⚙️ scripts/07_server_mail.sh

#!/bin/bash
# ============================================================
# Скрипт 07: Почтовый сервер (Postfix + Dovecot)
# Server 192.168.0.150
# Домен: kspai.ru
# ============================================================

set -e

echo "▶️  07. Почтовый сервер..."
echo ""

# ─── 1. Установка пакетов ─────────────────────────────────
echo "📦 Установка Postfix + Dovecot..."

# Preseed — чтобы не задавало вопросов
echo "postfix postfix/main_mailer_type select Internet Site" | sudo debconf-set-selections
echo "postfix postfix/mailname string mail.kspai.ru" | sudo debconf-set-selections

sudo DEBIAN_FRONTEND=noninteractive apt install -y \
    postfix postfix-pcre \
    dovecot-core dovecot-imapd dovecot-pop3d \
    mailutils opendkim opendkim-tools

# ─── 2. Настройка Postfix ─────────────────────────────────
echo "⚙️  Настройка Postfix..."

sudo postconf -e "myhostname = mail.kspai.ru"
sudo postconf -e "mydomain = kspai.ru"
sudo postconf -e "myorigin = \$mydomain"
sudo postconf -e "inet_interfaces = all"
sudo postconf -e "inet_protocols = ipv4"
sudo postconf -e "mydestination = \$myhostname, localhost.\$mydomain, localhost, \$mydomain"
sudo postconf -e "mynetworks = 127.0.0.0/8, 192.168.0.0/24"
sudo postconf -e "home_mailbox = Maildir/"
sudo postconf -e "smtpd_tls_cert_file = /etc/letsencrypt/live/mail.kspai.ru/fullchain.pem"
sudo postconf -e "smtpd_tls_key_file = /etc/letsencrypt/live/mail.kspai.ru/privkey.pem"
sudo postconf -e "smtpd_tls_security_level = may"
sudo postconf -e "smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1"
sudo postconf -e "smtpd_use_tls = yes"

# ─── 3. Настройка Dovecot ─────────────────────────────────
echo "⚙️  Настройка Dovecot..."

sudo tee /etc/dovecot/conf.d/10-mail.conf > /dev/null << 'EOF'
mail_location = maildir:~/Maildir
namespace inbox {
  inbox = yes
}
protocols = imap pop3 lmtp
EOF

sudo tee /etc/dovecot/conf.d/10-auth.conf > /dev/null << 'EOF'
disable_plaintext_auth = no
auth_mechanisms = plain login
!include auth-system.conf.ext
EOF

sudo tee /etc/dovecot/conf.d/10-ssl.conf > /dev/null << 'EOF'
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.kspai.ru/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.kspai.ru/privkey.pem
ssl_min_protocol = TLSv1.2
EOF

sudo tee /etc/dovecot/conf.d/10-master.conf > /dev/null << 'EOF'
service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 110
  }
  inet_listener pop3s {
    port = 995
    ssl = yes
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = postfix
    group = postfix
  }
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
    user = postfix
    group = postfix
  }
}
EOF

# ─── 4. Почтовые ящики ────────────────────────────────────
echo "👥 Создание пользователей..."
for user in admin info support; do
    if ! id "$user" &>/dev/null; then
        sudo useradd -m -s /bin/bash "$user"
        echo "$user:ChangeMe123!" | sudo chpasswd
        echo "   ✅ $user@kspai.ru / ChangeMe123!"
    fi
done

# ─── 5. Запуск ────────────────────────────────────────────
echo "🔄 Запуск служб..."
sudo systemctl restart postfix
sudo systemctl restart dovecot
sudo systemctl enable postfix dovecot

# ─── 6. Открываем порты ───────────────────────────────────
echo "🔥 Открытие портов..."
for port in 25 143 465 587 993 995; do
    sudo ufw allow $port/tcp 2>/dev/null || true
done

# ─── 7. Проверка ──────────────────────────────────────────
echo ""
echo "🔍 Статус:"
sudo systemctl is-active postfix && echo "   Postfix: ✅"
sudo systemctl is-active dovecot && echo "   Dovecot: ✅"
echo ""
echo "📋 Порты:"
sudo ss -tlnp | grep -E ":(25|143|465|587|993|995)" | awk '{print "   " $4}'

echo ""
echo "✅ 07_server_mail.sh завершён"
echo ""
echo "⚠️  Не забудьте:"
echo "   1. Пробросить порты на роутере (25,465,587,993,995)"
echo "   2. Настроить MX-запись kspai.ru → mail.kspai.ru"
echo "   3. Сменить пароли: passwd admin"