Extend selective SRS management and add installer tests

activate-srs.sh

@@ -191,6 +191,45 @@ postsrsd_srs_domain() {
 }
 
 
+srs_alias_tool() {
+   local action="$1"
+   python3 "$SRS_ALIAS_HELPER" "$action" \
+      --main-cf "$POSTFIX_MAIN_CF" \
+      --domain "$_SRS_DOMAIN" \
+      --reverse-map "socketmap:inet:${SRS_REVERSE_SOCKET_HOST}:${SRS_REVERSE_SOCKET_PORT}:reverse"
+}
+
+# Upgrade an already running instance without touching binaries/systemd units.
+# A new snapshot is taken on every attempt and restored on any failure.
+upgrade_existing_srs_aliases() {
+   local action="$1" folder snapshot
+   folder="/root/postfix-srs-alias-upgrade-${backup_date}"
+   snapshot="${folder}/main.cf"
+   mkdir -m 0700 "$folder" || fatal "Cannot create alias upgrade backup directory."
+   cp -a "$POSTFIX_MAIN_CF" "$snapshot" || fatal "Cannot snapshot main.cf for alias upgrade."
+   echononl "Track incoming SRS bounce aliases (${action}).."
+   if srs_alias_tool "$action" > "$log_file" 2>&1 &&
+      postfix check >> "$log_file" 2>&1 &&
+      [[ "$(srs_alias_tool status 2>>"$log_file")" == 'managed' ]] &&
+      { [[ "$action" == 'adopt' ]] || systemctl reload "$POSTFIX_SERVICE" >> "$log_file" 2>&1; }
+   then
+      echo_ok
+      info "SRS inbound alias settings now managed. Backup: ${snapshot}"
+      clean_up 0
+   fi
+   echo_failed
+   error "Alias upgrade failed: $(cat "$log_file")"
+   # A pure adoption changes only a comment. Never reload Postfix on
+   # either the success or rollback path for that operation.
+   if cp -a "$snapshot" "$POSTFIX_MAIN_CF" &&
+      postfix check > "$log_file" 2>&1 &&
+      { [[ "$action" == 'adopt' ]] || systemctl reload "$POSTFIX_SERVICE" >> "$log_file" 2>&1; }
+   then
+      fatal "Alias upgrade failed; previous main.cf restored successfully."
+   fi
+   fatal "Alias upgrade failed; automatic restore incomplete. Manual review: ${snapshot}"
+}
+
 state_main_cf_matches() {
    local parameter="$1"
    local was_set="$2"
@@ -747,6 +786,8 @@ check_required_commands \
 
 load_srs_config
 load_srs_state
+[[ -f "$SRS_ALIAS_HELPER" && ! -L "$SRS_ALIAS_HELPER" ]] ||
+   fatal "Missing regular SRS alias helper: ${SRS_ALIAS_HELPER}"
 
 smtp_pre_value=""
 amavis_pre_value=""
@@ -1255,9 +1296,31 @@ blank_line
 # Handle detected state
 # ----------
 
+# A running v1 installation can be upgraded without reinstalling PostSRSd.
+srs_alias_status="$(srs_alias_tool status 2>"$log_file")" ||
+   fatal "Unsafe virtual alias configuration: $(cat "$log_file")"
+
 if [[ "$srs_state" == "enabled" ]]; then
-   info "Selective SRS is already enabled. Nothing to do."
-   clean_up 0
+   case "$srs_alias_status" in
+      managed)
+         info "Selective SRS with inbound bounce reception is already enabled. Nothing to do."
+         clean_up 0
+         ;;
+      absent|legacy)
+         warn "SRS is enabled but bounce alias ownership is not tracked (${srs_alias_status})."
+         info "Only virtual alias parameters will be updated; PostSRSd binaries and services remain untouched."
+         if ! ask_yes_no "Upgrade incoming SRS alias management" "no"; then
+            info "Upgrade cancelled without changes."
+            clean_up 0
+         fi
+         if [[ "$srs_alias_status" == 'legacy' ]]; then
+            upgrade_existing_srs_aliases adopt
+         else
+            upgrade_existing_srs_aliases add
+         fi
+         ;;
+      *) fatal "Unexpected SRS alias status: ${srs_alias_status}" ;;
+   esac
 fi
 
 if [[ "$srs_state" == "inconsistent" ]]; then
@@ -1268,6 +1331,8 @@ fi
 if ! $activation_ready ; then
    fatal "Selective SRS is disabled, but the installation is incomplete. Activation is not possible."
 fi
+[[ "$srs_alias_status" == 'absent' ]] ||
+   fatal "SRS disabled but alias entries are not absent. Refusing activation."
 
 
 # ----------
@@ -1362,6 +1427,14 @@ else
    fatal_with_activation_rollback "Could not add managed SRS block to '${POSTFIX_MASTER_CF}'."
 fi
 
+echononl "Add incoming SRS virtual alias domain and reverse map.."
+if srs_alias_tool add > "$log_file" 2>&1 ; then
+   echo_ok
+else
+   echo_failed
+   fatal_with_activation_rollback "Could not add tracked virtual alias items: $(cat "$log_file")"
+fi
+
 echononl "Set port 25 receive_override_options.."
 if update_master_service_option \
       smtp \
@@ -1527,6 +1600,14 @@ else
    verification_ok=false
 fi
 
+echononl "Verify incoming SRS alias ownership.."
+if [[ "$(srs_alias_tool status 2>"$log_file")" == 'managed' ]]; then
+   echo_ok
+else
+   echo_failed
+   verification_ok=false
+fi
+
 echononl "Verify 'srs-forward' pipe service.."
 if master_srs_forward_present ; then
    echo_ok