Bonnes pratiques¶

#!/bin/bash
# backup-stalwart.sh — Sauvegarde quotidienne

BACKUP_DIR="/backup/stalwart"
DATE=$(date +%Y%m%d)
RETENTION_DAYS=30

# 1. Export des donnees Stalwart
curl -s -X GET "http://localhost:8080/api/store/export" \
  -H "Authorization: Bearer ${STALWART_ADMIN_TOKEN}" \
  -o "${BACKUP_DIR}/stalwart-${DATE}.tar"

# 2. Chiffrer la sauvegarde
age -r "${BACKUP_PUBLIC_KEY}" \
  -o "${BACKUP_DIR}/stalwart-${DATE}.tar.age" \
  "${BACKUP_DIR}/stalwart-${DATE}.tar"
rm "${BACKUP_DIR}/stalwart-${DATE}.tar"

# 3. Supprimer les anciennes sauvegardes
find "${BACKUP_DIR}" -name "*.age" -mtime +${RETENTION_DAYS} -delete

# 4. Verifier la taille (alerte si trop petite = sauvegarde incomplete)
SIZE=$(stat -f%z "${BACKUP_DIR}/stalwart-${DATE}.tar.age" 2>/dev/null \
  || stat --format=%s "${BACKUP_DIR}/stalwart-${DATE}.tar.age")
if [ "$SIZE" -lt 1048576 ]; then
    echo "ALERTE: Sauvegarde anormalement petite (${SIZE} octets)" >&2
    exit 1
fi

echo "Sauvegarde terminee: stalwart-${DATE}.tar.age (${SIZE} octets)"

# Restaurer sur une instance de test (jamais en production directement)
podman run -d --name stalwart-restore \
  -v /tmp/restore-data:/opt/stalwart-mail/data:Z \
  -p 18080:8080 \
  docker.io/stalwartlabs/stalwart-mail:latest

# Importer la sauvegarde
age -d -i /path/to/private-key \
  -o /tmp/stalwart-restore.tar \
  /backup/stalwart/stalwart-20260416.tar.age

curl -X POST "http://localhost:18080/api/store/import" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" \
  -F "file=@/tmp/stalwart-restore.tar"

# Verifier que les boites sont accessibles
curl -s http://localhost:18080/api/principal | jq '.items | length'

# Verifier si l'IP est blacklistee
# Utiliser MX Toolbox ou un script de verification
for rbl in \
    zen.spamhaus.org \
    bl.spamcop.net \
    b.barracudacentral.org \
    dnsbl.sorbs.net; do
    result=$(dig +short "10.113.0.203.${rbl}" 2>/dev/null)
    if [ -n "$result" ]; then
        echo "BLACKLISTE sur ${rbl}: ${result}"
    else
        echo "OK: ${rbl}"
    fi
done

# Apprendre un email comme ham (non-spam)
curl -X POST "http://localhost:8080/api/spam/train" \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"class": "ham", "message": "<raw-email-base64>"}'

# Apprendre un email comme spam
curl -X POST "http://localhost:8080/api/spam/train" \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"class": "spam", "message": "<raw-email-base64>"}'

# 1. Migration incrementale (pendant la coexistence)
imapsync \
  --host1 old-server.company.io --user1 alice --password1 "old-pwd" \
  --host2 mail.company.io --user2 alice@company.io --password2 "new-pwd" \
  --ssl1 --ssl2 \
  --syncinternaldates \
  --exclude "Spam|Trash"

# 2. Migration finale (apres basculement DNS)
imapsync \
  --host1 old-server.company.io --user1 alice --password1 "old-pwd" \
  --host2 mail.company.io --user2 alice@company.io --password2 "new-pwd" \
  --ssl1 --ssl2 \
  --syncinternaldates \
  --delete2duplicates

# Tester la connexion TLS SMTP
openssl s_client -connect mail.company.io:465 -quiet

# Tester STARTTLS SMTP
openssl s_client -connect mail.company.io:25 -starttls smtp -quiet

# Tester IMAPS
openssl s_client -connect mail.company.io:993 -quiet

# Verifier le certificat
echo | openssl s_client -connect mail.company.io:465 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer

# Verifier que DKIM signe correctement
# Envoyer un email de test et examiner les en-tetes
swaks --to test@gmail.com \
      --from alice@company.io \
      --server mail.company.io:587 \
      --auth LOGIN --tls

# Dans les en-tetes du mail recu, verifier :
# Authentication-Results: ...
#   dkim=pass header.d=company.io header.s=default
#   spf=pass
#   dmarc=pass

# Lister les emails en queue
curl -s http://localhost:8080/api/queue/list \
  -H "Authorization: Bearer <admin-token>" | jq '.items | length'

# Voir les details d'un message en queue
curl -s http://localhost:8080/api/queue/list \
  -H "Authorization: Bearer <admin-token>" | jq '.items[0]'

# Forcer la relivraison
curl -X POST http://localhost:8080/api/queue/retry \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"ids": ["<message-id>"]}'

# Purger les messages bloques depuis plus de 7 jours
curl -X DELETE "http://localhost:8080/api/queue/purge?older-than=7d" \
  -H "Authorization: Bearer <admin-token>"

# Test complet de la configuration email d'un domaine
# MX, SPF, DKIM, DMARC, reverse DNS, TLS, blacklists
dig company.io MX +short
dig company.io TXT +short
dig default._domainkey.company.io TXT +short
dig _dmarc.company.io TXT +short
dig -x $(dig mail.company.io A +short) +short

# Tester l'envoi SMTP avec details verbeux
swaks --to test@example.com \
      --from alice@company.io \
      --server mail.company.io:587 \
      --auth LOGIN --tls \
      --auth-user alice@company.io \
      -tlsc -tls-verify \
      --header "Subject: Test diagnostique"

# Verifier les logs Stalwart pour les erreurs recentes
podman logs --since 1h stalwart-mail 2>&1 | grep -iE "error|warn|fail"