[Josh merged some subsequent commits:]

* Guard via idempotency against termination between migration operations
* Final corrections and tweaks
* Pass passphrase through to all duplicity calls

Empirical evidence (a failed cron job) shows that cleanup requires the
passphrase (so it presumably needs to decrypt metadata), and though
remove-older-than has been working fine without it, it won't do any harm
to set it in case that changes or there are any special cases.

* Add back the archive-dir override but locate it at STORAGE_ROOT/backup/cache

see 4d22fb9b

fixes #360

drop the list of aliases from the users control panel page because with more than 50 aliases it seems to be so slow it times out

see https://discourse.mailinabox.email/t/small-bug-in-admin-panel-when-49-aliases/378

I added OpenDMARC's milter in fba4d470. But this started
setting Authentication-Results headers on outbound mail with failures. Not sure why it
fails at that point, but it shouldn't be set at all. The failure might cause recipients
to junk the mail. See #358.

This commit removes the milter from the SMTP submission (port 587) listener.

run status checks each night and email the administrator with the changes from the previous day's results

If the migration file is missing but the storage directory exists, assume this is a fresh directory -- don't bother trying to migrate, and do write the migration file with the current migration ID.

Merge branch 'master' of https://github.com/zealot128-os/mailinabox

Closes #334

Merge branch 'master' of https://github.com/h8h/mailinabox

see #353, #319

Configure fail2ban jails to prevent dumb brute-force attacks against postfix, dovecot and ssh. See #319

Update MX records using DNS Update API / Management UI

Give the DNS update tool the ability to customize MX records. Useful if you want a subdomain to send mail to another host.

Changed MX check to respect priorities other than 10.

The status check on MX records now correctly handles domains with
multiple MX records.

Reordered the if a little, added some string parsing, and modified the
OK text to include a warning.

Do not show '_secondary_nameserver' in Custom DNS table

It's redundant and potentially confusing, as any secondary NS shows in "Using a
Secondary Nameserver".

when serving a 'www.' domain, check if the parent domain's ssl certificate can be used besides checking PRIMARY_HOSTNAME

Removing buy_certificate.py which is not working and I don't want to update its call signatures.

all mail domains, not just (top-level) zones, must have an entry in the opendkim key tables so that such outgoing mail gets signed

If you had both x.y.com and y.com configured here, x.y.com mail would not get DKIM-signed.

if a domain has a catch-all or domain alias then we no longer force the creation of postmaster@ and so we should not be checking for its existence in the status checks

see 85a40da8

status checks: if a service isn't available publicly, check if it is available on the loopback interface to distinguish not running from not accessible

Add additional options to really prevent apt from asking questions, which causes setup to hang because stdin/out have been redirected.

fixes #270, #291

fixes #308