sudo apt install --no-install-recommends roundcube roundcube-mysql roundcube-plugins

sudo cp -a /etc/roundcube/config.inc.php /etc/roundcube/config.inc.php.orig
sudo tee -a /etc/roundcube/config.inc.php > /dev/null <<'EOF'
// ---- Ebenezer IT (Guía 09): lo que va aquí manda sobre lo de arriba ----
$config['imap_host'] = 'ssl://mail.TU_DOMINIO:993';
$config['smtp_host'] = 'tls://mail.TU_DOMINIO:587';
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['product_name'] = 'Correo TU_DOMINIO';
$config['skin'] = 'elastic';
$config['plugins'] = ['archive', 'zipdownload', 'markasjunk'];
$config['session_lifetime'] = 30;
$config['ip_check'] = true;
$config['login_rate_limit'] = 3;
$config['support_url'] = '';
EOF
sudo php -l /etc/roundcube/config.inc.php

sudo tee /etc/nginx/sites-available/mail.TU_DOMINIO > /dev/null <<'EOF'
# HTTP: Let's Encrypt y redirección a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name mail.TU_DOMINIO;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS: Roundcube, solo desde la VPN
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name mail.TU_DOMINIO;

    ssl_certificate     /etc/letsencrypt/live/mail.TU_DOMINIO/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mail.TU_DOMINIO/privkey.pem;
    include snippets/tls.conf;
    include snippets/solo-vpn.conf;

    # Quien no está en la VPN no ve un error: va a tu web
    error_page 403 = @fuera;
    location @fuera {
        return 302 https://www.TU_DOMINIO/;
    }

    add_header Strict-Transport-Security "max-age=86400" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    root /var/lib/roundcube/public_html;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~ /\. {
        deny all;
    }

    access_log /var/log/nginx/mail.access.log;
    error_log  /var/log/nginx/mail.error.log;
}
EOF
sudo nginx -t && sudo systemctl reload nginx

sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://rspamd.com/apt-stable/gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/rspamd.gpg
echo "deb [signed-by=/etc/apt/keyrings/rspamd.gpg] https://rspamd.com/apt-stable/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/rspamd.list
sudo apt update
sudo apt install rspamd redis-server
printf '\n# Límite para Rspamd\nmaxmemory 128mb\nmaxmemory-policy allkeys-lru\n' | sudo tee -a /etc/redis/redis.conf
sudo systemctl restart redis-server
redis-cli config get maxmemory
sudo ss -tlnp | grep -E ':(6379|11332|11333|11334) '

echo 'servers = "127.0.0.1:6379";' | sudo tee /etc/rspamd/local.d/redis.conf

sudo tee /etc/rspamd/local.d/actions.conf > /dev/null <<'EOF'
# Qué hacer según la puntuación de cada correo
reject = 15;       # rechazar en la entrada: casi seguro spam
add_header = 6;    # entregar marcado como spam (irá a la carpeta Spam)
greylist = null;   # sin umbral de listas grises
EOF

echo 'enabled = false;' | sudo tee /etc/rspamd/local.d/greylist.conf

sudo tee /etc/rspamd/local.d/milter_headers.conf > /dev/null <<'EOF'
use = ["x-spamd-bar", "x-spam-level", "authentication-results"];
extended_spam_headers = true;
EOF

echo 'enabled = false;' | sudo tee /etc/rspamd/local.d/dkim_signing.conf
echo 'enabled = false;' | sudo tee /etc/rspamd/local.d/arc.conf
echo 'autolearn = true;' | sudo tee /etc/rspamd/local.d/classifier-bayes.conf

sudo rspamadm configtest && sudo systemctl restart rspamd

sudo apt install unbound bind9-dnsutils
sudo systemctl disable --now unbound-resolvconf.service 2>/dev/null
sudo tee /etc/unbound/unbound.conf.d/rspamd.conf > /dev/null <<'EOF'
# DNS recursivo local, solo para Rspamd (listas negras)
server:
    interface: 127.0.0.1
    port: 5335
    access-control: 127.0.0.0/8 allow
    do-ip6: no
    hide-identity: yes
    hide-version: yes
    qname-minimisation: yes
    prefetch: yes
    num-threads: 1
    msg-cache-size: 16m
    rrset-cache-size: 32m
EOF
sudo unbound-checkconf && sudo systemctl restart unbound
grep nameserver /etc/resolv.conf
dig @127.0.0.1 -p 5335 2.0.0.127.multi.uribl.com +short

sudo tee /etc/rspamd/local.d/options.inc > /dev/null <<'EOF'
dns {
  nameserver = ["127.0.0.1:5335"];
}
EOF
sudo rspamadm configtest && sudo systemctl restart rspamd

sudo postconf milter_protocol smtpd_milters
sudo postconf -e \
  'milter_protocol = 6' \
  'smtpd_milters = inet:127.0.0.1:11332, inet:127.0.0.1:8891'
sudo postfix check && sudo systemctl reload postfix
sudo postconf smtpd_milters non_smtpd_milters

sudo apt install dovecot-sieve
sudo mkdir -p /etc/dovecot/sieve
sudo tee /etc/dovecot/sieve/spam-a-junk.sieve > /dev/null <<'EOF'
require ["fileinto", "mailbox"];

# Lo que Rspamd marca como spam va a la carpeta Junk (Spam)
if anyof (header :is "X-Spam" "Yes",
          header :is "X-Rspamd-Action" "add header") {
    fileinto :create "Junk";
    stop;
}
EOF

sudo tee /etc/dovecot/sieve/rspamd-aprender-spam.sh > /dev/null <<'EOF'
#!/bin/sh
exec /usr/bin/rspamc -h 127.0.0.1:11334 learn_spam
EOF
sudo tee /etc/dovecot/sieve/rspamd-aprender-ham.sh > /dev/null <<'EOF'
#!/bin/sh
exec /usr/bin/rspamc -h 127.0.0.1:11334 learn_ham
EOF
sudo chmod 755 /etc/dovecot/sieve/rspamd-aprender-*.sh

sudo tee /etc/dovecot/sieve/aprender-spam.sieve > /dev/null <<'EOF'
require ["vnd.dovecot.pipe", "copy", "imapsieve"];
# Has metido este correo en Spam: Rspamd lo aprende como spam
pipe :copy "rspamd-aprender-spam.sh";
EOF
sudo tee /etc/dovecot/sieve/aprender-ham.sieve > /dev/null <<'EOF'
require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"];
# Has sacado este correo de Spam: Rspamd lo aprende como correo bueno
# (salvo si va a la Papelera: borrarlo no significa que sea bueno)
if environment :matches "imap.mailbox" "*" {
    set "destino" "${1}";
}
if string "${destino}" "Trash" {
    stop;
}
pipe :copy "rspamd-aprender-ham.sh";
EOF

sudo doveconf -n > /dev/null && echo "configuracion correcta" && sudo systemctl reload dovecot
sudo sievec /etc/dovecot/sieve/spam-a-junk.sieve
sudo sievec /etc/dovecot/sieve/aprender-spam.sieve
sudo sievec /etc/dovecot/sieve/aprender-ham.sieve
ls /etc/dovecot/sieve/*.svbin

printf 'From: prueba@ejemplo.com\nTo: TU_BUZON@TU_DOMINIO\nSubject: prueba\nX-Spam: Yes\n\nHola\n' > /tmp/marcado.eml
sudo sieve-test /etc/dovecot/sieve/spam-a-junk.sieve /tmp/marcado.eml
rm /tmp/marcado.eml

sudo sed -i 's|^dns {|enable_test_patterns = true;\ndns {|' /etc/rspamd/local.d/options.inc
sudo rspamadm configtest && sudo systemctl restart rspamd
swaks --server mail.TU_DOMINIO --port 25 --from prueba@ejemplo.com --to TU_BUZON@TU_DOMINIO \
  --body 'XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X' | tail -n 4
sudo sed -i '/^enable_test_patterns = true;$/d' /etc/rspamd/local.d/options.inc
sudo rspamadm configtest && sudo systemctl restart rspamd
cat /etc/rspamd/local.d/options.inc

sudo grep -E "learned message as" /var/log/rspamd/rspamd.log | tail -n 2
rspamc -h 127.0.0.1:11334 stat | grep -E "learned" 

sudo tee /etc/postfix/sql/remitentes.cf > /dev/null <<'EOF'
user = mailuser
password = TU_PASS_BD_CORREO
hosts = 127.0.0.1
dbname = mailserver
query = SELECT username FROM mailbox WHERE username='%s' AND active = 1 UNION SELECT goto FROM alias WHERE address='%s' AND active = 1
EOF
sudo chown root:postfix /etc/postfix/sql/remitentes.cf
sudo chmod 640 /etc/postfix/sql/remitentes.cf
sudo postmap -q TU_BUZON@TU_DOMINIO mysql:/etc/postfix/sql/remitentes.cf

sudo postconf -e 'smtpd_sender_login_maps = mysql:/etc/postfix/sql/remitentes.cf'
sudo postconf -P "submission/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject"
sudo postfix check && sudo systemctl reload postfix

swaks --server mail.TU_DOMINIO --port 587 --tls --auth LOGIN --auth-user TU_BUZON@TU_DOMINIO \
  --from director@TU_DOMINIO --to TU_CORREO_EXTERNO | tail -n 4

sudo tee /etc/fail2ban/jail.d/correo.local > /dev/null <<'EOF'
[postfix-sasl]
enabled  = true
filter   = postfix[mode=auth]
port     = smtp,submission
logpath  = /var/log/mail.log
maxretry = 5
findtime = 10m
bantime  = 1h

[dovecot]
enabled  = true
port     = imaps,submission
logpath  = /var/log/mail.log
maxretry = 5
findtime = 10m
bantime  = 1h
EOF
sudo fail2ban-client -t && sudo systemctl reload fail2ban
sudo fail2ban-client status

for s in postfix dovecot opendkim rspamd redis-server unbound fail2ban php8.3-fpm; do printf "%-14s %s\n" $s $(systemctl is-active $s); done
sudo ss -tlnp | grep -E ':(25|587|993|5335|6379|8891|11332|11333|11334) '
sudo postconf smtpd_milters milter_protocol
sudo fail2ban-client status | grep "Jail list"
rspamc -h 127.0.0.1:11334 stat | grep -E "learned|scanned"