diff options
Diffstat (limited to 'files/usr/local')
12 files changed, 147 insertions, 71 deletions
diff --git a/files/usr/local/etc/mail/mailer.conf.smtp_server b/files/usr/local/etc/mail/mailer.conf.smtp_server new file mode 100644 index 0000000..d15a587 --- /dev/null +++ b/files/usr/local/etc/mail/mailer.conf.smtp_server @@ -0,0 +1,7 @@ +# +# Execute the Postfix sendmail program, named /usr/local/sbin/sendmail +# +sendmail /usr/local/sbin/sendmail +send-mail /usr/local/sbin/sendmail +mailq /usr/local/sbin/sendmail +newaliases /usr/local/sbin/sendmail diff --git a/files/usr/local/etc/nginx/acme.conf.common b/files/usr/local/etc/nginx/acme.conf.common deleted file mode 100644 index 583ca98..0000000 --- a/files/usr/local/etc/nginx/acme.conf.common +++ /dev/null @@ -1,4 +0,0 @@ -location /.well-known/acme-challenge/ { - root ${acme_webroot}; - default_type text/plain; -} diff --git a/files/usr/local/etc/nginx/nginx.conf-acme b/files/usr/local/etc/nginx/nginx.conf-acme deleted file mode 100644 index d77c0de..0000000 --- a/files/usr/local/etc/nginx/nginx.conf-acme +++ /dev/null @@ -1,55 +0,0 @@ -worker_processes ${nginx_worker_processes}; -worker_rlimit_nofile ${nginx_nofile}; - -events { - worker_connections ${nginx_worker_connections}; -} - -http { - include mime.types; - default_type application/octet-stream; - index index.html; - - aio threads; - aio_write on; - sendfile on; - directio 4m; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 65; - types_hash_max_size 2048; - server_tokens off; - client_max_body_size 5m; - charset utf-8; - gzip on; - gzip_http_version 1.0; - gzip_types text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript application/json image/svg+xml; - - proxy_buffers 64 32k; - proxy_busy_buffers_size 64k; - fastcgi_buffers 64 32k; - - ssl_session_timeout 1d; - ssl_session_cache shared:SSL:10m; - ssl_session_tickets off; - ssl_protocols TLSv1.3; - ssl_prefer_server_ciphers off; - - map \$http_upgrade \$connection_upgrade { - default upgrade; - '' keep-alive; - } - - server { - listen 0.0.0.0:80 default_server; - listen [::]:80 default_server; - - include acme.conf; - - location / { - return 301 https://\$host\$request_uri; - } - } - - include vhost*.conf; -} diff --git a/files/usr/local/etc/nginx/nginx.conf.common b/files/usr/local/etc/nginx/nginx.conf.common index b0a9a06..9ab993c 100644 --- a/files/usr/local/etc/nginx/nginx.conf.common +++ b/files/usr/local/etc/nginx/nginx.conf.common @@ -1,5 +1,6 @@ worker_processes ${nginx_worker_processes}; worker_rlimit_nofile ${nginx_nofile}; +$([ "${nginx_gssapi:-}" = true ] && echo 'load_module "/usr/local/libexec/nginx/ngx_http_auth_spnego_module.so";') events { worker_connections ${nginx_worker_connections}; @@ -40,5 +41,28 @@ http { '' keep-alive; } - include vhosts.conf; +$([ "${nginx_gssapi:-}" = true ] && cat <<EOF + auth_gss_realm ${realm}; + auth_gss_force_realm on; +EOF +) + +$([ "${nginx_acme:-}" = true ] && cat <<EOF + server { + listen 0.0.0.0:80 default_server; + listen [::]:80 default_server; + + location /.well-known/acme-challenge/ { + root ${acme_webroot}; + default_type text/plain; + } + + location / { + return 301 https://\$host\$request_uri; + } + } +EOF +) + + include vhosts.conf; } diff --git a/files/usr/local/etc/nginx/nginx.conf.smtp_server b/files/usr/local/etc/nginx/nginx.conf.smtp_server deleted file mode 120000 index 53de10f..0000000 --- a/files/usr/local/etc/nginx/nginx.conf.smtp_server +++ /dev/null @@ -1 +0,0 @@ -nginx.conf-acme
\ No newline at end of file diff --git a/files/usr/local/etc/nginx/vhosts.conf.smtp_server b/files/usr/local/etc/nginx/vhosts.conf.smtp_server index 71d6db8..4b84ede 100644 --- a/files/usr/local/etc/nginx/vhosts.conf.smtp_server +++ b/files/usr/local/etc/nginx/vhosts.conf.smtp_server @@ -9,14 +9,19 @@ server { add_header Strict-Transport-Security "max-age=63072000" always; +$(if [ -n "$rspamd_admin_users" ]; then +echo ' auth_gss on;' +echo " auth_gss_keytab ${nginx_keytab};" +printf ' auth_gss_authorized_principal %s;\n' $rspamd_admin_users +fi) + location / { proxy_http_version 1.1; - proxy_set_header Host \$host; - proxy_set_header X-Real-IP \$remote_addr; - proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme; - +$(if [ -z "$rspamd_admin_users" ]; then +echo ' proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;' +fi) proxy_pass http://127.0.0.1:${rspamd_port}/; } } diff --git a/files/usr/local/etc/postfix/main.cf.smtp_server b/files/usr/local/etc/postfix/main.cf.smtp_server index c1e40a4..802568f 100644 --- a/files/usr/local/etc/postfix/main.cf.smtp_server +++ b/files/usr/local/etc/postfix/main.cf.smtp_server @@ -56,24 +56,23 @@ smtpd_tls_chain_files = ${postfix_local_tls_key}, ${postfix_local_tls_cert} EOF -) +fi) smtpd_tls_security_level = may smtpd_tls_auth_only = yes smtpd_tls_mandatory_protocols = >=TLSv1.2 smtpd_tls_mandatory_ciphers = medium -smtpd_tls_dh1024_param_file = ${postfix_dhparams} smtpd_tls_loglevel = 1 smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous smtpd_helo_required = yes -smtp_tls_CApath = ${system_ca_dir} +smtp_tls_CApath = ${system_cacert_path} smtp_tls_security_level = may smtp_tls_session_cache_database = btree:\$data_directory/smtp_scache smtp_tls_loglevel = 1 -lmtp_tls_CApath = ${system_ca_dir} +lmtp_tls_CApath = ${system_cacert_path} lmtp_tls_security_level = encrypt lmtp_tls_wrappermode = yes lmtp_tls_session_cache_database = btree:\$data_directory/lmtp_scache diff --git a/files/usr/local/etc/poudriere.d/make.conf.pkg_repository b/files/usr/local/etc/poudriere.d/make.conf.pkg_repository index b0ae948..6dbbafc 100644 --- a/files/usr/local/etc/poudriere.d/make.conf.pkg_repository +++ b/files/usr/local/etc/poudriere.d/make.conf.pkg_repository @@ -10,8 +10,9 @@ OPTIONS_SET=GSSAPI GSSAPI_MIT MIT NONFREE LIBEDIT # Per-port options databases_akonadi_SET=MYSQL databases_luadbi_SET=PGSQL -databases_postgresql15-client_SET=PAM -databases_postgresql15-server_SET=PAM +databases_postgresql${postgresql_version}-client_SET=PAM +databases_postgresql${postgresql_version}-server_SET=PAM +devel_apr1_SET=LDAP devel_gitolite_SET=GITUSER devel_kio-extras_UNSET=AFC devel_librelp_UNSET=GNUTLS @@ -73,6 +74,7 @@ sysutils_htop_SET=LSOF sysutils_k3b_UNSET=EMOVIX VCDIMAGER sysutils_rsyslog8_SET=GSSAPI RELP OPENSSL sysutils_rsyslog8_UNSET=GCRYPT +www_apache${apache_version}_SET=AUTHNZ_LDAP LDAP SUEXEC SUEXEC_SYSLOG www_chromium_SET=WIDEVINE www_firefox_UNSET=PROFILE JACK www_nginx_SET=HTTPV3 HTTPV3_QTLS HTTP_AUTH_KRB5 HTTP_AUTH_LDAP diff --git a/files/usr/local/etc/poudriere.d/patches/postgresql16-gssapi.patch.pkg_repository b/files/usr/local/etc/poudriere.d/patches/postgresql16-gssapi.patch.pkg_repository new file mode 100644 index 0000000..0cf4e61 --- /dev/null +++ b/files/usr/local/etc/poudriere.d/patches/postgresql16-gssapi.patch.pkg_repository @@ -0,0 +1,73 @@ +--- databases/postgresql16-server/Makefile 2024-10-03 10:26:11.600924000 -0400 ++++ databases/postgresql16-server/Makefile 2024-10-03 10:46:16.602335000 -0400 +@@ -119,12 +119,15 @@ + + .if !defined(SLAVE_ONLY) + OPTIONS_DEFINE+= NLS PAM GSSAPI OPTIMIZED_CFLAGS DEBUG DOCS +-KRB5_DESC= Build with kerberos provider support ++OPTIONS_SINGLE+= GSSAPI ++OPTIONS_SINGLE_GSSAPI= GSSAPI_NONE GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT ++OPTIONS_DEFAULT+= GSSAPI_NONE ++GSSAPI_NONE_DESC= Build without GSSAPI support ++GSSAPI_BASE_DESC= Use GSSAPI from base ++GSSAPI_HEIMDAL_DESC= Use Heimdal GSSAPI from security/heimdal ++GSSAPI_MIT_DESC= Use MIT GSSAPI from security/krb5 + NLS_DESC= Use internationalized messages + PAM_DESC= Build with PAM Support +-MIT_KRB5_DESC= Build with MIT kerberos support +-HEIMDAL_KRB5_DESC= Builds with Heimdal kerberos +-GSSAPI_DESC= Build with GSSAPI support + OPTIMIZED_CFLAGS_DESC= Builds with compiler optimizations (-O3) + + OPTIONS_DEFINE+= SSL +@@ -132,7 +135,12 @@ + + OPTIONS_DEFAULT+= SSL + +-GSSAPI_CONFIGURE_WITH= gssapi ++GSSAPI_BASE_USES= gssapi:base ++GSSAPI_MIT_USES= gssapi:mit ++GSSAPI_HEIMDAL_USES= gssapi:heimdal,flags ++GSSAPI_BASE_CONFIGURE_ON= --with-gssapi ++GSSAPI_MIT_CONFIGURE_ON= --with-gssapi ++GSSAPI_HEIMDAL_CONFIGURE_ON= --with-gssapi + .endif # !SLAVE_ONLY + + SSL_USES= ssl +@@ -175,36 +183,7 @@ + .endif + + .if !defined(SLAVE_ONLY) +- + PATCH_DIST_STRIP=-p1 +- +-.if ${PORT_OPTIONS:MGSSAPI} +-.if empty(PORT_OPTIONS:MMIT_KRB5) && empty(PORT_OPTIONS:MHEIMDAL_KRB5) +-# Kerberos libraries will pull the proper GSSAPI library +-# via linker dependencies, but otherwise we must specify +-# it explicitely: ld --as-needed is used for compilation, +-# so configure's -lgssapi_krb5 won't go. +-LDFLAGS+= -lgssapi +-LDFLAGS_SL+= -lgssapi +-.endif +-.endif +- +-. if ${PORT_OPTIONS:MMIT_KRB5} +-. if defined(IGNORE_WITH_SRC_KRB5) && (exists(/usr/lib/libkrb5.so) || exists(/usr/bin/krb5-config)) +-IGNORE= requires that you remove heimdal\'s /usr/bin/krb5-config and /usr/lib/libkrb5.so*, and set NO_KERBEROS=true in /etc/src.conf to build successfully with MIT-KRB +-. else +-CONFIGURE_ARGS+=--with-krb5 +-# Allow defining a home built MIT Kerberos by setting KRB5_HOME +-. if defined(KRB5_HOME) && exists(${KRB5_HOME}/lib/libgssapi_krb5.a) && exists(${KRB5_HOME}/bin/krb5-config) +-LIB_DEPENDS+= libkrb5.so.3:security/krb5 +-. endif +-. endif +-. endif +- +-. if ${PORT_OPTIONS:MHEIMDAL_KRB5} +-CONFIGURE_ARGS+=--with-krb5 +-. endif +- + .endif # !SLAVE_ONLY + + # For testing files in FILESDIR diff --git a/files/usr/local/etc/poudriere.d/pkglist.pkg_repository b/files/usr/local/etc/poudriere.d/pkglist.pkg_repository index 4a54ec5..5e95f8c 100644 --- a/files/usr/local/etc/poudriere.d/pkglist.pkg_repository +++ b/files/usr/local/etc/poudriere.d/pkglist.pkg_repository @@ -1,13 +1,21 @@ +converters/php${php_version}-iconv +databases/php${php_version}-pdo_pgsql +databases/php${php_version}-pgsql +databases/postgresql${postgresql_version}-client +databases/postgresql${postgresql_version}-server databases/redis devel/ccache devel/git@lite +devel/php${php_version}-gettext dns/bind-tools dns/nsd dns/powerdns dns/unbound editors/vim@console editors/vim@tiny +ftp/php${php_version}-curl lang/python +lang/php${php_version} mail/dovecot mail/dovecot-pigeonhole mail/isync @@ -15,10 +23,12 @@ mail/mutt mail/postfix mail/rspamd mail/sieve-connect +misc/php${php_version}-calendar net/nss-pam-ldapd-sasl net/openldap26-client net/openldap26-server net/p5-perl-ldap +net/php${php_version}-ldap net/py-python-ldap net/rsync ports-mgmt/poudriere @@ -39,4 +49,10 @@ sysutils/pwgen sysutils/stow sysutils/tmux sysutils/tree +textproc/php${php_version}-xml +www/apache${apache_version} +www/mod_auth_gssapi +www/mod_php${php_version} www/nginx +www/php${php_version}-opcache +www/php${php_version}-session diff --git a/files/usr/local/lib/sasl2/smtpd.conf.smtp_server b/files/usr/local/lib/sasl2/smtpd.conf.smtp_server new file mode 100644 index 0000000..b07b16d --- /dev/null +++ b/files/usr/local/lib/sasl2/smtpd.conf.smtp_server @@ -0,0 +1,3 @@ +mech_list: gssapi plain login +pwcheck_method: saslauthd +saslauthd_path: ${saslauthd_runtime_dir}/mux diff --git a/files/usr/local/libexec/poudriere-cron.pkg_repository b/files/usr/local/libexec/poudriere-cron.pkg_repository index 0d713a9..b79535b 100644 --- a/files/usr/local/libexec/poudriere-cron.pkg_repository +++ b/files/usr/local/libexec/poudriere-cron.pkg_repository @@ -5,8 +5,15 @@ set -eu -o pipefail ports_tree=latest # update ports tree +git -C /usr/local/poudriere/ports/latest restore :/ +git -C /usr/local/poudriere/ports/latest clean -f poudriere ports -u -p "$ports_tree" > /dev/null +for patch in /usr/local/etc/poudriere.d/patches/*.patch; do + [ -f "$patch" ] || continue + patch -s -d /usr/local/poudriere/ports/latest -u < "$patch" +done + for jail in "$@"; do poudriere jail -u -j "$jail" > /dev/null poudriere bulk -j "$jail" -f /usr/local/etc/poudriere.d/pkglist-idm -p "$ports_tree" -z idm > /dev/null |