#!/bin/bash
#===============================================================================
# SCRIPT INSTALARE SERVER MAIL - POSTFIX + DOVECOT PE UBUNTU
#===============================================================================
# Versiune: 1.0
# Compatibil: Ubuntu 22.04 LTS / Ubuntu 24.04 LTS
# Descriere: Instalare automată și configurare server de email complet
#===============================================================================
# ATENȚIE: Rulați acest script ca ROOT sau cu SUDO
# Folosire: sudo bash install_mail_server.sh
#===============================================================================

set -e  # Oprește la prima eroare

#===============================================================================
# CONFIGURARE - MODIFICAȚI ACESTE VALORI
#===============================================================================

# Domeniul și hostname-ul serverului
DOMAIN="example.com"
MAIL_HOSTNAME="mail.example.com"
SERVER_IP="203.0.113.10"  # Înlocuiți cu IP-ul real al serverului

# Email-ul administratorului pentru Let's Encrypt
ADMIN_EMAIL="admin@example.com"

# Utilizatorul de email implicit (se va crea automat)
DEFAULT_EMAIL_USER="admin"
DEFAULT_EMAIL_PASSWORD="ChangeThisPassword123!"  # SCHIMBAȚI ACEASTA!

#===============================================================================
# CULORI PENTRU OUTPUT
#===============================================================================
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

#===============================================================================
# FUNCȚII UTILE
#===============================================================================

print_header() {
    echo -e "${BLUE}============================================================${NC}"
    echo -e "${BLUE}  $1${NC}"
    echo -e "${BLUE}============================================================${NC}"
}

print_success() {
    echo -e "${GREEN}[✓] $1${NC}"
}

print_warning() {
    echo -e "${YELLOW}[!] $1${NC}"
}

print_error() {
    echo -e "${RED}[✗] $1${NC}"
}

print_info() {
    echo -e "${BLUE}[i] $1${NC}"
}

check_root() {
    if [[ $EUID -ne 0 ]]; then
        print_error "Acest script trebuie rulat ca ROOT sau cu SUDO"
        exit 1
    fi
}

#===============================================================================
# VERIFICARE CERINȚE PRELIMINARE
#===============================================================================

check_prerequisites() {
    print_header "Verificare cerințe preliminare"

    # Verifică versiunea Ubuntu
    if [[ -f /etc/os-release ]]; then
        . /etc/os-release
        if [[ "$ID" != "ubuntu" ]]; then
            print_warning "Acest script este optimizat pentru Ubuntu. Puteți continua, dar pot apărea probleme."
        fi
        print_info "Sistem detectat: $PRETTY_NAME"
    fi

    # Verifică dacă este Ubuntu 22.04 sau mai nou
    UBUNTU_VERSION=$(lsb_release -rs 2>/dev/null || echo "0")
    if (( $(echo "$UBUNTU_VERSION < 22.04" | bc -l 2>/dev/null || echo "0") )); then
        print_warning "Se recomandă Ubuntu 22.04 LTS sau mai nou"
    else
        print_success "Versiune Ubuntu compatibilă: $UBUNTU_VERSION"
    fi

    # Verifică memoria RAM
    TOTAL_MEM=$(free -m | awk '/^Mem:/{print $2}')
    if [[ $TOTAL_MEM -lt 900 ]]; then
        print_warning "Memorie RAM scăzută: ${TOTAL_MEM}MB. Se recomandă minimum 1GB."
    else
        print_success "Memorie RAM: ${TOTAL_MEM}MB"
    fi

    # Verifică spațiul pe disc
    TOTAL_DISK=$(df -BG / | awk 'NR==2 {print $4}' | tr -d 'G')
    if [[ $TOTAL_DISK -lt 15 ]]; then
        print_warning "Spațiu disc scăzut: ${TOTAL_DISK}GB. Se recomandă minimum 20GB."
    else
        print_success "Spațiu disc disponibil: ${TOTAL_DISK}GB"
    fi
}

#===============================================================================
# CONFIGURARE HOSTNAME
#===============================================================================

configure_hostname() {
    print_header "Configurare hostname"

    # Setează hostname-ul
    hostnamectl set-hostname "$MAIL_HOSTNAME"
    print_success "Hostname setat: $MAIL_HOSTNAME"

    # Actualizează /etc/hosts
    if ! grep -q "$MAIL_HOSTNAME" /etc/hosts; then
        echo "$SERVER_IP    $MAIL_HOSTNAME    mail" >> /etc/hosts
        print_success "Adăugat intrare în /etc/hosts"
    fi

    # Verifică
    CURRENT_HOSTNAME=$(hostname -f)
    print_info "Hostname curent: $CURRENT_HOSTNAME"
}

#===============================================================================
# CONFIGURARE FIREWALL
#===============================================================================

configure_firewall() {
    print_header "Configurare firewall (UFW)"

    # Instalează UFW dacă nu există
    if ! command -v ufw &> /dev/null; then
        apt install -y ufw
    fi

    # Configurează regulile
    ufw default deny incoming
    ufw default allow outgoing

    # Permite SSH
    ufw allow 22/tcp

    # Permite porturi email
    ufw allow 25/tcp    # SMTP
    ufw allow 587/tcp   # Submission
    ufw allow 465/tcp   # SMTPS
    ufw allow 993/tcp   # IMAPS
    ufw allow 995/tcp   # POP3S
    ufw allow 143/tcp   # IMAP
    ufw allow 110/tcp   # POP3
    ufw allow 4190/tcp  # ManageSieve

    # Activează firewall
    echo "y" | ufw enable

    print_success "Firewall configurat"
    ufw status verbose
}

#===============================================================================
# ACTUALIZARE SISTEM
#===============================================================================

update_system() {
    print_header "Actualizare sistem"

    apt update -y
    apt upgrade -y
    print_success "Sistem actualizat"
}

#===============================================================================
# INSTALARE POSTFIX
#===============================================================================

install_postfix() {
    print_header "Instalare Postfix"

    # Preconfigurare pentru instalare non-interactivă
    debconf-set-selections <<< "postfix postfix/mailname string $DOMAIN"
    debconf-set-selections <<< "postfix postfix/main_mailer_type string 'Internet Site'"

    # Instalare pachete
    apt install -y postfix postfix-mysql mailutils

    # Backup configurație originală
    cp /etc/postfix/main.cf /etc/postfix/main.cf.backup 2>/dev/null || true

    print_success "Postfix instalat"
}

#===============================================================================
# CONFIGURARE POSTFIX
#===============================================================================

configure_postfix() {
    print_header "Configurare Postfix"

    # Creează configurația principală
    cat > /etc/postfix/main.cf << EOF
# /etc/postfix/main.cf
# Configurare Postfix - Server Mail
# Generat automat

#=============================================================================
# SETĂRI DE BAZĂ
#=============================================================================
myhostname = $MAIL_HOSTNAME
mydomain = $DOMAIN
myorigin = \$mydomain
mydestination = \$myhostname, localhost.\$mydomain, localhost
inet_interfaces = all
inet_protocols = all
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

#=============================================================================
# SETĂRI TLS/SSL - SERVER SMTP
#=============================================================================
smtpd_tls_cert_file = /etc/letsencrypt/live/$MAIL_HOSTNAME/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/$MAIL_HOSTNAME/privkey.pem
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:\${data_directory}/smtpd_scache
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHA

#=============================================================================
# SETĂRI TLS/SSL - CLIENT SMTP
#=============================================================================
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_session_cache_database = btree:\${data_directory}/smtp_scache

#=============================================================================
# AUTENTIFICARE SASL
#=============================================================================
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
smtpd_tls_auth_only = yes

#=============================================================================
# RESTRICȚII ANTI-SPAM
#=============================================================================
smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination,
    reject_unknown_reverse_client_hostname,
    reject_invalid_helo_hostname,
    reject_non_fqdn_helo_hostname,
    reject_non_fqdn_sender,
    reject_non_fqdn_recipient,
    reject_unknown_sender_domain,
    reject_unknown_recipient_domain,
    reject_rbl_client zen.spamhaus.org,
    reject_rbl_client bl.spamcop.net,
    permit

smtpd_helo_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_invalid_helo_hostname,
    reject_non_fqdn_helo_hostname

smtpd_helo_required = yes

#=============================================================================
# CUTII POȘTALE VIRTUALE
#=============================================================================
virtual_mailbox_domains = $DOMAIN
virtual_mailbox_base = /var/mail/vhosts
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_minimum_uid = 1000
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = lmtp:unix:private/dovecot-lmtp

#=============================================================================
# LIMITE MESAJE
#=============================================================================
message_size_limit = 52428800
mailbox_size_limit = 0
smtpd_recipient_limit = 100

#=============================================================================
# SETĂRI COADĂ
#=============================================================================
maximal_queue_lifetime = 5d
bounce_queue_lifetime = 5d
minimal_backoff_time = 300s
maximal_backoff_time = 4000s

#=============================================================================
# DIVERSE
#=============================================================================
smtpd_banner = \$myhostname ESMTP \$mail_name
disable_vrfy_command = yes
notify_classes = resource, software
compatibility_level = 3.6
EOF

    print_success "Configurație Postfix creată"
}

configure_postfix_master() {
    print_header "Configurare master.cf"

    # Backup
    cp /etc/postfix/master.cf /etc/postfix/master.cf.backup 2>/dev/null || true

    # Adaugă configurație pentru submission și smtps
    cat > /etc/postfix/master.cf << 'EOF'
# /etc/postfix/master.cf
# Configurare servicii Postfix

#=============================================================================
# SMTP STANDARD - Port 25
#=============================================================================
smtp      inet  n       -       y       -       -       smtpd

#=============================================================================
# SUBMISSION - Port 587
#=============================================================================
submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_tls_auth_only=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

#=============================================================================
# SMTPS - Port 465
#=============================================================================
smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_reject_unlisted_recipient=no
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

#=============================================================================
# SERVICII INTERNE
#=============================================================================
pickup    unix  n       -       y       60      1       pickup
cleanup   unix  n       -       y       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       y       1000?   1       tlsmgr
rewrite   unix  -       -       y       -       -       trivial-rewrite
bounce    unix  -       -       y       -       0       bounce
defer     unix  -       -       y       -       0       bounce
trace     unix  -       -       y       -       0       bounce
verify    unix  -       -       y       -       1       verify
flush     unix  n       -       y       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp
showq     unix  n       -       y       -       -       showq
error     unix  -       -       y       -       -       error
retry     unix  -       -       y       -       -       error
discard   unix  -       -       y       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       y       -       -       lmtp
anvil     unix  -       -       y       -       1       anvil
scache    unix  -       -       y       -       1       scache
postlog   unix-dgram n  -       n       -       1       postlogd
EOF

    print_success "Configurație master.cf creată"
}

#===============================================================================
# INSTALARE DOVECOT
#===============================================================================

install_dovecot() {
    print_header "Instalare Dovecot"

    apt install -y dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd dovecot-sieve dovecot-managesieved

    print_success "Dovecot instalat: $(dovecot --version)"
}

#===============================================================================
# CONFIGURARE DOVECOT
#===============================================================================

configure_dovecot_main() {
    print_header "Configurare Dovecot - main"

    cat > /etc/dovecot/dovecot.conf << EOF
# /etc/dovecot/dovecot.conf
# Configurare principală Dovecot

protocols = imap lmtp sieve
listen = *, ::

!include conf.d/*.conf
!include_try local.conf
EOF

    print_success "Configurație principală Dovecot creată"
}

configure_dovecot_auth() {
    print_header "Configurare Dovecot - autentificare"

    cat > /etc/dovecot/conf.d/10-auth.conf << EOF
# /etc/dovecot/conf.d/10-auth.conf

disable_plaintext_auth = yes
auth_mechanisms = plain login

!include auth-passwdfile.conf.ext
EOF

    # Creează configurația pentru passwd-file
    cat > /etc/dovecot/conf.d/auth-passwdfile.conf.ext << EOF
# /etc/dovecot/conf.d/auth-passwdfile.conf.ext

passdb {
  driver = passwd-file
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
}

userdb {
  driver = passwd-file
  args = username_format=%u /etc/dovecot/users
  default_fields = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
}
EOF

    print_success "Configurație autentificare Dovecot creată"
}

configure_dovecot_mail() {
    print_header "Configurare Dovecot - mail"

    cat > /etc/dovecot/conf.d/10-mail.conf << 'EOF'
# /etc/dovecot/conf.d/10-mail.conf

mail_location = maildir:/var/mail/vhosts/%d/%n/Maildir

namespace inbox {
  inbox = yes

  mailbox Drafts {
    special_use = \Drafts
    auto = subscribe
  }

  mailbox Junk {
    special_use = \Junk
    auto = subscribe
  }

  mailbox Sent {
    special_use = \Sent
    auto = subscribe
  }

  mailbox Trash {
    special_use = \Trash
    auto = subscribe
  }

  mailbox Archive {
    special_use = \Archive
    auto = subscribe
  }
}

mail_uid = vmail
mail_gid = vmail
mail_privileged_group = vmail
first_valid_uid = 1000
first_valid_gid = 1000
EOF

    print_success "Configurație mail Dovecot creată"
}

configure_dovecot_ssl() {
    print_header "Configurare Dovecot - SSL"

    cat > /etc/dovecot/conf.d/10-ssl.conf << EOF
# /etc/dovecot/conf.d/10-ssl.conf

ssl = required
ssl_cert = </etc/letsencrypt/live/$MAIL_HOSTNAME/fullchain.pem
ssl_key = </etc/letsencrypt/live/$MAIL_HOSTNAME/privkey.pem
ssl_prefer_server_ciphers = yes
ssl_min_protocol = TLSv1.2
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl_dh = </etc/dovecot/dh.pem
EOF

    # Generează DH parameters
    print_info "Generare DH parameters (poate dura câteva minute)..."
    openssl dhparam -out /etc/dovecot/dh.pem 4096 2>/dev/null || {
        print_warning "Generare DH parameters eșuată, folosim 2048 bits"
        openssl dhparam -out /etc/dovecot/dh.pem 2048
    }

    print_success "Configurație SSL Dovecot creată"
}

configure_dovecot_master() {
    print_header "Configurare Dovecot - master"

    cat > /etc/dovecot/conf.d/10-master.conf << 'EOF'
# /etc/dovecot/conf.d/10-master.conf

service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}

service imap {
  process_limit = 1024
}

service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0600
    user = postfix
    group = postfix
  }
  process_min_avail = 5
}

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
    group = vmail
  }
  user = dovecot
}

service auth-worker {
  user = vmail
}

service stats {
  unix_listener stats-reader {
    user = vmail
    group = vmail
    mode = 0660
  }
  unix_listener stats-writer {
    user = vmail
    group = vmail
    mode = 0660
  }
}
EOF

    print_success "Configurație master Dovecot creată"
}

configure_dovecot_lda() {
    print_header "Configurare Dovecot - LDA"

    cat > /etc/dovecot/conf.d/15-lda.conf << EOF
# /etc/dovecot/conf.d/15-lda.conf

postmaster_address = postmaster@$DOMAIN
hostname = $MAIL_HOSTNAME

protocol lda {
  mail_plugins = \$mail_plugins sieve
}

protocol lmtp {
  mail_plugins = \$mail_plugins sieve
}
EOF

    print_success "Configurație LDA Dovecot creată"
}

configure_dovecot_sieve() {
    print_header "Configurare Dovecot - Sieve"

    cat > /etc/dovecot/conf.d/90-sieve.conf << 'EOF'
# /etc/dovecot/conf.d/90-sieve.conf

plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve
  sieve_dir = ~/sieve
  sieve_before = /var/mail/vhosts/sieve/before.d/
  sieve_after = /var/mail/vhosts/sieve/after.d/
  sieve_default = /var/mail/vhosts/sieve/default.sieve
  sieve_extensions = +fileinto +reject +envelope +variables +imap4flags +notify +include +body +relational +regex +subaddress +copy +mailbox +date +index +duplicate +vacation +vacation-seconds
  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
  sieve_vacation_min_period = 1d
  sieve_vacation_max_period = 60d
  sieve_vacation_default_period = 7d
  sieve_max_script_size = 512K
  sieve_max_actions = 32
  sieve_max_redirects = 4
}

service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
}

service managesieve {
  process_limit = 256
}

protocol sieve {
  managesieve_logout_format = bytes=%i/%o
}
EOF

    print_success "Configurație Sieve creată"
}

#===============================================================================
# CERTIFICATE SSL LET'S ENCRYPT
#===============================================================================

install_certbot() {
    print_header "Instalare Certbot"

    apt install -y certbot

    print_success "Certbot instalat"
}

obtain_certificate() {
    print_header "Obținere certificate SSL"

    # Oprește serviciile care folosesc portul 80
    systemctl stop apache2 2>/dev/null || true
    systemctl stop nginx 2>/dev/null || true

    # Încearcă să obțină certificatul
    if certbot certonly --standalone \
        -d "$MAIL_HOSTNAME" \
        --email "$ADMIN_EMAIL" \
        --agree-tos \
        --non-interactive; then
        print_success "Certificat SSL obținut pentru $MAIL_HOSTNAME"
    else
        print_error "Nu s-a putut obține certificatul SSL"
        print_warning "Verificați că:"
        print_warning "  1. Domeniul $MAIL_HOSTNAME pointează către IP-ul $SERVER_IP"
        print_warning "  2. Portul 80 este accesibil din internet"
        print_warning "  3. Nu există alte servicii pe portul 80"
        exit 1
    fi

    # Creează script pentru renew
    mkdir -p /etc/letsencrypt/renewal-hooks/deploy
    cat > /etc/letsencrypt/renewal-hooks/deploy/mail-services.sh << 'EOF'
#!/bin/bash
systemctl restart postfix
systemctl restart dovecot
echo "$(date): Certificate renewed and mail services restarted" >> /var/log/letsencrypt-renewal.log
EOF
    chmod +x /etc/letsencrypt/renewal-hooks/deploy/mail-services.sh

    print_success "Auto-renewal configurat"
}

#===============================================================================
# CREARE UTILIZATOR VMAIL
#===============================================================================

create_vmail_user() {
    print_header "Creare utilizator vmail"

    # Creează grupul și utilizatorul
    if ! id -u vmail &>/dev/null; then
        groupadd -g 5000 vmail
        useradd -g vmail -u 5000 -d /var/mail/vhosts -s /usr/sbin/nologin -m vmail
        print_success "Utilizator vmail creat"
    else
        print_info "Utilizatorul vmail există deja"
    fi

    # Creează structura de directoare
    mkdir -p /var/mail/vhosts/$DOMAIN
    chown -R vmail:vmail /var/mail/vhosts
    chmod -R 770 /var/mail/vhosts

    # Creează directoare pentru Sieve
    mkdir -p /var/mail/vhosts/sieve/{before.d,after.d}
    chown -R vmail:vmail /var/mail/vhosts/sieve

    print_success "Structura de directoare creată"
}

#===============================================================================
# CONFIGURARE CUTII POȘTALE VIRTUALE
#===============================================================================

configure_virtual_mailboxes() {
    print_header "Configurare cutii poștale virtuale"

    # Creează fișierul vmailbox
    cat > /etc/postfix/vmailbox << EOF
# /etc/postfix/vmailbox
# Mapare adrese email la cutii poștale
$DEFAULT_EMAIL_USER@$DOMAIN    $DOMAIN/$DEFAULT_EMAIL_USER/Maildir/
EOF

    # Creează fișierul virtual (alias-uri)
    cat > /etc/postfix/virtual << EOF
# /etc/postfix/virtual
# Alias-uri de sistem
postmaster@$DOMAIN    $DEFAULT_EMAIL_USER@$DOMAIN
abuse@$DOMAIN         $DEFAULT_EMAIL_USER@$DOMAIN
webmaster@$DOMAIN     $DEFAULT_EMAIL_USER@$DOMAIN
hostmaster@$DOMAIN    $DEFAULT_EMAIL_USER@$DOMAIN
EOF

    # Generează hash-urile
    postmap /etc/postfix/vmailbox
    postmap /etc/postfix/virtual

    print_success "Cutii poștale virtuale configurate"
}

#===============================================================================
# CREARE UTILIZATORI EMAIL
#===============================================================================

create_email_users() {
    print_header "Creare utilizatori email"

    # Generează hash-ul parolei
    PASSWORD_HASH=$(doveadm pw -s SHA512-CRYPT -p "$DEFAULT_EMAIL_PASSWORD" 2>/dev/null)

    if [[ -z "$PASSWORD_HASH" ]]; then
        print_error "Nu s-a putut genera hash-ul parolei"
        exit 1
    fi

    # Creează fișierul users
    touch /etc/dovecot/users
    chmod 600 /etc/dovecot/users

    # Adaugă utilizatorul implicit
    echo "${DEFAULT_EMAIL_USER}@${DOMAIN}:${PASSWORD_HASH}:5000:5000::/var/mail/vhosts/${DOMAIN}/${DEFAULT_EMAIL_USER}::" > /etc/dovecot/users

    # Creează directorul Maildir pentru utilizator
    mkdir -p /var/mail/vhosts/$DOMAIN/$DEFAULT_EMAIL_USER/Maildir
    chown -R vmail:vmail /var/mail/vhosts/$DOMAIN/$DEFAULT_EMAIL_USER

    print_success "Utilizator email creat: $DEFAULT_EMAIL_USER@$DOMAIN"
    print_warning "Parola: $DEFAULT_EMAIL_PASSWORD"
    print_warning "SCHIMBAȚI PAROLA IMEDIAT DUPĂ INSTALARE!"
}

#===============================================================================
# CREARE SCRIPT URI UTILE
#===============================================================================

create_helper_scripts() {
    print_header "Creare script-uri utile"

    # Script pentru adăugare utilizatori
    cat > /usr/local/bin/mail-adduser << 'SCRIPT'
#!/bin/bash
# Script pentru adăugare utilizatori email
set -e

if [ -z "$1" ]; then
    echo "Folosire: mail-adduser user@domain.com"
    exit 1
fi

EMAIL="$1"
DOMAIN=$(echo "$EMAIL" | cut -d@ -f2)
USER=$(echo "$EMAIL" | cut -d@ -f1)
VMAIL_BASE="/var/mail/vhosts"

# Validare format email
if ! echo "$EMAIL" | grep -qE "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$"; then
    echo "Eroare: Format email invalid"
    exit 1
fi

# Verifică dacă utilizatorul există deja
if grep -q "^${EMAIL}:" /etc/dovecot/users 2>/dev/null; then
    echo "Eroare: Utilizatorul $EMAIL există deja"
    exit 1
fi

# Generează hash parolă
echo "Introduceți parola pentru $EMAIL:"
PASSWORD_HASH=$(doveadm pw -s SHA512-CRYPT)

# Creează director utilizator
mkdir -p "${VMAIL_BASE}/${DOMAIN}/${USER}/Maildir"
chown -R vmail:vmail "${VMAIL_BASE}/${DOMAIN}/${USER}"

# Adaugă utilizator în Dovecot
echo "${EMAIL}:${PASSWORD_HASH}:5000:5000::${VMAIL_BASE}/${DOMAIN}/${USER}::" >> /etc/dovecot/users

# Adaugă în Postfix vmailbox
echo "${EMAIL}    ${DOMAIN}/${USER}/Maildir/" >> /etc/postfix/vmailbox

# Regenerare hash Postfix
postmap /etc/postfix/vmailbox

echo "Utilizator $EMAIL creat cu succes!"
SCRIPT

    chmod +x /usr/local/bin/mail-adduser

    # Script pentru listare utilizatori
    cat > /usr/local/bin/mail-listusers << 'SCRIPT'
#!/bin/bash
echo "Utilizatori email configurați:"
echo "=============================="
cut -d: -f1 /etc/dovecot/users 2>/dev/null || echo "Niciun utilizator configurat"
SCRIPT

    chmod +x /usr/local/bin/mail-listusers

    print_success "Script-uri utile create:"
    print_info "  - mail-adduser user@domain.com  # Adaugă utilizator nou"
    print_info "  - mail-listusers                # Listează utilizatorii"
}

#===============================================================================
# CONFIGURARE FAIL2BAN
#===============================================================================

configure_fail2ban() {
    print_header "Configurare Fail2ban"

    apt install -y fail2ban

    cat > /etc/fail2ban/jail.local << EOF
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5

[postfix]
enabled = true
port = smtp,465,submission
filter = postfix
logpath = /var/log/mail.log
maxretry = 5
bantime = 3600

[postfix-sasl]
enabled = true
port = smtp,465,submission
filter = postfix-sasl
logpath = /var/log/mail.log
maxretry = 3
bantime = 7200

[dovecot]
enabled = true
port = pop3,pop3s,imap,imaps,submission,465,sieve
filter = dovecot
logpath = /var/log/mail.log
maxretry = 5
bantime = 3600
EOF

    systemctl restart fail2ban
    systemctl enable fail2ban

    print_success "Fail2ban configurat"
}

#===============================================================================
# CREARE SIEVE DEFAULT
#===============================================================================

create_default_sieve() {
    print_header "Creare script Sieve default"

    cat > /var/mail/vhosts/sieve/default.sieve << 'EOF'
# Default sieve script
require ["fileinto", "mailbox"];

# Mută spam în Junk
if header :contains "X-Spam-Flag" "YES" {
    fileinto :create "Junk";
    stop;
}

keep;
EOF

    # Compilează script-ul
    sievec /var/mail/vhosts/sieve/default.sieve
    chown -R vmail:vmail /var/mail/vhosts/sieve

    print_success "Script Sieve default creat"
}

#===============================================================================
# PORNIRE SERVICII
#===============================================================================

start_services() {
    print_header "Pornire servicii"

    # Repornește serviciile
    systemctl restart postfix
    systemctl restart dovecot

    # Activează la boot
    systemctl enable postfix
    systemctl enable dovecot

    # Verifică statusul
    systemctl status postfix --no-pager
    systemctl status dovecot --no-pager

    print_success "Servicii pornite"
}

#===============================================================================
# TESTARE
#===============================================================================

test_configuration() {
    print_header "Testare configurație"

    # Verifică porturile
    print_info "Verificare porturi deschise:"
    ss -tlnp | grep -E "(25|587|465|993|995|143|110|4190)" || true

    # Verifică autentificarea
    print_info "Verificare configurație Postfix:"
    postfix check 2>&1 || true

    print_info "Verificare configurație Dovecot:"
    doveconf -n | head -20 || true

    print_success "Testare completă"
}

#===============================================================================
# AFIȘARE INFORMAȚII FINALE
#===============================================================================

show_final_info() {
    print_header "INSTALARE COMPLETĂ!"

    echo ""
    echo -e "${GREEN}============================================${NC}"
    echo -e "${GREEN}    SERVER MAIL INSTALAT CU SUCCES!${NC}"
    echo -e "${GREEN}============================================${NC}"
    echo ""
    echo -e "${BLUE}Informații server:${NC}"
    echo "  Hostname: $MAIL_HOSTNAME"
    echo "  Domeniu:  $DOMAIN"
    echo ""
    echo -e "${BLUE}Utilizator implicit:${NC}"
    echo "  Email:    $DEFAULT_EMAIL_USER@$DOMAIN"
    echo "  Parola:   $DEFAULT_EMAIL_PASSWORD"
    echo ""
    echo -e "${YELLOW}ACȚIUNI NECESARE:${NC}"
    echo "  1. SCHIMBAȚI parola utilizatorului implicit!"
    echo "  2. Configurați înregistrările DNS:"
    echo "     - A Record:    $MAIL_HOSTNAME -> $SERVER_IP"
    echo "     - MX Record:   $DOMAIN -> $MAIL_HOSTNAME"
    echo "     - SPF Record:  v=spf1 mx ip4:$SERVER_IP -all"
    echo "     - DMARC:       v=DMARC1; p=quarantine"
    echo "  3. Configurați Reverse DNS (PTR) la provider-ul dvs."
    echo "  4. Testați livrabilitatea la mail-tester.com"
    echo ""
    echo -e "${BLUE}Porturi utilizate:${NC}"
    echo "  SMTP:        25, 587, 465"
    echo "  IMAP:        143, 993"
    echo "  POP3:        110, 995"
    echo "  ManageSieve: 4190"
    echo ""
    echo -e "${BLUE}Comenzi utile:${NC}"
    echo "  mail-adduser user@domain.com   # Adaugă utilizator nou"
    echo "  mail-listusers                 # Listează utilizatorii"
    echo "  postqueue -p                   # Vezi coada de email-uri"
    echo "  tail -f /var/log/mail.log      # Monitorizare log-uri"
    echo ""
    echo -e "${BLUE}Fișiere de configurare:${NC}"
    echo "  Postfix:  /etc/postfix/main.cf, /etc/postfix/master.cf"
    echo "  Dovecot:  /etc/dovecot/dovecot.conf, /etc/dovecot/conf.d/"
    echo "  Users:    /etc/dovecot/users"
    echo ""
    echo -e "${GREEN}============================================${NC}"
}

#===============================================================================
# MAIN
#===============================================================================

main() {
    clear
    print_header "INSTALARE SERVER MAIL - POSTFIX + DOVECOT"
    echo ""

    check_root
    check_prerequisites

    echo ""
    read -p "Continuați instalarea? (y/n): " -n 1 -r
    echo ""
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        echo "Instalare anulată."
        exit 0
    fi

    # Execută pașii de instalare
    update_system
    configure_hostname
    configure_firewall
    install_postfix
    install_dovecot
    install_certbot

    # Certificate SSL
    echo ""
    read -p "Doriți să obțineți certificate SSL Let's Encrypt acum? (y/n): " -n 1 -r
    echo ""
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        obtain_certificate
    else
        print_warning "Veți avea nevoie de certificate SSL pentru funcționarea corectă!"
        print_info "Rulați manual: certbot certonly --standalone -d $MAIL_HOSTNAME"
    fi

    # Configurare Postfix
    configure_postfix
    configure_postfix_master

    # Configurare Dovecot
    configure_dovecot_main
    configure_dovecot_auth
    configure_dovecot_mail
    configure_dovecot_ssl
    configure_dovecot_master
    configure_dovecot_lda
    configure_dovecot_sieve

    # Configurare utilizatori și cutii poștale
    create_vmail_user
    configure_virtual_mailboxes
    create_email_users
    create_default_sieve

    # Script-uri utile și securitate
    create_helper_scripts
    configure_fail2ban

    # Pornește serviciile
    start_services
    test_configuration

    # Afișează informațiile finale
    show_final_info
}

# Rulează script-ul
main "$@"