Homepage of Timotheus Pokorra

Our customer receives only spam from a certain Top Level Domain, in our case it was .icu. The customer assumes they will never receive legitimate E-Mails from this top level domain. They want all emails from this top level domain to be blacklisted.

According to the MailWatch FAQ (https://docs.mailwatch.org/using/faq.html), question “Can I use wildcards when using the Blacklist/Whitelist (SQLBlackWhiteList)?”, matching top level domains is not currently supported.

So we changed our file /usr/lib/MailScanner/MailScanner/CustomFunctions/SQLBlackWhiteList.pm

In sub LookupList, add $fromtld to the local variables, and use a regular expression to get the fromtld from the message->fromdomain.

Then we added some lines like $BlackWhite->{$to}{$fromtld}; and we are done.

#
# Based on the address it is going to, choose the right spam white/blacklist.
# Return 1 if the "from" address is white/blacklisted, 0 if not.
#
sub LookupList {
  my($message, $BlackWhite) = @_;
 
  return 0 unless $message; # Sanity check the input
 
  # Find the "from" address and the first "to" address
  my($from, $fromdomain, @todomain, $todomain, @to, $to, $ip, $fromtld);
  $from       = $message->{from};
  $fromdomain = $message->{fromdomain};
  @todomain   = @{$message->{todomain}};
  $todomain   = $todomain[0];
  @to         = @{$message->{to}};
  $to         = $to[0];
  $ip         = $message->{clientip};
  $fromtld    = $message->{fromdomain};
  ($fromtld)  = $fromtld =~ /(\.\w+)$/;
 
  # It is in the list if either the exact address is listed,
  # or the domain is listed
  return 1 if $BlackWhite->{$to}{$from};
  return 1 if $BlackWhite->{$to}{$fromdomain};
  return 1 if $BlackWhite->{$to}{$fromtld};
  return 1 if $BlackWhite->{$to}{$ip};
  return 1 if $BlackWhite->{$to}{'default'};
  return 1 if $BlackWhite->{$todomain}{$from};
  return 1 if $BlackWhite->{$todomain}{$fromdomain};
  return 1 if $BlackWhite->{$todomain}{$fromtld};
  return 1 if $BlackWhite->{$todomain}{$ip};
  return 1 if $BlackWhite->{$todomain}{'default'};
  return 1 if $BlackWhite->{'default'}{$from};
  return 1 if $BlackWhite->{'default'}{$fromdomain};
  return 1 if $BlackWhite->{'default'}{$fromtld};
  return 1 if $BlackWhite->{'default'}{$ip};
 
  # It is not in the list
  return 0;
}

The status of Mono in Fedora is sad. We cannot upgrade to the latest Mono versions because we require binary reference assemblies for the build, as described in https://bugzilla.redhat.com/show_bug.cgi?id=1436896#c91

My hope is that when .NET Core and msbuild become part of official Fedora, we can create the various packages for the binary reference assemblies.

For the moment, I create a copr for each Mono version, where we build Mono “the Fedora way”, but with Bootstrap mode always enabled.

So here is the current release Mono 5.18.0.225 for Fedora 29 and Epel 7:
https://copr.fedorainfracloud.org/coprs/tpokorra/mono-5.18/

The sources for the spec file and the patches are here:
https://github.com/tpokorra/mono-5.x-fedora/tree/master/mono-5.18

In 2014, I migrated the OpenPetra forum from phpBB to Discourse. The reason was that Discourse had a fresh look on the way how forums can be done, it had a nice design, and easy and modern user interface. Here is the post about the details: https://www.pokorra.de/2014/09/migrate-phpbb-forum-to-discourse-using-the-ubuntu-packages-from-packager-io/

Unfortunately, the requirements of Discourse for RAM is quite high, and you cannot just install it inside a shared hosting environment, because it is recommended to be run inside a docker container. It uses technology that I just don’t know very much, with Ruby on Rails and Redis etc.

Then I discovered Flarum, which is written in PHP, but looks as nice and feels as modern as Discourse. It does not have exotic requirements, it just works. It is helpful to have an SSH account, to install the dependencies with composer, but that is available at Hostsharing for my shared hosting anyway.
Flarum is still work in progress, and officially in Beta testing. But you can run your forums in production with the latest Beta already, if you know what you are doing.

So now the issue is, how to migrate your forum from Discourse to Flarum.

At TBits.net, we worked on a migration tool, based on the scripts https://github.com/robrotheram/phpbb_to_flarum,  https://github.com/viruxe/phpbb_to_flarum, and https://github.com/Reflic/phpbb_to_flarum.

We did not cover all aspects, but only those issues we needed for our OpenPetra forum.

Things we covered were:

• Format text properly, code, lists, http links, etc.
• convert categories to tags
• keep the users email addresses

We did not cover:

• migration of uploaded content
• we did not convert the user passwords (each user must use the resend password functionality of Flarum)
• and probably more…

So this blog post has the goal to make our script public, and to encourage you to use it and improve it! Pull Requests are welcome, or just fork it and use it as you like!

We started to host the script first at https://github.com/Crusader99/discourse_to_flarum, then at https://github.com/The-CJ/discourse-flarum, and now the official home for the script is:

https://github.com/TBits/discourse_to_flarum

Of course, in your real life scenario, you will have a database already. But for contributing to this script, we might need a test database, for reproducing specific situations. See my other post for details how to create a test database with dummy data for Discourse!

Setting up Flarum is quite easy if you can access your webspace with SSH and you can run Composer. See the german instructions how to install Flarum inside your Hostsharing account.

If you are working with a virtual machine and CentOS7, this Ansible script might be useful:
https://github.com/TBits/discourse_to_flarum/blob/master/ansible/flarum.yml

You can run the playbook like this (assuming your test server or container has the IP 192.168.122.52, and you can access it as root via SSH and via HTTP):

ansible-playbook flarum.yml -u root -e working_host=192.168.122.52

For running the script discourse_to_flarum.php, you also need a PostgreSQL database inside that container. This Ansible playbook will setup PostgreSQL, and will load the Discourse Backup into the PostgreSQL database. It will also install pgadmin and phpMyAdmin, which helps with debugging of the conversion routines.
You can run the playbook like this:

ansible-playbook migration.yml -u root -e working_host=192.168.122.52

After this, you can access phpMyAdmin on the url http://192.168.122.52/phpMyAdmin/, the user is flarum and the password is flarum. You can access phpPgAdmin on the url http://192.168.122.52/phpPgAdmin/, the user is discourse, and the password is discourse.
And on http://192.168.122.52/, your Flarum forum is running.

Now you can actually run the conversion script:

cd /root/flarummigration
composer update
cp migrate-example.yaml migrate.yaml
# perhaps you need to modify the database credentials in migrate.yaml if you have your own setup
# if your prefix is not fl_ for the flarum tables
sed -i "s/fl_//g" migrate.yaml
php discourse_to_flarum.php

to reset the flarum database for a rerun:

zcat ../flarum.sql.gz | mysql -u flarum flarum -p
# vi discourse_flarum.php, or vi migrate.yaml
php discourse_to_flarum.php

Here are two screenshots of the sample posts in Discourse and in Flarum after the migration (mind you, some of the BBCodes also don’t work in Discourse…)

So there is probably still quite some work to do. Pull requests are welcome!

This post is part of the work on a project to migrate a forum from Discourse to Flarum. See the related post here: Migrating a forum from Discourse to Flarum

Of course, in your real life scenario, you will have a database already. But for contributing to the script discourse_to_flarum.php, we need a test database, for reproducing specific situations.

It took a while to figure out how to create a test database…

Initial Setup of a test installation

First, follow the instructions at https://github.com/discourse/discourse/blob/master/docs/INSTALL-cloud.md to setup Discourse with a docker container.

On Fedora, I did:

wget -qO- https://get.docker.com/ | sh
mkdir /var/discourse
git clone https://github.com/discourse/discourse_docker.git /var/discourse
cd /var/discourse
./discourse-setup

I changed the hostname from discourse.example.com to localhost, and used admin@example.com as the E-mail address for the admin account. For the SMTP settings, you must enter values different than the defaults, but I use dummy values and create the admin account as described below.

My values for discourse-setup for a local test installation of Discourse:

Hostname for your Discourse? [discourse.example.com]: localhost
Email address for admin account(s)? [me@example.com,you@example.com]: admin@example.com
SMTP server address? [smtp.example.com]: my.smtp.example.com
SMTP port? [587]: 
SMTP user name? [user@example.com]: my.user@example.com
SMTP password? [pa$$word]: mypassword
Optional email address for setting up Let's Encrypt? (ENTER to skip) [me@example.com]:

To activate the admin user, type these commands:

cd /var/discourse
./launcher enter app
rake admin:create

I use the Email address for admin account specified above, eg. admin@example.com, and I am using the password Demo1234Demo1234! for this test database.

root@localhost-app:/var/www/discourse# rake admin:create
Email:  admin@example.com
Password:  
Repeat password:  
 
Ensuring account is active!
 
Account created successfully with username example
Do you want to grant Admin privileges to this account? (Y/n)  y
 
Your account now has Admin privileges!

Now the Discourse instance is running at http://localhost on my Fedora machine, and I can login with user admin@example.com and the password Demo1234Demo1234! (including the exclamation mark).

Just a note, how to start a fresh database again:

launcher stop app
launcher destroy app
rm -Rf shared/standalone/*

Then start again with ./discourse-setup as described above!

Creating sample data

To create some sample data, you can use the script https://github.com/discourse/discourse/blob/master/script/profile_db_generator.rb

I have modified that script a little bit, you can see my changes at https://gist.github.com/tpokorra/b2e34238dea0243572e822f649a35bab/revisions.

To execute this script:

./launcher enter app
cd /var/www/discourse
vi script/profile_db_generator.rb
# make some modifications as described in the gist linked above:
#     unless Rails.env == "profile"  becomes: unless Rails.env == "production"
#      if User.count > 2 becomes if User.count > 3
#      users = 100.times.map    becomes: users = 10.times.map
#      topic_ids = 100.times.map do becomes:  topic_ids = 50.times.map do
#   and for replies: 2000.times do becomes:   200.times do
RAILS_ENV=production sudo -H -E -u discourse bundle exec ruby script/profile_db_generator.rb

This is the output:

root@localhost-app:/var/www/discourse# RAILS_ENV=production sudo -H -E -u discourse bundle exec ruby script/profile_db_generator.rb
installing gabbler gem
Successfully installed gabbler-0.1.0
1 gem installed
Creating 100 users
..........
Creating 10 categories
..........
Creating 100 topics
..................................................
creating 200 replies
........................................................................................................................................................................................................

Creating a backup

To create a backup of the Postgresql Database:

./launcher enter app
sudo -u discourse pg_dump discourse | gzip > /shared/postgres_backup/discourse_pg`date '+%Y-%m-%d_%H-%M-%S'`.sql.gz

You find the result on your host machine, in directory /var/discourse/shared/standalone/postgres_backup.

I have uploaded this backup of the PostgreSQL database into the discourse_to_flarum repository.

Seit Juli 2017 unterstützt Hostsharing die automatische Verwaltung von Let’s Encrypt Zertifikaten für einzelne Domains und auch Subdomains.

In diesem Post soll es um die Wildcard Zertifikate gehen, die Let’s Encrypt seit März 2018 ausstellt. In meinem Fall brauche ich ein Wildcard Zertifikat für das Massenhosting von OpenPetra. Die Domain wird bei Hostsharing verwaltet, aber die Server laufen bei TBits.net, also muss ich die Zertifikate nicht bei Hostsharing einrichten. Wildcard Zertifikate werden nicht über HTTP authentifiziert, sondern über DNS. Daher muss ich also bei Hostsharing die Einträge im DNS vornehmen.

Ich habe nach einem leichtgewichtigen ACME Client gesucht, der Wildcard Domains unterstützt. Dabei bin ich auf acme.sh gestoßen, das als Shell Script (bash, dash, sh kompatibel) geschrieben ist, und auf Github gehostet ist.

Installiert wird es mit diesem Befehl:

curl https://get.acme.sh | sh

Es wird dadurch ein Verzeichnis ~/.acme.sh angelegt und mit entsprechenden Dateien gefüllt, weniger als ein MB.

Hier ist eine Anleitung für manuelle Konfiguration über DNS: https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode

Der erste Aufruf sieht so aus, für die Domain openpetra.com:

~/.acme.sh/acme.sh  --issue  -d '*.openpetra.com'  --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please

Die Ausgabe sieht dann in etwa so aus:

[Tue Sep 25 23:08:42 CEST 2018] Creating domain key
[Tue Sep 25 23:08:42 CEST 2018] The domain key is here: /home/pacs/tim00/users/.../.acme.sh/*.openpetra.com/*.openpetra.com.key
[Tue Sep 25 23:08:42 CEST 2018] Single domain='*.openpetra.com'
[Tue Sep 25 23:08:42 CEST 2018] Getting domain auth token for each domain
[Tue Sep 25 23:08:43 CEST 2018] Getting webroot for domain='*.openpetra.com'
[Tue Sep 25 23:08:43 CEST 2018] Add the following TXT record:
[Tue Sep 25 23:08:43 CEST 2018] Domain: '_acme-challenge.openpetra.com'
[Tue Sep 25 23:08:43 CEST 2018] TXT value: 'nrsGiN7Yb4R8eYxx7RNRAP8x6MA2zTrgbCLemD1t7aB'
[Tue Sep 25 23:08:43 CEST 2018] Please be aware that you prepend _acme-challenge. before your domain
[Tue Sep 25 23:08:43 CEST 2018] so the resulting subdomain will be: _acme-challenge.openpetra.com
[Tue Sep 25 23:08:43 CEST 2018] Please add the TXT records to the domains, and re-run with --renew.
[Tue Sep 25 23:08:43 CEST 2018] Please add '--debug' or '--log' to check more details.
[Tue Sep 25 23:08:43 CEST 2018] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh

Nun muss ich diesen TXT record für die Domain openpetra.com einrichten.

Ich muss zuerst eine Datei im Verzeichnis ~/doms/openpetra.com/etc einrichten, mit dem Namen pri.openpetra.com. Der Inhalt sieht in etwa so aus:

{DEFAULT_ZONEFILE}
$TTL 60M
 
_acme-challenge.openpetra.com.  3600  IN  TXT  "nrsGiN7Yb4R8eYxx7RNRAP8x6MA2zTrgbCLemD1t7aB" 
 
www       IN  A {DOM_IPNUMBER}
op012345  IN  A 178.123.12.123

Nach etwa 3 Minuten sieht man in der Datei /var/log/named/named.log, dass die eigene Domain aktualisiert wurde.

Dann kann der zweite Schritt mit acme.sh ausgeführt werden:

~/.acme.sh/acme.sh  --issue  -d '*.openpetra.com'  --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please --renew

Die Ausgabe sieht wie folgt aus:

[Tue Sep 25 23:09:54 CEST 2018] Renew: '*.openpetra.com'
[Tue Sep 25 23:09:55 CEST 2018] Single domain='*.openpetra.com'
[Tue Sep 25 23:09:55 CEST 2018] Getting domain auth token for each domain
[Tue Sep 25 23:09:55 CEST 2018] Verifying:*.openpetra.com
[Tue Sep 25 23:09:58 CEST 2018] Success
[Tue Sep 25 23:09:58 CEST 2018] Verify finished, start to sign.
[Tue Sep 25 23:10:00 CEST 2018] Cert success.
-----BEGIN CERTIFICATE-----
...........entfernt.................
-----END CERTIFICATE-----
[Tue Sep 25 23:10:00 CEST 2018] Your cert is in  /home/pacs/tim00/users/..../.acme.sh/*.openpetra.com/*.openpetra.com.cer 
[Tue Sep 25 23:10:00 CEST 2018] Your cert key is in  /home/pacs/tim00/users/..../.acme.sh/*.openpetra.com/*.openpetra.com.key 
[Tue Sep 25 23:10:00 CEST 2018] The intermediate CA cert is in  /home/pacs/tim00/users/..../.acme.sh/*.openpetra.com/ca.cer 
[Tue Sep 25 23:10:00 CEST 2018] And the full chain certs is there:  /home/pacs/tim00/users/..../.acme.sh/*.openpetra.com/fullchain.cer 
[Tue Sep 25 23:10:01 CEST 2018] It seems that you are using dns manual mode. please take care: The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead.
[Tue Sep 25 23:10:01 CEST 2018] Call hook error.

Ich kopiere nun die Dateien *.openpetra.com.key nach wildcard.openpetra.com.key und fullchain.cer nach wildcard.openpetra.com.crt auf den Produktionsserver, und binde sie im Nginx ein:

    ssl_certificate /var/lib/certs/wildcard.openpetra.com.crt;  
    ssl_certificate_key /var/lib/certs/wildcard.openpetra.com.key;

Da das Zertifikat nur für 3 Monate gültig ist, habe ich eine automatische Erinnerung
in meinem Kalender eingerichtet, die mich alle 2 Monate daran erinnert, das Wildcard Zertifikat zu erneuern.

For many years, I had an installation of KnowledgeTree for our small charity “Nazareth Kinderheim Kenia e.V.”.

Unfortunately, it has not been maintained anymore for many years, and the replacement of PHP5 with PHP7 forced me to do something.

I finally settled for SeedDMS as a replacement, and I really like it!

See instructions how to install SeedDMS in a shared hosting environment, at Hostsharing: https://wiki.hostsharing.net/index.php?title=SeedDMS_installieren (in German).

To export the files from KnowledgeTree, I made the decision, that I would ignore deleted files, and would not need the history of files, so only the latest version of each file. That made the migration much easier.

I found a Python script by Ben E. C. Boyter at https://boyter.org/2015/09/exporting-documents-knowledgetree-3-7-0-2/ which was a good start. I found only two issues with it: it would restore even deleted or archived files, and it would restore a random version of a file, not the latest version. So I fixed the Python script, and you can see it here as a gist: https://gist.github.com/tpokorra/71526bc60ced2649dba2c528d5cd2259

There is an import function in SeedDMS, where you can import from a directory on the server, which minimizes the used bandwidth. Alternatively, you can use WebDAV to import a lot of files at the same time.

Here comes a quick overview on recent updates to Kolab 16 packages.

Please note: I am only using public information. I have no background knowledge about the releases.

In the past days, the following packages have been updated:

• kolab-freebusy: https://obs.kolabsys.com/request/show/2183, Repack of tagged version
• guam: https://obs.kolabsys.com/package/rdiff/Kolab:16/guam?linkrev=base&rev=20, Allow empty lines in commands

Here comes a quick overview on recent updates to Kolab 16 packages.

Please note: I am only using public information. I have no background knowledge about the releases.

In the past days, the following packages have been updated:

• roundcubemail-plugins-kolab: https://obs.kolabsys.com/request/show/2176, Update from version 3.3.4 to 3.3.5
• kolab-syncroton: https://obs.kolabsys.com/request/show/2168, Update from 2.3.7 to 2.3.8

Because of these changes, the following packages have been rebuilt as well: kolab-freebusy, iRony

This is an updated version of the post from July 2015: https://www.pokorra.de/2015/07/submitting-patches-to-kolab-via-phabricator/

For a description of phabricator, see the post from July 2015.

Here are the updated instructions for using arcanist with CentOS7:

yum install git vim php-cli python-pep8
# this does not work because of contradicting dependancies:
# wget https://obs.kolabsys.com/repositories/Tools/CentOS_7/Tools.repo -O /etc/yum.repos.d/kolab-tools.repo
# yum install arcanist
git clone https://github.com/phacility/libphutil.git
git clone https://github.com/phacility/arcanist.git
export PATH=$PATH:/root/arcanist/bin/
arc set-config default https://git.kolab.org
arc install-certificate 
# go to https://git.kolab.org/conduit/login/ and copy the token and paste it to arc

Now get the repository you want to work with, eg. pykolab:

export PATH=$PATH:/root/arcanist/bin/
git clone https://git.kolab.org/diffusion/P/pykolab.git
cd pykolab
# do your changes
# vi pykolab/auth/ldap/__init__.py
git commit -a
arc diff            # Creates a new revision out of ALL unpushed commits on
                    # this branch.

Now you have a new Differential revision, in my example at: https://git.kolab.org/D559

Today, one of our customers at TBits.net noticed that when composing an e-mail in Roundcube, there is a spell checker button at the top. But only for English, and when there was text in the e-mail, and he clicked on the spell check button, he got the message: “An error was encountered on the server. Please try again later.”

I found the cause in the Roundcube log file, in /var/log/roundcubemail/errors:

PHP Error: Spell check engine error: Pspell extension not available in /usr/share/roundcubemail/program/steps/utils/spell.inc on line 50

So I installed the required packages:

yum install php-pspell aspell-de
systemctl restart httpd

Now this works for English. It seems for German and other languages, there are no packages readily available in the repositories.
I checked https://apps.fedoraproject.org/packages/aspell-de, there are packages for Fedora, but not for EPEL.

So you go to https://ftp.gnu.org/gnu/aspell/dict/0index.html#0.60 and download the dictionary for your language, and install it like this on your Kolab server:

tar xjf aspell6-de-20030222-1.tar.bz2
cd aspell6-de-20030222-1
./configure
make
make install

Now do a reload in Roundcube, and now you can check your spelling even in German!

Update: It was suggested by Luca Berra from Italy, to use enchant and hunspell instead of pspell/aspell.

For a discussion of hunspell vs aspell, see http://penguindreams.org/blog/aspell-and-hunspell-a-tale-of-two-spell-checkers/

Luca gave me these instructions:

yum install php-enchant hunspell-it
 
vi /etc/roundcubemail/config.inc.php
    $config['spellcheck_engine'] = 'enchant';

I have not tested this. Thanks to Luca for this suggestion!