of dirty workaround, but I guess that's ok :-)

(I need to set ssl settings to snakeoil before setting up packages and then change config to real ssl config afterwards, otherwise the packages will not install / start correct).

crpb

https://github.com/crpb/grommunio/blob/main/debian/alien8.sh

For now with static URLs/Files..

crpb

eryx Live Status

crpb

Postfix-Log

`/usr/share/grommunio-admin-api/config.yaml`

  Postfix:
    source: 'postfix@-.service'

Check via systemctl -a |grep postfix. As you can see postfix.service should be "exited" and the @-.service is running.

eryx

Everything seems to run so far. I fixed the fetchmail startup and this is now also working. An import from Kopano worked as well, even though most of the mails and attachements are fine, some are just junk. I don't know why. some have attachements others not. some of in German, some im Japanese, some in English. Some are big some are very small. So really don't know what's happening there. Also no errors during import.

What's still not working is the "Live Status" in the Admin UI. There I get a 500 error, but no clue why.

[ERROR] (grommunio Admin API) Response validation failed: [InvalidContentType(mimetype='text/html')] [WARNING] (grommunio Admin API) GET /api/v1/system/vhostStatus/local? from XXX.YYY.ZZZ.AAA -> 500 '{"message":"The server generated an invalid response."}\n'

Also the Logs for Postfix and PHP fpm are empty in the Admin WEB UI

eryx

I see, so this is a "bug" in the debian config then? Anf Nginx is not working because it is logging into files and not journal?

crpb

Haven't found the difference for nginx yet..

And with Postfix... i'm not that familiar with all those systemd-features as they are a shitload.
I really like to use the .timers instead of cron as you can do so much more like initiate those from some service and actually monitor the running/failing/... services.

But just to illustrate the intended Healthy Service...
You can see that systemctl status postfix.service does look alright.
And in systemctl cat postfix.service you will see a line with oneshot. A short explanation.
Also take a look at ExecStart for instance: It is only /bin/true.. :P
If i would have to guess from reading it.. It just checks if Conflicts not present and the main.cf is present.. that is all..

And if you look at systemctl cat postfix@.service and systemctl cat postfix@-.service you will see that the actual "Config-File" (First line) is the same. And here we also have our references to postfix.service...

Quote: "It's all documented!" :-P

sbudach

What about these errors with logrotate?

First it seemed like a permissions issue:

Aug 12 18:03:14 grommunio systemd[1]: Starting Rotate log files...
Aug 12 18:03:14 grommunio logrotate[67585]: error: stat of /var/log/grommunio-dav/*.log failed: Keine Berechtigung
Aug 12 18:03:14 grommunio logrotate[67585]: error: stat of /var/log/grommunio-sync/*.log failed: Keine Berechtigung

But there are actually no files in there, so logrotate still complains, after changing the POSIX rights accordingly:

Aug 12 18:04:35 grommunio systemd[1]: Starting Rotate log files...
Aug 12 18:04:35 grommunio logrotate[67609]: error: stat of /var/log/grommunio-dav/*.log failed: Datei oder Verzeichnis nicht gefunden
Aug 12 18:04:35 grommunio logrotate[67609]: error: stat of /var/log/grommunio-sync/*.log failed: Datei oder Verzeichnis nicht gefunden

crpb

missingok
Hab dazu sogar ein Ticket aufgemacht.

sbudach

crpb

Uhh… da hätte ich auch selber drauf kommen können… 🙄

sbudach

I just performed a simple apt update/apt upgrade and rebootet my host. There was only one package to be updated:

Paketlisten werden gelesen… Fertig
Abhängigkeitsbaum wird aufgebaut… Fertig
Statusinformationen werden eingelesen… Fertig
Aktualisierung für 1 Paket verfügbar. Führen Sie »apt list --upgradable« aus, um es anzuzeigen.
root@grommunio:~/Software/imapsync# apt list --upgradable
Auflistung… Fertig
gromox/unbekannt 1.28.143.3a0f47d29-1+33.1 amd64 [aktualisierbar von: 1.28.131.3b61826a8-1+27.1]
N: Es gibt 1 zusätzliche Version. Bitte verwenden Sie die Option »-a«, um sie anzuzeigen.
root@grommunio:~/Software/imapsync# apt upgrade
Paketlisten werden gelesen… Fertig
Abhängigkeitsbaum wird aufgebaut… Fertig
Statusinformationen werden eingelesen… Fertig
Paketaktualisierung (Upgrade) wird berechnet… Fertig
Die folgenden Pakete werden aktualisiert (Upgrade):
  gromox
1 aktualisiert, 0 neu installiert, 0 zu entfernen und 0 nicht aktualisiert.
Es müssen 1.782 kB an Archiven heruntergeladen werden.
Nach dieser Operation werden 0 B Plattenplatz zusätzlich benutzt.
Möchten Sie fortfahren? [J/n] j

However, after rebooting the host Grommunio is completely hosed. Most of the services are missing as if they had been removed:

root@grommunio:/etc/systemd/system# systemctl list-units --all | grep gro
  cron.service                                                                         loaded    active   running   Regular background program processing daemon
  grommunio-antispam.service                                                           loaded    active   running   rapid spam filtering system
  gromox-imap.service                                                                  loaded    active   running   Gromox IMAP server
  logrotate.service                                                                    loaded    inactive dead      Rotate log files
  logrotate.timer                                                                      loaded    active   waiting   Daily rotation of log files

So… any idea of what could have happened? I re-installed the packages again, but I never encountered anything like this before.

crpb

Hmm.. bei mir sieht noch alles gut aus.

root@grom-deb ~ # systemctl --failed
  UNIT LOAD ACTIVE SUB DESCRIPTION
0 loaded units listed.
root@grom-deb ~ # systemctl -a |grep grom
  var-lib-gromox.mount                                                                loaded    active   mounted   /var/lib/gromox
  grommunio-admin-api.service                                                         loaded    active   running   grommunio admin api
  grommunio-antispam.service                                                          loaded    active   running   rapid spam filtering system
  grommunio-index.service                                                             loaded    inactive dead      Fulltext search index regeneration
  gromox-delivery-queue.service                                                       loaded    active   running   Gromox local delivery agent frontend
  gromox-delivery.service                                                             loaded    active   running   Gromox mail spooler
  gromox-event.service                                                                loaded    active   running   Gromox event service
  gromox-http.service                                                                 loaded    active   running   Gromox HTTP service
  gromox-imap.service                                                                 loaded    active   running   Gromox IMAP server
  gromox-midb.service                                                                 loaded    active   running   Gromox midb service
  gromox-pop3.service                                                                 loaded    active   running   Gromox POP3 server
  gromox-timer.service                                                                loaded    active   running   Gromox timer service
  gromox-zcore.service                                                                loaded    active   running   Gromox zcore service
  redis@grommunio.service                                                             loaded    active   running   Redis instance: grommunio
  grommunio-admin-api.socket                                                          loaded    active   running   Socket for grommunio admin api
  grommunio-index.timer                                                               loaded    active   waiting   Daily regeneration of grommunio FTS indexes
root@grom-deb ~ # grep 2022-08-13 -A3 /var/log/apt/history.log 
Start-Date: 2022-08-13  12:25:35
Commandline: apt-get dist-upgrade --yes
Upgrade: gromox:amd64 (1.28.133.8d9d44986-1+29.1, 1.28.143.3a0f47d29-1+33.1)
End-Date: 2022-08-13  12:25:38
root@grom-deb ~ # uptime                                      
 14:31:39 up 26 min,  1 user,  load average: 0.01, 0.01, 0.00

« Previous Page Next Page »