---
# Configure MTA Front server for email relay and SMTP smuggling

- name: Update system packages
  apt:
    update_cache: yes
    upgrade: dist

- name: Install MTA packages
  apt:
    name:
      - postfix
      - postfix-pcre
      - dovecot-core
      - dovecot-imapd
      - opendkim
      - opendkim-tools
      - python3-pip
      - python3-venv
      - nginx
      - certbot
      - python3-certbot-nginx
      - dnsutils
      - swaks
      - telnet
    state: present

- name: Configure Postfix for MTA fronting
  template:
    src: "../templates/phishing/postfix-mta-front.j2"
    dest: /etc/postfix/main.cf
    backup: yes
  notify: restart postfix

- name: Configure Postfix master.cf for advanced relaying
  blockinfile:
    path: /etc/postfix/master.cf
    block: |
      # SMTP smuggling and advanced relay configurations
      587      inet  n       -       y       -       -       smtpd
        -o syslog_name=postfix/submission
        -o smtpd_tls_security_level=encrypt
        -o smtpd_sasl_auth_enable=yes
        -o smtpd_tls_wrappermode=no
        -o smtpd_client_restrictions=permit_sasl_authenticated,reject
        -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
        -o milter_macro_daemon_name=ORIGINATING
      
      # SMTP smuggling support
      cleanup   unix  n       -       y       -       0       cleanup
        -o header_checks=pcre:/etc/postfix/header_checks
        -o nested_header_checks=pcre:/etc/postfix/nested_header_checks

- name: Create SMTP smuggling header checks
  copy:
    dest: /etc/postfix/header_checks
    content: |
      # SMTP smuggling techniques
      /^Content-Transfer-Encoding:\s*7bit/i REPLACE Content-Transfer-Encoding: 8bit
      /^Content-Type:\s*text\/plain/i REPLACE Content-Type: text/html
    mode: '0644'
  notify: 
    - reload postfix
    - postmap header_checks

- name: Create nested header checks for advanced smuggling
  copy:
    dest: /etc/postfix/nested_header_checks
    content: |
      # Advanced SMTP smuggling patterns
      /^\s*<script/i IGNORE
      /^\s*<iframe/i IGNORE
    mode: '0644'
  notify:
    - reload postfix
    - postmap nested_header_checks

- name: Configure DKIM for domain reputation
  include_tasks: ../tasks/configure_mail.yml

- name: Create relay authentication
  copy:
    dest: /etc/postfix/sasl_passwd
    content: |
      {{ phishing_domain }} {{ smtp_relay_user }}:{{ smtp_relay_pass }}
    mode: '0600'
    owner: root
    group: root
  notify:
    - postmap sasl_passwd
    - restart postfix

- name: Configure transport maps for backend routing
  copy:
    dest: /etc/postfix/transport
    content: |
      {{ phishing_domain }}    smtp:[{{ gophish_ip }}]:25
      .{{ phishing_domain }}   smtp:[{{ gophish_ip }}]:25
    mode: '0644'
  notify:
    - postmap transport
    - restart postfix

- name: Install Python SMTP testing tools
  pip:
    name:
      - smtplib-extended
      - email-validator
      - faker
    state: present

- name: Create SMTP smuggling test script
  template:
    src: "../templates/phishing/smtp-smuggling-test.py.j2"
    dest: /root/Tools/smtp-smuggling-test.py
    mode: '0755'

- name: Create email reputation monitoring script
  template:
    src: "../templates/phishing/reputation-monitor.sh.j2"
    dest: /root/Tools/reputation-monitor.sh
    mode: '0755'

- name: Set up log monitoring for deliverability
  cron:
    name: "Monitor email deliverability"
    minute: "*/15"
    job: "/root/Tools/reputation-monitor.sh >> /var/log/reputation.log 2>&1"

handlers:
  - name: restart postfix
    service:
      name: postfix
      state: restarted

  - name: reload postfix
    service:
      name: postfix
      state: reloaded

  - name: postmap header_checks
    command: postmap /etc/postfix/header_checks

  - name: postmap nested_header_checks
    command: postmap /etc/postfix/nested_header_checks

  - name: postmap sasl_passwd
    command: postmap /etc/postfix/sasl_passwd

  - name: postmap transport
    command: postmap /etc/postfix/transport