cat << 'SCRIPT' | sudo tee /usr/local/bin/check-mail-prereqs.sh
#!/bin/bash
# Mail Server 前置條件檢查腳本
# 用法：bash check-mail-prereqs.sh <DNS_IP>

DNS_IP="${1:?用法: bash $0 <DNS_IP>}"

R='\033[31m'
G='\033[32m'
N='\033[0m'
P=0
F=0

c(){
  local label="$1"
  local cmd="$2"
  if eval "$cmd" >/dev/null 2>&1; then
    echo -e "  [${G}PASS${N}] ${label}"
    ((P++))
  else
    echo -e "  [${R}FAIL${N}] ${label}"
    ((F++))
  fi
}

# 檢查 Port 是否被非 mail 服務佔用
# 排除 master (Postfix)、dovecot、rspamd — Container 內的 mail 服務屬正常
check_port(){
  local port="$1"
  ! ss -tlnp 2>/dev/null | grep -E ":${port}\b" | grep -Eqv 'master|dovecot|rspamd'
}

echo "===== Mail Server 前置條件檢查 ====="

PODMAN_MAJOR=$(podman --version 2>/dev/null | awk '{print $3}' | cut -d. -f1)
c "Podman >= 4.4"              "test ${PODMAN_MAJOR:-0} -ge 4"
c "Quadlet generator"          "test -f /usr/libexec/podman/quadlet"
c "OpenSSL"                    "openssl version"
c "Git"                        "git --version"
c "systemd"                    "systemctl is-system-running | grep -qE 'running|degraded'"
c "Port 25 未被其他服務佔用"    "check_port 25"
c "Port 465 未被其他服務佔用"   "check_port 465"
c "Port 587 未被其他服務佔用"   "check_port 587"
c "Port 993 未被其他服務佔用"   "check_port 993"
c "Port 995 未被其他服務佔用"   "check_port 995"
c "Port 11334 未被其他服務佔用" "check_port 11334"
c "DNS Server ${DNS_IP}"       "dig @${DNS_IP} google.com +short +time=3"

echo "===== ${P} 通過 / ${F} 失敗 ====="
SCRIPT

sudo chmod +x /usr/local/bin/check-mail-prereqs.sh

sudo bash /usr/local/bin/check-mail-prereqs.sh 192.168.11.2  # ← 根據環境修改

# ===== 根據環境修改 =====
export DN="kubeantony.com"                # 郵件域名

sudo mkdir -p /opt/zfs/images/dkmail-rspamd

cat << 'EOF' | sudo tee /opt/zfs/images/dkmail-rspamd/Dockerfile
FROM docker.io/mailserver/docker-mailserver
ARG DN=""
ENV OVERRIDE_HOSTNAME="mx1.${DN}" \
    DMS_DEBUG="1" \
    POSTMASTER_ADDRESS="bigred@${DN}" \
    ENABLE_RSPAMD="1" \
    ENABLE_OPENDKIM="0" \
    ENABLE_OPENDMARC="0" \
    ENABLE_POLICYD_SPF="0" \
    ENABLE_AMAVIS="0" \
    ENABLE_SPAMASSASSIN="0" \
    ENABLE_IMAP="1" \
    ENABLE_POP3="1"
RUN apt-get update && apt-get install -y net-tools curl wget nano && \
    setup email add bigred@${DN} bigred && \
    setup email add rbean@${DN} rbean && \
    setup email add gbean@${DN} gbean && \
    touch /tmp/docker-mailserver/postfix-main.cf
EOF

sudo podman build \
  --build-arg DN="${DN}" \
  --format docker \
  --no-cache \
  -t dkmail.rspamd \
  /opt/zfs/images/dkmail-rspamd/

sudo podman tag dkmail.rspamd localhost/dkmail.rspamd:latest

# ===== 根據環境修改 =====
export DN="kubeantony.com"                # 郵件域名
export MAIL_HOST="mx1"                    # 郵件主機名稱前綴
export MAIL_FQDN="${MAIL_HOST}.${DN}"     # 郵件主機 FQDN（自動組合）

cd /opt
sudo git clone https://github.com/braveantony/mkcert.git
sudo chmod +x /opt/mkcert/certctl

cat << EOF | sudo tee /opt/mkcert/config
# CA 相關設定
CA_KEY="ca.key"
CA_CRT="ca.crt"
CA_DAYS=3650
CA_SUBJ="/C=TW/ST=Taipei/L=Taipei/O=${DN}/OU=Mail/CN=${DN} Root CA"

# Server 相關設定
DOMAIN_NAME="${DN}"
SERVER_KEY="\${DOMAIN_NAME}.key"
SERVER_CSR="\${DOMAIN_NAME}.csr"
SERVER_CRT="\${DOMAIN_NAME}.crt"
SERVER_DAYS=3650
SERVER_SUBJ="/C=TW/ST=Taipei/L=Taipei/O=${DN}/OU=Mail/CN=${MAIL_FQDN}"
V3_EXT="v3.ext"

ALT_NAMES=(
  "DNS.1=*.\${DOMAIN_NAME}"
  "DNS.2=\${DOMAIN_NAME}"
  "DNS.3=${MAIL_FQDN}"
)
EOF

sudo /opt/mkcert/certctl

ls -l /opt/mkcert/${DN}/

# ===== 根據環境修改 =====
export DN="kubeantony.com"                # 郵件域名
export MY_NETWORKS="127.0.0.0/8,192.168.11.0/24"  # 允許 relay 的網段
export RSPAMD_PW='$2$zmnrfhkhbr9sb411b8eykyxgs1do4jeg$3fjncbo78qfsymbzu7nhfi35inhwezqh313trc7if4ie3d6sj1fy'  # Rspamd Web UI 密碼 hash

sudo mkdir -p \
  /opt/zfs/dkmail/data \
  /opt/zfs/dkmail/conf/ssl \
  /opt/zfs/dkmail/conf/rspamd/override.d

sudo cp /opt/mkcert/${DN}/${DN}.key /opt/zfs/dkmail/conf/ssl/

sudo bash -c "cat \
  /opt/mkcert/${DN}/${DN}.crt \
  /opt/mkcert/${DN}/ca.crt \
  > /opt/zfs/dkmail/conf/ssl/fullchain.pem"

sudo chmod 644 /opt/zfs/dkmail/conf/ssl/fullchain.pem
sudo chmod 600 /opt/zfs/dkmail/conf/ssl/${DN}.key

cat << 'EOF' | sudo tee /opt/zfs/dkmail/conf/rspamd/override.d/options.inc
local_networks = ["127.0.0.1/8"];
EOF

cat << EOF | sudo tee /opt/zfs/dkmail/conf/rspamd/override.d/worker-controller.inc
password = ${RSPAMD_PW}
EOF

cat << 'EOF' | sudo tee /opt/zfs/dkmail/conf/rspamd/override.d/hfilter.conf
enabled = false;
EOF

cat << EOF | sudo tee /opt/zfs/dkmail/conf/postfix-main.cf
# Relay 設定（允許內網寄信）
mynetworks = ${MY_NETWORKS}

# 寄出郵件啟用 TLS
smtp_tls_security_level = may
smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
EOF

# ===== 根據環境修改 =====
export DN="kubeantony.com"                # 郵件域名
export MAIL_HOST="mx1"                    # 郵件主機名稱前綴
export MAIL_FQDN="${MAIL_HOST}.${DN}"     # 郵件主機 FQDN（自動組合）
export DNS_IP="192.168.11.2"            # 內網 DNS Server IP
export NET_IF="ens18"                     # Mail Server 網路介面名稱

cat << EOF | sudo tee /etc/containers/systemd/dkmail.yaml
apiVersion: v1
kind: Pod
metadata:
  name: dkmail
  labels:
    app: dkmail
spec:
  hostname: ${MAIL_FQDN}
  hostNetwork: true
  dnsConfig:
    nameservers:
      - ${DNS_IP}
    searches:
      - ${DN}
  containers:
    - name: dkmail
      image: localhost/dkmail.rspamd:latest
      env:
        - name: NETWORK_INTERFACE
          value: "${NET_IF}"
        - name: SSL_TYPE
          value: "manual"
        - name: SSL_CERT_PATH
          value: "/etc/ssl/mail/fullchain.pem"
        - name: SSL_KEY_PATH
          value: "/etc/ssl/mail/${DN}.key"
      volumeMounts:
        - name: mail-data
          mountPath: /var/mail
        - name: postfix-main-cf
          mountPath: /tmp/docker-mailserver/postfix-main.cf
          readOnly: true
        - name: rspamd-config
          mountPath: /tmp/docker-mailserver/rspamd
        - name: ssl-certs
          mountPath: /etc/ssl/mail
          readOnly: true
  volumes:
    - name: mail-data
      hostPath:
        path: /opt/zfs/dkmail/data
        type: Directory
    - name: postfix-main-cf
      hostPath:
        path: /opt/zfs/dkmail/conf/postfix-main.cf
        type: File
    - name: rspamd-config
      hostPath:
        path: /opt/zfs/dkmail/conf/rspamd
        type: Directory
    - name: ssl-certs
      hostPath:
        path: /opt/zfs/dkmail/conf/ssl
        type: Directory
EOF

cat << 'EOF' | sudo tee /etc/containers/systemd/dkmail.kube
[Unit]
Description=Docker Mail Server (dkmail) with TLS
After=network-online.target
Wants=network-online.target

[Kube]
Yaml=/etc/containers/systemd/dkmail.yaml
Network=host

[Service]
Restart=always
RestartSec=10
TimeoutStartSec=120

[Install]
WantedBy=multi-user.target default.target
EOF

# 重新載入 systemd（讓 Quadlet generator 產生 service）
sudo systemctl daemon-reload

# 啟動服務
sudo systemctl start dkmail.service

# 設定開機自動啟動
sudo systemctl enable dkmail.service

# 確認狀態
sudo systemctl status dkmail.service

# ===== 根據環境修改 =====
export MAIL_FQDN="mx1.kubeantony.com"    # 郵件主機 FQDN

sudo podman pod ps
sudo podman ps --pod

# SMTP STARTTLS（Port 587）
openssl s_client -connect ${MAIL_FQDN}:587 -starttls smtp

# SMTPS（Port 465）
openssl s_client -connect ${MAIL_FQDN}:465

# IMAPS（Port 993）
openssl s_client -connect ${MAIL_FQDN}:993

# POP3S（Port 995）
openssl s_client -connect ${MAIL_FQDN}:995

# ===== 根據環境修改 =====
export DN="kubeantony.com"                # 郵件域名
export MAIL_IP="192.168.11.3"           # Mail Server IP
export DNS_IP="192.168.11.2"            # 內網 DNS Server IP

nsupdate << EOF
server ${DNS_IP}
zone ${DN}
update del ${DN}. TXT
update add ${DN}. 300 IN TXT "v=spf1 ip4:${MAIL_IP} ~all"
send
EOF

dig @${DNS_IP} ${DN}. TXT +short

# ===== 根據環境修改 =====
export DN="kubeantony.com"                # 郵件域名
export DNS_IP="192.168.11.2"            # 內網 DNS Server IP

sudo podman exec -it dkmail-dkmail setup config dkim domain ${DN}

sudo sed -i 's/sign_local = false/sign_local = true/' \
  /opt/zfs/dkmail/conf/rspamd/override.d/dkim_signing.conf

grep 'sign_local' /opt/zfs/dkmail/conf/rspamd/override.d/dkim_signing.conf

tree /opt/zfs/dkmail/conf/rspamd/

DKIM_K8S_TXT=$(sed -n 's|.*"\([^"]*\)".*|"\1"|p' \
  /opt/zfs/dkmail/conf/rspamd/dkim/rsa-2048-mail-${DN}.public.txt | tr '\n' ' ')

echo $DKIM_K8S_TXT

nsupdate << EOF
server ${DNS_IP}
zone ${DN}
update del mail._domainkey.${DN}
update add mail._domainkey.${DN} 3600 IN TXT $DKIM_K8S_TXT
send
EOF

dig @${DNS_IP} mail._domainkey.${DN}. TXT +short

sudo systemctl restart dkmail.service

# ===== 根據環境修改 =====
export DN="kubeantony.com"                # 郵件域名
export DNS_IP="192.168.11.2"            # 內網 DNS Server IP
export POSTMASTER="bigred"                # Postmaster 帳號名稱

nsupdate << EOF
server ${DNS_IP}
zone ${DN}
update del _dmarc.${DN}. TXT
update add _dmarc.${DN}. 300 IN TXT "v=DMARC1; p=none; rua=mailto:${POSTMASTER}@${DN}"
send
EOF

dig @${DNS_IP} _dmarc.${DN}. TXT +short

# ===== 根據環境修改（在測試機器上執行）=====
export DN="kubeantony.com"                # 郵件域名
export MAIL_HOST="mx1"                    # 郵件主機名稱前綴
export MAIL_FQDN="${MAIL_HOST}.${DN}"     # 郵件主機 FQDN（自動組合）
export MAIL_IP="192.168.11.3"           # Mail Server IP
export POSTMASTER="bigred"                # Postmaster 帳號名稱

# Debian/Ubuntu
sudo apt install -y s-nail

# Alpine Linux
sudo apk add s-nail

echo "Test Mail" | s-nail \
  -S mta=smtp://${MAIL_IP} \
  -s "Mail Server Test" \
  "sreantony@gmail.com"

cat << EOF > ~/.msmtprc
account    test
host       ${MAIL_FQDN}
port       587
from       ${POSTMASTER}@${DN}
auth       plain
user       ${POSTMASTER}@${DN}
password   ${POSTMASTER}
tls        on
tls_starttls on
tls_certcheck off
logfile    /tmp/msmtp.log
EOF

chmod 600 ~/.msmtprc

echo -e "To: sreantony@gmail.com\nSubject: Auth Test\n\n認證測試" | msmtp -a test sreantony@gmail.com

# ===== 根據環境修改 =====
export DN="kubeantony.com"                # 郵件域名
export MAIL_IP="192.168.11.3"           # Mail Server IP

# 從伺服器下載 ca.crt
scp user@${MAIL_IP}:/opt/mkcert/${DN}/ca.crt ~/Desktop/

# 手動執行 generator 檢查錯誤
sudo /usr/libexec/podman/quadlet --dryrun

# 用 podman kube play 直接測試
sudo podman kube play /etc/containers/systemd/dkmail.yaml

# 測試完畢清除
sudo podman kube down /etc/containers/systemd/dkmail.yaml

sudo podman images | grep dkmail

# 如果缺少 localhost 前綴，重新標記
sudo podman tag dkmail.rspamd localhost/dkmail.rspamd:latest

sudo podman exec -it dkmail-dkmail postconf mynetworks

sudo podman exec -it dkmail-dkmail ls -l /dev/shm/sasl-auth.sock

sudo podman exec -it dkmail-dkmail postconf smtpd_sasl_path