wip

CHANGELOG.md

@@ -2,23 +2,14 @@
 
 ## untagged
 
-## 1.3.0 - 2024-06-06
-
-- don't check necessary DNS records on cmdeploy init anymore
-  ([#316](https://github.com/deltachat/chatmail/pull/316))
-
-- ensure cron and acl are installed
-  ([#293](https://github.com/deltachat/chatmail/pull/293),
-  [#310](https://github.com/deltachat/chatmail/pull/310))
+- run metrics generation with systemd-timer instead of cron
+  ([#304](https://github.com/deltachat/chatmail/pull/304))
 
 - change default for delete_mails_after from 40 to 20 days
-  ([#300](https://github.com/deltachat/chatmail/pull/300))
-
-- save journald logs only to memory and save nginx logs to journald instead of file
-  ([#299](https://github.com/deltachat/chatmail/pull/299))
+  ([#300]https://github.com/deltachat/chatmail/pull/300)
 
 - fix writing of multiple obs repositories in `/etc/apt/sources.list`
-  ([#290](https://github.com/deltachat/chatmail/pull/290))
+  ([#272](https://github.com/deltachat/chatmail/issues/272))
 
 - metadata: add support for `/shared/vendor/deltachat/irohrelay`
   ([#284](https://github.com/deltachat/chatmail/pull/284))

cmdeploy/src/cmdeploy/__init__.py

@@ -17,6 +17,7 @@ from pyinfra.operations import apt, files, pip, server, systemd
 
 from .acmetool import deploy_acmetool
 
+root_owned = dict(user="root", group="root", mode="644")
 
 def _build_chatmaild(dist_dir) -> None:
     dist_dir = Path(dist_dir).resolve()
@@ -50,7 +51,6 @@ def _install_remote_venv_with_chatmaild(config) -> None:
     remote_dist_file = f"{remote_base_dir}/dist/{dist_file.name}"
     remote_venv_dir = f"{remote_base_dir}/venv"
     remote_chatmail_inipath = f"{remote_base_dir}/chatmail.ini"
-    root_owned = dict(user="root", group="root", mode="644")
 
     apt.packages(
         name="apt install python3-virtualenv",
@@ -85,9 +85,19 @@ def _install_remote_venv_with_chatmaild(config) -> None:
         ],
     )
 
+    # create metrics every 5 minutes via systemd
+
+    files.put(
+        name="Upload metrics.timer",
+        src=importlib.resources.files(__package__).joinpath("service/metrics.timer"),
+        dest=f"/etc/systemd/system/metrics.timer",
+        **root_owned,
+    )
+
     files.template(
-        src=importlib.resources.files(__package__).joinpath("metrics.cron.j2"),
-        dest="/etc/cron.d/chatmail-metrics",
+        name="upload metrics.service",
+        src=importlib.resources.files(__package__).joinpath("service/metrics.service.j2"),
+        dest="/etc/systemd/system/metrics.service",
         user="root",
         group="root",
         mode="644",
@@ -97,6 +107,15 @@ def _install_remote_venv_with_chatmaild(config) -> None:
         },
     )
 
+    systemd.service(
+        name=f"Setup metrics timer",
+        service="metrics.timer",
+        running=True,
+        enabled=True,
+        restarted=True,
+        daemon_reload=True,
+    )
+
     # install systemd units
     for fn in (
         "doveauth",
@@ -352,6 +371,23 @@ def _configure_dovecot(config: Config, debug: bool = False) -> bool:
             commands=["/usr/bin/sievec /etc/dovecot/default.sieve"],
         )
 
+    files.template(
+        src=importlib.resources.files(__package__).joinpath("service/expunge.service.j2"),
+        dest="/etc/systemd/system/expunge.service",
+        config={
+            "mail_domain": config.mail_domain,
+            "delete_mails_after": config.delete_mails_after,
+        },
+        **root_owned,
+    )
+
+    files.put(
+        name="Upload expunge.timer",
+        src=importlib.resources.files(__package__).joinpath("service/expunge.timer"),
+        dest=f"/etc/systemd/system/expunge.timer",
+        **root_owned,
+    )
+
     files.template(
         src=importlib.resources.files(__package__).joinpath("dovecot/expunge.cron.j2"),
         dest="/etc/cron.d/expunge",
@@ -523,6 +559,7 @@ def deploy_chatmail(config_path: Path) -> None:
             "systemctl reset-failed unbound.service",
         ],
     )
+
     systemd.service(
         name="Start and enable unbound",
         service="unbound.service",
@@ -642,12 +679,5 @@ def deploy_chatmail(config_path: Path) -> None:
         service="systemd-journald.service",
         running=True,
         enabled=True,
-        restarted=journald_conf.changed,
+        restarted=journald_conf,
     )
-
-    apt.packages(
-        name="Ensure cron is installed",
-        packages=["cron"],
-    )
-
-

cmdeploy/src/cmdeploy/cmdeploy.py

@@ -38,6 +38,10 @@ def init_cmd(args, out):
     else:
         write_initial_config(args.inipath, mail_domain)
         out.green(f"created config file for {mail_domain} in {args.inipath}")
+    check_necessary_dns(
+        out,
+        mail_domain,
+    )
 
 
 def run_cmd_options(parser):

cmdeploy/src/cmdeploy/dns.py

@@ -183,7 +183,6 @@ def show_dns(args, out) -> int:
 
 def check_necessary_dns(out, mail_domain):
     """Check whether $mail_domain and mta-sts.$mail_domain resolve."""
-    print("Checking necessary DNS records... ")
     dns = DNS(out, mail_domain)
     ipv4 = dns.get("A", mail_domain)
     ipv6 = dns.get("AAAA", mail_domain)
@@ -205,5 +204,5 @@ def check_necessary_dns(out, mail_domain):
             print(line)
         print()
     else:
-        dns.out.green("All necessary DNS records seem to be set.")
+        dns.out.green("\nAll necessary DNS entries seem to be set.")
         return True

cmdeploy/src/cmdeploy/journald.conf

@@ -1,3 +1,2 @@
 [Journal]
 MaxRetentionSec=3d
-Storage=volatile

cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

@@ -1,7 +1,7 @@
 user www-data;
 worker_processes auto;
 pid /run/nginx.pid;
-error_log syslog:server=unix:/dev/log,facility=local3;
+error_log /var/log/nginx/error.log;
 
 events {
 	worker_connections 768;
@@ -35,8 +35,6 @@ http {
 
 		server_name _;
 
-		access_log syslog:server=unix:/dev/log,facility=local7;
-
 		location / {
 			# First attempt to serve request as file, then
 			# as directory, then fall back to displaying a 404.
@@ -82,6 +80,5 @@ http {
 		listen [::]:443 ssl;
 		server_name www.{{ config.domain_name }};
 		return 301 $scheme://{{ config.domain_name }}$request_uri;
-		access_log syslog:server=unix:/dev/log,facility=local7;
 	}
 }

cmdeploy/src/cmdeploy/service/expunge.service.j2

@@ -0,0 +1,16 @@
+[Unit]
+Description=Expunge old mails after {{ config.delete_mails_after }} days
+
+[Service]
+Type=oneshot
+# delete all mails after {{ config.delete_mails_after }} days, in the Inbox
+ExecStart=/home/vmail/mail/{{ config.mail_domain }} -path '*/cur/*' -mtime +{{ config.delete_mails_after }} -type f -delete
+# or in any IMAP subfolder
+ExecStart=vmail find /home/vmail/mail/{{ config.mail_domain }} -path '*/.*/cur/*' -mtime +{{ config.delete_mails_after }} -type f -delete
+# even if they are unseen
+ExecStart=vmail find /home/vmail/mail/{{ config.mail_domain }} -path '*/new/*' -mtime +{{ config.delete_mails_after }} -type f -delete
+ExecStart=vmail find /home/vmail/mail/{{ config.mail_domain }} -path '*/new/*' -mtime +{{ config.delete_mails_after }} -type f -delete
+# or only temporary (but then they shouldn't be around after {{ config.delete_mails_after }} days anyway).
+ExecStart=vmail find /home/vmail/mail/{{ config.mail_domain }} -path '*/tmp/*' -mtime +{{ config.delete_mails_after }} -type f -delete
+ExecStart=vmail find /home/vmail/mail/{{ config.mail_domain }} -path '*/.*/tmp/*' -mtime +{{ config.delete_mails_after }} -type f -delete
+ExecStart=vmail find /home/vmail/mail/{{ config.mail_domain }} -name 'maildirsize' -type f -delete

cmdeploy/src/cmdeploy/service/expunge.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Run expunge.service daily
+
+[Timer]
+OnCalendar=weekly
+Persistent=true
+
+[Install]
+WantedBy=timers.target

cmdeploy/src/cmdeploy/service/metrics.service.j2

@@ -0,0 +1,5 @@
+[Unit]
+Description=Generate metrics in /var/www/html/metrics
+
+[Service]
+ExecStart={{ config.execpath }} /home/vmail/mail/{{ config.mail_domain }} > /var/www/html/metrics

cmdeploy/src/cmdeploy/service/metrics.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Run metrics.service every 5 minutes
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=5min
+
+[Install]
+WantedBy=timers.target

cmdeploy/src/cmdeploy/tests/online/test_1_basic.py

@@ -86,7 +86,6 @@ def test_exceed_rate_limit(cmsetup, gencreds, maildata, chatmail_config):
     pytest.fail("Rate limit was not exceeded")
 
 
-@pytest.mark.slow
 def test_expunged(remote, chatmail_config):
     outdated_days = int(chatmail_config.delete_mails_after) + 1
     find_cmds = [

scripts/dovecot/README.md

@@ -1,80 +0,0 @@
-## Introduction to custom Dovecot builds
-
-Chatmail servers use a custom Debian build of the IMAP 'dovecot' server software because 
-
-a) Dovecot developers did not yet merge a [pull request](https://github.com/dovecot/core/pull/216)
-   which majorly speeds up message delivery by removing a hardcoded 0.5 second delay 
-   on relaying incoming messages.  
-
-b) Even if merged, it would take years for it to reach Debian stable.
-
-c) The modified dovecot has been successfully used since December 2023 without issues
-   and we see no noticeable downside (theoretically higher CPU usage but not measureable)
-   but a considerable upside as the delay-removal facilitates end-to-end message 
-   delivery of 200 ms in real networks. 
-
-The modified forked dovecot code lives at 
-[https://github.com/chatmail/dovecot](https://github.com/chatmail/dovecot).  
-The remainder of this document describes the setup of the Debian repository 
-containing the patched dovecot version. 
-
-## Building Debian packages at build.opensuse.org 
-
-Delta Chat developers maintain an [account](https://build.opensuse.org/project/show/home:deltachat) 
-in the [Open Build Service (OBS)](https://openbuildservice.org/), 
-where the [resulting package](https://build.opensuse.org/package/show/home:deltachat/dovecot) 
-is now used in deploying chatmail servers. 
-   
-The Open Build Service (OBS) is a platform for building and distributing software packages 
-across various operating systems and architectures. 
-It supports openSUSE, Fedora, Debian, Ubuntu and Arch.
-It's [primary instance](https://build.opensuse.org/) is ran by the openSUSE project 
-and is part of the pipeline of the creation of SUSE Linux Enterprise.
-
-The OBS provides a mercurial-like interface to create source repositories 
-that are then automatically built. 
-While in theory a package can be created entirely over the web interface, 
-the use of the cli-tool `osc` is more convenient and is described in the [official documentation](https://openbuildservice.org/help/manuals/obs-user-guide/art.obs.bg#sec.obsbg.obsconfig).
-
-### How to build the dovecot debian package on the OBS via our script
-
-In scripts/dovecot/ is a shell script that prepares the required files and pushes them to build.opensuse.org.
-
-Before using the script, you should have osc set up as described in the [official documentation](https://openbuildservice.org/help/manuals/obs-user-guide/art.obs.bg#sec.obsbg.obsconfig).
-
-The script assumes you are on Debian. It automatically installs any needed dependencies and creates the source package. To upload the resulting source package to the OBS you need to enter the username and password for deltachat on build.opensuse.org in the last step of the script.
-
-Use `source build-obs.sh` to run it.
-
-### Adding the resulting OBS repository to Debian 12
-
-Our dovecot fork is automatically installed as part of the chatmail deployment. You can see it in cmdeploy/src/cmdeploy/__init__.py. If you want to add our fork manually to a system, you can do the following:
-
-First add our signing key to your apt keyring:
-
-```
-sudo cp cmdeploy/src/cmdeploy/obs-home-deltachat.gpg /etc/apt/keyrings/obs-home-deltachat.gpg`
-```
-
-Now add our repository and key to /etc/apt/sources.list with a text editor of your choice:
-
-```
-deb [signed-by=/etc/apt/keyrings/obs-home-deltachat.gpg] https://download.opensuse.org/repositories/home:/deltachat/Debian_12/ ./
-```
-
-You can now install dovecot like normal.
-
-```
-sudo apt update
-sudo apt install dovecot-core
-```
-
-### Security concerns 
-
-The signing of the patched dovecot package is done in the OBS and 
-in theory SUSE could make changes to the package delivered.
-It is probably reasonable to trust SUSE to not mess with the build
-process because it would cause serious negative reputation damage for them 
-if they tried and someone finds out. 
-
-Our dovecot fork will receive the same security backports as the dovecot package in Debian Sid.

scripts/dovecot/build-obs.sh

@@ -1,54 +0,0 @@
-#!/bin/bash
-
-# Install dependencies
-echo "Installing dependencies for this script:"
-sudo apt install -y devscripts build-essential osc curl git debhelper-compat
-
-# Define path of your local OBS repository
-SCRIPT_DIR=$PWD
-OBS_PATH=$SCRIPT_DIR/obs
-REPO_PATH=$OBS_PATH/home:deltachat/dovecot/
-
-# Download Debian Source Files
-echo "Downloading precise files from Debian unstable repository..."
-mkdir dovecot-build
-cd dovecot-build
-
-# taken May 6th 2024, from https://packages.debian.org/unstable/dovecot-core 
-curl http://deb.debian.org/debian/pool/main/d/dovecot/dovecot_2.3.21+dfsg1-3.debian.tar.xz -O
-curl http://deb.debian.org/debian/pool/main/d/dovecot/dovecot_2.3.21+dfsg1.orig.tar.gz -O
-curl http://deb.debian.org/debian/pool/main/d/dovecot/dovecot_2.3.21+dfsg1.orig-pigeonhole.tar.gz -O
-
-# Clone the Chatmail Dovecot Repo
-echo "Cloning the Chatmail Dovecot fork..."
-git clone https://github.com/chatmail/dovecot.git
-
-# Build the source package
-echo "Building the source package"
-cd dovecot
-dpkg-source -b .
-
-# Setting up OSC
-echo "Setting up OBS home repository"
-mkdir $OBS_PATH
-cd $OBS_PATH
-rm -rf home:deltachat/dovecot
-osc checkout home:deltachat/dovecot
-
-# Copy Files to Your Local OBS Repository,
-echo "Copying files to your local OBS repository..."
-cd $SCRIPT_DIR/dovecot-build
-cp -rf dovecot_2.3.21+dfsg1-3.debian.tar.xz $REPO_PATH
-cp -rf dovecot_2.3.21+dfsg1.orig.tar.gz $REPO_PATH
-cp -rf dovecot_2.3.21+dfsg1.orig-pigeonhole.tar.gz $REPO_PATH
-cp -rf dovecot_2.3.21+dfsg1-3.dsc $REPO_PATH
-
-# Push Changes to OBS
-echo "Pushing changes to OBS..."
-cd $REPO_PATH
-osc up
-osc add dovecot_2.3.21+dfsg1-3.debian.tar.xz
-osc add dovecot_2.3.21+dfsg1.orig.tar.gz
-osc add dovecot_2.3.21+dfsg1.orig-pigeonhole.tar.gz
-osc add dovecot_2.3.21+dfsg1-3.dsc
-osc commit

www/src/index.md

@@ -1,17 +1,11 @@
 
 <img class="banner" src="collage-top.png"/>
 
-## Dear [Delta Chat](https://get.delta.chat) users and newcomers ... 
+## Dear [Delta Chat](https://get.delta.chat) users and newcomers, 
 
-{% if config.mail_domain != "nine.testrun.org" %}
 Welcome to instant, interoperable and [privacy-preserving](privacy.html) messaging :) 
-{% else %}
-Welcome to the default onboarding server ({{ config.mail_domain }}) 
-for Delta Chat users.  For details how it avoids storing personal information
-please see our [privacy policy](privacy.html). 
-{% endif %}
 
-👉 **Tap** or scan this QR code to get a `@{{config.mail_domain}}` chat profile
+👉 **Tap** or scan this QR code to get a random `@{{config.mail_domain}}` e-mail address
 
 <a href="DCACCOUNT:https://{{ config.mail_domain }}/new">
     <img width=300 style="float: none;" src="qr-chatmail-invite-{{config.mail_domain}}.png" /></a>

www/src/info.md

@@ -1,4 +1,6 @@
 
+<img class="banner" src="collage-info.png"/>
+
 ## More information 
 
 {{ config.mail_domain }} provides a low-maintenance, resource efficient and 
@@ -9,7 +11,7 @@ for the usage in chats, especially DeltaChat.
 ### Choosing a chatmail address instead of using a random one
 
 In the Delta Chat account setup 
-you may tap `I already have a profile`
+you may tap `LOG INTO YOUR E-MAIL ACCOUNT` 
 and fill the two fields like this: 
 
 - `Address`: invent a word with

www/src/privacy.md

@@ -1,41 +1,21 @@
+<img class="banner" src="collage-privacy.png"/>
 
 # Privacy Policy for {{ config.mail_domain }} 
 
-{% if config.mail_domain == "nine.testrun.org" %}
-Welcome to `{{config.mail_domain}}`, the default chatmail onboarding server for Delta Chat users. 
-It is operated on the side by a small sysops team employed by [merlinux](https://merlinux.eu),
-an open-source R&D company also acting as the fiscal sponsor of Delta Chat app developments. 
-See [other chatmail servers](https://delta.chat/en/chatmail) for alternative server operators. 
-{% endif %}
-
-
-## Summary: No personal data asked or collected 
-
-This chatmail server neither asks for nor retains personal information. 
-Chatmail servers exist to reliably transmit (store and deliver) end-to-end encrypted messages
-between user's devices running the Delta Chat messenger app. 
-Technically, you may think of a Chatmail server as 
-an end-to-end encrypted "messaging router" at Internet-scale. 
-
-A chatmail server is very unlike classic e-mail servers (for example Google Mail servers)
-that ask for personal data and permanently store messages. 
-A chatmail server behaves more like the Signal messaging server 
-but does not know about phone numbers and securely and automatically interoperates 
-with other chatmail and classic e-mail servers. 
-
-In particular, this chatmail server 
-
-- unconditionally removes messages after {{ config.delete_mails_after }} days,
-
-- prohibits sending out un-encrypted messages,
-
-- only has temporary log files used for debugging purposes.
-
-Legally, authorities might still regard chatmail as a "classic e-mail" server
-which collects and retains personal data. 
-We do not agree on this interpretation. Nevertheless, we provide more legal details below
-to make life easier for data protection specialists and lawyers scrutinizing chatmail operations. 
+We want to show you in a fair and transparent way
+what personal data is processed by us.
+We follow a strict privacy-by-design approach
+and try to avoid processing your data in the first place,
+but as you may know,
+the internet, 
+and in particular sending e-mail messages,
+does not work without data.
+Still,
+it's only fair that you know at all times
+what personal data is processed
+when you use our service.
 
+If you have any remaining questions about data protection, please contact us. 
 
 ## 1. Name and contact information 
 
@@ -198,9 +178,8 @@ for the purpose of drawing conclusions about your person.
 
 ## 4. Transfer of Data
 
-We do not retain any personal data but e-mail messages waiting to be delivered 
-may contain personal data.
-Any such residual personal data will not be transferred to third parties
+Your personal data
+will not be transferred to third parties
 for purposes other than those listed below:
 
 a) you have given your express consent