Почтовый сервер Postfix на Debian 13: Dovecot 2.4, Rspamd, DKIM и панель Mailroom

#!/usr/bin/env bash
# Mailstack for a NEW Debian 13 host. Review README before running.
# No remote scripts are executed. Packages come from configured apt repositories.
set -Eeuo pipefail
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
umask 077
VERSION=1.1.0
DOMAIN='' MAILHOST='' PUBLIC_IP='' SSH_PORT=22 POP3=0 YES=0 MODE=install OUT=''
DB=postgresql
POLICY_OWNED=0 TMP='' INSTALL_STARTED=0
usage() {
cat <<'HELP'
Usage:
  sudo bash install.sh --domain example.com --hostname mail.example.com \
    --public-ip YOUR_PUBLIC_IPV4 [--db postgresql|mysql] [--ssh-port 22] \
    [--pop3] [--yes]
  sudo bash install.sh --check
  bash install.sh --render-only DIRECTORY --domain example.com \
    --hostname mail.example.com --public-ip 203.0.113.10 [--db mysql] [--pop3]
--db selects the database: postgresql (default) or mysql (MariaDB server).
Fresh Debian 13 ONLY. Does not migrate or repair an existing installation.
Render-only writes dummy credentials and configuration, not usable secrets;
no packages, services, DNS or system files are changed in that mode.
Setup blocks external mail/webmail until local checks pass. Port 80 must be
reachable for Let's Encrypt HTTP-01. PTR/DNS changes remain your responsibility.
HELP
}
die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
while (($#)); do
  case "$1" in
    --domain|--hostname|--public-ip|--ssh-port|--render-only|--db)
      (($# >= 2)) || die "Missing value for $1"
      case "$1" in
        --domain) DOMAIN=$2;; --hostname) MAILHOST=$2;;
        --public-ip) PUBLIC_IP=$2;; --ssh-port) SSH_PORT=$2;;
        --render-only) MODE=render; OUT=$2;;
        --db) DB=$2;;
      esac; shift 2;;
    --pop3) POP3=1; shift;; --yes) YES=1; shift;;
    --check) MODE=check; shift;; --help|-h) usage; exit 0;;
    *) die "Unknown option: $1";;
  esac
done
case $DB in
  postgresql|postgres|pgsql) DB=postgresql DBSVC=postgresql;;
  mysql|mariadb) DB=mysql DBSVC=mariadb;;
  *) die '--db must be postgresql or mysql.';;
esac
cleanup() {
  local code=$?
  trap - EXIT
  if ((POLICY_OWNED)); then rm -f /usr/sbin/policy-rc.d; fi
  [[ -z "$TMP" ]] || rm -rf -- "$TMP"
  if ((code != 0 && INSTALL_STARTED)); then
    if declare -F firewall >/dev/null; then firewall setup || true; fi
    printf '\nInstallation incomplete. External mail/webmail remain blocked.\n' >&2
    printf 'Inspect /var/log/mailstack-install.log; preserve credentials.\n' >&2
    printf 'Do not re-run on this partially configured host. Restore a snapshot\n' >&2
    printf 'or finish/repair the failed stage after reviewing generated files.\n' >&2
  fi
  exit "$code"
}
trap cleanup EXIT
trap 'printf "Failed at line %s (status %s).\n" "$LINENO" "$?" >&2' ERR
if [[ $MODE == check ]]; then
  ((EUID == 0)) || die 'Run --check as root.'
  [[ -x /usr/local/sbin/mailstack-health ]] || die 'Mailstack is not installed.'
  /usr/local/sbin/mailstack-health
  exit
fi
validate_inputs() {
  command -v python3 >/dev/null || die 'python3 is required (apt install python3).'
  python3 - "$DOMAIN" "$MAILHOST" "$PUBLIC_IP" "$SSH_PORT" <<'PY'
import sys,re,ipaddress
D,H,I,P=sys.argv[1:]
for name,value in [('domain',D),('hostname',H)]:
    if len(value)>253 or value!=value.lower() or '.' not in value:
        raise SystemExit('Invalid '+name+': use lowercase ASCII FQDN.')
    if any(not re.fullmatch(r'[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?',x) for x in value.split('.')):
        raise SystemExit('Invalid '+name)
if H==D: raise SystemExit('Use a separate mail hostname, e.g. mail.example.com.')
try: ipaddress.IPv4Address(I)
except ValueError: raise SystemExit('Invalid IPv4 address')
if not P.isdecimal() or not 1<=int(P)<=65535: raise SystemExit('Invalid SSH port')
if int(P) in [25,80,443,465,587,993,995,3310,4190,5432,8080,3306,6379,11332,11333,11334]:
    raise SystemExit('SSH port conflicts with a mailstack port.')
PY
}
render() {
  python3 - "$OUT" "$CREDS" "$POP3" <<'PY'
from pathlib import Path
import sys,json,os
root=Path(sys.argv[1]); c=json.load(open(sys.argv[2])); pop=sys.argv[3]=='1'
d=c['domain']; h=c['hostname']; ip=c['public_ip']
pg=c['db']=='postgresql'
# MAP: Postfix/Dovecot driver; DSN: Roundcube/PEAR scheme; PFADB: PostfixAdmin type.
params={'D':d,'H':h,'IP':ip,'MAP':'pgsql' if pg else 'mysql',
        'DSN':'pgsql' if pg else 'mysql','PFADB':'pgsql' if pg else 'mysqli',
        'DBSVC':'postgresql' if pg else 'mariadb',
        'DBCONF':'etc/postgresql' if pg else 'etc/mysql',
        'DBDUMP':('runuser -u postgres -- pg_dumpall --globals-only > "$work/globals.sql"\n'
                  'for db in postfixadmin roundcube; do\n'
                  '  runuser -u postgres -- pg_dump -Fc "$db" > "$work/$db.dump"\n'
                  'done') if pg else
                 'mariadb-dump --single-transaction --routines --triggers --databases postfixadmin roundcube > "$work/databases.sql"',
        # Must precede **c: the block itself contains @@read_pass@@.
        'DOVECOT_SQL':('sql_driver = pgsql\npgsql 127.0.0.1 {\n  parameters {\n'
                       '    user = mailreader\n    password = @@read_pass@@\n    dbname = postfixadmin\n  }\n}')
                      if pg else
                      ('sql_driver = mysql\nmysql 127.0.0.1 {\n  user = mailreader\n'
                       '  password = @@read_pass@@\n  dbname = postfixadmin\n}'),
        **c}
def write(name,text,mode=0o640):
    for k,v in params.items(): text=text.replace('@@'+k+'@@',str(v))
    p=root/name.lstrip('/');p.parent.mkdir(parents=True,exist_ok=True)
    p.write_text(text.rstrip()+'\n');p.chmod(mode)
write('/etc/mailstack/identity.json',json.dumps({k:c[k] for k in ['domain','hostname','public_ip','ssh_port','mailbox','db']},indent=2),0o600)
write('/etc/mailstack/backup.pass',c['backup_pass'],0o600)
if not pg:
    write('/etc/mysql/mariadb.conf.d/99-mailstack.cnf','''[mysqld]
bind-address = 127.0.0.1
''',0o644)
write('/etc/postfix/mailstack-main.cf','''myhostname = @@H@@
mydomain = @@D@@
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost
inet_interfaces = all
inet_protocols = ipv4
mynetworks = 127.0.0.0/8
relayhost =
relay_domains =
virtual_alias_domains =
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
recipient_delimiter = +
message_size_limit = 26214400
mailbox_size_limit = 0
disable_vrfy_command = yes
smtpd_helo_required = yes
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unlisted_recipient
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = no
smtpd_sasl_security_options = noanonymous
smtpd_tls_auth_only = yes
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/letsencrypt/live/@@H@@/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/@@H@@/privkey.pem
smtpd_tls_protocols = >=TLSv1.2
smtpd_tls_mandatory_protocols = >=TLSv1.2
smtpd_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_protocols = >=TLSv1.2
virtual_mailbox_domains = proxy:@@MAP@@:/etc/postfix/sql/domains.cf
virtual_mailbox_maps = proxy:@@MAP@@:/etc/postfix/sql/mailboxes.cf
virtual_alias_maps = proxy:@@MAP@@:/etc/postfix/sql/aliases.cf, proxy:@@MAP@@:/etc/postfix/sql/alias-domains.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp
smtpd_sender_login_maps = proxy:@@MAP@@:/etc/postfix/sql/sender-login.cf
smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = $smtpd_milters
milter_protocol = 6
milter_default_action = tempfail
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
''')
write('/etc/postfix/mailstack-submission.cf','''submission inet n - y - - smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_restrictions=reject_authenticated_sender_login_mismatch
465 inet n - y - - smtpd
  -o syslog_name=postfix/submissions
  -o smtpd_tls_wrappermode=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_restrictions=reject_authenticated_sender_login_mismatch
''')
common='user = mailreader\npassword = @@read_pass@@\nhosts = 127.0.0.1\ndbname = postfixadmin\nquery = '
# Portable SQL: PostfixAdmin flags are BOOLEAN in PostgreSQL and TINYINT in
# MySQL; the literals '1'/'0' are valid for both. POSITION/CONCAT exist in both,
# FIND_IN_SET is MySQL-only. A bare % must not appear: Postfix expands it.
A1="active='1'"; B0="backupmx='0'"
queries={
'domains':f"SELECT domain FROM domain WHERE domain='%s' AND {A1} AND {B0} UNION SELECT ad.alias_domain FROM alias_domain ad JOIN domain d ON d.domain=ad.target_domain WHERE ad.alias_domain='%s' AND ad.{A1} AND d.{A1} AND d.{B0}",
'mailboxes':f"SELECT 1 FROM mailbox m JOIN domain d ON d.domain=m.domain WHERE m.username='%s' AND m.{A1} AND d.{A1} AND d.{B0}",
'aliases':f"SELECT a.goto FROM alias a JOIN domain d ON d.domain=a.domain WHERE a.address='%s' AND a.{A1} AND d.{A1} AND d.{B0}",
'alias-domains':f"SELECT CONCAT('%u','@',ad.target_domain) FROM alias_domain ad JOIN domain d ON d.domain=ad.target_domain WHERE ad.alias_domain='%d' AND ad.{A1} AND d.{A1} AND d.{B0} AND (EXISTS (SELECT 1 FROM mailbox m WHERE m.username=CONCAT('%u','@',ad.target_domain) AND m.{A1}) OR EXISTS (SELECT 1 FROM alias a WHERE a.address=CONCAT('%u','@',ad.target_domain) AND a.{A1}))",
'sender-login':f"SELECT m.username FROM mailbox m JOIN domain d ON d.domain=m.domain WHERE m.username='%s' AND m.{A1} AND d.{A1} AND d.{B0} UNION SELECT m.username FROM alias a JOIN mailbox m ON POSITION(CONCAT(',',m.username,',') IN CONCAT(',',a.goto,','))>0 JOIN domain d ON d.domain=a.domain JOIN domain md ON md.domain=m.domain WHERE a.address='%s' AND a.{A1} AND m.{A1} AND d.{A1} AND md.{A1} AND d.{B0} AND md.{B0}"
}
for name,q in queries.items(): write('/etc/postfix/sql/'+name+'.cf',common+q)
write('/etc/postfixadmin/config.local.php',r'''<?php
$CONF['configured'] = true;
$CONF['default_language'] = 'ru';
$CONF['database_type'] = '@@PFADB@@';
$CONF['database_host'] = '127.0.0.1';
$CONF['database_name'] = 'postfixadmin';
$CONF['database_user'] = 'pfa';
$CONF['database_password'] = '@@pfa_pass@@';
$CONF['encrypt'] = 'dovecot:ARGON2ID';
$CONF['dovecotpw'] = '/usr/bin/doveadm -O pw';
$CONF['domain_path'] = 'YES';
$CONF['domain_in_mailbox'] = 'NO';
$CONF['quota'] = 'YES';
$CONF['quota_multiplier'] = '1048576';
$CONF['emailcheck_resolve_domain'] = 'YES';
$CONF['password_expiration'] = 'NO';
$CONF['vacation'] = 'NO'; // Autoreplies are managed via Sieve, not PFA vacation.pl.
$CONF['setup_password'] = 'disabled-installation-managed-locally';
$CONF['password_validation'] = array('/.{12}/' => 'password_too_short 12');
''')
write('/etc/dovecot/dovecot.conf',r'''dovecot_config_version = 2.4.0
dovecot_storage_version = 2.4.0
protocols = imap lmtp sieve
listen = *
ssl = required
ssl_min_protocol = TLSv1.2
ssl_server_cert_file = /etc/letsencrypt/live/@@H@@/fullchain.pem
ssl_server_key_file = /etc/letsencrypt/live/@@H@@/privkey.pem
auth_allow_cleartext = no
auth_mechanisms = plain login
auth_username_format = %{user | lower}
mail_uid = vmail
mail_gid = vmail
first_valid_uid = 5000
mail_driver = maildir
mail_path = %{home}/Maildir
mailbox_list_index = yes
namespace inbox {
  inbox = yes
  separator = /
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
}
@@DOVECOT_SQL@@
passdb sql {
  default_password_scheme = ARGON2ID
  query = SELECT m.username AS user, m.password FROM mailbox m JOIN domain d ON d.domain=m.domain WHERE m.username='%{user}' AND m.active='1' AND d.active='1' AND d.backupmx='0'
}
userdb sql {
  query = SELECT CONCAT('/var/vmail/',m.maildir) AS home, CONCAT(m.quota,'B') AS quota_storage_size FROM mailbox m JOIN domain d ON d.domain=m.domain WHERE m.username='%{user}' AND m.active='1' AND d.active='1' AND d.backupmx='0'
  iterate_query = SELECT m.username AS user FROM mailbox m JOIN domain d ON d.domain=m.domain WHERE m.active='1' AND d.active='1' AND d.backupmx='0'
}
service imap-login {
  inet_listener imap {
    port = 0
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service managesieve-login {
  inet_listener sieve {
    listen = 127.0.0.1
    port = 4190
  }
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = postfix
    group = postfix
  }
}
protocol lmtp {
  postmaster_address = postmaster@@@D@@
  mail_plugins {
    sieve = yes
  }
}
mail_plugins {
  quota = yes
}
protocol imap {
  mail_plugins {
    imap_quota = yes
  }
}
quota user {
  driver = count
}
sieve_script personal {
  driver = file
  path = ~/sieve
  active_path = ~/.dovecot.sieve
}
sieve_script spam {
  type = before
  driver = file
  path = /etc/dovecot/sieve/spam.sieve
}
''',0o600)
if pop:
    p=root/'etc/dovecot/dovecot.conf'
    p.write_text(p.read_text().replace('protocols = imap lmtp sieve','protocols = imap pop3 lmtp sieve')+'''\nservice pop3-login {
  inet_listener pop3 {
    port = 0
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}
''')
write('/etc/dovecot/sieve/spam.sieve',r'''require ["fileinto", "mailbox"];
if anyof (header :is "X-Rspamd-Action" "add header", header :is "X-Spam" "Yes", header :is "X-Spam-Flag" "YES") {
  fileinto :create "Junk";
  stop;
}
''',0o644)
write('/etc/roundcube/config.inc.php',r'''<?php
$config = [];
$config['db_dsnw'] = '@@DSN@@://roundcube:@@rc_pass@@@127.0.0.1/roundcube';
$config['imap_host'] = 'ssl://@@H@@:993';
$config['smtp_host'] = 'tls://@@H@@:587';
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['imap_conn_options'] = ['ssl' => ['verify_peer'=>true, 'verify_peer_name'=>true, 'cafile'=>'/etc/ssl/certs/ca-certificates.crt']];
$config['smtp_conn_options'] = $config['imap_conn_options'];
$config['des_key'] = '@@rc_key@@';
$config['product_name'] = 'Mail';
$config['language'] = 'ru_RU';
$config['skin'] = 'elastic';
$config['plugins'] = ['managesieve','password','archive','zipdownload'];
$config['force_https'] = true;
$config['session_lifetime'] = 30;
$config['session_samesite'] = 'Lax';
$config['enable_installer'] = false;
$config['support_url'] = '';
''')
# Plugin options live in the plugin config files: Roundcube loads them after the
# main config, so values left in a packaged plugin file would otherwise win.
TLSOPT="['ssl' => ['verify_peer'=>true, 'verify_peer_name'=>true, 'cafile'=>'/etc/ssl/certs/ca-certificates.crt']]"
write('/etc/roundcube/plugins/managesieve/config.inc.php',r'''<?php
$config = [];
$config['managesieve_host'] = 'tls://@@H@@:4190';
$config['managesieve_auth_type'] = 'PLAIN';
$config['managesieve_conn_options'] = @@TLSOPT@@;
$config['managesieve_vacation'] = 1;
$config['managesieve_forward'] = 1;
'''.replace('@@TLSOPT@@',TLSOPT))
write('/etc/roundcube/plugins/password/config.inc.php',r'''<?php
$config = [];
$config['password_driver'] = 'sql';
$config['password_confirm_current'] = true;
$config['password_minimum_length'] = 12;
$config['password_algorithm'] = 'dovecot';
$config['password_dovecotpw'] = '/usr/bin/doveadm -O pw';
$config['password_dovecotpw_method'] = 'ARGON2ID';
$config['password_dovecotpw_with_method'] = true;
$config['password_db_dsn'] = '@@DSN@@://rcpassword:@@rcpw_pass@@@127.0.0.1/postfixadmin';
$config['password_query'] = "UPDATE mailbox SET password=%P, modified=NOW() WHERE username=%u AND active='1'";
''')
write('/etc/php/mailstack.ini','''expose_php = Off
upload_max_filesize = 18M
post_max_size = 20M
memory_limit = 256M
session.cookie_httponly = 1
session.use_strict_mode = 1
''')
write('/etc/apache2/ports.conf','''Listen 80
Listen 443
Listen 127.0.0.1:8080
''',0o644)
write('/etc/apache2/sites-available/mailstack-http.conf',r'''<VirtualHost *:80>
  ServerName @@H@@
  DocumentRoot /var/www/mailstack-acme
  <Directory /var/www/mailstack-acme>
    Options -Indexes
    AllowOverride None
    Require all granted
  </Directory>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
  RewriteRule ^ https://@@H@@%{REQUEST_URI} [R=301,L]
</VirtualHost>
''',0o644)
write('/etc/apache2/sites-available/mailstack-webmail.conf',r'''<VirtualHost *:443>
  ServerName @@H@@
  DocumentRoot /var/lib/roundcube/public_html
  SSLEngine on
  SSLProtocol -all +TLSv1.2 +TLSv1.3
  SSLCertificateFile /etc/letsencrypt/live/@@H@@/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/@@H@@/privkey.pem
  Include /etc/roundcube/apache.conf
  <Directory /var/lib/roundcube/public_html>
    Options -Indexes +FollowSymLinks
    AllowOverride All
    Require all granted
  </Directory>
  <LocationMatch "^/(installer|config|SQL|logs|temp)(/|$)">
    Require all denied
  </LocationMatch>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "same-origin"
  Header always set X-Frame-Options "SAMEORIGIN"
  ErrorLog ${APACHE_LOG_DIR}/webmail-error.log
  CustomLog ${APACHE_LOG_DIR}/webmail-access.log combined
</VirtualHost>
''',0o644)
write('/etc/apache2/sites-available/mailstack-admin.conf',r'''<VirtualHost 127.0.0.1:8080>
  ServerName localhost
  DocumentRoot /usr/share/postfixadmin/public
  <Directory /usr/share/postfixadmin/public>
    Options -Indexes +FollowSymLinks
    AllowOverride None
    Require local
    DirectoryIndex index.php
  </Directory>
  <LocationMatch "^/(setup|upgrade)\.php$">
    Require all denied
  </LocationMatch>
  ErrorLog ${APACHE_LOG_DIR}/mailadmin-error.log
  CustomLog ${APACHE_LOG_DIR}/mailadmin-access.log combined
</VirtualHost>
''',0o644)
write('/etc/rspamd/local.d/redis.conf','servers = "127.0.0.1";')
write('/etc/rspamd/local.d/worker-proxy.inc','''bind_socket = "127.0.0.1:11332";
milter = yes;
timeout = 120s;
upstream "local" {
  default = yes;
  self_scan = yes;
}
''')
write('/etc/rspamd/local.d/worker-controller.inc','''bind_socket = "127.0.0.1:11334";
password = "@@rspamd_hash@@";
enable_password = "@@rspamd_hash@@";
''')
write('/etc/rspamd/local.d/dkim_signing.conf','''path = "/var/lib/rspamd/dkim/$domain.$selector.key";
selector = "mail";
use_domain = "header";
use_esld = false;
sign_authenticated = true;
sign_local = true;
allow_username_mismatch = false;
allow_hdrfrom_mismatch = false;
''')
write('/etc/rspamd/local.d/milter_headers.conf','''extended_spam_headers = true;
''')
write('/etc/rspamd/local.d/antivirus.conf','''clamav {
  action = "reject";
  symbol = "CLAM_VIRUS";
  type = "clamav";
  servers = "127.0.0.1:3310";
  scan_mime_parts = true;
  timeout = 30s;
  retransmits = 2;
}
''')
write('/etc/rspamd/local.d/force_actions.conf','''rules {
  CLAMAV_UNAVAILABLE {
    action = "soft reject";
    expression = "CLAM_VIRUS_FAIL";
    message = "Antivirus temporarily unavailable; try again later";
  }
}
''')
write('/etc/rspamd/local.d/ratelimit.conf','''rates {
  authenticated_user {
    selector = "user.lower";
    bucket {
      burst = 100;
      rate = "100 / 1h";
    }
  }
}
''')
write('/etc/redis/mailstack-note.txt','Keep Redis on loopback; do not expose port 6379.',0o600)
write('/etc/fail2ban/jail.d/mailstack.local',f'''[DEFAULT]
banaction = nftables-multiport
[postfix-sasl]
enabled = true
backend = auto
port = 465,587
logpath = /var/log/mail.log
maxretry = 5
findtime = 10m
bantime = 1h
[dovecot]
enabled = true
backend = auto
port = 993{',995' if pop else ''}
logpath = /var/log/mail.log
maxretry = 5
findtime = 10m
bantime = 1h
''')
write('/etc/letsencrypt/renewal-hooks/deploy/20-mailstack',r'''#!/bin/sh
set -eu
[ -f /etc/mailstack/installed ] || exit 0
postfix check
doveconf -n >/dev/null
apache2ctl configtest
systemctl reload postfix
systemctl reload dovecot
systemctl reload apache2
''',0o750)
write('/usr/local/lib/mailstack/bootstrap.php',r'''<?php
// Run locally as root; secrets are read from a root-only JSON file, not argv.
define('POSTFIXADMIN_CLI', true);
$c = json_decode(file_get_contents($argv[1]), true, 512, JSON_THROW_ON_ERROR);
chdir('/usr/share/postfixadmin/public');
require 'upgrade.php';
function create_record($class,$id,$values) {
  $o=new $class(1);
  if (!$o->init($id) || !$o->set($values) || !$o->save()) {
    // Do not dump handler state: it can contain plaintext passwords.
    throw new RuntimeException('PostfixAdmin bootstrap failed for '.$class.' '.$id);
  }
}
create_record('DomainHandler', $c['domain'], [
  'description'=>'Mail domain','aliases'=>0,'mailboxes'=>0,
  'maxquota'=>10240,'quota'=>0,'transport'=>'virtual',
  'backupmx'=>0,'active'=>1,'default_aliases'=>0]);
create_record('AdminHandler', 'admin@'.$c['domain'], [
  'password'=>$c['admin_pass'],'password2'=>$c['admin_pass'],
  'superadmin'=>1,'active'=>1,'domains'=>[]]);
create_record('MailboxHandler', $c['mailbox'], [
  'password'=>$c['mailbox_pass'],'password2'=>$c['mailbox_pass'],
  'name'=>'Mail administrator','quota'=>2048,'active'=>1,'welcome_mail'=>0]);
foreach (['postmaster','abuse','dmarc'] as $local) {
  create_record('AliasHandler', $local.'@'.$c['domain'], [
    'goto'=>[$c['mailbox']], 'active'=>1]);
}
echo "PostfixAdmin schema, domain, admin, mailbox and aliases initialized.\n";
''',0o600)
write('/usr/local/sbin/mailstack-health',r'''#!/usr/bin/env bash
set -uo pipefail
fail=0
for s in @@DBSVC@@ dovecot rspamd redis-server apache2 clamav-daemon clamav-freshclam fail2ban; do
  if systemctl is-active --quiet "$s"; then echo "OK service $s";
  else echo "FAIL service $s"; fail=1; fi
done
if pgrep -x master >/dev/null && postfix status >/dev/null 2>&1; then echo 'OK Postfix';
else echo 'FAIL Postfix'; fail=1; fi
if ! postfix check; then fail=1; fi
if ! doveconf -n >/dev/null; then fail=1; fi
if ! rspamadm configtest >/dev/null; then fail=1; fi
if ! apache2ctl configtest; then fail=1; fi
h=$(python3 -c 'import json;print(json.load(open("/etc/mailstack/identity.json"))["hostname"])')
m=$(python3 -c 'import json;print(json.load(open("/etc/mailstack/identity.json"))["mailbox"])')
if ! openssl x509 -in "/etc/letsencrypt/live/$h/fullchain.pem" -checkend 1209600 -noout; then fail=1; fi
if ! doveadm user "$m" >/dev/null; then fail=1; fi
if ! [[ -S /var/spool/postfix/private/auth && -S /var/spool/postfix/private/dovecot-lmtp ]]; then fail=1; fi
if ! nft list table inet mailstack >/dev/null; then fail=1; fi
for port in 25 465 587 993 443 3310 11332; do
  if ! timeout 3 bash -c "exec 3<>/dev/tcp/127.0.0.1/$port"; then echo "FAIL port $port"; fail=1; fi
done
printf 'Disk and inode usage:\n'; df -h /var/vmail; df -i /var/vmail
printf 'Mail queue:\n'; postqueue -p
exit "$fail"
''',0o750)
write('/usr/local/sbin/mailstack-backup',r'''#!/usr/bin/env bash
# OFFLINE encrypted local backup. Schedule only after testing off-host restore.
set -Eeuo pipefail
umask 077
exec 9>/run/mailstack-backup.lock
flock -n 9 || exit 0
[[ $EUID == 0 ]] || { echo 'Run as root'; exit 1; }
install -d -m 0700 /var/backups/mailstack
work=$(mktemp -d /var/backups/mailstack/work.XXXXXX)
restore_services() {
  rc=$?
  systemctl start dovecot postfix apache2 || true
  rm -rf -- "$work"
  exit "$rc"
}
trap restore_services EXIT
systemctl stop apache2 postfix dovecot
@@DBDUMP@@
out="/var/backups/mailstack/mailstack-$(date +%F-%H%M%S).tar.gz.gpg"
tar --numeric-owner -czf - \
  -C / etc/postfix etc/dovecot etc/postfixadmin etc/roundcube etc/apache2 \
  @@DBCONF@@ etc/rspamd etc/mailstack etc/letsencrypt etc/fail2ban \
  var/vmail var/spool/postfix var/lib/rspamd/dkim root/mailstack-credentials.json \
  -C "$work" . |
  gpg --batch --yes --pinentry-mode loopback \
    --passphrase-file /etc/mailstack/backup.pass --symmetric \
    --cipher-algo AES256 --output "$out.partial"
mv "$out.partial" "$out"
printf 'Created %s\nCopy it AND the backup passphrase to independent storage.\n' "$out"
''',0o750)
write('/etc/systemd/system/mailstack-health.service','''[Unit]
Description=Mailstack local health checks
After=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/mailstack-health
''',0o644)
write('/etc/systemd/system/mailstack-health.timer','''[Unit]
Description=Check mailstack every 15 minutes
[Timer]
OnBootSec=5min
OnUnitActiveSec=15min
[Install]
WantedBy=timers.target
''',0o644)
write('/etc/systemd/system/mailstack-backup.service','''[Unit]
Description=Offline encrypted mailstack backup (maintenance window)
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/mailstack-backup
''',0o644)
write('/etc/systemd/system/mailstack-backup.timer','''[Unit]
Description=Optional nightly offline backup; NOT enabled by installer
[Timer]
OnCalendar=*-*-* 03:30:00
Persistent=false
[Install]
WantedBy=timers.target
''',0o644)
write('/etc/systemd/system/mailstack-firewall.service','''[Unit]
Description=Mailstack scoped network protection (does not replace global firewall)
After=network-pre.target nftables.service
Before=postfix.service dovecot.service apache2.service mariadb.service postgresql.service redis-server.service rspamd.service clamav-daemon.service
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /etc/mailstack/firewall.nft
ExecReload=/usr/sbin/nft -f /etc/mailstack/firewall.nft
[Install]
WantedBy=multi-user.target
''',0o644)
if pg:
    # Roles first; databases owned by the application roles. Passwords are hex.
    write('/db-initial.sql',r'''CREATE ROLE pfa LOGIN PASSWORD '@@pfa_pass@@';
CREATE ROLE mailreader LOGIN PASSWORD '@@read_pass@@';
CREATE ROLE roundcube LOGIN PASSWORD '@@rc_pass@@';
CREATE ROLE rcpassword LOGIN PASSWORD '@@rcpw_pass@@';
CREATE DATABASE postfixadmin OWNER pfa ENCODING 'UTF8' TEMPLATE template0;
CREATE DATABASE roundcube OWNER roundcube ENCODING 'UTF8' TEMPLATE template0;
REVOKE ALL ON DATABASE postfixadmin FROM PUBLIC;
REVOKE ALL ON DATABASE roundcube FROM PUBLIC;
GRANT CONNECT ON DATABASE postfixadmin TO mailreader, rcpassword;
''',0o600)
    # Runs inside the postfixadmin database after the PostfixAdmin schema exists.
    write('/db-rights.sql',r'''GRANT USAGE ON SCHEMA public TO mailreader, rcpassword;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO mailreader;
ALTER DEFAULT PRIVILEGES FOR ROLE pfa IN SCHEMA public GRANT SELECT ON TABLES TO mailreader;
GRANT SELECT (username,password,active), UPDATE (password,modified) ON mailbox TO rcpassword;
''',0o600)
else:
    write('/db-initial.sql',r'''CREATE DATABASE postfixadmin CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE DATABASE roundcube CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'pfa'@'127.0.0.1' IDENTIFIED BY '@@pfa_pass@@';
GRANT ALL PRIVILEGES ON postfixadmin.* TO 'pfa'@'127.0.0.1';
CREATE USER 'mailreader'@'127.0.0.1' IDENTIFIED BY '@@read_pass@@';
GRANT SELECT ON postfixadmin.* TO 'mailreader'@'127.0.0.1';
CREATE USER 'roundcube'@'127.0.0.1' IDENTIFIED BY '@@rc_pass@@';
GRANT ALL PRIVILEGES ON roundcube.* TO 'roundcube'@'127.0.0.1';
CREATE USER 'rcpassword'@'127.0.0.1' IDENTIFIED BY '@@rcpw_pass@@';
''',0o600)
    write('/db-rights.sql',r'''GRANT SELECT (username,password,active), UPDATE (password,modified) ON postfixadmin.mailbox TO 'rcpassword'@'127.0.0.1';
''',0o600)
# Ensure no accidental placeholder survived. Generated @ characters in email/DSN
# are intentional; only the exact @@NAME@@ pattern is a placeholder.
import re
for f in root.rglob('*'):
    if f.is_file() and re.search(r'@@[A-Za-z_]+@@',f.read_text()):
        raise SystemExit('Unresolved placeholder in '+str(f))
print('Rendered configuration files (credentials not printed).')
PY
}
make_credentials() {
  python3 - "$CREDS" "$DOMAIN" "$MAILHOST" "$PUBLIC_IP" "$SSH_PORT" "$MODE" "$DB" <<'PY'
import json,secrets,sys,os
path,d,h,ip,ssh,mode,db=sys.argv[1:]
def secret(n=32): return secrets.token_hex(n) if mode!='render' else 'a1'*n
c=dict(domain=d,hostname=h,public_ip=ip,ssh_port=int(ssh),mailbox='mailadmin@'+d,db=db,
       **{k:secret() for k in ['pfa_pass','read_pass','rc_pass','rcpw_pass','admin_pass','mailbox_pass','rspamd_pass','backup_pass']})
c['rc_key']=secret(12);c['rspamd_hash']='DUMMY_HASH_RENDER_ONLY'
with open(path,'x') as f: json.dump(c,f,indent=2);f.write('\n')
os.chmod(path,0o600)
PY
}
if [[ $MODE == render ]]; then
  validate_inputs
  [[ ! -e "$OUT" ]] || die 'Render output must not exist (prevents overwrite).'
  mkdir -p -- "$OUT"
  chmod 0700 "$OUT"
  OUT=$(realpath "$OUT"); CREDS="$OUT/dummy-credentials.json"
  make_credentials; render
  printf 'RENDER ONLY complete. Dummy configs at %s. Do not deploy them.\n' "$OUT"
  exit
fi
((EUID == 0)) || die 'Run as root.'
[[ -r /etc/os-release ]] || die 'Missing /etc/os-release.'
# shellcheck disable=SC1091
. /etc/os-release
[[ ${ID:-} == debian && ${VERSION_ID:-} == 13 ]] || die 'Only Debian 13 is supported.'
if [[ -z $DOMAIN ]]; then read -r -p 'Mail domain (lowercase ASCII): ' DOMAIN; fi
if [[ -z $MAILHOST ]]; then read -r -p 'Mail hostname (lowercase ASCII): ' MAILHOST; fi
if [[ -z $PUBLIC_IP ]]; then read -r -p 'Public IPv4 address: ' PUBLIC_IP; fi
validate_inputs
[[ ! -e /etc/mailstack && ! -e /root/mailstack-credentials.json ]] || die 'Existing/partial mailstack installation detected.'
[[ ! -e /usr/sbin/policy-rc.d ]] || die 'Existing policy-rc.d: review host policy before installation.'
for data_dir in /var/vmail /var/lib/mysql /var/lib/postgresql; do
  if [[ -d $data_dir && -n $(find "$data_dir" -mindepth 1 -print -quit) ]]; then
    die "Existing data in $data_dir. Use a fresh host."
  fi
done
for pkg in postfix exim4-daemon-light exim4-daemon-heavy dovecot-core mariadb-server postgresql apache2 roundcube-core postfixadmin rspamd redis-server clamav-daemon; do
  if dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -q 'install ok installed'; then
    die "Existing package $pkg detected. Use a fresh dedicated host, not a migration."
  fi
done
[[ $(awk '/MemTotal/{print int($2/1024)}' /proc/meminfo) -ge 3800 ]] || die 'At least 4 GiB RAM required with ClamAV; 8 GiB recommended.'
[[ $(df -Pk / | awk 'NR==2{print $4}') -ge 10485760 ]] || die 'At least 10 GiB free space required (more for real mail).'
getent passwd 5000 >/dev/null && die 'UID 5000 is occupied.'
getent group 5000 >/dev/null && die 'GID 5000 is occupied.'
getent passwd vmail >/dev/null && die 'User vmail already exists.'
if (( ! YES )); then
  printf '\nWill configure a NEW host for %s (%s). DNS/PTR are not modified.\n' "$DOMAIN" "$MAILHOST"
  printf 'Existing host firewall is preserved. Mailstack ports will be protected.\n'
  read -r -p 'Type INSTALL to proceed (a provider snapshot is recommended): ' answer
  [[ $answer == INSTALL ]] || die 'Cancelled.'
fi
INSTALL_STARTED=1
install -d -m 0700 /etc/mailstack
CREDS=/root/mailstack-credentials.json
make_credentials
install -m 0600 /dev/null /var/log/mailstack-install.log
exec > >(tee -a /var/log/mailstack-install.log) 2>&1
printf 'Mailstack %s started at %s\n' "$VERSION" "$(date -Is)"
TMP=$(mktemp -d /root/mailstack-build.XXXXXX)
printf '#!/bin/sh\nexit 101\n' > /usr/sbin/policy-rc.d
chmod 0755 /usr/sbin/policy-rc.d; POLICY_OWNED=1
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y nftables dnsutils ca-certificates openssl curl python3 gnupg
firewall() {
  local mode=$1
  cat > /etc/mailstack/firewall.nft <<'NFT'
add table inet mailstack
flush table inet mailstack
table inet mailstack {
  chain input {
    type filter hook input priority -20; policy accept;
    iifname "lo" accept
    tcp dport { 8080, 4190, 3306, 3310, 5432, 6379, 11332, 11333, 11334 } reject with tcp reset
NFT
  if [[ $mode == setup ]]; then
    printf '    tcp dport { 25, 443, 465, 587, 993, 995 } reject with tcp reset\n' >> /etc/mailstack/firewall.nft
  elif (( ! POP3 )); then
    printf '    tcp dport 995 reject with tcp reset\n' >> /etc/mailstack/firewall.nft
  fi
  printf '  }\n}\n' >> /etc/mailstack/firewall.nft
  nft -c -f /etc/mailstack/firewall.nft
  nft -f /etc/mailstack/firewall.nft
}
firewall setup
# No external scripts executed; only distribution packages.
A=$(dig +short A "$MAILHOST" | grep -Fx "$PUBLIC_IP" || true)
[[ -n $A ]] || die 'Public A record must already point to --public-ip.'
[[ -z $(dig +short AAAA "$MAILHOST") ]] || die 'IPv4-only installer: remove AAAA or use a reviewed IPv6 configuration.'
PTR=$(dig +short -x "$PUBLIC_IP" | tr '[:upper:]' '[:lower:]')
[[ $PTR == "$MAILHOST." ]] || printf 'WARNING: PTR does not match; change it at your provider before production.\n'
printf 'postfix postfix/main_mailer_type select Internet Site\npostfix postfix/mailname string %s\npostfixadmin postfixadmin/dbconfig-install boolean false\nroundcube-core roundcube/dbconfig-install boolean false\n' "$DOMAIN" | debconf-set-selections
if [[ $DB == postgresql ]]; then
  DBPKGS=(postgresql postfix-pgsql dovecot-pgsql php-pgsql roundcube-pgsql)
else
  DBPKGS=(mariadb-server postfix-mysql dovecot-mysql php-mysql roundcube-mysql)
fi
apt-get install -y "${DBPKGS[@]}" postfix dovecot-core dovecot-imapd \
  dovecot-lmtpd dovecot-sieve dovecot-managesieved \
  apache2 libapache2-mod-php php-cli \
  php-mbstring php-intl php-xml php-curl php-zip php-gd \
  postfixadmin roundcube roundcube-plugins \
  rspamd redis-server clamav-daemon clamav-freshclam fail2ban \
  certbot swaks rsyslog
if ((POP3)); then apt-get install -y dovecot-pop3d; fi
[[ $(dovecot --version) == 2.4.* ]] || die 'Expected Dovecot 2.4.x.'
doveadm -O pw -l | grep -qw ARGON2ID || die 'ARGON2ID unavailable.'
# rspamadm requires a controlling TTY. Use a private PTY, not plaintext argv.
python3 - "$CREDS" <<'PY'
import json,os,pty,select,time,re,sys,signal
p=sys.argv[1];c=json.load(open(p))
pid,fd=pty.fork()
if pid==0: os.execvp('rspamadm',['rspamadm','pw'])
buf=b''; sent=False; deadline=time.monotonic()+30
try:
    while time.monotonic()<deadline:
        ready,_,_=select.select([fd],[],[],0.5)
        if not ready: continue
        try: part=os.read(fd,4096)
        except OSError: break
        if not part: break
        buf+=part
        if b'passphrase:' in buf.lower() and not sent:
            os.write(fd,(c['rspamd_pass']+'\n').encode());sent=True
    else:
        os.kill(pid,signal.SIGKILL)
        raise RuntimeError('rspamadm pw timeout')
finally:
    os.close(fd)
    _,status=os.waitpid(pid,0)
if os.waitstatus_to_exitcode(status)!=0: raise SystemExit('rspamadm pw failed')
m=re.search(rb'\$[A-Za-z0-9]+\$[^\s]+',buf)
if not m: raise SystemExit('Cannot parse rspamadm password hash')
c['rspamd_hash']=m.group(0).decode()
with open(p,'w') as f: json.dump(c,f,indent=2);f.write('\n')
PY
OUT="$TMP/render";mkdir -m 0700 "$OUT";render
# Install only generated /etc and /usr files, not SQL scratch files.
while IFS= read -r -d '' f; do
  target=${f#"$OUT"}
  install -D -m "$(stat -c %a "$f")" "$f" "$target"
done < <(find "$OUT/etc" "$OUT/usr" -type f -print0)
# Preserve package directory modes; grant only intended service readers.
chown root:www-data /etc/postfixadmin/config.local.php /etc/roundcube/config.inc.php \
  /etc/roundcube/plugins/managesieve/config.inc.php /etc/roundcube/plugins/password/config.inc.php
chown root:postfix /etc/postfix/sql/*.cf
chmod 0750 /etc/postfix/sql
chown root:postfix /etc/postfix/sql
chown root:_rspamd /etc/rspamd/local.d/*.conf /etc/rspamd/local.d/*.inc
chmod 0755 /etc/dovecot/sieve
PHPVER=$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')
install -m 0644 /etc/php/mailstack.ini "/etc/php/$PHPVER/mods-available/mailstack.ini"
phpenmod mailstack
hostnamectl set-hostname "$MAILHOST"
# Force local clients to loopback while still verifying the public hostname.
printf '\n127.0.0.1 %s # mailstack-local-client\n' "$MAILHOST" >> /etc/hosts
groupadd --gid 5000 vmail
useradd --uid 5000 --gid vmail --home-dir /var/vmail --no-create-home --shell /usr/sbin/nologin vmail
install -d -o vmail -g vmail -m 0750 /var/vmail
# Service starts are now explicit; remove our package-start suppression.
rm -f /usr/sbin/policy-rc.d; POLICY_OWNED=0
systemctl daemon-reload
systemctl enable --now mailstack-firewall.service
# Database administration helpers: local superuser access via peer/unix socket.
if [[ $DB == postgresql ]]; then
  dbsu() { runuser -u postgres -- psql -X -q -v ON_ERROR_STOP=1 "$@"; }
  systemctl enable --now postgresql
  # Debian default: listen on localhost only, scram-sha-256 for 127.0.0.1.
  [[ $(dbsu -Atc 'SHOW listen_addresses') == localhost ]] || die 'PostgreSQL must listen on localhost only.'
  dbsu < "$OUT/db-initial.sql"
else
  dbsu() { mariadb "$@"; }
  systemctl enable --now mariadb
  dbsu < "$OUT/db-initial.sql"
fi
php /usr/local/lib/mailstack/bootstrap.php "$CREDS"
if [[ $DB == postgresql ]]; then
  [[ $(dbsu -d postfixadmin -Atc 'SELECT COUNT(*) FROM mailbox') -eq 1 ]] || die 'Mailbox bootstrap verification failed.'
  dbsu -d postfixadmin < "$OUT/db-rights.sql"
  RC_SCHEMA=/usr/share/roundcube/SQL/postgres.initial.sql
  [[ -f $RC_SCHEMA ]] || die 'Roundcube schema path changed; review package.'
  # Create Roundcube tables as their owner, not as the postgres superuser.
  { echo 'SET ROLE roundcube;'; cat "$RC_SCHEMA"; } | dbsu -d roundcube
else
  [[ $(dbsu -NBe 'SELECT COUNT(*) FROM postfixadmin.mailbox') -eq 1 ]] || die 'Mailbox bootstrap verification failed.'
  dbsu < "$OUT/db-rights.sql"
  RC_SCHEMA=/usr/share/roundcube/SQL/mysql.initial.sql
  [[ -f $RC_SCHEMA ]] || die 'Roundcube schema path changed; review package.'
  dbsu roundcube < "$RC_SCHEMA"
fi
for cfg in /etc/postfixadmin/config.local.php /etc/roundcube/config.inc.php; do php -l "$cfg"; done
# Apply main.cf changes without losing distribution service settings.
while IFS= read -r line; do [[ -z $line || $line == \#* ]] || postconf -e "$line"; done < /etc/postfix/mailstack-main.cf
# Fresh-host precondition: a submission service should not already be active.
if grep -Eq '^(submission|submissions|smtps|465)[[:space:]]+inet' /etc/postfix/master.cf; then
  die 'Unexpected active submission service in package master.cf; review before merging.'
fi
cat /etc/postfix/mailstack-submission.cf >> /etc/postfix/master.cf
# Debian already ships "postmaster: root"; duplicate keys make newaliases warn.
grep -q '^postmaster:' /etc/aliases || printf 'postmaster: root\n' >> /etc/aliases
sed -i '/^root:/d' /etc/aliases
printf 'root: mailadmin@%s\n' "$DOMAIN" >> /etc/aliases
newaliases
install -d -m 0755 /var/www/mailstack-acme/.well-known/acme-challenge
# Disable package-global aliases and the default site on this new dedicated host.
a2disconf postfixadmin || true
a2disconf roundcube || true
a2dissite 000-default default-ssl || true
a2enmod ssl headers rewrite
# HTTP only until a valid certificate exists.
a2ensite mailstack-http
apache2ctl configtest
systemctl enable --now apache2
certbot certonly --non-interactive --agree-tos --register-unsafely-without-email \
  --webroot -w /var/www/mailstack-acme --cert-name "$MAILHOST" -d "$MAILHOST"
[[ -f /etc/letsencrypt/live/$MAILHOST/fullchain.pem ]] || die 'Certificate path missing.'
# CA account has no email because first mailbox is not online at issue time.
# Configure an externally reachable ACME account contact after installation.
a2ensite mailstack-webmail mailstack-admin
apache2ctl configtest
systemctl restart apache2
# Loopback TCP ClamAV avoids permissive Unix socket modes.
python3 - <<'PY'
from pathlib import Path
p=Path('/etc/clamav/clamd.conf');s=p.read_text().splitlines()
s=[x for x in s if not x.startswith(('TCPSocket ', 'TCPAddr '))]
p.write_text('\n'.join(s)+'\nTCPSocket 3310\nTCPAddr 127.0.0.1\n')
PY
# Download signatures before starting scanning. Do not claim virus protection
# when the database is missing. freshclam failure aborts behind the setup guard.
systemctl stop clamav-freshclam || true
freshclam
systemctl enable --now clamav-freshclam clamav-daemon
# Loading the signature database takes minutes on small VMs (3 min was not
# enough in testing); wait up to 10 minutes and show the reason on failure.
for ((attempt=1; attempt<=300; attempt++)); do
  if timeout 2 bash -c 'exec 3<>/dev/tcp/127.0.0.1/3310' 2>/dev/null; then break; fi
  sleep 2
done
if ! timeout 3 bash -c 'exec 3<>/dev/tcp/127.0.0.1/3310'; then
  journalctl -u clamav-daemon -n 30 --no-pager || true
  die 'ClamAV did not become ready.'
fi
install -d -o _rspamd -g _rspamd -m 0700 /var/lib/rspamd/dkim
rspamadm dkim_keygen -b 2048 -s mail -d "$DOMAIN" \
  -k "/var/lib/rspamd/dkim/$DOMAIN.mail.key" > /root/mailstack-dkim.txt
chown _rspamd:_rspamd "/var/lib/rspamd/dkim/$DOMAIN.mail.key"
chmod 0600 "/var/lib/rspamd/dkim/$DOMAIN.mail.key"
# Redis default listener must be loopback. Abort if config was changed upstream.
if ! grep -Eq '^bind[[:space:]]+127\.0\.0\.1' /etc/redis/redis.conf; then
  die 'Redis loopback configuration changed; inspect /etc/redis/redis.conf.'
fi
systemctl enable --now redis-server rsyslog
if ! grep -REq '^[[:space:]]*mail\.\*.*mail\.log' /etc/rsyslog.conf /etc/rsyslog.d; then
  printf 'mail.* -/var/log/mail.log\n' > /etc/rsyslog.d/25-mailstack.conf
fi
rsyslogd -N1
systemctl restart rsyslog
touch /var/log/mail.log
chown root:adm /var/log/mail.log
chmod 0640 /var/log/mail.log
sievec /etc/dovecot/sieve/spam.sieve
chmod 0644 /etc/dovecot/sieve/spam.svbin
postfix check
doveconf -n > /dev/null
rspamadm configtest
fail2ban-client -t
systemctl enable --now rspamd dovecot postfix fail2ban certbot.timer
systemctl restart rspamd dovecot postfix fail2ban
# Test canonical maps before opening the public mail ports.
MAP=$([[ $DB == postgresql ]] && echo pgsql || echo mysql)
[[ $(postmap -q "$DOMAIN" proxy:$MAP:/etc/postfix/sql/domains.cf) == "$DOMAIN" ]] || die 'Domain map failed.'
[[ $(postmap -q "mailadmin@$DOMAIN" proxy:$MAP:/etc/postfix/sql/mailboxes.cf) == 1 ]] || die 'Mailbox map failed.'
[[ -z $(postmap -q "missing-$RANDOM@$DOMAIN" proxy:$MAP:/etc/postfix/sql/mailboxes.cf) ]] || die 'Unknown mailbox unexpectedly exists.'
doveadm user "mailadmin@$DOMAIN" >/dev/null
# Real local IMAP/SMTP authentication: read secrets from the root-only file,
# never in command-line arguments or logs. Deliver a test mail through milter/LMTP.
python3 - "$CREDS" <<'PY'
import json,sys,imaplib,smtplib,ssl,time
from email.message import EmailMessage
c=json.load(open(sys.argv[1]));h=c['hostname'];u=c['mailbox'];p=c['mailbox_pass'];ctx=ssl.create_default_context()
msg=EmailMessage();msg['From']=u;msg['To']=u;msg['Subject']='Mailstack installation self-test';msg.set_content('Local SMTP AUTH, TLS, milter and LMTP self-test.')
with smtplib.SMTP(h,587,timeout=30) as s:
    s.ehlo();s.starttls(context=ctx);s.ehlo();s.login(u,p);s.send_message(msg)
for attempt in range(15):
    with imaplib.IMAP4_SSL(h,993,ssl_context=ctx,timeout=15) as im:
        im.login(u,p);im.select('INBOX');typ,data=im.search(None,'SUBJECT','"Mailstack installation self-test"');im.logout()
    if typ=='OK' and data and data[0]:break
    time.sleep(2)
else:raise SystemExit('Local SMTP->LMTP->IMAP delivery failed')
# Verify unauthenticated submission is refused, even for a local recipient.
with smtplib.SMTP(h,587,timeout=15) as s:
    s.ehlo();s.starttls(context=ctx);s.ehlo();s.mail(u);code,_=s.rcpt(u)
    if code<400:raise SystemExit('Unauthenticated submission unexpectedly allowed')
print('PASS local TLS/AUTH/delivery and unauthenticated-submission check.')
PY
/usr/local/sbin/mailstack-health
# Validate ACME renewal while external access is still guarded.
certbot renew --dry-run
# Save package versions for reproducibility; security updates may change them.
dpkg-query -W postfix dovecot-core postfixadmin roundcube-core rspamd clamav-daemon > /root/mailstack-versions.txt
cat > /root/mailstack-dns.txt <<DNS
; Replace/publish these in the authoritative DNS zone. PTR is set by IP provider.
$MAILHOST. IN A $PUBLIC_IP
$DOMAIN. IN MX 10 $MAILHOST.
$DOMAIN. IN TXT "v=spf1 ip4:$PUBLIC_IP -all"
_dmarc.$DOMAIN. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@$DOMAIN"
; PTR: $PUBLIC_IP -> $MAILHOST
; DKIM public record follows:
DNS
cat /root/mailstack-dkim.txt >> /root/mailstack-dns.txt
firewall production
systemctl enable --now mailstack-health.timer
# Offline backup timer is installed but intentionally not enabled.
printf '%s\n' "$(date -Is) version=$VERSION" > /etc/mailstack/installed
printf '\nINSTALLATION COMPLETE (local checks only).\nWebmail: https://%s/\n' "$MAILHOST"
printf 'Admin: ssh -N -L 8080:127.0.0.1:8080 -p %s YOUR_SSH_USER@%s\n' "$SSH_PORT" "$MAILHOST"
printf 'Then browse http://127.0.0.1:8080/\n'
printf 'Credentials: /root/mailstack-credentials.json (root-only; do not publish).\n'
printf 'DNS records: /root/mailstack-dns.txt\n'
printf 'Mandatory: external relay, inbound/outbound, DKIM/SPF/DMARC, AV outage\n'
printf 'and EICAR tests; DNS/PTR publication; off-host backup/restore test.\n'
printf 'No HA, ActiveSync, LDAP migration or delivery guarantee is configured.\n'