From: Matt Birkholz <matt@birchwood-abbey.net>
Date: Wed, 30 Oct 2024 04:25:53 +0000 (-0700)
Subject: Encrypt emails archiving the public Apache logs.
X-Git-Url: https://birchwood-abbey.net/git?a=commitdiff_plain;h=557b285ad6b7f3fcef8021cbb184a911fd6fe789;p=Network

Encrypt emails archiving the public Apache logs.
---

diff --git a/README.org b/README.org
index ae69275..8aa7824 100644
--- a/README.org
+++ b/README.org
@@ -552,9 +552,7 @@ needed because Postfix does not provide an emulation of ~mail(1)~ and
 some translation to ~sendmail(1)~ was required.  Since then the script
 has learned to compute the date-dependent file name, compress the log,
 convert it to base64, and encapsulate it in MIME format, before
-sending it on to ~sendmail~.  Note that there is no encryption (yet).
-This is a low priority because much of the data is available to
-Droplet's ISP's Mom, the NSA/CIA/NWO.
+encrypting and sending to ~sendmail~.
 
 #+CAPTION: [[file:roles_t/abbey-front/files/logrotate-mailer][=roles_t/abbey-front/files/logrotate-mailer=]]
 #+BEGIN_SRC sh :tangle roles_t/abbey-front/files/logrotate-mailer
@@ -573,22 +571,27 @@ else
 fi
 
 ( echo "Subject: $2"
-  echo "Content-Type: multipart/mixed; boundary=\"boundary\""
-  echo "MIME-Version: 1.0"
   echo ""
-  echo "--boundary"
-  echo "Content-Type: text/plain"
-  echo "Content-Transfer-Encoding: 8bit"
-  echo ""
-  echo "$F"
-  echo "--boundary"
-  echo "Content-Type: application/gzip; name=\"$F\""
-  echo "Content-Disposition: attachment; filename=\"$F\""
-  echo "Content-Transfer-Encoding: base64"
-  echo ""
-  gzip | base64
-  echo ""
-  echo "--boundary--" ) | sendmail "$3"
+  ( echo "Content-Type: multipart/mixed; boundary=\"boundary\""
+    echo "MIME-Version: 1.0"
+    echo ""
+    echo "--boundary"
+    echo "Content-Type: text/plain"
+    echo "Content-Transfer-Encoding: 8bit"
+    echo ""
+    echo "$F"
+    echo "--boundary"
+    echo "Content-Type: application/gzip; name=\"$F\""
+    echo "Content-Disposition: attachment; filename=\"$F\""
+    echo "Content-Transfer-Encoding: base64"
+    echo ""
+    gzip | base64
+    echo ""
+    echo "--boundary--" ) \
+  | gpg --encrypt --armor \
+	--trust-model always --recipient root@core ) \
+| sendmail root \
+|| exit $?
 #+END_SRC
 
 ** Install Let's Encrypt
@@ -729,7 +732,7 @@ The following task arranges to rotate Certbot's logs files.
 ** Archive Let's Encrypt Data
 
 A backup copy of Let's Encrypt's data (=/etc/letsencrypt/=) is sent to
-~root@core~ in S/MIME encrypted email every time it changes.  Changes
+~root@core~ in OpenPGP encrypted email every time it changes.  Changes
 are detected by keeping a copy in =/etc/letsencrypt~/= for comparison.
 
 #+CAPTION: [[file:roles_t/abbey-front/tasks/main.yml][=roles_t/abbey-front/tasks/main.yml=]]
diff --git a/roles_t/abbey-front/files/logrotate-mailer b/roles_t/abbey-front/files/logrotate-mailer
index 4505083..f4f47db 100644
--- a/roles_t/abbey-front/files/logrotate-mailer
+++ b/roles_t/abbey-front/files/logrotate-mailer
@@ -13,19 +13,24 @@ else
 fi
 
 ( echo "Subject: $2"
-  echo "Content-Type: multipart/mixed; boundary=\"boundary\""
-  echo "MIME-Version: 1.0"
   echo ""
-  echo "--boundary"
-  echo "Content-Type: text/plain"
-  echo "Content-Transfer-Encoding: 8bit"
-  echo ""
-  echo "$F"
-  echo "--boundary"
-  echo "Content-Type: application/gzip; name=\"$F\""
-  echo "Content-Disposition: attachment; filename=\"$F\""
-  echo "Content-Transfer-Encoding: base64"
-  echo ""
-  gzip | base64
-  echo ""
-  echo "--boundary--" ) | sendmail "$3"
+  ( echo "Content-Type: multipart/mixed; boundary=\"boundary\""
+    echo "MIME-Version: 1.0"
+    echo ""
+    echo "--boundary"
+    echo "Content-Type: text/plain"
+    echo "Content-Transfer-Encoding: 8bit"
+    echo ""
+    echo "$F"
+    echo "--boundary"
+    echo "Content-Type: application/gzip; name=\"$F\""
+    echo "Content-Disposition: attachment; filename=\"$F\""
+    echo "Content-Transfer-Encoding: base64"
+    echo ""
+    gzip | base64
+    echo ""
+    echo "--boundary--" ) \
+  | gpg --encrypt --armor \
+	--trust-model always --recipient root@core ) \
+| sendmail root \
+|| exit $?