update..

roles/common/files/a.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf

@@ -0,0 +1,133 @@
+#---------------------------------------
+#-----------------------------
+# Settings for script check_cert_for_dovecot.sh
+#-----------------------------
+#---------------------------------------
+
+# - service_domain
+# -
+# - The main domain for which the certificate was issued
+# -
+# - Example:
+# -    service_domain="a.mx.oopen.de"
+# -    service_domain="mail.cadus.org"
+# -    service_domain="mx.warenform.de"
+# -
+#service_domain=""
+service_domain="a.mx.oopen.de"
+
+
+# - service_name
+# -
+# - Name of service.
+# -
+# - Note: this var will also be used to determin systemd service file
+# - or sysVinit script.
+# -
+# - Example: 
+# -    service_name="Mumble"
+# -    service_name="Prosody"
+# -
+# - Defaults to:
+# -    service_name="Dovecot"
+# -
+#service_name=""
+
+
+# - check_string_ps
+# -
+# - String wich (clearly) identifies the service at the process list (ps)
+# -
+# - Example:
+# -    check_string_ps="[[:digit:]]\ /usr/sbin/murmurd"
+# -    check_string_ps=""
+# -
+# - Defaults to:
+# -    check_string_ps="[[:digit:]]\ /usr/local/dovecot-[[:digit:]]{1,2}\.[[:digit:]]{1,2}\.[[:digit:]]{1,2}(\.[[:digit:]]{1,2})?/sbin/dovecot"
+# -
+#check_string_ps=""
+
+
+# - service_user
+# -
+# - User under which the service is running.
+# -
+# - Example:
+# -    service_user="mumble-server"
+# -    service_user="prosody"
+# -
+# - Defaults to:
+# -    service_user="prosody"
+# -
+#service_user=""
+
+
+# - service_group
+# -
+# - Group under which the service is running.
+# -
+# - Example:
+# -    service_group="mumble-server"
+# -    service_group="prosody"
+# -
+# - Defaults to:
+# -    service_group="prosody"
+# -
+#service_group=""
+
+
+# - cert_installed
+# -
+# - Locataion of certificate read by service
+# -
+# - Example:
+# -    cert_installed="/var/lib/mumble-server/fullchain.pem"
+# -    cert_installed="/var/lib/dehydrated/certs/jabber.so36.net/fullchain.pem"
+# -
+# - Defaults to:
+# -    /etc/dovecot/ssl/mailserver.crt
+# -
+#cert_installed=""
+
+
+# - key_installed
+# -
+# - Location of the key read by service
+# -
+# - Example:
+# -    key_installed="/var/lib/mumble-server/privkey.pem"
+# -    key_installed="/etc/prosody/certs/privkey_jabber.so36.pem"
+# -
+# - Defaults to:
+# -    /etc/dovecot/ssl/mailserver.key
+# -
+#key_installed=""
+
+
+# - cert_newest
+# -
+# - Location of the newest certificate.
+# -
+# - Example:
+# -    cert_newest="/var/lib/dehydrated/certs/il-mumble.oopen.de/fullchain.pem"
+# -    cert_newest="/var/lib/dehydrated/certs/jabber.so36.net/fullchain.pem"
+# -
+# - Defaults to: 
+# -    /var/lib/dehydrated/certs/${service_domain}/fullchain.pem
+# -
+#cert_newest=""
+
+
+# - key_newest
+# -
+# - Location of the newest Key
+# -
+# - Example:
+# -    key_newest="/var/lib/dehydrated/certs/il-mumble.oopen.de/privkey.pem"
+# -    key_newest="/var/lib/dehydrated/certs/jabber.so36.net/privkey.pem"
+# -
+# - Defaults to:
+# -    /var/lib/dehydrated/certs/${service_domain}/privkey.pem
+# -
+#key_newest=""
+

roles/common/files/a.mx/root/bin/monitoring/conf/check_webservice_load.conf

@@ -0,0 +1,145 @@
+#---------------------------------------
+#-----------------------------
+# Settings
+#-----------------------------
+#---------------------------------------
+
+#LOGGING=true
+LOGGING=false
+
+# - What to check
+# -
+check_load=true
+check_mysql=false
+check_apache=true
+check_php_fpm=true
+check_website=false
+
+
+# - Additional Settings for check_mysql
+# -
+# - MySQL / MariaDB credentials
+# -
+# - Giving password on command line is insecure an sind mysql 5.5
+# - you will get a warning doing so.
+# - 
+# - Reading username/password fro file ist also possible, using MySQL/MariaDB
+# - commandline parameter '--defaults-file'.
+# - 
+# - Since Mysql Version 5.6, you can read username/password from
+# - encrypted file.
+# -
+# -    Create (encrypted) option file:
+# -    $ mysql_config_editor set --login-path=local --socket=/tmp/mysql.sock  --user=root --password
+# -    $ Password:
+# -
+# -    Use of option file:
+# -    $ mysql --login-path=local ...
+# -
+# - Example
+# -    mysql_credential_args="--login-path=local"
+# -    mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
+# -    mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf"
+# -
+mysql_credential_args="--login-path=local"
+
+
+# - Additional Settings for check_php_fpm
+# -
+# - On Linux Vserver System set
+# -    curl_check_host=localhost
+# -
+# - On LX-Container set
+# -    curl_check_host=127.0.0.1
+# -
+curl_check_host=127.0.0.1
+
+# - Which PHP versions should be supported by this script. If more than one,
+# - give a blank separated list
+# -
+# - Example:
+# -    php_versions="5.4 5.6 7.0 7.1"
+# -
+php_versions="7.4"
+
+# - If PHP-FPM's ping.path setting does not match ping-$php_major_version,
+# - set the value given in your ping.path setting here. Give ping_path also
+# - the concerning php_version in form
+# -    <php-version>:<ping-path>
+# -
+# - Multiple settings are possible, give a blank separated list.
+# -
+# - Example:
+# -
+# -    ping_path="5.4:ping-site36_net 5.6:ping-oopen_de"
+# -
+ping_path=""
+
+
+# - Additional Settings for check_website - checking (expected) website response
+# -
+# - example:
+# -    is_working_url="https://www.outoflineshop.de/"
+# -    check_string='ool-account-links'
+# -    include_cleanup_function=true
+# -    extra_alert_address="ilker@so36.net"
+# -    cleanup_function='
+# -    rm -rf /var/www/www.outoflineshop.de/htdocs/var/cache/*
+# -    rm -rf /var/www/www.outoflineshop.de/htdocs/var/session/*
+# -    /usr/local/bin/redis-cli flushall > /dev/null 2>&1
+# -    if [[ "$?" = "0" ]]; then
+# -       ok "I have cleaned up directory \"/var/www/www.outoflineshop.de/htdocs/var/cache/\""
+# -    else
+# -       error "Cleaning up directory \"/var/www/www.outoflineshop.de/htdocs/var/cache/\" failed!"
+# -     fi
+# -    /etc/init.d/redis_6379 restart
+# -    if [[ "$?" = "0" ]]; then
+# -       ok "I restarted the redis service"
+# -       echo -e "\t[ Ok ]:    I restarted the redis service" >> $LOCK_DIR/extra_msg.txt
+# -    else
+# -       error "Restarting the redis server failed!"
+# -       echo -e "\t[ Error ]: Restarting the redis server failed!" >> $LOCK_DIR/extra_msg.txt
+# -    fi
+# -    '
+# -
+is_working_url=''
+
+check_string=''
+
+include_cleanup_function=true
+
+# - An extra e-mail address, which will be informed, if the given check URL
+# - does not response as expected (check_string) AFTER script checking, restarting
+# - servervices (webserver, php-fpm) and cleaning up (cleanup_function) was done.
+# -
+extra_alert_address=''
+
+# - php_version_of_working_url
+# -
+# - If given website (is_working_url) does not response as expected, this PHP FPM
+# - engines will be restarted.
+# -
+# - Type "None" if site does not support php
+# -
+# - If php_version_of_working_url is not set, PHP FPM processes of ALL versions (php_versions)
+# - will be restarted
+# -
+php_version_of_working_url=''
+
+# - Notice:
+# - If single qoutes "'" not needed inside cleanup function, then use single quotes
+# - to enclose variable "cleanup_function". Then you don't have do masquerade any 
+# - sign inside.
+# -
+# - Otherwise use double quotes and masq any sign to prevent bash from interpreting.
+# -
+cleanup_function='
+'
+
+
+# - E-Mail settings for sending script messages
+# -
+from_address="root@`hostname -f`"
+content_type='Content-Type: text/plain;\n charset="utf-8"'
+to_addresses="root"
+

roles/common/files/a.mx/root/bin/postfix/conf/create_opendkim_key.conf

@@ -0,0 +1,170 @@
+# ---------------------------------------------------------
+# - Parameter Settings for script 'create_opendkim_key.sh'.
+# ---------------------------------------------------------
+ 
+ 
+# ---------- 
+# DNS Server 
+# ---------- 
+ 
+# - dns_dkim_zone_master_server
+# - 
+# - The DNS Server who is serving the update zone and is used 
+# - for the dynamic updates (nsupdate) 
+# - 
+dns_dkim_zone_master_server="b.ns.oopen.de"
+
+# - update_dns
+# -
+# - Possible Values are 'true' or 'false'
+# -
+#update_dns=true
+
+# - update_zone
+# -
+# - Zone containing the DKIM TXT record.
+# -
+# - Defaults to '_domainkey.<dkim_domaini>'
+# -
+# - Note:
+# -    do NOT change/set this option unless you know what you do.
+# -
+#update_zone=""
+
+# - TTL
+# -
+# - TTL for the DKIM TXT Record.
+# -
+# - Defaults to "" if update_dns=false
+# - Defaults to "43200" if update_dns=true
+# -
+#TTL=
+
+
+# ----------
+# TSIG Key
+# ----------
+
+# - key_secret
+# -
+# - Sectret Key used by 'nsupdate' to create/update the
+# - DKIM TXT record.
+# -
+# - Example:
+# -    key_secret="EtvvMdW0PXD4GMHP+onuHZ0dT/Z8OSJGlce/xH10OwI="
+# -
+key_secret="4woPu0jqf9Jp1IX+gduJ3BVW/1ZMeyCPTQMqEsMXLFw="
+
+# - key_algo
+# -
+# - The key algorithm used for key creation. Available choices are: hmac-md5, 
+# - hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512. The 
+# - default is hmac-sha256. Options are case-insensitive.
+# -
+# - Example:
+# -    key_algo="hmac-md5"
+# -
+# - Defaults to 'hmac-sha256'
+# -
+key_algo="hmac-sha256"
+
+# - key_name
+# -
+# - Name of the Key
+# -
+# - Defaults to "$update_zone"
+# -
+key_name="update-dkim"
+
+
+# ----------
+# Access Credentials DNS Server
+# ----------
+
+# - dns_ssh_user
+# -
+# - Defaults to 'manage-bind'
+# -
+#dns_ssh_user="manage-bind"
+
+# - dns_ssh_port
+# -
+# - Defaults to '22'
+# -
+#dns_ssh_port=22
+
+# - dns_ssh_key
+# -
+# - Defaults to '/root/.ssh/id_rsa-opendkim'
+# -
+#dns_ssh_key="/root/.ssh/id_rsa-opendkim"
+
+
+# ----------
+# Scripts envoked at DNS Server
+# ----------
+
+# - set_new_serial_script
+# -
+# - Script increases the serial for a given domain or a given 
+# - hostname's concerning domain.
+# -
+# - Defaults to /root/bin/bind/bind_set_new_serial.sh
+# -
+#set_new_serial_script="/root/bin/bind/bind_set_new_serial.sh"
+
+# - create_dkim_delegation_script
+# -
+# - Script adds DKIM subdomain delegation for a given domain
+# -
+# - Defaults to '/root/bin/bind/bind_create_dkim_delegation.sh'
+# -
+#create_dkim_delegation_script="/root/bin/bind/bind_create_dkim_delegation.sh"
+
+# - add_dkim_zone_master_script
+# -
+# - Script adds zone _domainkey.<dkim domain> as master zone
+# -
+# - Defaults to '/root/bin/bind/bind_add_dkim_zone_master.sh'
+# -
+#add_dkim_zone_master_script="/root/bin/bind/bind_add_dkim_zone_master.sh"
+
+# - add_dkim_zone_slave_script
+# -
+# - Script adds zone _domainkey.<dkim domain> as slave zone
+# -
+# - Defaults to '/root/bin/bind/bind_add_dkim_zone_slave.sh'
+# -
+#add_dkim_zone_slave_script="/root/bin/bind/bind_add_dkim_zone_slave.sh"
+
+
+
+# ----------
+# OpenDKIM Installation
+# ----------
+
+# - opendkim_dir
+# -
+# - OpenDKIM's etc-directory
+# -
+# - Defaults to opendkim_dir="/etc/opendkim"
+# -
+#opendkim_dir="/etc/opendkim"
+
+# - key_base_dir
+# -
+# - Defaults to "${opendkim_dir}/keys"
+# -
+#key_base_dir=${opendkim_dir}/keys
+
+# - signing_table_file
+# -
+# - Defaults to "${opendkim_dir}/signing.table"
+# -
+#signing_table_file="${opendkim_dir}/signing.table"
+
+# - key_table_file
+# -
+# - Defaults to "${opendkim_dir}/key.table"
+# -
+#key_table_file="${opendkim_dir}/key.table"

roles/common/files/a.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf

@@ -0,0 +1,84 @@
+# ----------------------------------------------------
+# ---
+# - Parameter Settings for script 'postfix_add_mailboxes.sh'.
+# ---
+# ----------------------------------------------------
+
+# - dovecot_enc_method
+# -
+# - The (dovecot) password  scheme  which  should  be  used  to  generate  the  hashed  
+# - passwords of EXISTING users.
+# -
+# - Possible values are: 
+# -
+# -    See output of 'doveadm pw -l'
+# -
+# - DEFAULTS to: dovecot_enc_method="SHA512-CRYPT"
+# -
+#dovecot_enc_method="SHA512-CRYPT"
+
+# - in_file
+# -
+# - The file from wich the script reads the e-mail-address/password
+# - kombination(s). Each line in this file must only contain
+# -    <emal-address> <password>
+# -
+# - Defaults to: in_file="${conf_dir}/mailboxes_new.lst"
+# -
+#in_file="${conf_dir}/mailboxes_new.lst"
+
+# - db_type
+# -
+# - Type of Postfix Database
+# -
+# - Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL)
+# - 
+# - Defaults to: db_type="pgsql"
+# -
+#db_type="pgsql"
+
+# - db_name
+# -
+# - Database name for the postfix database
+# - 
+# - Defaults to: db_name="postfix"
+# -
+#db_name="postfix"
+
+# - db_name
+# -
+# - Database name for the postfix database
+# - 
+# - Defaults to: db_name="postfix"
+# -
+#db_name="postfix"
+
+# - mysql_credential_args (root access to MySQL Database)
+# -
+# - Example
+# -    mysql_credential_args="--login-path=local"
+# -    mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
+# -    mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf"
+# -
+# - Defaults to:
+# -    '/etc/mysql/debian.cnf' if MySQL is installed from debian package system
+# -    '/usr/local/mysql/sys-maint.cnf' otherwise
+# -
+#mysql_credential_args=""
+
+# - quota
+# -
+# - The quota setting for the new mailboxes.
+# -
+# - Defaults to: quota="536870912"
+# -
+#quota="536870912"
+quota=1073741824
+
+# - log_file
+# -
+# - Where to write logging informations?
+# -
+# - Defaults to: log_file="${script_dir}/log/postfix_add_mailboxes.log"
+# -
+#log_file="${script_dir}/log/postfix_add_mailboxes.log"

roles/common/files/a.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf

@@ -0,0 +1,92 @@
+# ----------------------------------------------------
+# ---
+# - Parameter Settings for script 'sent_userinfo_postfix.sh'.
+# ---
+# ----------------------------------------------------
+
+# - message_body_file
+# -
+# - Full path to file containing the user info. This file must contain 
+# - the message body WITHOUT e-mail headers. If file is placed in the
+# - 'files' directory use '${file_dir}/<file-name>'
+# -
+# - Defaults to '${file_dir}/sent_userinfo_postfix.message'
+# -
+#message_body_file="${file_dir}/sent_userinfo_postfix.email"
+
+
+# - email_from
+# -
+# - From Address of user info
+# -
+# - Example: 'oo@oopen.de'
+# -
+#email_from=""
+email_from="oo@oopen.de"
+
+
+# - email_from_org
+# -
+# - Example: email_from_org="O.OPEN"
+# -
+#email_from_org=""
+email_from_org="O.OPEN"
+
+
+# - db_type
+# -
+# - Type of Postfix Database
+# -
+# - Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL)
+# - 
+# - Defaults to: db_type="pgsql"
+# -
+#db_type="pgsql"
+
+# - db_name
+# -
+# - Database name for the postfix database
+# - 
+# - Defaults to: db_name="postfix"
+# -
+#db_name="postfix"
+
+# - mysql_credential_args (root access to MySQL Database)
+# -
+# - Example
+# -    mysql_credential_args="--login-path=local"
+# -    mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
+# -    mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf"
+# -
+# - Defaults to:
+# -    '/etc/mysql/debian.cnf' if MySQL is installed from debian package system
+# -    '/usr/local/mysql/sys-maint.cnf' otherwise
+# -
+#mysql_credential_args=""
+
+
+# - mail_user
+# -
+# - The owner of the mailbox directories and within the e-mails itself.
+# -
+# - defaults to mail_user="vmail"
+# -
+#mail_user="vmail"
+
+
+# - mail_group
+# -
+# - The group of the mailbox directories
+# -
+# - defaults to mail_group="vmail"
+# -
+#mail_group="vmail"
+
+
+# - mail_basedir - No more needed!
+# -
+# - The root directory where all mailbox-domains are located.
+# -
+# - Defaults to '/var/vmail'.
+# -
+#mail_basedir=/var/vmail

roles/common/files/a.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf

@@ -0,0 +1,42 @@
+# ======================================================
+# ---
+# Parameter Settings for Script 'whitelist_mb_sigs.conf'
+# ---
+# ======================================================
+
+# QUARANTINE_BASE_DIR
+#
+# Base directory where amavis stores quarantined e-mails, mostly in
+#
+#    virus e-mails:   $QUARANTINE_BASE_DIR/virus
+#    spam emails:     $QUARANTINE_BASE_DIR/spam
+#    ..
+#
+#    Defaults to:
+#       QUARANTINE_BASE_DIR="/var/QUARANTINE"
+#
+#QUARANTINE_BASE_DIR="/var/QUARANTINE"
+
+
+# CLAMAV_VIRUS_WHITE_LIST
+#
+# Full path to clamav's (personal) white list file
+#
+# Defaults to:
+#    CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
+#
+#CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
+
+
+# WHITE_LIST_STRINGS
+#
+# A blank separated list of strings to whitelist.
+#
+# Example:
+#    WHITE_LIST_STRINGS="google.com tinyurl.com"
+#
+# Defaults to:
+#    WHITE_LIST_STRINGS="google.com"
+#
+#WHITE_LIST_STRINGS="google.com"
+WHITE_LIST_STRINGS="google.com tinyurl.com"