{% extends "base.html" %}
{% load i18n %}
{% block title %}{% translate "Exim Settings" %} - Eenos{% endblock %}
{% block content %}
    <div class="eenos-page-header flex-wrap">
        <div>
            <h1 class="eenos-page-title">{% translate "Exim Settings" %}</h1>
            <div class="eenos-page-subtitle">{% translate "Manage mail policy, sender verification, reputation checks, malware scanning, and TLS security." %}</div>
        </div>
        <div class="d-grid col-12 col-sm-auto d-sm-flex gap-2">
            <a href="{% url 'exim_rbl' %}" class="btn btn-outline-secondary btn-sm text-nowrap"><i data-lucide="shield-ban"></i>{% translate "Manage RBL Servers" %}</a>
            <button type="button"
                    class="btn btn-outline-warning btn-sm text-nowrap exim-command"
                    data-action="restart"><i data-lucide="refresh-cw"></i>{% translate "Restart Exim" %}</button>
        </div>
    </div>
    <nav class="eenos-breadcrumb" aria-label="{% translate 'Breadcrumb' %}">
        <a href="{% url 'dashboard' %}">{% translate "Dashboard" %}</a>
        <span class="eenos-breadcrumb-separator" aria-hidden="true">
            <i data-lucide="chevron-right"></i>
        </span>
        <span>{% translate "Mail Services" %}</span>
        <span class="eenos-breadcrumb-separator" aria-hidden="true">
            <i data-lucide="chevron-right"></i>
        </span>
        <a href="{% url 'exim_settings' %}">Exim</a>
        <span class="eenos-breadcrumb-separator" aria-hidden="true">
            <i data-lucide="chevron-right"></i>
        </span>
        <span class="eenos-breadcrumb-current" aria-current="page">{% translate "Settings" %}</span>
    </nav>
    {% include "includes/form_alerts.html" %}
    <form method="post"
          id="eximSettingsForm"
          class="eenos-form"
          data-parsley-validate>
        {% csrf_token %}
        <input type="hidden" name="savesettings" value="yes">
        <div class="eenos-card mb-4">
            <div class="mb-3">
                <div class="eenos-panel-title">{% translate "Mail Policy" %}</div>
                <div class="eenos-panel-subtitle">{% translate "Set the core SMTP checks and message authentication policy." %}</div>
            </div>
            <div class="row g-3">
                {% include "includes/exim_switch.html" with field_name="dictionary_attack" field_value=settings.dictionary_attack field_label=_("Dictionary Attack Protection") field_help=_("Detect repeated delivery attempts against unknown recipients.") %}
                {% include "includes/exim_switch.html" with field_name="primary_hostname_bl" field_value=settings.primary_hostname_bl field_label=_("Primary Hostname Blocklist Check") field_help=_("Reject connections when this server hostname is listed by supported blocklists.") %}
                {% include "includes/exim_switch.html" with field_name="spam_scan_secondarymx" field_value=settings.spam_scan_secondarymx field_label=_("Scan Secondary MX Mail") field_help=_("Apply spam scanning to messages accepted as a secondary MX.") %}
                {% include "includes/exim_switch.html" with field_name="smtp_ratelimit" field_value=settings.smtp_ratelimit field_label=_("SMTP Rate Limiting") field_help=_("Limit abusive SMTP connection and delivery rates.") %}
                {% include "includes/exim_switch.html" with field_name="slow_fail_block" field_value=settings.slow_fail_block field_label=_("Slow Failure Blocking") field_help=_("Temporarily block hosts that generate repeated SMTP failures.") %}
                {% include "includes/exim_switch.html" with field_name="spf" field_value=settings.spf field_label=_("SPF Verification") field_help=_("Verify the sending host against the domain SPF policy.") %}
                {% include "includes/exim_switch.html" with field_name="dkim" field_value=settings.dkim field_label=_("DKIM Verification") field_help=_("Verify DomainKeys Identified Mail signatures.") %}
                {% include "includes/exim_switch.html" with field_name="dkim_failure_reject" field_value=settings.dkim_failure_reject field_label=_("Reject DKIM Failures") field_help=_("Reject messages whose DKIM signature explicitly fails verification.") %}
                {% include "includes/exim_switch.html" with field_name="ipv6" field_value=settings.ipv6 field_label=_("IPv6 Support") field_help=_("Allow Exim to listen and deliver mail over IPv6.") %}
                {% include "includes/exim_switch.html" with field_name="send_on_dedicated_ips" field_value=settings.send_on_dedicated_ips field_label=_("Send Through Dedicated IPs") field_help=_("Use account-specific dedicated addresses for outbound delivery.") %}
            </div>
        </div>
        <div class="eenos-card mb-4">
            <div class="mb-3">
                <div class="eenos-panel-title">{% translate "HELO and Sender Verification" %}</div>
                <div class="eenos-panel-subtitle">{% translate "Validate SMTP identity and envelope sender information before accepting mail." %}</div>
            </div>
            <div class="row g-3">
                {% include "includes/exim_switch.html" with field_name="requirehelo" field_value=settings.requirehelo field_label=_("Require HELO/EHLO") field_help=_("Require remote SMTP clients to identify themselves.") %}
                {% include "includes/exim_switch.html" with field_name="requirehelo_noforge" field_value=settings.requirehelo_noforge field_label=_("Reject Forged HELO") field_help=_("Reject clients that claim an invalid or forged local identity.") %}
                {% include "includes/exim_switch.html" with field_name="requirehelo_nolocal" field_value=settings.requirehelo_nolocal field_label=_("Reject Local HELO Names") field_help=_("Prevent remote clients from presenting a local server identity.") %}
                {% include "includes/exim_switch.html" with field_name="requirehelo_rfc" field_value=settings.requirehelo_rfc field_label=_("Enforce RFC HELO Syntax") field_help=_("Require HELO and EHLO values to follow RFC syntax.") %}
                {% include "includes/exim_switch.html" with field_name="sender_rate" field_value=settings.sender_rate field_label=_("Sender Rate Control") field_help=_("Apply delivery-rate controls to envelope senders.") %}
                {% include "includes/exim_switch.html" with field_name="sender_verify" field_value=settings.sender_verify field_label=_("Verify Senders") field_help=_("Verify that envelope sender addresses can receive mail.") %}
                {% include "includes/exim_switch.html" with field_name="sender_verify_callout" field_value=settings.sender_verify_callout field_label=_("Sender Callout Verification") field_help=_("Contact the sender domain mail server during verification.") %}
                {% include "includes/exim_switch.html" with field_name="local_from_check" field_value=settings.local_from_check field_label=_("Validate Local From Addresses") field_help=_("Check locally submitted From addresses against hosted accounts.") %}
                {% include "includes/exim_switch.html" with field_name="spam_scanner_fail_delivery" field_value=settings.spam_scanner_fail_delivery field_label=_("Fail Closed on Scanner Errors") field_help=_("Defer delivery when the spam scanner cannot complete a scan.") %}
            </div>
        </div>
        <div class="eenos-card mb-4">
            <div class="mb-3">
                <div class="eenos-panel-title">{% translate "Delivery Limits and Filters" %}</div>
                <div class="eenos-panel-subtitle">{% translate "Configure listener ports, spam thresholds, recipient limits, and the server-wide system filter." %}</div>
            </div>
            <div class="row g-4">
                <div class="col-12 col-lg-6">
                    {% include "includes/exim_switch.html" with field_name="exim_on_additional_ports" field_value=settings.exim_on_additional_ports field_label=_("Additional SMTP Ports") field_help=_("Listen for SMTP connections on additional comma-separated ports.") detail_target="eximAdditionalPorts" %}
                    <div id="eximAdditionalPorts" class="row mt-2">
                        <div class="col-12 col-sm-8 col-xl-7">
                            <label for="exim_on_additional_ports_value" class="form-label">{% translate "Additional ports" %}</label>
                            <input type="text"
                                   class="form-control"
                                   id="exim_on_additional_ports_value"
                                   name="exim_on_additional_ports_value"
                                   value="{{ settings.exim_on_additional_ports_value|default:'26' }}"
                                   inputmode="numeric"
                                   pattern="^[0-9]+(\s*,\s*[0-9]+)*$"
                                   data-parsley-required-message="{% translate 'Enter at least one additional SMTP port.' %}"
                                   data-parsley-pattern-message="{% translate 'Enter one port or a comma-separated list of numeric ports.' %}"
                                   data-required-when-active="true">
                        </div>
                    </div>
                </div>
                <div class="col-12 col-lg-6">
                    {% include "includes/exim_switch.html" with field_name="ratelimit_spam_score" field_value=settings.ratelimit_spam_score field_label=_("Rate-limit Spam Score") field_help=_("Apply rate limits when a message reaches this spam score.") detail_target="rateLimitScore" %}
                    <div id="rateLimitScore" class="row mt-2">
                        <div class="col-12 col-sm-6 col-xl-5">
                            <label for="ratelimit_spam_score_value" class="form-label">{% translate "Spam score threshold" %}</label>
                            <input type="number"
                                   class="form-control"
                                   id="ratelimit_spam_score_value"
                                   name="ratelimit_spam_score_value"
                                   value="{{ settings.ratelimit_spam_score_value|default:'' }}"
                                   min="1"
                                   data-parsley-required-message="{% translate 'Enter the spam score threshold used for rate limiting.' %}"
                                   data-parsley-min-message="{% translate 'The spam score must be at least 1.' %}"
                                   data-required-when-active="true">
                        </div>
                    </div>
                </div>
                <div class="col-12 col-lg-6">
                    {% include "includes/exim_switch.html" with field_name="deny_rcpt_soft_limit" field_value=settings.deny_rcpt_soft_limit field_label=_("Recipient Soft Limit") field_help=_("Start applying additional checks after this recipient count.") detail_target="recipientSoftLimit" %}
                    <div id="recipientSoftLimit" class="row mt-2">
                        <div class="col-12 col-sm-6 col-xl-5">
                            <label for="deny_rcpt_soft_limit_value" class="form-label">{% translate "Maximum recipients (soft limit)" %}</label>
                            <input type="number"
                                   class="form-control"
                                   id="deny_rcpt_soft_limit_value"
                                   name="deny_rcpt_soft_limit_value"
                                   value="{{ settings.deny_rcpt_soft_limit_value|default:'' }}"
                                   min="1"
                                   max="100"
                                   data-parsley-required-message="{% translate 'Enter the maximum recipient soft limit.' %}"
                                   data-parsley-min-message="{% translate 'The recipient soft limit must be at least 1.' %}"
                                   data-parsley-max-message="{% translate 'The recipient soft limit cannot exceed 100.' %}"
                                   data-required-when-active="true">
                        </div>
                    </div>
                </div>
                <div class="col-12 col-lg-6">
                    {% include "includes/exim_switch.html" with field_name="deny_rcpt_hard_limit" field_value=settings.deny_rcpt_hard_limit field_label=_("Recipient Hard Limit") field_help=_("Reject additional recipients after this count is reached.") detail_target="recipientHardLimit" %}
                    <div id="recipientHardLimit" class="row mt-2">
                        <div class="col-12 col-sm-6 col-xl-5">
                            <label for="deny_rcpt_hard_limit_value" class="form-label">{% translate "Maximum recipients (hard limit)" %}</label>
                            <input type="number"
                                   class="form-control"
                                   id="deny_rcpt_hard_limit_value"
                                   name="deny_rcpt_hard_limit_value"
                                   value="{{ settings.deny_rcpt_hard_limit_value|default:'' }}"
                                   min="1"
                                   max="100"
                                   data-parsley-required-message="{% translate 'Enter the maximum recipient hard limit.' %}"
                                   data-parsley-min-message="{% translate 'The recipient hard limit must be at least 1.' %}"
                                   data-parsley-max-message="{% translate 'The recipient hard limit cannot exceed 100.' %}"
                                   data-required-when-active="true">
                        </div>
                    </div>
                </div>
                <div class="col-12 col-lg-6">
                    <label for="system_filter" class="form-label">{% translate "System Filter" %}</label>
                    <select class="form-select exim-conditional-select"
                            id="system_filter"
                            name="system_filter"
                            data-detail-target="#systemFilterPath"
                            data-active-value="custom"
                            data-parsley-required-message="{% translate 'Select a system filter option.' %}"
                            required>
                        <option value="off"
                                {% if settings.system_filter == 'off' %}selected{% endif %}>{% translate "Disabled" %}</option>
                        <option value="on" {% if settings.system_filter == 'on' %}selected{% endif %}>{% translate "Default filter" %}</option>
                        <option value="custom"
                                {% if settings.system_filter == 'custom' %}selected{% endif %}>{% translate "Custom filter" %}</option>
                    </select>
                    <div class="form-text">{% translate "The default server-wide filter is /etc/eenos_exim_system_filter." %}</div>
                    <div id="systemFilterPath" class="mt-3">
                        <label for="system_filter_value" class="form-label">{% translate "Custom filter path" %}</label>
                        <input type="text"
                               class="form-control font-monospace"
                               id="system_filter_value"
                               name="system_filter_value"
                               value="{{ settings.system_filter_value|default:'/etc/eenos_exim_system_filter' }}"
                               maxlength="128"
                               data-parsley-required-message="{% translate 'Enter the absolute path to the custom Exim system filter.' %}"
                               data-required-when-active="true">
                    </div>
                </div>
            </div>
        </div>
        <div class="eenos-card mb-4">
            <div class="d-flex flex-wrap justify-content-between align-items-start gap-3 mb-3">
                <div>
                    <div class="eenos-panel-title">{% translate "DNS Blocklists" %}</div>
                    <div class="eenos-panel-subtitle">{% translate "Control DNS-based reputation checks and the built-in RBL providers." %}</div>
                </div>
                <a href="{% url 'exim_rbl' %}" class="btn btn-outline-secondary btn-sm"><i data-lucide="list-filter"></i>{% translate "Custom RBL Servers" %}</a>
            </div>
            <div class="eenos-notice eenos-notice-warning mb-3">
                <div class="eenos-notice-icon">
                    <i data-lucide="triangle-alert"></i>
                </div>
                <div class="eenos-notice-content">
                    <div class="eenos-notice-title">{% translate "Use blocklists selectively" %}</div>
                    <div class="eenos-notice-text">{% translate "Enabling many RBL providers can increase DNS traffic and delay message acceptance." %}</div>
                </div>
            </div>
            <div class="row g-3">
                {% include "includes/exim_switch.html" with field_name="rbl" field_value=settings.rbl field_label=_("Enable RBL Checks") field_help=_("Check connecting IP addresses against configured DNS blocklists.") %}
                {% include "includes/exim_switch.html" with field_name="rbl_skip_neighbor" field_value=settings.rbl_skip_neighbor field_label=_("Exclude Server Network") field_help=_("Skip RBL checks for addresses in this server's subnet.") %}
                {% include "includes/exim_switch.html" with field_name="rbl_skip_greylist_common_provider" field_value=settings.rbl_skip_greylist_common_provider field_label=_("Skip Greylisting for Common Providers") field_help=_("Avoid greylisting recognized large mail providers.") %}
                {% include "includes/exim_switch.html" with field_name="rbl_skip_greylist_trusted_hosts" field_value=settings.rbl_skip_greylist_trusted_hosts field_label=_("Skip Greylisting for Trusted Hosts") field_help=_("Avoid greylisting hosts listed as trusted.") %}
                {% include "includes/exim_switch.html" with field_name="rbl_list_spamcop" field_value=settings.rbl_list_spamcop field_label="bl.spamcop.net" field_help=_("SpamCop RBL") %}
                {% include "includes/exim_switch.html" with field_name="rbl_list_spamhaus" field_value=settings.rbl_list_spamhaus field_label="zen.spamhaus.org" field_help=_("Spamhaus combined RBL") %}
                {% include "includes/exim_switch.html" with field_name="rbl_list_baracuda" field_value=settings.rbl_list_baracuda field_label="b.barracudacentral.org" field_help=_("Barracuda Reputation Block List") %}
                {% include "includes/exim_switch.html" with field_name="rbl_list_psbl" field_value=settings.rbl_list_psbl field_label="psbl.surriel.com" field_help=_("Passive Spam Block List") %}
            </div>
        </div>
        <div class="eenos-card mb-4">
            <div class="mb-3">
                <div class="eenos-panel-title">{% translate "Malware and Transport Security" %}</div>
                <div class="eenos-panel-subtitle">{% translate "Configure antivirus scanning, TLS advertisement, protocol options, and accepted cipher suites." %}</div>
            </div>
            <div class="row g-3 mb-4">
                {% include "includes/exim_switch.html" with field_name="clamav" field_value=settings.clamav field_label=_("ClamAV Virus Scanner") field_help=_("Scan incoming messages when ClamAV is available.") %}
                {% include "includes/exim_switch.html" with field_name="clamav_scan_auth" field_value=settings.clamav_scan_auth field_label=_("Scan Authenticated Mail") field_help=_("Scan messages submitted by authenticated senders.") %}
                {% include "includes/exim_switch.html" with field_name="clamav_scan_out" field_value=settings.clamav_scan_out field_label=_("Scan Outgoing Mail") field_help=_("Scan messages leaving hosted domains.") %}
                {% include "includes/exim_switch.html" with field_name="server_advertise_condition" field_value=settings.server_advertise_condition field_label=_("Advertise TLS") field_help=_("Advertise STARTTLS support to SMTP clients.") %}
            </div>
            <div class="row g-4">
                <div class="col-12 col-lg-6">
                    <label for="openssl_options" class="form-label">{% translate "OpenSSL Options" %}</label>
                    <select class="form-select exim-conditional-select"
                            id="openssl_options"
                            name="openssl_options"
                            data-detail-target="#opensslOptionsValue"
                            data-active-value="custom"
                            data-parsley-required-message="{% translate 'Select an OpenSSL configuration option.' %}"
                            required>
                        <option value="default"
                                {% if settings.openssl_options != 'custom' %}selected{% endif %}>{% translate "Use secure defaults" %}</option>
                        <option value="custom"
                                {% if settings.openssl_options == 'custom' %}selected{% endif %}>{% translate "Custom options" %}</option>
                    </select>
                    <div id="opensslOptionsValue" class="mt-3">
                        <label for="openssl_options_value" class="form-label">{% translate "Custom OpenSSL options" %}</label>
                        <input type="text"
                               class="form-control font-monospace"
                               id="openssl_options_value"
                               name="openssl_options_value"
                               value="{{ settings.openssl_options_value|default:'+no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1' }}"
                               maxlength="128"
                               data-parsley-required-message="{% translate 'Enter the custom OpenSSL protocol options.' %}"
                               data-required-when-active="true">
                    </div>
                </div>
                <div class="col-12">
                    <label for="tls_require_ciphers" class="form-label">{% translate "Required TLS Ciphers" %}</label>
                    <textarea class="form-control font-monospace"
                              id="tls_require_ciphers"
                              name="tls_require_ciphers"
                              rows="4"
                              maxlength="2048"
                              required
                              data-parsley-required-message="{% translate 'Enter at least one permitted TLS cipher suite.' %}">{% if settings.tls_require_ciphers %}{{ settings.tls_require_ciphers }}{% else %}ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384{% endif %}</textarea>
                </div>
            </div>
        </div>
        <div class="d-flex gap-2 mb-4">
            <button type="submit" class="btn btn-primary"><i data-lucide="save"></i>{% translate "Save Settings" %}</button>
            <button type="button"
                    class="btn btn-outline-secondary exim-command"
                    data-action="reset"><i data-lucide="rotate-ccw"></i>{% translate "Reset to Default" %}</button>
        </div>
    </form>
    <form method="post" id="eximCommandForm" class="d-none">
        {% csrf_token %}
        <input type="hidden" name="reset" id="eximReset" disabled><input type="hidden" name="restart" id="eximRestart" disabled>
    </form>
    <div class="modal fade"
         id="eximConfirmModal"
         tabindex="-1"
         aria-hidden="true">
        <div class="modal-dialog modal-dialog-centered">
            <div class="modal-content">
                <div class="modal-header">
                    <h2 class="modal-title fs-5" id="eximConfirmTitle"></h2>
                    <button type="button"
                            class="btn-close"
                            data-bs-dismiss="modal"
                            aria-label="{% translate 'Close' %}"></button>
                </div>
                <div class="modal-body">
                    <div class="eenos-notice eenos-notice-warning">
                        <div class="eenos-notice-icon">
                            <i data-lucide="triangle-alert"></i>
                        </div>
                        <div class="eenos-notice-content">
                            <div class="eenos-notice-title" id="eximConfirmHeading"></div>
                            <div class="eenos-notice-text" id="eximConfirmText"></div>
                        </div>
                    </div>
                </div>
                <div class="modal-footer">
                    <button type="button"
                            class="btn btn-outline-secondary"
                            data-bs-dismiss="modal">{% translate "Cancel" %}</button><button type="button" class="btn btn-warning" id="confirmEximCommand"></button>
                </div>
            </div>
        </div>
    </div>
{% endblock %}
{% block extra_js %}
    <script>
$(function(){
    function setSwitchState($switch){const enabled=$switch.prop('checked'),target=$switch.data('value-target'),detail=$switch.data('detail-target');$(target).val(enabled?'on':'off');if(detail){const $detail=$(detail);$detail.toggle(enabled);$detail.find('[data-required-when-active]').prop('required',enabled).prop('disabled',!enabled);}}
    $('.exim-setting-switch').each(function(){setSwitchState($(this));}).on('change',function(){setSwitchState($(this));});
    function setSelectState($select){const active=$select.val()===$select.data('active-value'),$detail=$($select.data('detail-target'));$detail.toggle(active);$detail.find('[data-required-when-active]').prop('required',active).prop('disabled',!active);}
    $('.exim-conditional-select').each(function(){setSelectState($(this));}).on('change',function(){setSelectState($(this));});
    const modal=bootstrap.Modal.getOrCreateInstance(document.getElementById('eximConfirmModal'));let command='';
    $('.exim-command').on('click',function(){command=$(this).data('action');const restart=command==='restart';$('#eximConfirmTitle').text(restart?"{% translate 'Restart Exim' %}":"{% translate 'Reset Exim Settings' %}");$('#eximConfirmHeading').text(restart?"{% translate 'Service interruption' %}":"{% translate 'Restore default configuration' %}");$('#eximConfirmText').text(restart?"{% translate 'Active mail connections may be interrupted briefly while Exim restarts.' %}":"{% translate 'Your current Exim configuration will be replaced by the server defaults.' %}");$('#confirmEximCommand').text(restart?"{% translate 'Restart Exim' %}":"{% translate 'Reset Settings' %}");modal.show();});
    $('#confirmEximCommand').on('click',function(){$('#eximReset,#eximRestart').prop('disabled',true);$(command==='restart'?'#eximRestart':'#eximReset').prop('disabled',false).val('yes');document.getElementById('eximCommandForm').submit();});
});
    </script>
{% endblock %}