deploy

#!/bin/bash

set -o errexit -o nounset -o pipefail

source venv/bin/activate

touch lock
exec {fd}< lock
if ! flock -n $fd; then
    echo already deploying >&2
    exit 1
fi

gixy nginx/nginx.conf

remote=root@mail.grapheneos.org

./sort-blocklist
./generate-blocklist

rsync -rpcv --delete --chmod=D755,F644 --fsync --preallocate dovecot opendmarc $remote:/etc/
rsync -rpcv --delete --chown root:opendkim --chmod=D750,F640 --fsync --preallocate opendkim $remote:/etc/
rsync -pcv --chmod=644 --fsync --preallocate python-policyd-spf/policyd-spf.conf $remote:/etc/python-policyd-spf
rsync -rpcv --chmod=D755,F644 --fsync --preallocate postfix/aliases postfix/body_checks postfix/client_access.cidr postfix/main.cf postfix/master.cf postfix/header_checks postfix/sender_access postfix/submission_header_checks $remote:/etc/postfix/
ssh $remote "newaliases; postmap /etc/postfix/sender_access /etc/postfix/sender_login_maps"
rsync -rpcv --chmod=D755,F644 --fsync --preallocate systemd/ $remote:/etc/systemd/
rsync -rpcv --chmod=D755,F644 --fsync --preallocate tmpfiles.d/opendmarc.conf $remote:/etc/tmpfiles.d/
rsync -pcv --chmod=755 --fsync --preallocate remote-backup $remote:/usr/local/bin/
rsync -pcv --chmod=644 --fsync --preallocate systemd/system/remote-backup.timer $remote:/etc/systemd/system/remote-backup.timer
rsync -pcv --chmod=644 --fsync --preallocate systemd/system/remote-backup.service $remote:/etc/systemd/system/remote-backup.service
rsync -pcv --chmod=644 --fsync --preallocate backup-public-key.txt cloud-archive.sh $remote:
rsync -rpcv --chmod=D755,F644 --fsync --preallocate nginx/{nginx.conf,mime.types} $remote:/etc/nginx/
ssh $remote nginx -s reload