fix the fail2ban issues and other things

configure.d/10-core.sh

@@ -14,6 +14,7 @@ CORES_DIR="$HOME/.config/coredesktop/cores"
 TAILSCALE_CONF="$HOME/.config/coredesktop/tailscale.conf"
 BACKUP_CONF="$HOME/.config/coredesktop/backup.conf"
 GOA_ACCOUNT="$COREDESKTOP/configure.d/lib/goa-account"
+EMAIL_WATCH="$COREDESKTOP/system/email-watch"
 source "$COREDESKTOP/configure.d/lib/nextcloud.sh"
 [ -f "$CORE_CONF" ] && source "$CORE_CONF"
 MAIN_DOMAIN="$CORE_DOMAIN"
@@ -40,6 +41,7 @@ core_names() {
   SUPERPANEL_DESKTOP="$HOME/.local/share/applications/core-$CORE_DOMAIN-superpanel.desktop"
   MATRIX="https://matrix.$CORE_DOMAIN"
   ELEMENT_CONFIG="$HOME/.config/Element/config.json"
+  PLAUSIBLE="plausible.$CORE_DOMAIN"
 }
 
 superpanel_done() {
@@ -70,6 +72,26 @@ element_done() {
     "$ELEMENT_CONFIG" &> /dev/null
 }
 
+# Tally for Plausible, a Flatpak, shows one Plausible Analytics. It follows the
+# main Core, if that runs Plausible.
+TALLY=com.cassidyjames.plausible
+
+tally_installed() {
+  flatpak info "$TALLY" &> /dev/null
+}
+
+tally_setting() {
+  flatpak run --command=gsettings "$TALLY" "$@" 2> /dev/null
+}
+
+tally_done() {
+  [ "$(tally_setting get "$TALLY" domain)" = "'$PLAUSIBLE'" ]
+}
+
+plausible_on_core() {
+  curl -sf -o /dev/null --max-time 15 "https://$PLAUSIBLE/api/health"
+}
+
 # Element only follows the main Core
 core_done() {
   superpanel_done && nextcloud_done && email_done && files_done \
@@ -293,6 +315,13 @@ setup_element() {
   echo "Element will use $MATRIX the next time it starts."
 }
 
+# Tally opens the page it showed last, so forget that one too
+setup_tally() {
+  tally_setting set "$TALLY" domain "$PLAUSIBLE" || return 1
+  tally_setting set "$TALLY" current-url "" || return 1
+  echo "Tally for Plausible will show https://$PLAUSIBLE the next time it starts. Sign in there."
+}
+
 # Run a step unless it's done; a failed step doesn't stop the ones after it
 step() {
   local name="$1" title="$2"
@@ -359,7 +388,12 @@ setup_core() {
   step files "Nextcloud files at $MOUNT"
   [ "$CORE_DOMAIN" = "$MAIN_DOMAIN" ] && element_installed \
     && step element "Element with your Core's Matrix server"
+  [ "$CORE_DOMAIN" = "$MAIN_DOMAIN" ] && tally_installed && plausible_on_core \
+    && step tally "Tally for Plausible with your Core's Plausible"
   unset PASSWORD APP_PASSWORD
+
+  # Pauses email if the mail server stops taking its password (system/email-watch)
+  systemctl --user start coredesktop-email-watch.service 2> /dev/null
   return $STATUS
 }
 
@@ -399,10 +433,12 @@ change_password() {
 
   echo
   if email_done; then
+    local was_paused=""
+    "$GOA_ACCOUNT" paused imap_smtp "$CORE_EMAIL" 2> /dev/null && was_paused=", and isn't paused any more"
     jq -n --arg password "$PASSWORD" '{"imap-password": $password, "smtp-password": $password}' \
       | "$GOA_ACCOUNT" update imap_smtp "$CORE_EMAIL" 2> /dev/null
     case $? in
-      0) echo "  Email: has your new password" ;;
+      0) echo "  Email: has your new password$was_paused" ;;
       3) echo -e "  \e[31mEmail: saved your new password, but the mail server didn't accept it.\e[0m"
          STATUS=1 ;;
       *) echo -e "  \e[31mEmail: couldn't save your new password.\e[0m"; STATUS=1 ;;
@@ -462,6 +498,10 @@ main_changed() {
   if element_installed && ! element_done && confirm_yes "Point Element at $MATRIX?"; then
     setup_element
   fi
+  if tally_installed && ! tally_done && plausible_on_core \
+      && confirm_yes "Point Tally for Plausible at https://$PLAUSIBLE?"; then
+    setup_tally
+  fi
   [ -f "$TAILSCALE_CONF" ] && echo "To move this computer to its Tailscale network: configure tailscale"
   [ -f "$BACKUP_CONF" ] && echo "To back up to it instead: configure backup"
   return 0
@@ -547,13 +587,26 @@ failed() {
 # Test an Online Accounts account, and that none of what CoreDesktop set it up
 # for is turned off in Settings:
 # <title> <provider> <identity> <setup> <fix> <enable>
+# One Online Accounts already found failing isn't signed in to again: each
+# wrong password counts towards the mail server blocking this computer.
 test_account() {
   local error off works=1
   if ! "$GOA_ACCOUNT" exists "$2" "$3" 2> /dev/null; then
     failed "$1" "not set up" "$4"
     return
   fi
-  if ! error="$("$GOA_ACCOUNT" check "$2" "$3" 2>&1)"; then
+  if "$GOA_ACCOUNT" paused "$2" "$3" 2> /dev/null; then
+    failed "$1" "paused, as the server stopped taking its password" "$5" \
+      "So this computer doesn't keep trying it. Did your Core password change?"
+    works=0
+  elif "$GOA_ACCOUNT" attention "$2" "$3" 2> /dev/null; then
+    failed "$1" "the server doesn't take its password" "$5" "Did your Core password change?"
+    works=0
+  # Check email's password with Nextcloud first, not the mail server
+  elif [ "$2" = imap_smtp ] && { "$EMAIL_WATCH" --check-password "$3"; [ $? -eq 2 ]; }; then
+    failed "$1" "has an old password: Nextcloud doesn't take it" "$5" "Did your Core password change?"
+    works=0
+  elif ! error="$("$GOA_ACCOUNT" check "$2" "$3" 2>&1)"; then
     failed "$1" "can't sign in" "$5" "$error"
     works=0
   fi
@@ -592,6 +645,16 @@ test_element() {
   fi
 }
 
+test_tally() {
+  local title="Tally for Plausible with your Core's Plausible"
+  plausible_on_core || return 0
+  if tally_done; then
+    passed "$title"
+  else
+    failed "$title" "Tally shows another Plausible" setup_tally
+  fi
+}
+
 test_backups() {
   local webdav
   webdav="$(source "$BACKUP_CONF" && echo "$BACKUP_WEBDAV")"
@@ -631,6 +694,7 @@ test_core() {
   test_account "Email in Online Accounts" imap_smtp "$CORE_EMAIL" setup_email fix_email enable_email
   test_files
   [ "$CORE_DOMAIN" = "$MAIN_DOMAIN" ] && element_installed && test_element
+  [ "$CORE_DOMAIN" = "$MAIN_DOMAIN" ] && tally_installed && test_tally
   backup_on "$CORE_DOMAIN" && test_backups
   return 0
 }