#!/usr/bin/env bash
set -euo pipefail

# Postfix policy: reject mode (hard reject)
# Requires root privileges to update main.cf and reload Postfix.

run_as_root() {
  if [[ "${EUID}" -eq 0 ]]; then
    "$@"
  else
    sudo "$@"
  fi
}

echo "[INFO] Switching Postfix policy to REJECT mode (hard reject)..."

run_as_root postconf -e "smtpd_recipient_restrictions=check_sender_access regexp:/etc/postfix/sender_domain_policy.regexp, reject"
run_as_root postconf -e "sender_in_allowed_domain_gate=check_recipient_access regexp:/etc/postfix/allowed_rcpt_domains.regexp, check_sender_access hash:/etc/postfix/allowed_external_senders, reject"
run_as_root postconf -e "sender_outside_allowed_domain_gate=check_recipient_access hash:/etc/postfix/rcpt_access, check_recipient_access regexp:/etc/postfix/rcpt_domain_policy.regexp, reject"

run_as_root postfix check
run_as_root postfix reload

echo "[OK] Switched to REJECT mode."
run_as_root postconf -n | grep -E '^(smtpd_recipient_restrictions|sender_in_allowed_domain_gate|sender_outside_allowed_domain_gate) = '