#!/bin/bash
# Fix inbound mail to @gisportal.id from cPanel/NAT path (rspamd SPOOFED_UNAUTH)
set -euo pipefail

echo "== Add forwarding hosts (trusted inbound relays) =="
docker exec mailcowdockerized-mysql-mailcow-1 bash -lc '
mysql mailcow -uroot -p"$MYSQL_ROOT_PASSWORD" -e "
INSERT IGNORE INTO forwarding_hosts (host, source, filter_spam) VALUES
  (\"10.100.1.1\", \"NAT gateway inbound\", 1),
  (\"103.229.73.23\", \"cPanel sc138\", 1),
  (\"sc138.idcloudhosting.cloud\", \"cPanel SMTP hostname\", 1),
  (\"spfilter-2.idcloudhosting.com\", \"cPanel spam filter\", 1);
SELECT host, source FROM forwarding_hosts;
"
'

docker exec mailcowdockerized-postfix-mailcow-1 postfix reload
docker exec mailcowdockerized-rspamd-mailcow-1 rspamadm reload 2>/dev/null || true
echo "DONE forwarding hosts"