2017-08-07 17:39:40 +02:00
|
|
|
# each program entry below is a separate terminal command.
|
|
|
|
|
# Each command MUST run in the foreground and stay running.
|
|
|
|
|
# If the command ever exits, the supervisor daemon will automatically run it again.
|
|
|
|
|
# Programs can be controlled like this: 'supervisorctl start fail2ban' 'supervisorctl stop fail2ban'
|
|
|
|
|
# supervisor writes program statuses in /var/log/supervisor
|
|
|
|
|
|
|
|
|
|
[program:mailserver]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=true
|
|
|
|
|
autorestart=false
|
|
|
|
|
stdout_logfile=/dev/stdout
|
|
|
|
|
stdout_logfile_maxbytes=0
|
|
|
|
|
stderr_logfile=/dev/stderr
|
|
|
|
|
stderr_logfile_maxbytes=0
|
|
|
|
|
command=/usr/local/bin/start-mailserver.sh
|
|
|
|
|
|
|
|
|
|
[program:cron]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
command=/usr/sbin/cron -f
|
|
|
|
|
|
|
|
|
|
[program:rsyslog]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
command=/usr/sbin/rsyslogd -n
|
|
|
|
|
|
|
|
|
|
[program:fail2ban]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
2023-01-29 13:35:57 +01:00
|
|
|
command=/usr/bin/fail2ban-server -xf start
|
2017-08-07 17:39:40 +02:00
|
|
|
|
|
|
|
|
[program:opendkim]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
command=/usr/sbin/opendkim -f
|
|
|
|
|
|
|
|
|
|
[program:opendmarc]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
command=/usr/sbin/opendmarc -f -p "inet:8893@localhost" -P /var/run/opendmarc/opendmarc.pid
|
|
|
|
|
|
|
|
|
|
[program:dovecot]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
command=/usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf
|
|
|
|
|
|
|
|
|
|
[program:clamav]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
command=/usr/sbin/clamd -c /etc/clamav/clamd.conf
|
|
|
|
|
|
|
|
|
|
[program:postgrey]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
2023-12-29 21:59:09 +01:00
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
tests(refactor): `mail_fetchmail.bats` + co-locate test cases for processes (#3010)
* chore: Co-locate process checking and process restart verification
Extract the test cases for checking a process is running and properly restarts from various test files into a single one:
Core (always running):
opendkim, opendmarc, master (postfix)
ENV dependent:
amavi (amavisd-new), clamd, dovecot, fail2ban-server (fail2ban), fetchmail, postgrey, postsrsd, saslauthd
These now run off a single container with the required ENV and call a common function (the revised version in parallel test cases).
* fix(saslauthd): Quote wrap supervisor config vars
`saslauth.conf` calls `-O` option for most commands defined with an ENV that may be empty/null. This would cause the process to silently fail / die.
This doesn't happen if quote wrapping the ENV, which calls `-O` with an empty string.
Not necessary, but since one of `postgrey` ENV were quote wrapped in `supervisor-app.conf`, I've also done the same there.
* fix(postsrsd): Change supervisor `autorestart` policy to `true`
The PR that introduced the config switched from `true` to `unexpected` without any context. That prevents restart working when the process is killed. Setting to `true` instead will correctly restart the service.
* chore: Remove disabled postgrey test file
`mail_with_postgrey_disabled_by_default.bats` only checked the migrated test cases, removed as no longer serving a purpose.
* tests(refactor): Make `_should_restart_when_killed()` more reliable
The previous version did not ensure that the last checks process was actually restarted, only that it was running.
It turns out that `pkill` is only sending the signal, there can be some delay before the original process is actually killed and restarted.
This can be identified with `pgrep --older <seconds>`. First ensure the process is at a specified age, then after killing check that the process is not running that is at least that old, finally check that there is a younger process actually running.. (_could fail if a process doesn't restart, or there is a delay such as imposed by `sleep` in wrapper scripts for postfix and fail2ban_)
The helper method is not used anywhere else now, move it into this test instead. It has been refactored to accomodate the needs for `--older`, and `--list-full` provides some output that can be matched (similar for `pkill --echo`).
* test(docs): Add inline notes about processes
* chore: Compress test cases into single case with loop
Moves the list of processes into array vars to iterate through instead.
If a failure occurs, the process name is visible along with line number in `_should_restart_when_killed()` to identify what went wrong.
* chore: Handle `FETCHMAIL_PARALLEL=1` process checks as well
* tests: Add test case for disabled ENV
Additional coverage to match what other test files were doing before, ensuring that these ENV can prevent their respective service from running.
* chore: Move `clamd` enabled check to it's own test case
Not sure about this.
It reduces the time of CPU activity (sustained full load on a thread) and increase in memory usage (1GB+ loading signatures database), but as a separate test case it also adds 10 seconds without reducing the time of the test case it was extracted from.
* chore: Make `disabled` variant the 1st test case
* fix: Adjust test cases to pass when using slower wrapper scripts
* tests(refactor): `mail_fetchmail.bats` updated to new format
Additionally merges in the parallel test file.
* chore: Move `config/fetchmail.cf` into separate sub-directory
Keep out of the default base config for tests.
* chore: Change `fetchmail.cf` FQDNs to `.test` TLD
Changed the first configs remote and local user values to more clearly document what their values should represent (_and that they don't need to be a full mail address, that's just what our Dovecot is configured with for login_).
Shifted the `here` to the end of the `is` line. It's optional syntax, only intended to contrast with the remote `there` for readability.
Additionally configured imap protocol. Not tested or verified if that's correct configuration for usage with imap protocol instead. The fetchmail feature tests are currently lacking.
Added an inline doc into the fetchmail test to reference a PR about the importance of the trailing `.` in the config. Updated the partial matching to ensure it matches for that in the value as well.
* chore: Finalize `process-check-restart.bats`
Few minor adjustments. The other ENV for clamd doesn't seem to provide any benefit, trim out the noise. Added a note about why it's been split out.
Fetchmail parallel configs are matching the config file path in the process command that is returned. The `.rc` suffix is just to add further clarity to that.
2023-01-18 02:42:55 +01:00
|
|
|
command=/usr/sbin/postgrey --inet=127.0.0.1:10023 --syslog-facility=mail --delay="%(ENV_POSTGREY_DELAY)s" --max-age="%(ENV_POSTGREY_MAX_AGE)s" --auto-whitelist-clients="%(ENV_POSTGREY_AUTO_WHITELIST_CLIENTS)s" --greylist-text="%(ENV_POSTGREY_TEXT)s"
|
2017-08-07 17:39:40 +02:00
|
|
|
|
|
|
|
|
[program:amavis]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
2024-01-24 17:05:55 +01:00
|
|
|
command=/usr/sbin/amavisd foreground
|
2017-08-07 17:39:40 +02:00
|
|
|
|
2023-01-05 08:39:00 +01:00
|
|
|
[program:rspamd]
|
|
|
|
|
startsecs=0
|
|
|
|
|
stopwaitsecs=55
|
|
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
2023-10-14 17:14:10 +02:00
|
|
|
stdout_logfile=/var/log/mail/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/mail/%(program_name)s.log
|
2023-01-25 10:28:59 +01:00
|
|
|
command=/usr/bin/rspamd --no-fork --user=_rspamd --group=_rspamd
|
2023-01-05 08:39:00 +01:00
|
|
|
|
2023-03-04 10:45:43 +01:00
|
|
|
[program:rspamd-redis]
|
2023-01-05 08:39:00 +01:00
|
|
|
startsecs=0
|
|
|
|
|
stopwaitsecs=55
|
|
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
2023-03-04 10:45:43 +01:00
|
|
|
command=redis-server /etc/redis/redis.conf
|
2023-01-05 08:39:00 +01:00
|
|
|
|
2017-08-07 17:39:40 +02:00
|
|
|
[program:fetchmail]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
user=fetchmail
|
2024-02-21 11:19:41 +01:00
|
|
|
environment=HOME="/var/lib/fetchmail",USER="fetchmail"
|
tests(refactor): `mail_fetchmail.bats` + co-locate test cases for processes (#3010)
* chore: Co-locate process checking and process restart verification
Extract the test cases for checking a process is running and properly restarts from various test files into a single one:
Core (always running):
opendkim, opendmarc, master (postfix)
ENV dependent:
amavi (amavisd-new), clamd, dovecot, fail2ban-server (fail2ban), fetchmail, postgrey, postsrsd, saslauthd
These now run off a single container with the required ENV and call a common function (the revised version in parallel test cases).
* fix(saslauthd): Quote wrap supervisor config vars
`saslauth.conf` calls `-O` option for most commands defined with an ENV that may be empty/null. This would cause the process to silently fail / die.
This doesn't happen if quote wrapping the ENV, which calls `-O` with an empty string.
Not necessary, but since one of `postgrey` ENV were quote wrapped in `supervisor-app.conf`, I've also done the same there.
* fix(postsrsd): Change supervisor `autorestart` policy to `true`
The PR that introduced the config switched from `true` to `unexpected` without any context. That prevents restart working when the process is killed. Setting to `true` instead will correctly restart the service.
* chore: Remove disabled postgrey test file
`mail_with_postgrey_disabled_by_default.bats` only checked the migrated test cases, removed as no longer serving a purpose.
* tests(refactor): Make `_should_restart_when_killed()` more reliable
The previous version did not ensure that the last checks process was actually restarted, only that it was running.
It turns out that `pkill` is only sending the signal, there can be some delay before the original process is actually killed and restarted.
This can be identified with `pgrep --older <seconds>`. First ensure the process is at a specified age, then after killing check that the process is not running that is at least that old, finally check that there is a younger process actually running.. (_could fail if a process doesn't restart, or there is a delay such as imposed by `sleep` in wrapper scripts for postfix and fail2ban_)
The helper method is not used anywhere else now, move it into this test instead. It has been refactored to accomodate the needs for `--older`, and `--list-full` provides some output that can be matched (similar for `pkill --echo`).
* test(docs): Add inline notes about processes
* chore: Compress test cases into single case with loop
Moves the list of processes into array vars to iterate through instead.
If a failure occurs, the process name is visible along with line number in `_should_restart_when_killed()` to identify what went wrong.
* chore: Handle `FETCHMAIL_PARALLEL=1` process checks as well
* tests: Add test case for disabled ENV
Additional coverage to match what other test files were doing before, ensuring that these ENV can prevent their respective service from running.
* chore: Move `clamd` enabled check to it's own test case
Not sure about this.
It reduces the time of CPU activity (sustained full load on a thread) and increase in memory usage (1GB+ loading signatures database), but as a separate test case it also adds 10 seconds without reducing the time of the test case it was extracted from.
* chore: Make `disabled` variant the 1st test case
* fix: Adjust test cases to pass when using slower wrapper scripts
* tests(refactor): `mail_fetchmail.bats` updated to new format
Additionally merges in the parallel test file.
* chore: Move `config/fetchmail.cf` into separate sub-directory
Keep out of the default base config for tests.
* chore: Change `fetchmail.cf` FQDNs to `.test` TLD
Changed the first configs remote and local user values to more clearly document what their values should represent (_and that they don't need to be a full mail address, that's just what our Dovecot is configured with for login_).
Shifted the `here` to the end of the `is` line. It's optional syntax, only intended to contrast with the remote `there` for readability.
Additionally configured imap protocol. Not tested or verified if that's correct configuration for usage with imap protocol instead. The fetchmail feature tests are currently lacking.
Added an inline doc into the fetchmail test to reference a PR about the importance of the trailing `.` in the config. Updated the partial matching to ensure it matches for that in the value as well.
* chore: Finalize `process-check-restart.bats`
Few minor adjustments. The other ENV for clamd doesn't seem to provide any benefit, trim out the noise. Added a note about why it's been split out.
Fetchmail parallel configs are matching the config file path in the process command that is returned. The `.rc` suffix is just to add further clarity to that.
2023-01-18 02:42:55 +01:00
|
|
|
command=/usr/bin/fetchmail -f /etc/fetchmailrc --nodetach --daemon "%(ENV_FETCHMAIL_POLL)s" -i /var/lib/fetchmail/.fetchmail-UIDL-cache --pidfile /var/run/fetchmail/fetchmail.pid
|
2017-08-07 17:39:40 +02:00
|
|
|
|
|
|
|
|
[program:postfix]
|
|
|
|
|
startsecs=0
|
2021-08-17 15:39:30 +02:00
|
|
|
stopwaitsecs=55
|
2017-08-07 17:39:40 +02:00
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
2023-02-26 07:32:53 +01:00
|
|
|
command=/usr/bin/pidproxy /var/spool/postfix/pid/master.pid /usr/sbin/postfix start-fg
|
2017-08-07 17:39:40 +02:00
|
|
|
|
2017-10-10 08:15:18 +02:00
|
|
|
[program:changedetector]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2017-10-10 08:15:18 +02:00
|
|
|
autostart=false
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
2017-10-18 07:43:30 +02:00
|
|
|
command=/usr/local/bin/check-for-changes.sh
|
2018-02-06 08:11:57 +01:00
|
|
|
|
|
|
|
|
[program:postsrsd]
|
|
|
|
|
startsecs=0
|
2021-05-06 19:04:24 +02:00
|
|
|
stopwaitsecs=55
|
2018-03-18 20:15:06 +01:00
|
|
|
autostart=false
|
tests(refactor): `mail_fetchmail.bats` + co-locate test cases for processes (#3010)
* chore: Co-locate process checking and process restart verification
Extract the test cases for checking a process is running and properly restarts from various test files into a single one:
Core (always running):
opendkim, opendmarc, master (postfix)
ENV dependent:
amavi (amavisd-new), clamd, dovecot, fail2ban-server (fail2ban), fetchmail, postgrey, postsrsd, saslauthd
These now run off a single container with the required ENV and call a common function (the revised version in parallel test cases).
* fix(saslauthd): Quote wrap supervisor config vars
`saslauth.conf` calls `-O` option for most commands defined with an ENV that may be empty/null. This would cause the process to silently fail / die.
This doesn't happen if quote wrapping the ENV, which calls `-O` with an empty string.
Not necessary, but since one of `postgrey` ENV were quote wrapped in `supervisor-app.conf`, I've also done the same there.
* fix(postsrsd): Change supervisor `autorestart` policy to `true`
The PR that introduced the config switched from `true` to `unexpected` without any context. That prevents restart working when the process is killed. Setting to `true` instead will correctly restart the service.
* chore: Remove disabled postgrey test file
`mail_with_postgrey_disabled_by_default.bats` only checked the migrated test cases, removed as no longer serving a purpose.
* tests(refactor): Make `_should_restart_when_killed()` more reliable
The previous version did not ensure that the last checks process was actually restarted, only that it was running.
It turns out that `pkill` is only sending the signal, there can be some delay before the original process is actually killed and restarted.
This can be identified with `pgrep --older <seconds>`. First ensure the process is at a specified age, then after killing check that the process is not running that is at least that old, finally check that there is a younger process actually running.. (_could fail if a process doesn't restart, or there is a delay such as imposed by `sleep` in wrapper scripts for postfix and fail2ban_)
The helper method is not used anywhere else now, move it into this test instead. It has been refactored to accomodate the needs for `--older`, and `--list-full` provides some output that can be matched (similar for `pkill --echo`).
* test(docs): Add inline notes about processes
* chore: Compress test cases into single case with loop
Moves the list of processes into array vars to iterate through instead.
If a failure occurs, the process name is visible along with line number in `_should_restart_when_killed()` to identify what went wrong.
* chore: Handle `FETCHMAIL_PARALLEL=1` process checks as well
* tests: Add test case for disabled ENV
Additional coverage to match what other test files were doing before, ensuring that these ENV can prevent their respective service from running.
* chore: Move `clamd` enabled check to it's own test case
Not sure about this.
It reduces the time of CPU activity (sustained full load on a thread) and increase in memory usage (1GB+ loading signatures database), but as a separate test case it also adds 10 seconds without reducing the time of the test case it was extracted from.
* chore: Make `disabled` variant the 1st test case
* fix: Adjust test cases to pass when using slower wrapper scripts
* tests(refactor): `mail_fetchmail.bats` updated to new format
Additionally merges in the parallel test file.
* chore: Move `config/fetchmail.cf` into separate sub-directory
Keep out of the default base config for tests.
* chore: Change `fetchmail.cf` FQDNs to `.test` TLD
Changed the first configs remote and local user values to more clearly document what their values should represent (_and that they don't need to be a full mail address, that's just what our Dovecot is configured with for login_).
Shifted the `here` to the end of the `is` line. It's optional syntax, only intended to contrast with the remote `there` for readability.
Additionally configured imap protocol. Not tested or verified if that's correct configuration for usage with imap protocol instead. The fetchmail feature tests are currently lacking.
Added an inline doc into the fetchmail test to reference a PR about the importance of the trailing `.` in the config. Updated the partial matching to ensure it matches for that in the value as well.
* chore: Finalize `process-check-restart.bats`
Few minor adjustments. The other ENV for clamd doesn't seem to provide any benefit, trim out the noise. Added a note about why it's been split out.
Fetchmail parallel configs are matching the config file path in the process command that is returned. The `.rc` suffix is just to add further clarity to that.
2023-01-18 02:42:55 +01:00
|
|
|
autorestart=true
|
2018-02-06 08:11:57 +01:00
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
2023-03-13 00:39:03 +01:00
|
|
|
command=/bin/bash -c 'env $(grep -vE "^(#.*|\s*)$" /etc/default/postsrsd) postsrsd -e -p /var/run/postsrsd.pid'
|
2021-05-19 21:18:06 +02:00
|
|
|
|
|
|
|
|
[program:update-check]
|
|
|
|
|
startsecs=0
|
|
|
|
|
stopwaitsecs=55
|
|
|
|
|
autostart=false
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
command=/bin/bash -l -c /usr/local/bin/update-check.sh
|
2024-01-13 09:37:20 +01:00
|
|
|
|
|
|
|
|
# Docs: https://github.com/Snawoot/postfix-mta-sts-resolver/blob/master/man/mta-sts-daemon.1.adoc
|
|
|
|
|
[program:mta-sts-daemon]
|
|
|
|
|
startsecs=0
|
|
|
|
|
stopwaitsecs=55
|
|
|
|
|
autostart=false
|
|
|
|
|
autorestart=true
|
|
|
|
|
stdout_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
stderr_logfile=/var/log/supervisor/%(program_name)s.log
|
|
|
|
|
command=/usr/bin/mta-sts-daemon --config /etc/mta-sts-daemon.yml
|
|
|
|
|
user=_mta-sts
|
|
|
|
|
environment=HOME=/var/lib/mta-sts
|
