hostname -f
timeout 5 bash -c '</dev/tcp/gmail-smtp-in.l.google.com/25' && echo "Puerto 25: ABIERTO" || echo "Puerto 25: BLOQUEADO"
sudo ss -tlnp | grep -E ':(25|587|993|3306) '

sudo ufw allow 25/tcp comment 'SMTP: correo entrante'
sudo ufw allow 587/tcp comment 'SMTP: envio con usuario'
sudo ufw allow 993/tcp comment 'IMAPS: leer el correo'
sudo ufw status | grep -E '\b(25|110|143|465|587|993|995)/tcp'

sudo tee /etc/nginx/sites-available/mail.TU_DOMINIO > /dev/null <<'EOF'
server {
    listen 80;
    listen [::]:80;
    server_name mail.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://www.TU_DOMINIO;
    }
}
EOF
sudo tee /etc/nginx/sites-available/postfixadmin.TU_DOMINIO > /dev/null <<'EOF'
server {
    listen 80;
    listen [::]:80;
    server_name postfixadmin.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}
EOF
sudo ln -s /etc/nginx/sites-available/mail.TU_DOMINIO /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/postfixadmin.TU_DOMINIO /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

sudo certbot certonly --webroot -w /var/www/letsencrypt -d mail.TU_DOMINIO --dry-run
sudo certbot certonly --webroot -w /var/www/letsencrypt -d mail.TU_DOMINIO --cert-name mail.TU_DOMINIO
sudo certbot certonly --webroot -w /var/www/letsencrypt -d postfixadmin.TU_DOMINIO --cert-name postfixadmin.TU_DOMINIO

sudo tee /etc/letsencrypt/renewal-hooks/deploy/recargar-correo.sh > /dev/null <<'EOF'
#!/bin/sh
# Tras renovar el certificado del correo, Postfix y Dovecot cargan el nuevo
case "$RENEWED_LINEAGE" in
    */mail.TU_DOMINIO) systemctl reload postfix dovecot ;;
esac
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/recargar-correo.sh

sudo apt update
sudo apt install mariadb-server
sudo ss -tlnp | grep 3306

openssl rand -hex 20
openssl rand -hex 20

sudo mariadb <<'EOF'
CREATE DATABASE mailserver CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'postfixadmin'@'localhost' IDENTIFIED BY 'TU_PASS_BD_ADMIN';
GRANT ALL PRIVILEGES ON mailserver.* TO 'postfixadmin'@'localhost';
CREATE USER 'mailuser'@'127.0.0.1' IDENTIFIED BY 'TU_PASS_BD_CORREO';
GRANT SELECT ON mailserver.* TO 'mailuser'@'127.0.0.1';
FLUSH PRIVILEGES;
EOF
sudo mariadb -e "SELECT user, host FROM mysql.user;" 

sudo apt install php8.3-fpm php8.3-mysql php8.3-mbstring
systemctl is-active php8.3-fpm

cd /tmp
wget https://github.com/postfixadmin/postfixadmin/archive/refs/tags/postfixadmin-TU_VERSION_POSTFIXADMIN.tar.gz
tar -xzf postfixadmin-TU_VERSION_POSTFIXADMIN.tar.gz
ls -d postfixadmin-*/
sudo mv postfixadmin-postfixadmin-TU_VERSION_POSTFIXADMIN /var/www/postfixadmin
sudo chown -R root:root /var/www/postfixadmin
sudo mkdir -p /var/www/postfixadmin/templates_c
sudo chown www-data:www-data /var/www/postfixadmin/templates_c
rm postfixadmin-TU_VERSION_POSTFIXADMIN.tar.gz

sudo chown root:www-data /var/www/postfixadmin/config.local.php
sudo chmod 640 /var/www/postfixadmin/config.local.php

sudo tee /etc/nginx/sites-available/postfixadmin.TU_DOMINIO > /dev/null <<'EOF'
# HTTP: Let's Encrypt y redirección a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name postfixadmin.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS: PostfixAdmin, solo desde la VPN
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name postfixadmin.TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/postfixadmin.TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/postfixadmin.TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;
    include snippets/solo-vpn.conf;

    add_header Strict-Transport-Security "max-age=86400" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Frame-Options "DENY" always;

    root /var/www/postfixadmin/public;
    index index.php;

    # Se activa en el paso 9, cuando el asistente ya ha terminado
    # location = /setup.php { deny all; }

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    access_log /var/log/nginx/postfixadmin.access.log;
    error_log  /var/log/nginx/postfixadmin.error.log;
}
EOF

sudo nginx -t && sudo systemctl reload nginx

sudo sed -i 's|^    # location = /setup.php { deny all; }|    location = /setup.php { deny all; }|' /etc/nginx/sites-available/postfixadmin.TU_DOMINIO
grep -n "setup.php" /etc/nginx/sites-available/postfixadmin.TU_DOMINIO
sudo nginx -t && sudo systemctl reload nginx

sudo groupadd -g 5000 vmail
sudo useradd -g vmail -u 5000 -d /var/mail/vhosts -s /usr/sbin/nologin vmail
sudo mkdir -p /var/mail/vhosts
sudo chown vmail:vmail /var/mail/vhosts
sudo chmod 770 /var/mail/vhosts
ls -ld /var/mail/vhosts

sudo apt install postfix postfix-mysql

sudo mkdir -p /etc/postfix/sql

sudo tee /etc/postfix/sql/dominios.cf > /dev/null <<'EOF'
user = mailuser
password = TU_PASS_BD_CORREO
hosts = 127.0.0.1
dbname = mailserver
query = SELECT domain FROM domain WHERE domain='%s' AND backupmx = 0 AND active = 1
EOF

sudo tee /etc/postfix/sql/buzones.cf > /dev/null <<'EOF'
user = mailuser
password = TU_PASS_BD_CORREO
hosts = 127.0.0.1
dbname = mailserver
query = SELECT maildir FROM mailbox WHERE username='%s' AND active = 1
EOF

sudo tee /etc/postfix/sql/alias.cf > /dev/null <<'EOF'
user = mailuser
password = TU_PASS_BD_CORREO
hosts = 127.0.0.1
dbname = mailserver
query = SELECT goto FROM alias WHERE address='%s' AND active = 1
EOF

sudo chown root:postfix /etc/postfix/sql/*.cf
sudo chmod 640 /etc/postfix/sql/*.cf
ls -l /etc/postfix/sql/

sudo postconf -e \
  'myhostname = mail.TU_DOMINIO' \
  'mydomain = TU_DOMINIO' \
  'myorigin = $mydomain' \
  'mydestination = localhost' \
  'inet_protocols = ipv4' \
  'smtpd_banner = $myhostname ESMTP' \
  'disable_vrfy_command = yes' \
  'smtpd_helo_required = yes' \
  'message_size_limit = 26214400' \
  'recipient_delimiter = +'

sudo postconf -e \
  'smtpd_tls_cert_file = /etc/letsencrypt/live/mail.TU_DOMINIO/fullchain.pem' \
  'smtpd_tls_key_file = /etc/letsencrypt/live/mail.TU_DOMINIO/privkey.pem' \
  'smtpd_tls_security_level = may' \
  'smtpd_tls_auth_only = yes' \
  'smtpd_tls_protocols = >=TLSv1.2' \
  'smtpd_tls_mandatory_protocols = >=TLSv1.2' \
  'smtpd_tls_loglevel = 1' \
  'smtp_tls_security_level = may' \
  'smtp_tls_loglevel = 1'

sudo postconf -e \
  'smtpd_sasl_type = dovecot' \
  'smtpd_sasl_path = private/auth' \
  'smtpd_sasl_auth_enable = no' \
  'smtpd_sasl_security_options = noanonymous' \
  'smtpd_sasl_tls_security_options = noanonymous' \
  'smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination'

sudo postconf -e \
  'virtual_mailbox_domains = mysql:/etc/postfix/sql/dominios.cf' \
  'virtual_mailbox_maps = mysql:/etc/postfix/sql/buzones.cf' \
  'virtual_alias_maps = mysql:/etc/postfix/sql/alias.cf' \
  'virtual_transport = lmtp:unix:private/dovecot-lmtp'
sudo postconf -n | wc -l

sudo postconf -M submission/inet="submission inet n - y - - smtpd"
sudo postconf -P \
  "submission/inet/syslog_name=postfix/submission" \
  "submission/inet/smtpd_tls_security_level=encrypt" \
  "submission/inet/smtpd_sasl_auth_enable=yes" \
  "submission/inet/smtpd_client_restrictions=permit_sasl_authenticated,reject" \
  "submission/inet/smtpd_relay_restrictions=permit_sasl_authenticated,reject" \
  "submission/inet/milter_macro_daemon_name=ORIGINATING"
sudo postconf -Mf submission/inet

sudo apt install dovecot-imapd dovecot-lmtpd dovecot-mysql
grep -n "include_try local.conf" /etc/dovecot/dovecot.conf
grep -n "auth-system.conf.ext" /etc/dovecot/conf.d/10-auth.conf

sudo sed -i 's/^!include auth-system.conf.ext/#!include auth-system.conf.ext/' /etc/dovecot/conf.d/10-auth.conf
grep -n "auth-system.conf.ext" /etc/dovecot/conf.d/10-auth.conf

sudo tee /etc/dovecot/dovecot-sql.conf.ext > /dev/null <<'EOF'
driver = mysql
connect = host=127.0.0.1 dbname=mailserver user=mailuser password=TU_PASS_BD_CORREO
default_pass_scheme = BLF-CRYPT

password_query = SELECT username AS user, password FROM mailbox WHERE username = '%u' AND active = '1'
user_query = SELECT 5000 AS uid, 5000 AS gid FROM mailbox WHERE username = '%u' AND active = '1'
EOF
sudo chown root:dovecot /etc/dovecot/dovecot-sql.conf.ext
sudo chmod 640 /etc/dovecot/dovecot-sql.conf.ext

sudo doveconf -n > /dev/null && echo "configuracion correcta"
sudo systemctl restart dovecot
sudo postfix check
sudo systemctl restart postfix
sudo ss -tlnp | grep -E ':(25|110|143|587|993|995) '

sudo postmap -q TU_DOMINIO mysql:/etc/postfix/sql/dominios.cf
sudo postmap -q TU_BUZON@TU_DOMINIO mysql:/etc/postfix/sql/buzones.cf
sudo postmap -q postmaster@TU_DOMINIO mysql:/etc/postfix/sql/alias.cf
sudo doveadm user TU_BUZON@TU_DOMINIO
sudo doveadm auth test TU_BUZON@TU_DOMINIO

sudo apt install swaks

swaks --server mail.TU_DOMINIO --port 587 --tls \
  --auth LOGIN --auth-user TU_BUZON@TU_DOMINIO \
  --from TU_BUZON@TU_DOMINIO --to TU_CORREO_EXTERNO \
  --header "Subject: Prueba desde mi servidor" \
  --body "Hola. Este correo sale de mi propio servidor." 

sudo grep -E "status=sent|lmtp" /var/log/mail.log | tail -n 5
sudo doveadm mailbox status -u TU_BUZON@TU_DOMINIO messages INBOX

swaks --server mail.TU_DOMINIO --port 25 --from alguien@ejemplo.com --to TU_CORREO_EXTERNO
swaks --server mail.TU_DOMINIO --port 25 --quit-after EHLO

sudo apt install opendkim opendkim-tools
sudo mkdir -p /etc/opendkim/keys/TU_DOMINIO
sudo opendkim-genkey -b 2048 -d TU_DOMINIO -D /etc/opendkim/keys/TU_DOMINIO -s dkim2026 -v
sudo chown -R opendkim:opendkim /etc/opendkim
sudo chmod 700 /etc/opendkim/keys
sudo ls -l /etc/opendkim/keys/TU_DOMINIO/

echo "dkim2026._domainkey.TU_DOMINIO TU_DOMINIO:dkim2026:/etc/opendkim/keys/TU_DOMINIO/dkim2026.private" | sudo tee /etc/opendkim/key.table
echo "*@TU_DOMINIO dkim2026._domainkey.TU_DOMINIO" | sudo tee /etc/opendkim/signing.table
printf '127.0.0.1\nlocalhost\n' | sudo tee /etc/opendkim/trusted.hosts
sudo chown opendkim:opendkim /etc/opendkim/*.table /etc/opendkim/trusted.hosts

sudo systemctl restart opendkim
sudo ss -tlnp | grep 8891
sudo postconf -e \
  'smtpd_milters = inet:127.0.0.1:8891' \
  'non_smtpd_milters = $smtpd_milters' \
  'milter_default_action = accept'
sudo systemctl reload postfix

sudo grep -o '"[^"]*"' /etc/opendkim/keys/TU_DOMINIO/dkim2026.txt | tr -d '"\n'; echo

sudo opendkim-testkey -d TU_DOMINIO -s dkim2026 -vvv

swaks --server mail.TU_DOMINIO --port 587 --tls \
  --auth LOGIN --auth-user TU_BUZON@TU_DOMINIO \
  --from TU_BUZON@TU_DOMINIO --to test-xxxxx@srv1.mail-tester.com \
  --header "Subject: Comprobación de mi servidor de correo" \
  --body "Hola. Estoy comprobando que mi servidor de correo está bien configurado: SPF, DKIM y DMARC. Un saludo." 

for s in mariadb php8.3-fpm postfix dovecot opendkim; do printf "%-12s %s\n" $s $(systemctl is-active $s); done
sudo ss -tlnp | grep -E ':(25|110|143|465|587|993|995|3306|8891) '
sudo postconf smtpd_tls_auth_only smtpd_sasl_auth_enable
sudo doveconf disable_plaintext_auth ssl
mailq | tail -n 1