From 33f925caa76b8ddbfcd08daf19dc6e7eac813392 Mon Sep 17 00:00:00 2001
From: holger krekel <holger@merlinux.eu>
Date: Sat, 26 Sep 2026 23:18:20 +0200
Subject: [PATCH] refactor: un-hardcode filesystem paths in configuration
 templates

Drive all file system paths from templating variables,
useful e.g. for FreeBSD which keeps debian's `/etc` hiearchy rather in `/usr/local/etc`.
Also support static nginx builds which have the stream module compiled in
and thus don't need dynamic linking to a stream module.
---
 cmdeploy/src/cmdeploy/dovecot/deployer.py     |  3 +++
 cmdeploy/src/cmdeploy/dovecot/dovecot.conf.j2 | 10 +++++-----
 cmdeploy/src/cmdeploy/nginx/deployer.py       |  4 ++++
 cmdeploy/src/cmdeploy/nginx/nginx.conf.j2     | 14 +++++++-------
 cmdeploy/src/cmdeploy/opendkim/KeyTable       |  2 +-
 cmdeploy/src/cmdeploy/opendkim/deployer.py    |  3 +++
 cmdeploy/src/cmdeploy/opendkim/opendkim.conf  |  8 ++++----
 cmdeploy/src/cmdeploy/postfix/deployer.py     |  3 +++
 cmdeploy/src/cmdeploy/postfix/main.cf.j2      |  8 ++++----
 cmdeploy/src/cmdeploy/postfix/master.cf.j2    |  2 +-
 10 files changed, 35 insertions(+), 22 deletions(-)

diff --git a/cmdeploy/src/cmdeploy/dovecot/deployer.py b/cmdeploy/src/cmdeploy/dovecot/deployer.py
index a4e0d5a7..b0d23ec9 100644
--- a/cmdeploy/src/cmdeploy/dovecot/deployer.py
+++ b/cmdeploy/src/cmdeploy/dovecot/deployer.py
@@ -133,6 +133,9 @@ def _configure_dovecot(deployer, config: Config, debug: bool = False):
         config=config,
         debug=debug,
         disable_ipv6=config.disable_ipv6,
+        config_dir="/etc/dovecot",
+        dh_path="/usr/share/dovecot/dh.pem",
+        quota_expire_bin="/usr/local/lib/chatmaild/venv/bin/chatmail-quota-expire",
     )
     deployer.put_template("dovecot/auth.lua.j2", "/etc/dovecot/auth.lua", config=config)
     deployer.remove_file("/etc/dovecot/auth.conf")
diff --git a/cmdeploy/src/cmdeploy/dovecot/dovecot.conf.j2 b/cmdeploy/src/cmdeploy/dovecot/dovecot.conf.j2
index 19b08a64..5f4ff51e 100644
--- a/cmdeploy/src/cmdeploy/dovecot/dovecot.conf.j2
+++ b/cmdeploy/src/cmdeploy/dovecot/dovecot.conf.j2
@@ -62,11 +62,11 @@ imap_capability = +XDELTAPUSH XCHATMAIL
 # Authentication for system users.
 passdb {
   driver = lua
-  args = file=/etc/dovecot/auth.lua blocking=yes
+  args = file={{ config_dir }}/auth.lua blocking=yes
 }
 userdb {
   driver = lua
-  args = file=/etc/dovecot/auth.lua blocking=yes
+  args = file={{ config_dir }}/auth.lua blocking=yes
 }
 ##
 ## Mailbox locations and namespaces
@@ -168,7 +168,7 @@ plugin {
 }
 
 service quota-warning {
-  executable = script /usr/local/lib/chatmaild/venv/bin/chatmail-quota-expire
+  executable = script {{ quota_expire_bin }}
   user = vmail
   unix_listener quota-warning {
      user = vmail
@@ -179,7 +179,7 @@ service quota-warning {
 # push_notification configuration
 plugin {
   # <https://doc.dovecot.org/2.3/configuration_manual/push_notification/#lua-lua>
-  push_notification_driver = lua:file=/etc/dovecot/push_notification.lua
+  push_notification_driver = lua:file={{ config_dir }}/push_notification.lua
 }
 
 service lmtp {
@@ -254,7 +254,7 @@ service anvil {
 ssl = required
 ssl_cert = <{{ config.tls_cert_path }}
 ssl_key = <{{ config.tls_key_path }}
-ssl_dh = </usr/share/dovecot/dh.pem
+ssl_dh = <{{ dh_path }}
 ssl_min_protocol = TLSv1.3
 ssl_prefer_server_ciphers = yes
 
diff --git a/cmdeploy/src/cmdeploy/nginx/deployer.py b/cmdeploy/src/cmdeploy/nginx/deployer.py
index c88464d4..998f421d 100644
--- a/cmdeploy/src/cmdeploy/nginx/deployer.py
+++ b/cmdeploy/src/cmdeploy/nginx/deployer.py
@@ -55,6 +55,10 @@ def _configure_nginx(deployer, config: Config, debug: bool = False):
         "/etc/nginx/nginx.conf",
         config=config,
         disable_ipv6=config.disable_ipv6,
+        config_dir="/etc/nginx",
+        stream_module="modules/ngx_stream_module.so",
+        www_root="/var/www/html",
+        cgi_dir="/usr/lib/cgi-bin",
     )
 
     deployer.put_template(
diff --git a/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2 b/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2
index 04ab3643..84e319b0 100644
--- a/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2
+++ b/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2
@@ -1,4 +1,4 @@
-load_module modules/ngx_stream_module.so;
+{% if stream_module %}load_module {{ stream_module }};{% endif %}
 
 user www-data;
 worker_processes auto;
@@ -54,7 +54,7 @@ http {
 	# Do not emit nginx version on error pages.
 	server_tokens off;
 
-	include /etc/nginx/mime.types;
+	include {{ config_dir }}/mime.types;
 	default_type application/octet-stream;
 
 	ssl_protocols TLSv1.2 TLSv1.3;
@@ -68,7 +68,7 @@ http {
   
 		listen 127.0.0.1:8443 ssl default_server;
 
-		root /var/www/html;
+		root {{ www_root }};
 
 		index index.html index.htm;
 
@@ -96,8 +96,8 @@ http {
 {% endif %}
 
 			fastcgi_pass unix:/run/fcgiwrap.socket;
-			include /etc/nginx/fastcgi_params;
-			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
+			include {{ config_dir }}/fastcgi_params;
+			fastcgi_param SCRIPT_FILENAME {{ cgi_dir }}/newemail.py;
 		}
 
 		# Old URL for compatibility with e.g. printed QR codes.
@@ -114,8 +114,8 @@ http {
 {% endif %}
 
 			fastcgi_pass unix:/run/fcgiwrap.socket;
-			include /etc/nginx/fastcgi_params;
-			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
+			include {{ config_dir }}/fastcgi_params;
+			fastcgi_param SCRIPT_FILENAME {{ cgi_dir }}/newemail.py;
 		}
 
                 # Proxy to iroh-relay service.
diff --git a/cmdeploy/src/cmdeploy/opendkim/KeyTable b/cmdeploy/src/cmdeploy/opendkim/KeyTable
index bb2f6fb3..eeeb27f7 100644
--- a/cmdeploy/src/cmdeploy/opendkim/KeyTable
+++ b/cmdeploy/src/cmdeploy/opendkim/KeyTable
@@ -1 +1 @@
-{{ config.opendkim_selector }}._domainkey.{{ config.domain_name }} {{ config.domain_name }}:{{ config.opendkim_selector }}:/etc/dkimkeys/{{ config.opendkim_selector }}.private
+{{ config.opendkim_selector }}._domainkey.{{ config.domain_name }} {{ config.domain_name }}:{{ config.opendkim_selector }}:{{ keys_dir }}/{{ config.opendkim_selector }}.private
diff --git a/cmdeploy/src/cmdeploy/opendkim/deployer.py b/cmdeploy/src/cmdeploy/opendkim/deployer.py
index 27b3876a..362627f8 100644
--- a/cmdeploy/src/cmdeploy/opendkim/deployer.py
+++ b/cmdeploy/src/cmdeploy/opendkim/deployer.py
@@ -30,6 +30,8 @@ class OpendkimDeployer(Deployer):
             "opendkim/opendkim.conf",
             "/etc/opendkim.conf",
             config={"domain_name": domain, "opendkim_selector": dkim_selector},
+            keys_dir="/etc/dkimkeys",
+            trust_anchor="/usr/share/dns/root.key",
         )
 
         self.remove_file("/etc/opendkim/screen.lua")
@@ -46,6 +48,7 @@ class OpendkimDeployer(Deployer):
             "/etc/dkimkeys/KeyTable",
             owner="opendkim",
             config={"domain_name": domain, "opendkim_selector": dkim_selector},
+            keys_dir="/etc/dkimkeys",
         )
 
         self.put_template(
diff --git a/cmdeploy/src/cmdeploy/opendkim/opendkim.conf b/cmdeploy/src/cmdeploy/opendkim/opendkim.conf
index e1a3e1b2..5cf411bb 100644
--- a/cmdeploy/src/cmdeploy/opendkim/opendkim.conf
+++ b/cmdeploy/src/cmdeploy/opendkim/opendkim.conf
@@ -21,9 +21,9 @@ DNSTimeout          60
 # setup options can be found in /usr/share/doc/opendkim/README.opendkim.
 Domain			{{ config.domain_name }}
 Selector		{{ config.opendkim_selector }}
-KeyFile		  /etc/dkimkeys/{{ config.opendkim_selector }}.private
-KeyTable          /etc/dkimkeys/KeyTable
-SigningTable      refile:/etc/dkimkeys/SigningTable
+KeyFile		  {{ keys_dir }}/{{ config.opendkim_selector }}.private
+KeyTable          {{ keys_dir }}/KeyTable
+SigningTable      refile:{{ keys_dir }}/SigningTable
 
 # Sign Autocrypt header in addition to the default specified in RFC 6376.
 #
@@ -58,7 +58,7 @@ PidFile			/run/opendkim/opendkim.pid
 
 # The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided
 # by the package dns-root-data.
-TrustAnchorFile		/usr/share/dns/root.key
+TrustAnchorFile		{{ trust_anchor }}
 
 # Sign messages when `-o milter_macro_daemon_name=ORIGINATING` is set.
 MTA ORIGINATING
diff --git a/cmdeploy/src/cmdeploy/postfix/deployer.py b/cmdeploy/src/cmdeploy/postfix/deployer.py
index 53d5f2de..b5ae65c5 100644
--- a/cmdeploy/src/cmdeploy/postfix/deployer.py
+++ b/cmdeploy/src/cmdeploy/postfix/deployer.py
@@ -24,6 +24,8 @@ class PostfixDeployer(Deployer):
             "/etc/postfix/main.cf",
             config=config,
             disable_ipv6=config.disable_ipv6,
+            config_dir="/etc/postfix",
+            ca_path="/etc/ssl/certs",
         )
 
         self.put_template(
@@ -31,6 +33,7 @@ class PostfixDeployer(Deployer):
             "/etc/postfix/master.cf",
             debug=False,
             config=config,
+            config_dir="/etc/postfix",
         )
 
         self.put_file(
diff --git a/cmdeploy/src/cmdeploy/postfix/main.cf.j2 b/cmdeploy/src/cmdeploy/postfix/main.cf.j2
index c6aa51ab..37dadcfc 100644
--- a/cmdeploy/src/cmdeploy/postfix/main.cf.j2
+++ b/cmdeploy/src/cmdeploy/postfix/main.cf.j2
@@ -19,13 +19,13 @@ smtpd_tls_cert_file={{ config.tls_cert_path }}
 smtpd_tls_key_file={{ config.tls_key_path }}
 smtpd_tls_security_level=may
 
-smtp_tls_CApath=/etc/ssl/certs
+smtp_tls_CApath={{ ca_path }}
 smtp_tls_security_level=verify
 # Send SNI extension when connecting to other servers.
 # <https://www.postfix.org/postconf.5.html#smtp_tls_servername>
 smtp_tls_servername = hostname
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
-smtp_tls_policy_maps = regexp:/etc/postfix/smtp_tls_policy_map
+smtp_tls_policy_maps = regexp:{{ config_dir }}/smtp_tls_policy_map
 smtp_tls_protocols = >=TLSv1.2
 smtp_tls_mandatory_protocols = >=TLSv1.2
 
@@ -83,7 +83,7 @@ inet_protocols = ipv4
 inet_protocols = all
 {% endif %}
 
-lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup
+lmtp_header_checks = regexp:{{ config_dir }}/lmtp_header_cleanup
 
 # Do not apply header checks to MIME headers
 # and other headers that are actually part of the message body.
@@ -98,7 +98,7 @@ mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticate
 mua_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit
 
 # 1:1 map MAIL FROM to SASL login name.
-smtpd_sender_login_maps = regexp:/etc/postfix/login_map
+smtpd_sender_login_maps = regexp:{{ config_dir }}/login_map
 
 # Do not lookup SMTP client hostnames to reduce delays
 # and avoid unnecessary DNS requests.
diff --git a/cmdeploy/src/cmdeploy/postfix/master.cf.j2 b/cmdeploy/src/cmdeploy/postfix/master.cf.j2
index bd599f5c..13b39e53 100644
--- a/cmdeploy/src/cmdeploy/postfix/master.cf.j2
+++ b/cmdeploy/src/cmdeploy/postfix/master.cf.j2
@@ -102,7 +102,7 @@ postlog   unix-dgram n  -       n       -       1       postlogd
 # to make sure the users
 # cannot send unprotected Subject.
 authclean unix  n       -       -       -       0       cleanup
-  -o header_checks=regexp:/etc/postfix/submission_header_cleanup
+  -o header_checks=regexp:{{ config_dir }}/submission_header_cleanup
 
 # Reducing `maxproc` here may result in a head of line blocking
 # when there are many messages sent to unreachable destinations