#!/usr/bin/env bash
# audit-mail-env.sh — read-only mail environment probe.
#
# Runs ON the target host, delivered via the ssh chokepoints:
#   tests/remote.sh prox-file|vm-file   OR   remote-dns.sh <host>-file
# Collects: installed MTAs, postfix relay config, alternative relay configs
# (ssmtp/msmtp/nullmailer/dma), identity (mailname/aliases/forward),
# smtp listeners, and recent relay evidence from mail logs.
# Makes NO changes. Redacts auth material. Output is "KEY value" text.
set -u

as_root() {
  if [ "$(id -u)" -eq 0 ]; then
    "$@"
  else
    if sudo -n "$@" 2>/dev/null; then
      :
    else
      "$@"
    fi
  fi
}

echo "== host $(hostname -f 2>/dev/null || hostname) | $(date '+%F %T %Z')"

echo "== mtas"
for b in postconf postfix sendmail exim4 msmtp ssmtp nullmailer-send dma; do
  p="$(command -v "$b" 2>/dev/null)"
  if [ -n "${p}" ]; then
    echo "bin ${b}: ${p}"
  fi
done

echo "== postfix"
if command -v postconf >/dev/null 2>&1; then
  for k in myhostname myorigin relayhost mydestination inet_interfaces; do
    v="$(as_root postconf -h "$k" 2>/dev/null)"
    echo "postconf ${k} = ${v:-<empty>}"
  done
else
  echo "postconf: not installed"
  grep -Hs '^relayhost' /etc/postfix/main.cf 2>/dev/null
fi

echo "== alt-relay"
if [ -r /etc/ssmtp/ssmtp.conf ]; then
  sed -n -E 's/^(AuthPass|AuthUser)=.*/\1=<redacted>/p; s/^(mailhub|hostname|rewriteDomain|UseSTARTTLS|UseTLS)=/\1=/p' /etc/ssmtp/ssmtp.conf | sed 's/^/ssmtp /'
fi
for f in /etc/msmtp.conf /root/.msmtprc "${HOME}/.msmtprc"; do
  if [ -r "$f" ]; then
    grep -Es '^(account|host|port|from|auth |tls|syslog)' "$f" | sed "s|^|msmtp ${f} |"
  fi
done
for f in /etc/nullmailer/remotes /var/spool/nullmailer/remotes; do
  if [ -r "$f" ]; then
    sed -E 's/ --[^ ]*//g' "$f" | sed 's/^/nullmailer-remote /'
  fi
done
if [ -r /etc/dma/dma.conf ]; then
  grep -Es '^(SMARTHOST|PORT|MAILNAME)' /etc/dma/dma.conf | sed 's/^/dma /'
fi

echo "== identity"
if [ -r /etc/mailname ]; then
  echo "mailname: $(cat /etc/mailname)"
fi
grep -hsE '^root:' /etc/aliases /etc/mail/aliases 2>/dev/null | sed 's/^/alias /'
if [ -r /root/.forward ]; then
  echo "root-forward: $(head -1 /root/.forward)"
fi

echo "== listeners-25-465-587"
as_root ss -ltn 2>/dev/null | awk 'NR==1 || $4 ~ /:(25|465|587|2525)$/'

echo "== recent-relay-evidence"
as_root sh -c 'grep -h "relay=" /var/log/mail.log /var/log/mail.log.1 /var/log/maillog 2>/dev/null | tail -n 6'

echo "== done $(hostname -f 2>/dev/null || hostname)"