#!/usr/bin/env bash
set -euo pipefail

CONF="/etc/postfix-policyd-spf-python/policyd-spf.conf"
BACKUP="${CONF}.$(date +%Y%m%d-%H%M%S).bak"

if [[ ! -f "$CONF" ]]; then
  echo "ERROR: Config not found: $CONF" >&2
  exit 1
fi

cp -a -- "$CONF" "$BACKUP"

ensure_kv() {
  local key="$1"
  local value="$2"

  # Prüfen ob es eine AKTIVE (nicht auskommentierte) Zeile gibt
  if grep -Eq "^[[:space:]]*${key}[[:space:]]*=" "$CONF"; then
    # Nur erste aktive Zeile ersetzen
    sed -ri "0,/^[[:space:]]*${key}[[:space:]]*=.*/s//${key} = ${value}/" "$CONF"
  else
    # Anfügen mit Leerzeile + Kommentar
    cat >>"$CONF" <<EOF

# --- Mailinglist-friendly SPF policy (added by script) ---
${key} = ${value}
EOF
  fi
}

ensure_kv "HELO_reject" "False"
ensure_kv "Mail_From_reject" "False"
ensure_kv "PermError_reject" "False"
ensure_kv "TempError_Defer" "True"

echo "Updated: $CONF"
echo "Backup : $BACKUP"

exit