# 检查 Swap 状态
sudo swapon --show
# 低于 8GB RAM，设置 2*RAM 的 Swap
# 4096 * 1MB = 4GB
sudo dd if=/dev/zero of=/swapfile bs=1M count=4096
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
sudo vim /etc/fstab
# 添加下面一行
/swapfile none swap sw 0 0
# 检查 fstab 挂载
sudo mount -a
sudo swapon --show
free -h

sudo apt install ufw
# 确保 IPv6 支持
sudo sed -i 's/IPV6=no/IPV6=yes/' /etc/default/ufw
# 设置默认规则
sudo ufw default deny incoming
sudo ufw default allow outgoing
# SSH 安全端口
sudo ufw allow 22122/tcp comment 'SSH'
# 80 用于 ACME 证书挑战和 MTA-STS 刷新
sudo ufw allow 80/tcp comment 'HTTP / ACME'
# 443 用于 JMAP, Admin 后台, MTA-STS 策略查询
sudo ufw allow 443/tcp comment 'HTTPS / JMAP'
# SMTP 入站（必须保留，用于接收外域邮件）
sudo ufw allow 25/tcp comment 'Mail Inbound'
# SMTPS (Implicit TLS) 客户端发信
sudo ufw allow 465/tcp comment 'SMTPS'
# IMAPS (Implicit TLS) 客户端收信
sudo ufw allow 993/tcp comment 'IMAPS'
# 临时放行8080,安装的时候需要
sudo ufw allow 8080/tcp comment 'Temporary Init Server'
# 启用防火墙
sudo ufw enable
# 重载防火墙配置
sudo ufw reload
# 查看规则
sudo ufw status numbered

sudo hostnamectl set-hostname mail.via.moe

# 下载脚本
curl --proto '=https' --tlsv1.2 -sSf https://get.stalw.art/install.sh -o install.sh
sudo sh ./install.sh
# 执行安装脚本
sudo sh ./install.sh

⏳ Downloading stalwart for x86_64-unknown-linux-gnu...
Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure
Warning: Not enforcing TLS v1.2, this is potentially less secure
stalwart
🖥️  Creating 'stalwart' account...
✅ Configuration file written to /opt/stalwart/etc/config.toml
🔑 Your administrator account is 'admin' with password 'XvdNDhax3Q'.
🔐 Setting permissions...
🚀 Starting service...
Created symlink '/etc/systemd/system/multi-user.target.wants/stalwart.service' → '/etc/systemd/system/stalwart.service'.
🎉 Installation complete! Continue the setup at http://127.0.0.1:8080/login

# 切换到 root 用户
sudo -i
curl https://get.acme.sh | sh -s email=<联系邮箱>
# 重载 Shell 设置
source ~/.bashrc

# 新建 acmedotsh 项目
gcloud projects create acmedotsh
# 切换到该项目
gcloud config set project acmedotsh
# 创建密钥
gcloud publicca external-account-keys create
# 输出 y 确认开启 Public Certificate Authority API
gcloud publicca external-account-keys create
API [publicca.googleapis.com] not enabled on project [acmedotsh]. Would you like to enable and retry (this will take a few minutes)? (y/N)?  y

Enabling service [publicca.googleapis.com] on project [acmedotsh]...
Operation "operations/acat.p2-105847362940-f728394a-bcde-4123-af90-1234567890ab" finished successfully.
Created an external account key
[b64MacKey: <eab-hmac-key>
keyId: <eab-kid>]

acme.sh --register-account -m [email protected] \
  --server google \
  --eab-kid "<eab-kid>" \
  --eab-hmac-key "<eab-hmac-key>"

export CF_Token="<Cloudflare 用户令牌>"
export CF_Zone_ID="<Cloudflare 区域 ID>"
# 申请 ECC 证书
acme.sh --issue --dns dns_cf \
  -d mail.via.moe \
  --server google \
  --keylength ec-256

sudo mkdir -p /etc/nginx/cert
sudo chmod 700 /etc/nginx/cert
# 安装到指定目录并设置权限
acme.sh --install-cert -d mail.via.moe --ecc \
  --key-file       /etc/nginx/cert/mail.via.moe.key \
  --fullchain-file /etc/nginx/cert/mail.via.moe.pem \
  --reloadcmd     "systemctl reload nginx && chown root:stalwart /etc/nginx/cert/mail.via.moe.* && chmod 640 /etc/nginx/cert/mail.via.moe.key"

# 按照 ${file:文件路径}% 的格式把前面 acme.sh 安装证书的路径写进去保存即可。
证书公钥路径：%{file:/etc/nginx/cert/mail.via.moe.pem}%
证书私钥路径：%{file:/etc/nginx/cert/mail.via.moe.key}%

sudo vim /opt/stalwart/etc/config.toml

tail -f /opt/stalwart/logs/stalwart.log.*

sudo vim /etc/nginx/nginx.conf

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    ...# 这里省略了
}
# 仅需添加下面一行
include  /etc/nginx/stream.conf.d/*.conf;

sudo vim /etc/nginx/stream.conf.d/mail.via.moe.conf

stream {
    log_format proxy '$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time "$upstream_addr"';

    access_log /var/log/nginx/mail.via.moe.access.log proxy;
    error_log  /var/log/nginx/mail.via.moe.error.log;

    server {
        listen 25;
        listen [::]:25;
        proxy_pass 127.0.0.1:10025;
        proxy_protocol on;
    }

    server {
        listen 465;
        listen [::]:465;
        proxy_pass 127.0.0.1:10465;
        proxy_protocol on;
    }

    server {
        listen 993;
        listen [::]:993;
        proxy_pass 127.0.0.1:10993;
        proxy_protocol on;
    }

    server {
        listen 443;
        listen [::]:443;
        proxy_pass 127.0.0.1:10443;
        proxy_protocol on;
    }
}

sudo nginx -t
sudo nginx -s reload

sudo ufw delete allow 8080/tcp
sudo ufw reload