From 23c972c9251f73a34e4afe1d3bccd572e98743ee Mon Sep 17 00:00:00 2001 From: "manuel.maier" Date: Tue, 13 Oct 2026 12:52:19 +0200 Subject: [PATCH] Dateien nach "/" hochladen --- Setup-SMTPGraphRelay.ps1 | 2155 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 2155 insertions(+) create mode 100644 Setup-SMTPGraphRelay.ps1 diff --git a/Setup-SMTPGraphRelay.ps1 b/Setup-SMTPGraphRelay.ps1 new file mode 100644 index 0000000..33b2b64 --- /dev/null +++ b/Setup-SMTPGraphRelay.ps1 @@ -0,0 +1,2155 @@ +#Requires -Version 5.1 +#Requires -RunAsAdministrator +<# +.SYNOPSIS + SMTPGraphRelay Installer / Repair / Update + +.DESCRIPTION + Einheitliches Verwaltungswerkzeug fuer SMTPGraphRelay. + + Modi: + 1 - Neuinstallation + 2 - Installation reparieren + 3 - Relay aktualisieren + 4 - Entra App & Berechtigungen pruefen + 5 - Zertifikat erneuern + 6 - Health Check ausfuehren + 7 - Deinstallieren + + WICHTIG: + Dieses Skript muss mit Windows PowerShell 5.1 ausgefuehrt werden. +#> + +[CmdletBinding()] +param( + [string]$InstallPath = "$env:ProgramFiles\SMTPGraphRelay" +) + +$ErrorActionPreference = "Stop" +[Console]::OutputEncoding = [System.Text.Encoding]::UTF8 + +$TaskName = "SMTPGraphRelay" +$AppDefaultName = "SMTPGraphRelay" +$RelayFileName = "SMTPGraphRelay.ps1" +$HealthFileName = "Test-SMTPGraphRelay.ps1" +$RenewFileName = "Renew-SMTPGraphRelayCertificate.ps1" +$ConfigFileName = "config.json" + +# Zentrales Gitea-Repository / Updatequelle +$RepoBaseUrl = "https://me-gitea.maieredv.cloud/MAIEREDV/SMTPGraphRelay" +$RemoteVersionUrl = "$RepoBaseUrl/raw/branch/main/version.json" +$RemoteArchiveUrl = "$RepoBaseUrl/archive/main.zip" +$RemoteRelayUrl = "$RepoBaseUrl/raw/branch/main/SMTPGraphRelay.ps1" + +# Dateien, die ein Update veraendern darf. +# config.json, Queue, Logs und sonstige lokale Daten sind absichtlich NICHT enthalten. +$ManagedReleaseFiles = @( + "SMTPGraphRelay.ps1", + "Test-SMTPGraphRelay.ps1", + "Test-SMTPGraphRelay-FailureModes.ps1", + "Renew-SMTPGraphRelayCertificate.ps1", + "Setup-SMTPGraphRelay.ps1", + "version.json", + "README.md" +) + +function Write-Title { + param([string]$Text) + Write-Host "" + Write-Host "==========================================================" -ForegroundColor Cyan + Write-Host " $Text" -ForegroundColor Cyan + Write-Host "==========================================================" -ForegroundColor Cyan + Write-Host "" +} + +function Write-Ok { param([string]$Text) Write-Host "[OK] $Text" -ForegroundColor Green } +function Write-Warn { param([string]$Text) Write-Host "[WARN] $Text" -ForegroundColor Yellow } +function Write-Fail { param([string]$Text) Write-Host "[FAIL] $Text" -ForegroundColor Red } +function Write-Info { param([string]$Text) Write-Host "[INFO] $Text" -ForegroundColor Cyan } + +function Read-Default { + param([string]$Prompt, [string]$Default) + $value = Read-Host "$Prompt [Standard: $Default]" + if ([string]::IsNullOrWhiteSpace($value)) { return $Default } + return $value +} + +function Confirm-Yes { + param([string]$Prompt) + $answer = Read-Host "$Prompt [j/N]" + return ($answer -match '^(?i)j|ja|y|yes$') +} + +function Assert-WindowsPowerShell51 { + if ($PSVersionTable.PSEdition -ne "Desktop" -or $PSVersionTable.PSVersion.Major -ne 5) { + Write-Title "FALSCHE POWERSHELL-VERSION" + Write-Fail "Dieses Tool muss mit Windows PowerShell 5.1 ausgefuehrt werden." + Write-Host "" + Write-Host "Aktuell erkannt:" + Write-Host " Edition: $($PSVersionTable.PSEdition)" + Write-Host " Version: $($PSVersionTable.PSVersion)" + Write-Host "" + Write-Host "Bitte starten:" + Write-Host " C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ForegroundColor Yellow + exit 1 + } + + Write-Ok "Windows PowerShell $($PSVersionTable.PSVersion) erkannt." +} + +function Ensure-PackageProvider { + try { + if (-not (Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue)) { + Write-Info "NuGet Package Provider wird installiert..." + Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null + } + } catch { + Write-Warn "NuGet Provider konnte nicht automatisch vorbereitet werden: $($_.Exception.Message)" + } +} + +function Ensure-Modules { + Ensure-PackageProvider + + $modules = @( + "Microsoft.Graph.Authentication", + "Microsoft.Graph.Applications" + ) + + $allUsersPath = Join-Path $env:ProgramFiles "WindowsPowerShell\Modules" + + foreach ($module in $modules) { + # Pruefe explizit, ob das Modul im AllUsers-Pfad liegt + $existing = Get-Module -ListAvailable -Name $module | + Where-Object { $_.ModuleBase -like "$allUsersPath*" } | + Sort-Object Version -Descending | + Select-Object -First 1 + + if (-not $existing) { + Write-Info "$module fehlt (System-weit). Installation fuer AllUsers..." + Install-Module $module -Scope AllUsers -Repository PSGallery -Force -AllowClobber + + $existing = Get-Module -ListAvailable -Name $module | + Where-Object { $_.ModuleBase -like "$allUsersPath*" } | + Sort-Object Version -Descending | + Select-Object -First 1 + } + + if (-not $existing) { + throw "Modul '$module' konnte nicht fuer AllUsers installiert/gefunden werden." + } + + Write-Ok "$module verfuegbar (System-weit)." + } +} + + +function New-RepoStagingArea { + Enable-Tls12 + + $root = Join-Path $env:TEMP ("SMTPGraphRelay-repo-{0}" -f [guid]::NewGuid().ToString("N")) + $archive = Join-Path $root "main.zip" + $extract = Join-Path $root "extract" + + New-Item -ItemType Directory -Path $extract -Force | Out-Null + + Write-Info "Lade aktuellen Stand aus Gitea..." + Write-Info "Quelle: $RemoteArchiveUrl" + + Invoke-WebRequest ` + -Uri $RemoteArchiveUrl ` + -OutFile $archive ` + -UseBasicParsing ` + -TimeoutSec 120 ` + -ErrorAction Stop + + if (-not (Test-Path -LiteralPath $archive)) { + throw "Gitea-Archiv wurde nicht heruntergeladen." + } + + Expand-Archive ` + -LiteralPath $archive ` + -DestinationPath $extract ` + -Force + + $releaseRoot = Find-ExtractedReleaseRoot -ExtractPath $extract + + # Pflichtdateien pruefen. + foreach ($required in @("SMTPGraphRelay.ps1", "version.json")) { + if (-not (Test-Path -LiteralPath (Join-Path $releaseRoot $required))) { + throw "Repository-Archiv ist unvollstaendig: '$required' fehlt." + } + } + + $versionInfo = Get-Content ` + -LiteralPath (Join-Path $releaseRoot "version.json") ` + -Raw ` + -Encoding UTF8 | ConvertFrom-Json + + if (-not $versionInfo.Version) { + throw "version.json aus dem Repository enthaelt keine Version." + } + + Write-Ok "Repository-Version $($versionInfo.Version) geladen." + + return [pscustomobject]@{ + TempRoot = $root + ReleaseRoot = $releaseRoot + VersionInfo = $versionInfo + } +} + +function Remove-RepoStagingArea { + param($Staging) + + if ($Staging -and $Staging.TempRoot) { + Remove-Item -LiteralPath $Staging.TempRoot -Recurse -Force -ErrorAction SilentlyContinue + } +} + +function Install-RepoProgramFiles { + param( + [Parameter(Mandatory)][string]$ReleaseRoot, + [Parameter(Mandatory)][string]$TargetPath + ) + + New-Item -ItemType Directory -Path $TargetPath -Force | Out-Null + + foreach ($name in $ManagedReleaseFiles) { + $source = Join-Path $ReleaseRoot $name + + if (Test-Path -LiteralPath $source) { + Copy-Item ` + -LiteralPath $source ` + -Destination (Join-Path $TargetPath $name) ` + -Force + + Write-Ok "Installiert: $name" + } + } +} + +function Get-SourceFile { + param([Parameter(Mandatory)][string]$Name) + + $candidate = Join-Path $PSScriptRoot $Name + + if (Test-Path -LiteralPath $candidate) { + return $candidate + } + + return $null +} + +function Get-PackageVersion { + $versionFile = Join-Path $PSScriptRoot "version.json" + + if (-not (Test-Path -LiteralPath $versionFile)) { + return $null + } + + try { + return Get-Content -LiteralPath $versionFile -Raw -Encoding UTF8 | ConvertFrom-Json + } + catch { + Write-Warn "version.json konnte nicht gelesen werden: $($_.Exception.Message)" + return $null + } +} + +function Get-InstalledVersion { + param([Parameter(Mandatory)][string]$TargetPath) + + $versionFile = Join-Path $TargetPath "version.json" + + if (-not (Test-Path -LiteralPath $versionFile)) { + return $null + } + + try { + return Get-Content -LiteralPath $versionFile -Raw -Encoding UTF8 | ConvertFrom-Json + } + catch { + return $null + } +} + +function Copy-ProgramFiles { + param( + [Parameter(Mandatory)][string]$TargetPath, + [switch]$RequireRelay + ) + + New-Item -ItemType Directory -Path $TargetPath -Force | Out-Null + + $files = @($RelayFileName, $HealthFileName, $RenewFileName, "version.json") + + foreach ($name in $files) { + $source = Get-SourceFile -Name $name + + if (-not $source) { + if ($name -eq $RelayFileName -and $RequireRelay) { + throw "Quelldatei '$name' wurde neben dem Installer nicht gefunden." + } + + Write-Warn "Optionale Quelldatei nicht gefunden: $name" + continue + } + + $destination = Join-Path $TargetPath $name + + # Nicht auf sich selbst kopieren. + if ([IO.Path]::GetFullPath($source) -ne [IO.Path]::GetFullPath($destination)) { + Copy-Item -LiteralPath $source -Destination $destination -Force + } + + Write-Ok "$name bereitgestellt." + } + + # Installer selbst ebenfalls in den Installationsordner legen. + try { + $selfDest = Join-Path $TargetPath "Setup-SMTPGraphRelay.ps1" + if ([IO.Path]::GetFullPath($PSCommandPath) -ne [IO.Path]::GetFullPath($selfDest)) { + Copy-Item -LiteralPath $PSCommandPath -Destination $selfDest -Force + } + } catch {} +} + +function Ensure-Directories { + param([Parameter(Mandatory)][string]$TargetPath) + + foreach ($dir in @( + $TargetPath, + (Join-Path $TargetPath "queue"), + (Join-Path $TargetPath "queue\incoming"), + (Join-Path $TargetPath "queue\pending"), + (Join-Path $TargetPath "queue\processing"), + (Join-Path $TargetPath "failed"), + (Join-Path $TargetPath "logs") + )) { + New-Item -ItemType Directory -Path $dir -Force | Out-Null + } + + Write-Ok "Programm-/Queue-/Log-Verzeichnisse vorhanden." +} + +function Get-RelayConfig { + param([Parameter(Mandatory)][string]$TargetPath) + + $path = Join-Path $TargetPath $ConfigFileName + if (-not (Test-Path -LiteralPath $path)) { + return $null + } + + try { + return Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json + } + catch { + throw "config.json konnte nicht gelesen werden: $($_.Exception.Message)" + } +} + +function Write-RelayConfig { + param( + [Parameter(Mandatory)]$Config, + [Parameter(Mandatory)][string]$TargetPath + ) + + $configPath = Join-Path $TargetPath $ConfigFileName + $tmp = "$configPath.tmp" + + $Config | ConvertTo-Json -Depth 20 | Set-Content -LiteralPath $tmp -Encoding UTF8 + Move-Item -LiteralPath $tmp -Destination $configPath -Force + + Write-Ok "config.json geschrieben." +} + +function Ensure-FirewallRule { + param([Parameter(Mandatory)][int]$Port) + + $prefix = "SMTPGraphRelay TCP " + Get-NetFirewallRule -ErrorAction SilentlyContinue | + Where-Object { $_.DisplayName -like "$prefix*" -and $_.DisplayName -ne "$prefix$Port" } | + Remove-NetFirewallRule -ErrorAction SilentlyContinue + + $ruleName = "$prefix$Port" + $existing = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue + + if (-not $existing) { + New-NetFirewallRule ` + -DisplayName $ruleName ` + -Direction Inbound ` + -Action Allow ` + -Protocol TCP ` + -LocalPort $Port ` + -Profile Any | Out-Null + + Write-Ok "Firewallregel '$ruleName' erstellt." + } + else { + Write-Ok "Firewallregel '$ruleName' vorhanden." + } +} + +function Ensure-ScheduledTask { + param([Parameter(Mandatory)][string]$TargetPath) + + $scriptPath = Join-Path $TargetPath $RelayFileName + if (-not (Test-Path -LiteralPath $scriptPath)) { + throw "Relay-Skript fehlt: $scriptPath" + } + + $psExe = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" + + $configPath = Join-Path $TargetPath $ConfigFileName + + $action = New-ScheduledTaskAction ` + -Execute $psExe ` + -Argument "-NoLogo -NoProfile -ExecutionPolicy Bypass -File `"$scriptPath`" -ConfigPath `"$configPath`"" ` + -WorkingDirectory $TargetPath + + $trigger = New-ScheduledTaskTrigger -AtStartup + $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest + $settings = New-ScheduledTaskSettingsSet ` + -AllowStartIfOnBatteries ` + -DontStopIfGoingOnBatteries ` + -StartWhenAvailable ` + -RestartCount 5 ` + -RestartInterval (New-TimeSpan -Minutes 1) ` + -ExecutionTimeLimit ([TimeSpan]::Zero) + + Register-ScheduledTask ` + -TaskName $TaskName ` + -Action $action ` + -Trigger $trigger ` + -Principal $principal ` + -Settings $settings ` + -Description "Lokaler SMTP Store-and-Forward Relay zu Microsoft 365 via Microsoft Graph" ` + -Force | Out-Null + + Write-Ok "Scheduled Task '$TaskName' eingerichtet." +} + +function Stop-RelayTask { + $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue + + if (-not $task -or $task.State -ne "Running") { + return + } + + $graceSeconds = 30 + + try { + $config = Get-RelayConfig -TargetPath $InstallPath + if ($config -and $config.Smtp.PSObject.Properties.Name -contains "GracefulShutdownSeconds") { + $configured = [int]$config.Smtp.GracefulShutdownSeconds + if ($configured -ge 5 -and $configured -le 300) { + $graceSeconds = $configured + } + } + } + catch {} + + $signalPath = Join-Path $InstallPath "shutdown.request" + + try { + [IO.File]::WriteAllText( + $signalPath, + ([DateTime]::UtcNow.ToString("o")), + (New-Object Text.UTF8Encoding($false)) + ) + + Write-Info "Graceful Shutdown angefordert. Warte auf Relay (max. $graceSeconds Sekunden)..." + + $deadline = (Get-Date).AddSeconds($graceSeconds + 5) + + while ((Get-Date) -lt $deadline) { + Start-Sleep -Milliseconds 250 + $current = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue + + if (-not $current -or $current.State -ne "Running") { + Write-Ok "Relay sauber beendet." + return + } + } + + Write-Warn "Graceful-Shutdown-Timeout erreicht. Task wird hart beendet." + Stop-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue + Start-Sleep -Milliseconds 750 + } + finally { + Remove-Item -LiteralPath $signalPath -Force -ErrorAction SilentlyContinue + } +} + +function Start-RelayTask { + $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue + if ($task) { + Remove-Item -LiteralPath (Join-Path $InstallPath "shutdown.request") -Force -ErrorAction SilentlyContinue + Start-ScheduledTask -TaskName $TaskName + Start-Sleep -Seconds 2 + Write-Ok "Scheduled Task gestartet." + } +} + +function Convert-CertToKeyCredential { + param([Parameter(Mandatory)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate) + + return @{ + Type = "AsymmetricX509Cert" + Usage = "Verify" + Key = $Certificate.GetRawCertData() + DisplayName = "SMTPGraphRelay Certificate" + StartDateTime = $Certificate.NotBefore.ToUniversalTime() + EndDateTime = $Certificate.NotAfter.ToUniversalTime() + } +} + +function New-RelayCertificate { + $subject = "CN=SMTPGraphRelay-$env:COMPUTERNAME" + + return New-SelfSignedCertificate ` + -Subject $subject ` + -CertStoreLocation "Cert:\LocalMachine\My" ` + -KeyAlgorithm RSA ` + -KeyLength 2048 ` + -HashAlgorithm SHA256 ` + -KeyExportPolicy NonExportable ` + -KeySpec Signature ` + -NotAfter (Get-Date).AddYears(2) +} + +function Connect-RelayGraphAdmin { + param([string]$TenantId) + + Import-Module Microsoft.Graph.Authentication -Force -ErrorAction Stop + Import-Module Microsoft.Graph.Applications -Force -ErrorAction Stop + + Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null + + $scopes = @("Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All") + + if ([string]::IsNullOrWhiteSpace($TenantId)) { + Connect-MgGraph -Scopes $scopes -NoWelcome + } + else { + Connect-MgGraph -TenantId $TenantId -Scopes $scopes -NoWelcome + } +} + +function Enable-Tls12 { + try { + [Net.ServicePointManager]::SecurityProtocol = ` + [Net.ServicePointManager]::SecurityProtocol -bor ` + [Net.SecurityProtocolType]::Tls12 + } catch {} +} + +function Get-RemoteVersion { + Enable-Tls12 + + $tempFile = Join-Path $env:TEMP ("SMTPGraphRelay-version-{0}.json" -f [guid]::NewGuid().ToString("N")) + + try { + Invoke-WebRequest ` + -Uri $RemoteVersionUrl ` + -OutFile $tempFile ` + -UseBasicParsing ` + -TimeoutSec 20 ` + -ErrorAction Stop + + $remote = Get-Content -LiteralPath $tempFile -Raw -Encoding UTF8 | ConvertFrom-Json + + if (-not $remote.Version) { + throw "Remote version.json enthaelt keine Version." + } + + return $remote + } + finally { + Remove-Item -LiteralPath $tempFile -Force -ErrorAction SilentlyContinue + } +} + +function Compare-RelayVersions { + param( + [Parameter(Mandatory)][string]$Installed, + [Parameter(Mandatory)][string]$Remote + ) + + try { + $installedVersion = [version]$Installed + $remoteVersion = [version]$Remote + + if ($remoteVersion -gt $installedVersion) { return 1 } + if ($remoteVersion -lt $installedVersion) { return -1 } + return 0 + } + catch { + throw "Versionsvergleich fehlgeschlagen: installiert='$Installed', remote='$Remote'." + } +} + +function Find-ExtractedReleaseRoot { + param( + [Parameter(Mandatory)][string]$ExtractPath + ) + + # Gitea kann beim Archiv einen zusaetzlichen Root-Ordner erzeugen. + # Daher suchen wir nach der Kombination aus Relay + version.json statt + # einen konkreten Archivordnernamen vorauszusetzen. + $relayFiles = Get-ChildItem ` + -LiteralPath $ExtractPath ` + -Recurse ` + -File ` + -Filter $RelayFileName ` + -ErrorAction SilentlyContinue + + foreach ($relay in $relayFiles) { + $candidate = $relay.Directory.FullName + if (Test-Path -LiteralPath (Join-Path $candidate "version.json")) { + return $candidate + } + } + + throw "Im heruntergeladenen Archiv wurde kein gueltiges SMTPGraphRelay-Release gefunden." +} + +function Backup-ManagedFiles { + param( + [Parameter(Mandatory)][string]$TargetPath + ) + + $backupRoot = Join-Path $TargetPath "backup" + $backupPath = Join-Path $backupRoot (Get-Date -Format "yyyyMMdd-HHmmss") + + New-Item -ItemType Directory -Path $backupPath -Force | Out-Null + + foreach ($name in $ManagedReleaseFiles) { + $source = Join-Path $TargetPath $name + + if (Test-Path -LiteralPath $source) { + Copy-Item -LiteralPath $source -Destination (Join-Path $backupPath $name) -Force + } + } + + return $backupPath +} + +function Restore-ManagedFiles { + param( + [Parameter(Mandatory)][string]$BackupPath, + [Parameter(Mandatory)][string]$TargetPath + ) + + foreach ($name in $ManagedReleaseFiles) { + $backupFile = Join-Path $BackupPath $name + $targetFile = Join-Path $TargetPath $name + + if (Test-Path -LiteralPath $backupFile) { + Copy-Item -LiteralPath $backupFile -Destination $targetFile -Force + } + } +} + +function Install-ExtractedRelease { + param( + [Parameter(Mandatory)][string]$ReleaseRoot, + [Parameter(Mandatory)][string]$TargetPath + ) + + $required = @( + "SMTPGraphRelay.ps1", + "version.json" + ) + + foreach ($name in $required) { + if (-not (Test-Path -LiteralPath (Join-Path $ReleaseRoot $name))) { + throw "Updatepaket ist unvollstaendig: '$name' fehlt." + } + } + + foreach ($name in $ManagedReleaseFiles) { + $source = Join-Path $ReleaseRoot $name + + if (Test-Path -LiteralPath $source) { + Copy-Item -LiteralPath $source -Destination (Join-Path $TargetPath $name) -Force + Write-Ok "Aktualisiert: $name" + } + } +} + +function Invoke-PostUpdateHealthCheck { + param( + [Parameter(Mandatory)][string]$TargetPath + ) + + $health = Join-Path $TargetPath $HealthFileName + + if (-not (Test-Path -LiteralPath $health)) { + Write-Warn "Health Check ist nicht installiert; automatische Nachpruefung entfaellt." + return 0 + } + + Write-Info "Starte Health Check nach dem Update..." + & $health -ConfigPath (Join-Path $TargetPath $ConfigFileName) + return $LASTEXITCODE +} + +function Install-New { + Write-Title "SMTPGraphRelay - Neuinstallation aus Gitea" + + if (Test-Path -LiteralPath (Join-Path $InstallPath $ConfigFileName)) { + Write-Warn "Es existiert bereits eine config.json unter:" + Write-Host " $InstallPath" + Write-Warn "Neuinstallation wuerde eine neue App/Zertifikat erzeugen." + + if (-not (Confirm-Yes "Trotzdem fortfahren?")) { + return + } + } + + $staging = $null + + try { + $staging = New-RepoStagingArea + + Ensure-Modules + Ensure-Directories -TargetPath $InstallPath + + # Nur Programmdateien aus Git uebernehmen. + Install-RepoProgramFiles ` + -ReleaseRoot $staging.ReleaseRoot ` + -TargetPath $InstallPath + + Write-Ok "Programmdateien aus Gitea installiert." + + $appName = Read-Default "Name der Entra App" $AppDefaultName + + $senderMailbox = Read-Host "Standard-Absenderpostfach (Fallback/Test, z.B. info@firma.de)" + while ([string]::IsNullOrWhiteSpace($senderMailbox) -or $senderMailbox -notmatch '^[^@\s]+@[^@\s]+\.[^@\s]+$') { + $senderMailbox = Read-Host "Bitte eine gueltige Mailadresse eingeben" + } + + $listenAddress = Read-Default "Lokale Listen-IP" "0.0.0.0" + $port = [int](Read-Default "SMTP-Port" "2525") + $allowedText = Read-Default "Erlaubte Netze, mit Komma getrennt" "127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" + $allowedNetworks = @($allowedText -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ }) + + Write-Info "Erzeuge Relay-Zertifikat..." + $cert = New-RelayCertificate + Write-Ok "Zertifikat erstellt: $($cert.Thumbprint)" + + Write-Info "Microsoft Graph Anmeldung erforderlich (Entra-Admin)." + Connect-RelayGraphAdmin + + try { + $tenantId = (Get-MgContext).TenantId + Write-Ok "Tenant: $tenantId" + + $appParams = @{ + DisplayName = $appName + SignInAudience = "AzureADMyOrg" + KeyCredentials = @( + (Convert-CertToKeyCredential -Certificate $cert) + ) + } + + $app = New-MgApplication -BodyParameter $appParams + Write-Ok "App Registration erstellt: $($app.AppId)" + + $sp = $null + for ($i = 0; $i -lt 10 -and -not $sp; $i++) { + try { + $sp = New-MgServicePrincipal -AppId $app.AppId + } + catch { + Start-Sleep -Seconds 2 + } + } + + if (-not $sp) { + throw "Entra Service Principal konnte nicht erstellt werden." + } + + Write-Ok "Entra Service Principal erstellt: $($sp.Id)" + + Write-Info "Erteile globale 'Mail.Send' Application Berechtigung (Tenant-weiter Versand)..." + $graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles" + $mailSendRole = $graphSp.AppRoles | Where-Object { $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1 + + if (-not $mailSendRole) { + throw "Microsoft Graph AppRole 'Mail.Send' konnte nicht gefunden werden." + } + + $existingAssig = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue | Where-Object { $_.AppRoleId -eq $mailSendRole.Id } + + if (-not $existingAssig) { + New-MgServicePrincipalAppRoleAssignment ` + -ServicePrincipalId $sp.Id ` + -PrincipalId $sp.Id ` + -ResourceId $graphSp.Id ` + -AppRoleId $mailSendRole.Id | Out-Null + Write-Ok "Globale 'Mail.Send' Application Role (ohne Einschraenkung) erfolgreich vergeben." + } else { + Write-Ok "Globale 'Mail.Send' Berechtigung war bereits vergeben." + } + + $config = [ordered]@{ + Smtp = [ordered]@{ + ListenAddress = $listenAddress + Port = $port + Hostname = $env:COMPUTERNAME + AllowedNetworks = $allowedNetworks + MaxMessageSizeMB = 25 + ClientTimeoutSeconds = 120 + MaxConcurrentClients = 20 + MaxRecipients = 50 + MaxMessagesPerConnection = 25 + RequireAuth = $false + AuthMaxFailures = 5 + AllowUnauthenticatedNetworks = @() + AuthUsers = @() + GracefulShutdownSeconds = 30 + } + Graph = [ordered]@{ + TenantId = $tenantId + ClientId = $app.AppId + CertificateThumbprint = $cert.Thumbprint + SenderMailbox = $senderMailbox + ForceSender = $false + CertificateWarningDays = 60 + CertificateCriticalDays = 14 + CertificateCheckHours = 12 + } + Queue = [ordered]@{ + PollSeconds = 10 + MaxRetries = 8 + RetryMinutes = @(1,5,15,30,60,120,240,480) + MaxPendingMessages = 5000 + MinFreeDiskSpaceMB = 1024 + } + Paths = [ordered]@{ + Queue = "queue" + Failed = "failed" + Logs = "logs" + } + Logging = [ordered]@{ + MaxFileSizeMB = 10 + RetentionDays = 30 + CleanupHours = 12 + } + Update = [ordered]@{ + Repository = $RepoBaseUrl + Branch = "main" + } + } + + Write-RelayConfig -Config $config -TargetPath $InstallPath + Ensure-FirewallRule -Port $port + Ensure-ScheduledTask -TargetPath $InstallPath + + Write-Info "Teste App-only Anmeldung mit Relay-Zertifikat..." + Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null + + Connect-MgGraph ` + -TenantId $tenantId ` + -ClientId $app.AppId ` + -Certificate $cert ` + -NoWelcome | Out-Null + + $ctx = Get-MgContext + if (-not $ctx -or $ctx.AuthType -ne "AppOnly") { + throw "App-only Anmeldung konnte nicht bestaetigt werden." + } + + Write-Ok "App-only Anmeldung funktioniert." + Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null + + Start-RelayTask + + $health = Join-Path $InstallPath $HealthFileName + if (Test-Path -LiteralPath $health) { + Write-Info "Starte abschliessenden Health Check..." + & $health -ConfigPath (Join-Path $InstallPath $ConfigFileName) + $healthExit = $LASTEXITCODE + + if ($healthExit -ge 2) { + Write-Warn "Installation abgeschlossen, Health Check meldet Fehler. Bitte Ausgabe pruefen." + } + } + + Write-Title "Neuinstallation abgeschlossen" + Write-Host "Version: $($staging.VersionInfo.Version)" + Write-Host "Installationspfad: $InstallPath" + Write-Host "Client ID: $($app.AppId)" + Write-Host "Tenant ID: $tenantId" + Write-Host "Default Sender: $senderMailbox" + Write-Host "SMTP: $listenAddress`:$port" + Write-Host "Das Relay darf im Namen JEDEN Benutzers senden (ForceSender = false)." -ForegroundColor Green + } + finally { + Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null + } + } + finally { + Remove-RepoStagingArea -Staging $staging + } +} + +function Repair-Installation { + Write-Title "SMTPGraphRelay - Repair aus Gitea" + + $config = Get-RelayConfig -TargetPath $InstallPath + if (-not $config) { + Write-Fail "Keine config.json gefunden. Repair ist nur fuer bestehende Installationen gedacht." + Write-Info "Bitte Neuinstallation verwenden." + return + } + + $staging = $null + $backupPath = $null + + try { + $staging = New-RepoStagingArea + + Ensure-Modules + Ensure-Directories -TargetPath $InstallPath + + $certPath = "Cert:\LocalMachine\My\$($config.Graph.CertificateThumbprint)" + $cert = Get-Item -LiteralPath $certPath -ErrorAction SilentlyContinue + + if (-not $cert) { + Write-Fail "Konfiguriertes Zertifikat fehlt: $($config.Graph.CertificateThumbprint)" + Write-Warn "Repair erzeugt absichtlich kein neues Credential. Nutze Zertifikat erneuern." + } + elseif (-not $cert.HasPrivateKey) { + Write-Fail "Konfiguriertes Zertifikat besitzt keinen privaten Schluessel." + } + else { + Write-Ok "Zertifikat vorhanden und besitzt Private Key." + } + + Write-Info "Sichere aktuelle Programmdateien..." + $backupPath = Backup-ManagedFiles -TargetPath $InstallPath + Write-Ok "Backup: $backupPath" + + Stop-RelayTask + + Install-RepoProgramFiles ` + -ReleaseRoot $staging.ReleaseRoot ` + -TargetPath $InstallPath + + Ensure-FirewallRule -Port ([int]$config.Smtp.Port) + Ensure-ScheduledTask -TargetPath $InstallPath + Start-RelayTask + + $healthExit = Invoke-PostUpdateHealthCheck -TargetPath $InstallPath + + if ($healthExit -ge 2) { + throw "Health Check nach Repair meldet FEHLER (ExitCode $healthExit)." + } + + if ($healthExit -eq 1) { + Write-Warn "Repair abgeschlossen, Health Check enthaelt Warnungen." + } + else { + Write-Ok "Repair Health Check erfolgreich." + } + + Write-Title "Repair abgeschlossen" + Write-Host "Installierte Repo-Version: $($staging.VersionInfo.Version)" + } + catch { + Write-Fail "Repair fehlgeschlagen: $($_.Exception.Message)" + + if ($backupPath -and (Test-Path -LiteralPath $backupPath)) { + Write-Warn "Stelle vorherige Programmdateien wieder her..." + + try { + Stop-RelayTask + Restore-ManagedFiles -BackupPath $backupPath -TargetPath $InstallPath + Ensure-ScheduledTask -TargetPath $InstallPath + Start-RelayTask + Write-Ok "Rollback nach Repair abgeschlossen." + } + catch { + Write-Fail "Repair-Rollback fehlgeschlagen: $($_.Exception.Message)" + } + } + } + finally { + Remove-RepoStagingArea -Staging $staging + } +} + +function Update-Relay { + Write-Title "SMTPGraphRelay - Online Update" + + $config = Get-RelayConfig -TargetPath $InstallPath + if (-not $config) { + Write-Fail "Keine bestehende config.json gefunden." + Write-Info "Fuer eine neue Installation bitte 'Neuinstallation' waehlen." + return + } + + $installedVersionInfo = Get-InstalledVersion -TargetPath $InstallPath + $installedVersion = $null + + if ($installedVersionInfo -and $installedVersionInfo.Version) { + $installedVersion = [string]$installedVersionInfo.Version + Write-Info "Installierte Version: $installedVersion" + } + else { + Write-Warn "Keine installierte version.json gefunden." + $installedVersion = Read-Host "Installierte Version manuell eingeben (z.B. 1.5.0)" + if ([string]::IsNullOrWhiteSpace($installedVersion)) { + Write-Fail "Ohne lokale Versionsinformation kann kein sicheres Online-Update durchgefuehrt werden." + return + } + } + + Write-Info "Pruefe Gitea auf neue Version..." + Write-Info "Repository: $RepoBaseUrl" + + try { + $remoteInfo = Get-RemoteVersion + } + catch { + Write-Fail "Remote-Version konnte nicht geladen werden: $($_.Exception.Message)" + return + } + + $remoteVersion = [string]$remoteInfo.Version + Write-Ok "Remote-Version: $remoteVersion" + + try { + $comparison = Compare-RelayVersions -Installed $installedVersion -Remote $remoteVersion + } + catch { + Write-Fail $_.Exception.Message + return + } + + if ($comparison -eq 0) { + Write-Ok "SMTPGraphRelay ist bereits aktuell ($installedVersion)." + return + } + + if ($comparison -lt 0) { + Write-Warn "Die installierte Version ($installedVersion) ist neuer als main ($remoteVersion)." + if (-not (Confirm-Yes "Downgrade auf $remoteVersion durchfuehren?")) { + return + } + } + else { + Write-Host "" + Write-Host "Update verfuegbar:" -ForegroundColor Green + Write-Host " Installiert: $installedVersion" + Write-Host " Neu: $remoteVersion" -ForegroundColor Yellow + Write-Host "" + + if (-not (Confirm-Yes "Update auf $remoteVersion installieren?")) { + return + } + } + + Enable-Tls12 + + $updateRoot = Join-Path $env:TEMP ("SMTPGraphRelay-update-{0}" -f [guid]::NewGuid().ToString("N")) + $archivePath = Join-Path $updateRoot "main.zip" + $extractPath = Join-Path $updateRoot "extract" + + New-Item -ItemType Directory -Path $updateRoot -Force | Out-Null + New-Item -ItemType Directory -Path $extractPath -Force | Out-Null + + $backupPath = $null + $taskWasRunning = $false + + try { + Write-Info "Lade Repository-Archiv..." + Invoke-WebRequest ` + -Uri $RemoteArchiveUrl ` + -OutFile $archivePath ` + -UseBasicParsing ` + -TimeoutSec 120 ` + -ErrorAction Stop + + if (-not (Test-Path -LiteralPath $archivePath)) { + throw "Download des Updatearchivs fehlgeschlagen." + } + + Write-Ok "Archiv heruntergeladen." + + Expand-Archive ` + -LiteralPath $archivePath ` + -DestinationPath $extractPath ` + -Force + + $releaseRoot = Find-ExtractedReleaseRoot -ExtractPath $extractPath + Write-Ok "Release im Archiv gefunden: $releaseRoot" + + $downloadedVersionInfo = Get-Content ` + -LiteralPath (Join-Path $releaseRoot "version.json") ` + -Raw ` + -Encoding UTF8 | ConvertFrom-Json + + if (-not $downloadedVersionInfo.Version) { + throw "version.json im Archiv enthaelt keine Version." + } + + if ([string]$downloadedVersionInfo.Version -ne $remoteVersion) { + throw "Versionskonflikt: version.json-URL meldet $remoteVersion, Archiv enthaelt $($downloadedVersionInfo.Version)." + } + + $task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue + if ($task -and $task.State -eq "Running") { + $taskWasRunning = $true + } + + Write-Info "Erstelle Backup der verwalteten Programmdateien..." + $backupPath = Backup-ManagedFiles -TargetPath $InstallPath + Write-Ok "Backup: $backupPath" + + Stop-RelayTask + + Write-Info "Installiere Release $remoteVersion..." + Install-ExtractedRelease ` + -ReleaseRoot $releaseRoot ` + -TargetPath $InstallPath + + Ensure-Directories -TargetPath $InstallPath + Ensure-FirewallRule -Port ([int]$config.Smtp.Port) + Ensure-ScheduledTask -TargetPath $InstallPath + + Start-RelayTask + + $healthExit = Invoke-PostUpdateHealthCheck -TargetPath $InstallPath + + if ($healthExit -ge 2) { + throw "Health Check nach Update meldet FEHLER (ExitCode $healthExit)." + } + + if ($healthExit -eq 1) { + Write-Warn "Update erfolgreich, Health Check enthaelt Warnungen." + } + else { + Write-Ok "Health Check nach Update erfolgreich." + } + + Write-Title "Online Update abgeschlossen" + Write-Host "Vorher: $installedVersion" + Write-Host "Jetzt: $remoteVersion" -ForegroundColor Green + Write-Host "Backup: $backupPath" + } + catch { + Write-Host "" + Write-Fail "Update fehlgeschlagen: $($_.Exception.Message)" + + if ($backupPath -and (Test-Path -LiteralPath $backupPath)) { + Write-Warn "Automatischer Rollback wird durchgefuehrt..." + + try { + Stop-RelayTask + Restore-ManagedFiles ` + -BackupPath $backupPath ` + -TargetPath $InstallPath + + Ensure-ScheduledTask -TargetPath $InstallPath + Start-RelayTask + + Write-Ok "Rollback abgeschlossen." + } + catch { + Write-Fail "Rollback fehlgeschlagen: $($_.Exception.Message)" + Write-Warn "Backup liegt unter: $backupPath" + } + } + } + finally { + Remove-Item -LiteralPath $updateRoot -Recurse -Force -ErrorAction SilentlyContinue + } +} + +function Verify-CloudPermissions { + Write-Title "SMTPGraphRelay - Entra Berechtigungen pruefen" + + $config = Get-RelayConfig -TargetPath $InstallPath + if (-not $config) { + Write-Fail "config.json nicht gefunden." + return + } + + Ensure-Modules + + Write-Info "Microsoft Graph Anmeldung erforderlich (Entra-Admin)." + Connect-RelayGraphAdmin -TenantId $config.Graph.TenantId + + try { + $app = Get-MgApplication -Filter "appId eq '$($config.Graph.ClientId)'" -Property "id,appId,displayName,keyCredentials" | + Select-Object -First 1 + + if (-not $app) { + Write-Fail "App Registration mit ClientId $($config.Graph.ClientId) nicht gefunden." + return + } + + Write-Ok "App Registration gefunden: $($app.DisplayName)" + + $sp = Get-MgServicePrincipal -Filter "appId eq '$($config.Graph.ClientId)'" -Property "id,appId,displayName" | + Select-Object -First 1 + + if (-not $sp) { + Write-Fail "Entra Service Principal nicht gefunden." + return + } + + Write-Ok "Entra Service Principal gefunden: $($sp.Id)" + + $graphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" -Property "id,appRoles" + $mailSendRole = $graphSp.AppRoles | Where-Object { $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application" } | Select-Object -First 1 + + $globalAssig = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue | Where-Object { $_.AppRoleId -eq $mailSendRole.Id } + + if ($globalAssig) { + Write-Ok "Erfolg: App besitzt die erforderliche GLOBALE (tenant-weite) Microsoft Graph Mail.Send Berechtigung in Entra ID." + } else { + Write-Fail "Fehler: Der App fehlt die GLOBALE Microsoft Graph Mail.Send Berechtigung. Bitte in Entra ID hinzufuegen und zustimmen." + } + } + finally { + Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null + } +} + +function Invoke-CertificateRenewal { + Write-Title "SMTPGraphRelay - Zertifikat erneuern" + + $renew = Join-Path $InstallPath $RenewFileName + if (-not (Test-Path -LiteralPath $renew)) { + Write-Fail "$RenewFileName ist nicht installiert." + return + } + + & $renew -ConfigPath (Join-Path $InstallPath $ConfigFileName) +} + +function Invoke-HealthCheck { + Write-Title "SMTPGraphRelay - Health Check ausfuehren" + + $health = Join-Path $InstallPath $HealthFileName + if (-not (Test-Path -LiteralPath $health)) { + Write-Fail "$HealthFileName ist nicht installiert." + return + } + + & $health -ConfigPath (Join-Path $InstallPath $ConfigFileName) +} + + +function ConvertTo-PlainText { + param([Security.SecureString]$SecureString) + + if ($null -eq $SecureString) { + return "" + } + + $ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString) + + try { + return [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr) + } + finally { + [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr) + } +} + +function Invoke-Pbkdf2Sha256 { + param( + [Parameter(Mandatory)][string]$Password, + [Parameter(Mandatory)][byte[]]$Salt, + [Parameter(Mandatory)][int]$Iterations, + [int]$Length = 32 + ) + + if ($Iterations -lt 1) { + throw "Iterations must be greater than zero." + } + + # Auf unterstuetzten .NET-Framework-Versionen verwenden wir die native, + # schnelle PBKDF2-SHA256-Implementierung. + try { + $derive = New-Object System.Security.Cryptography.Rfc2898DeriveBytes( + $Password, + $Salt, + $Iterations, + [System.Security.Cryptography.HashAlgorithmName]::SHA256 + ) + + try { + return $derive.GetBytes($Length) + } + finally { + $derive.Dispose() + } + } + catch { + # Kompatibilitaets-Fallback fuer aeltere .NET-Framework-Staende. + $hmac = New-Object System.Security.Cryptography.HMACSHA256 + $hmac.Key = [Text.Encoding]::UTF8.GetBytes($Password) + + try { + $hashLength = 32 + $blocks = [Math]::Ceiling($Length / [double]$hashLength) + $output = New-Object byte[] ($blocks * $hashLength) + $offset = 0 + + for ($block = 1; $block -le $blocks; $block++) { + $blockBytes = [BitConverter]::GetBytes([int]$block) + if ([BitConverter]::IsLittleEndian) { + [Array]::Reverse($blockBytes) + } + + $input = New-Object byte[] ($Salt.Length + 4) + [Array]::Copy($Salt, 0, $input, 0, $Salt.Length) + [Array]::Copy($blockBytes, 0, $input, $Salt.Length, 4) + + $u = $hmac.ComputeHash($input) + $t = New-Object byte[] $u.Length + [Array]::Copy($u, $t, $u.Length) + + for ($i = 2; $i -le $Iterations; $i++) { + $u = $hmac.ComputeHash($u) + for ($j = 0; $j -lt $t.Length; $j++) { + $t[$j] = $t[$j] -bxor $u[$j] + } + } + + [Array]::Copy($t, 0, $output, $offset, $t.Length) + $offset += $t.Length + } + + $result = New-Object byte[] $Length + [Array]::Copy($output, 0, $result, 0, $Length) + return $result + } + finally { + $hmac.Dispose() + } + } +} + +function New-SmtpPasswordRecord { + param([Parameter(Mandatory)][string]$Password) + + $plain = $Password + + try { + $salt = New-Object byte[] 16 + $rng = [Security.Cryptography.RandomNumberGenerator]::Create() + + try { + $rng.GetBytes($salt) + } + finally { + $rng.Dispose() + } + + $iterations = 150000 + $hash = Invoke-Pbkdf2Sha256 ` + -Password $plain ` + -Salt $salt ` + -Iterations $iterations ` + -Length 32 + + return [pscustomobject]@{ + Salt = [Convert]::ToBase64String($salt) + PasswordHash = [Convert]::ToBase64String($hash) + Iterations = $iterations + } + } + finally { + $plain = $null + } +} + +function Ensure-SmtpAuthConfig { + param([Parameter(Mandatory)]$Config) + + if (-not ($Config.Smtp.PSObject.Properties.Name -contains "RequireAuth")) { + $Config.Smtp | Add-Member -NotePropertyName RequireAuth -NotePropertyValue $false + } + + if (-not ($Config.Smtp.PSObject.Properties.Name -contains "AuthMaxFailures")) { + $Config.Smtp | Add-Member -NotePropertyName AuthMaxFailures -NotePropertyValue 5 + } + + if (-not ($Config.Smtp.PSObject.Properties.Name -contains "AllowUnauthenticatedNetworks")) { + $Config.Smtp | Add-Member -NotePropertyName AllowUnauthenticatedNetworks -NotePropertyValue @() + } + + if (-not ($Config.Smtp.PSObject.Properties.Name -contains "AuthUsers")) { + $Config.Smtp | Add-Member -NotePropertyName AuthUsers -NotePropertyValue @() + } + + return $Config +} + +function Save-SmtpAuthConfigAndRestart { + param([Parameter(Mandatory)]$Config) + + Write-RelayConfig -Config $Config -TargetPath $InstallPath + Ensure-ScheduledTask -TargetPath $InstallPath + + Stop-RelayTask + Start-RelayTask +} + + +function Get-FailedQueuePath { + param([Parameter(Mandatory)]$Config) + + $path = [string]$Config.Paths.Failed + + if ([IO.Path]::IsPathRooted($path)) { + return $path + } + + return (Join-Path $InstallPath $path) +} + +function Get-PendingQueuePath { + param([Parameter(Mandatory)]$Config) + + $path = [string]$Config.Paths.Queue + + if (-not [IO.Path]::IsPathRooted($path)) { + $path = Join-Path $InstallPath $path + } + + return (Join-Path $path "pending") +} + +function Get-FailedQueueEntries { + param([Parameter(Mandatory)]$Config) + + $failedPath = Get-FailedQueuePath -Config $Config + + if (-not (Test-Path -LiteralPath $failedPath)) { + return @() + } + + $entries = @() + + foreach ($file in Get-ChildItem -LiteralPath $failedPath -Filter "*.eml" -File -ErrorAction SilentlyContinue | Sort-Object LastWriteTime) { + $metaPath = "$($file.FullName).json" + $meta = $null + + if (Test-Path -LiteralPath $metaPath) { + try { + $meta = Get-Content -LiteralPath $metaPath -Raw -Encoding UTF8 | ConvertFrom-Json + } + catch {} + } + + $queueId = [IO.Path]::GetFileNameWithoutExtension($file.Name) + if ($meta -and $meta.PSObject.Properties.Name -contains "QueueId" -and $meta.QueueId) { + $queueId = [string]$meta.QueueId + } + + $entries += [pscustomobject]@{ + QueueId = $queueId + FileName = $file.Name + Path = $file.FullName + MetaPath = $metaPath + SizeKB = [Math]::Round($file.Length / 1KB, 1) + FailedSince = $file.LastWriteTime + RetryCount = if ($meta -and $meta.RetryCount -ne $null) { [int]$meta.RetryCount } else { $null } + From = if ($meta) { [string]$meta.EnvelopeFrom } else { "" } + Recipients = if ($meta) { (@($meta.EnvelopeRecipients) -join ", ") } else { "" } + LastStatusCode = if ($meta) { [string]$meta.LastStatusCode } else { "" } + LastError = if ($meta) { [string]$meta.LastError } else { "" } + AuthenticatedUser = if ($meta -and $meta.PSObject.Properties.Name -contains "AuthenticatedUser") { [string]$meta.AuthenticatedUser } else { "" } + Meta = $meta + } + } + + return @($entries) +} + +function Retry-FailedQueueEntry { + param( + [Parameter(Mandatory)]$Config, + [Parameter(Mandatory)]$Entry + ) + + $pendingPath = Get-PendingQueuePath -Config $Config + New-Item -ItemType Directory -Path $pendingPath -Force | Out-Null + + $targetEml = Join-Path $pendingPath $Entry.FileName + $targetMeta = "$targetEml.json" + + if (Test-Path -LiteralPath $targetEml) { + throw "Pending enthaelt bereits '$($Entry.FileName)'." + } + + if ($Entry.Meta) { + $meta = $Entry.Meta + + if ($meta.PSObject.Properties.Name -contains "RetryCount") { + $meta.RetryCount = 0 + } else { + $meta | Add-Member -NotePropertyName RetryCount -NotePropertyValue 0 + } + + $now = [DateTime]::UtcNow.ToString("o") + + if ($meta.PSObject.Properties.Name -contains "NextAttemptUtc") { + $meta.NextAttemptUtc = $now + } else { + $meta | Add-Member -NotePropertyName NextAttemptUtc -NotePropertyValue $now + } + + if ($meta.PSObject.Properties.Name -contains "RequeuedUtc") { + $meta.RequeuedUtc = $now + } else { + $meta | Add-Member -NotePropertyName RequeuedUtc -NotePropertyValue $now + } + + $meta | ConvertTo-Json -Depth 10 | Set-Content -LiteralPath $Entry.MetaPath -Encoding UTF8 + } + + if (Test-Path -LiteralPath $Entry.MetaPath) { + Move-Item -LiteralPath $Entry.MetaPath -Destination $targetMeta -Force + } + + Move-Item -LiteralPath $Entry.Path -Destination $targetEml -Force +} + +function Remove-FailedQueueEntry { + param([Parameter(Mandatory)]$Entry) + + Remove-Item -LiteralPath $Entry.Path -Force -ErrorAction Stop + Remove-Item -LiteralPath $Entry.MetaPath -Force -ErrorAction SilentlyContinue +} + +function Manage-FailedQueue { + $config = Get-RelayConfig -TargetPath $InstallPath + + if (-not $config) { + Write-Fail "config.json nicht gefunden." + return + } + + while ($true) { + Clear-Host + Write-Title "SMTPGraphRelay - Failed Queue" + + $entries = @(Get-FailedQueueEntries -Config $config) + + Write-Host "Failed-Mails: $($entries.Count)" + Write-Host "" + + Write-Host " [1] Failed Queue anzeigen" + Write-Host " [2] Details einer Mail anzeigen" + Write-Host " [3] Eine Mail erneut zustellen" + Write-Host " [4] Alle Mails erneut zustellen" + Write-Host " [5] Eine Mail endgueltig loeschen" + Write-Host " [6] Alle Failed-Mails endgueltig loeschen" + Write-Host " [0] Zurueck" + Write-Host "" + + $choice = Read-Host "Auswahl" + + switch ($choice) { + "1" { + if ($entries.Count -eq 0) { + Write-Ok "Failed Queue ist leer." + } + else { + $entries | + Select-Object QueueId,FailedSince,RetryCount,From,Recipients,LastStatusCode,SizeKB | + Format-Table -AutoSize + } + + Read-Host "Enter" + } + + "2" { + $id = Read-Host "Queue-ID" + + $entry = $entries | + Where-Object { $_.QueueId -eq $id -or $_.FileName -eq $id -or $_.FileName -eq "$id.eml" } | + Select-Object -First 1 + + if (-not $entry) { + Write-Fail "Queue-ID '$id' nicht gefunden." + } + else { + Write-Host "" + Write-Host "Queue-ID: $($entry.QueueId)" + Write-Host "Datei: $($entry.FileName)" + Write-Host "Fehlgeschlagen:$($entry.FailedSince)" + Write-Host "RetryCount: $($entry.RetryCount)" + Write-Host "Von: $($entry.From)" + Write-Host "An: $($entry.Recipients)" + Write-Host "Auth-User: $($entry.AuthenticatedUser)" + Write-Host "Status: $($entry.LastStatusCode)" + Write-Host "Groesse: $($entry.SizeKB) KB" + Write-Host "" + Write-Host "Letzter Fehler:" -ForegroundColor Yellow + Write-Host $entry.LastError + } + + Read-Host "Enter" + } + + "3" { + $id = Read-Host "Queue-ID" + + $entry = $entries | + Where-Object { $_.QueueId -eq $id -or $_.FileName -eq $id -or $_.FileName -eq "$id.eml" } | + Select-Object -First 1 + + if (-not $entry) { + Write-Fail "Queue-ID '$id' nicht gefunden." + } + else { + Retry-FailedQueueEntry -Config $config -Entry $entry + Write-Ok "[$($entry.QueueId)] zurueck nach pending verschoben." + } + + Read-Host "Enter" + } + + "4" { + if ($entries.Count -eq 0) { + Write-Ok "Failed Queue ist leer." + } + elseif (Confirm-Yes "Alle $($entries.Count) Failed-Mails erneut zustellen?") { + $ok = 0 + $failed = 0 + + foreach ($entry in $entries) { + try { + Retry-FailedQueueEntry -Config $config -Entry $entry + $ok++ + } + catch { + $failed++ + Write-Warn "[$($entry.QueueId)] konnte nicht requeued werden: $($_.Exception.Message)" + } + } + + Write-Ok "$ok Mail(s) zurueck nach pending verschoben." + if ($failed -gt 0) { + Write-Warn "$failed Mail(s) konnten nicht verschoben werden." + } + } + + Read-Host "Enter" + } + + "5" { + $id = Read-Host "Queue-ID" + + $entry = $entries | + Where-Object { $_.QueueId -eq $id -or $_.FileName -eq $id -or $_.FileName -eq "$id.eml" } | + Select-Object -First 1 + + if (-not $entry) { + Write-Fail "Queue-ID '$id' nicht gefunden." + } + elseif (Confirm-Yes "[$($entry.QueueId)] endgueltig aus Failed loeschen?") { + Remove-FailedQueueEntry -Entry $entry + Write-Ok "[$($entry.QueueId)] geloescht." + } + + Read-Host "Enter" + } + + "6" { + if ($entries.Count -eq 0) { + Write-Ok "Failed Queue ist leer." + } + elseif (Confirm-Yes "WIRKLICH alle $($entries.Count) Failed-Mails endgueltig loeschen?") { + if (Confirm-Yes "Endgueltiges Loeschen nochmals bestaetigen?") { + $ok = 0 + + foreach ($entry in $entries) { + try { + Remove-FailedQueueEntry -Entry $entry + $ok++ + } + catch { + Write-Warn "[$($entry.QueueId)] konnte nicht geloescht werden." + } + } + + Write-Ok "$ok Failed-Mail(s) endgueltig geloescht." + } + } + + Read-Host "Enter" + } + + "0" { + return + } + + default { + Write-Warn "Ungueltige Auswahl." + Start-Sleep -Seconds 1 + } + } + + $config = Get-RelayConfig -TargetPath $InstallPath + } +} + +function Manage-SmtpAuth { + $config = Get-RelayConfig -TargetPath $InstallPath + + if (-not $config) { + Write-Fail "config.json nicht gefunden." + return + } + + $config = Ensure-SmtpAuthConfig -Config $config + + while ($true) { + Clear-Host + Write-Title "SMTPGraphRelay - SMTP-AUTH" + + $users = @($config.Smtp.AuthUsers) + $authState = if ([bool]$config.Smtp.RequireAuth) { "ERFORDERLICH" } else { "optional / nicht erforderlich" } + + Write-Host "Status: $authState" + Write-Host "Benutzer: $($users.Count)" + Write-Host "Max. Fehlversuche: $($config.Smtp.AuthMaxFailures)" + Write-Host "Ohne Auth erlaubte Netze: $(@($config.Smtp.AllowUnauthenticatedNetworks) -join ', ')" + Write-Host "" + Write-Host " [1] SMTP-AUTH erforderlich EIN/AUS" + Write-Host " [2] Benutzer hinzufuegen" + Write-Host " [3] Benutzer anzeigen" + Write-Host " [4] Passwort aendern" + Write-Host " [5] Benutzer loeschen" + Write-Host " [6] Netze ohne Auth verwalten" + Write-Host " [7] Max. Fehlversuche aendern" + Write-Host " [0] Zurueck" + Write-Host "" + + $choice = Read-Host "Auswahl" + + switch ($choice) { + "1" { + $config.Smtp.RequireAuth = -not [bool]$config.Smtp.RequireAuth + + if ($config.Smtp.RequireAuth -and @($config.Smtp.AuthUsers).Count -eq 0) { + Write-Warn "AUTH wurde aktiviert, aber es existiert noch kein SMTP-Benutzer." + } + + Save-SmtpAuthConfigAndRestart -Config $config + Write-Ok "SMTP-AUTH Status geaendert." + Read-Host "Enter" + } + + "2" { + $username = Read-Host "Benutzername" + + if ([string]::IsNullOrWhiteSpace($username) -or $username -notmatch '^[A-Za-z0-9._@-]{1,128}$') { + Write-Fail "Ungueltiger Benutzername." + Read-Host "Enter" + continue + } + + $existing = @($config.Smtp.AuthUsers) | + Where-Object { ([string]$_.Username).Equals($username, [StringComparison]::OrdinalIgnoreCase) } | + Select-Object -First 1 + + if ($existing) { + Write-Fail "Benutzer '$username' existiert bereits." + Read-Host "Enter" + continue + } + + $plain1 = Read-Host "Passwort" + $plain2 = Read-Host "Passwort wiederholen" + + $plain1 = ConvertTo-PlainText -SecureString $2 + $plain2 = ConvertTo-PlainText -SecureString $2 + + try { + if ($plain1.Length -lt 8) { + Write-Fail "Passwort muss mindestens 8 Zeichen lang sein." + Read-Host "Enter" + continue + } + + if ($plain1 -cne $2) { + Write-Fail "Passwoerter stimmen nicht ueberein." + Read-Host "Enter" + continue + } + } + finally { + $plain1 =$null + $plain2 =$null + } + + $record = New-SmtpPasswordRecord -Password $2 + + $newUser = [pscustomobject]@{ + Username = $username + Salt = $record.Salt + PasswordHash = $record.PasswordHash + Iterations = $record.Iterations + } + + $config.Smtp.AuthUsers = @($config.Smtp.AuthUsers) + @($newUser) + + Save-SmtpAuthConfigAndRestart -Config $config + Write-Ok "SMTP-Benutzer '$username' angelegt." + Read-Host "Enter" + } + + "3" { + Write-Host "" + + if (@($config.Smtp.AuthUsers).Count -eq 0) { + Write-Warn "Keine SMTP-Benutzer vorhanden." + } + else { + @($config.Smtp.AuthUsers) | + Select-Object Username,Iterations | + Format-Table -AutoSize + } + + Read-Host "Enter" + } + + "4" { + $username = Read-Host "Benutzername" + + $user = @($config.Smtp.AuthUsers) | + Where-Object { ([string]$_.Username).Equals($username, [StringComparison]::OrdinalIgnoreCase) } | + Select-Object -First 1 + + if (-not $user) { + Write-Fail "Benutzer '$username' nicht gefunden." + Read-Host "Enter" + continue + } + + $p1 = Read-Host "Neues Passwort" -AsSecureString + $plain2 = Read-Host "Passwort wiederholen" + + $plain1 = ConvertTo-PlainText -SecureString $2 + $plain2 = ConvertTo-PlainText -SecureString $2 + + try { + if ($plain1.Length -lt 8) { + Write-Fail "Passwort muss mindestens 8 Zeichen lang sein." + Read-Host "Enter" + continue + } + + if ($plain1 -cne $2) { + Write-Fail "Passwoerter stimmen nicht ueberein." + Read-Host "Enter" + continue + } + } + finally { + $plain1 =$null + $plain2 =$null + } + + $record = New-SmtpPasswordRecord -Password $2 + $user.Salt =$record.Salt + $user.PasswordHash =$record.PasswordHash + $user.Iterations =$record.Iterations + + Save-SmtpAuthConfigAndRestart -Config $config + Write-Ok "Passwort fuer '$username' geaendert." + Read-Host "Enter" + } + + "5" { + $username = Read-Host "Benutzername" + + $found = @($config.Smtp.AuthUsers) | + Where-Object { ([string]$_.Username).Equals($username, [StringComparison]::OrdinalIgnoreCase) } + + if (-not $found) { + Write-Fail "Benutzer '$username' nicht gefunden." + Read-Host "Enter" + continue + } + + if (Confirm-Yes "Benutzer '$username' wirklich loeschen?") { + $config.Smtp.AuthUsers = @($config.Smtp.AuthUsers | + Where-Object { -not ([string]$_.Username).Equals($username, [StringComparison]::OrdinalIgnoreCase) } + ) + + Save-SmtpAuthConfigAndRestart -Config $config + Write-Ok "Benutzer '$username' geloescht." + } + + Read-Host "Enter" + } + + "6" { + $current = @($config.Smtp.AllowUnauthenticatedNetworks) -join "," + $input = Read-Default "Netze/IPs ohne AUTH, Komma getrennt; '-' fuer keine" $(if ($current) { $current } else { "-" }) + + if ($input -eq "-") { + $config.Smtp.AllowUnauthenticatedNetworks = @() + } + else { + $config.Smtp.AllowUnauthenticatedNetworks = @($input -split "," | + ForEach-Object { $_.Trim() } | + Where-Object { $_ } + ) + } + + Save-SmtpAuthConfigAndRestart -Config $config + Write-Ok "Ausnahmen fuer SMTP-AUTH gespeichert." + Read-Host "Enter" + } + + "7" { + $value = Read-Host "Maximale Fehlversuche pro Verbindung [aktuell: $($config.Smtp.AuthMaxFailures)]" + + if ($value -match '^\d+$' -and [int]$value -ge 1 -and [int]$value -le 100) { + $config.Smtp.AuthMaxFailures = [int]$value + Save-SmtpAuthConfigAndRestart -Config $config + Write-Ok "Maximale Fehlversuche geaendert." + } + else { + Write-Fail "Bitte einen Wert zwischen 1 und 100 eingeben." + } + + Read-Host "Enter" + } + + "0" { + return + } + + default { + Write-Warn "Ungueltige Auswahl." + Start-Sleep -Seconds 1 + } + } + + # Config nach jeder Aenderung neu laden, damit Serialisierung/Arrays exakt + # dem installierten Zustand entsprechen. + $config = Get-RelayConfig -TargetPath $InstallPath + $config = Ensure-SmtpAuthConfig -Config $2 + } +} + + +function Invoke-FailureModeTests { + Write-Title "SMTPGraphRelay - Failure Mode QA" + + $tester = Join-Path $2 "Test-SMTPGraphRelay-FailureModes.ps1" + if (-not (Test-Path -LiteralPath $tester)) { + Write-Fail "Test-SMTPGraphRelay-FailureModes.ps1 ist nicht installiert." + return + } + + & $tester -InstallPath $2 +} + +function Uninstall-Relay { + Write-Title "SMTPGraphRelay - Deinstallation" + + $config = Get-RelayConfig -TargetPath $InstallPath + + Write-Warn "Lokale Deinstallation entfernt Task, Firewallregel und auf Wunsch das lokale Zertifikat." + if (-not (Confirm-Yes "Lokale SMTPGraphRelay-Installation wirklich entfernen?")) { + return + } + + Stop-RelayTask + Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue + Write-Ok "Scheduled Task entfernt." + + Get-NetFirewallRule -ErrorAction SilentlyContinue | + Where-Object { $_.DisplayName -like "SMTPGraphRelay TCP *" } | + Remove-NetFirewallRule -ErrorAction SilentlyContinue + Write-Ok "SMTPGraphRelay Firewallregeln entfernt." + + if ($config -and $2.Graph.CertificateThumbprint) { + if (Confirm-Yes "Lokales Relay-Zertifikat $($config.Graph.CertificateThumbprint) entfernen?") { + Remove-Item -LiteralPath "Cert:\LocalMachine\My\$($config.Graph.CertificateThumbprint)" -Force -ErrorAction SilentlyContinue + Write-Ok "Lokales Zertifikat entfernt." + } + } + + if ($config -and (Confirm-Yes "Auch Entra-App entfernen?")) { + Ensure-Modules + + Write-Warn "Cloud-Cleanup ist destruktiv und betrifft die konfigurierte ClientId:" + Write-Host " $($config.Graph.ClientId)" -ForegroundColor Yellow + + if (Confirm-Yes "Cloud-Cleanup endgueltig bestaetigen?") { + Connect-RelayGraphAdmin -TenantId $config.Graph.TenantId + + try { + $app = Get-MgApplication -Filter "appId eq '$($config.Graph.ClientId)'" -Property "id,appId,displayName" | Select-Object -First 1 + $sp = Get-MgServicePrincipal -Filter "appId eq '$($config.Graph.ClientId)'" -Property "id,appId,displayName" | Select-Object -First 1 + + if ($sp) { + Remove-MgServicePrincipal -ServicePrincipalId $sp.Id -ErrorAction SilentlyContinue + Write-Ok "Entra Service Principal entfernt." + } + + if ($app) { + Remove-MgApplication -ApplicationId $app.Id -ErrorAction SilentlyContinue + Write-Ok "Entra App Registration entfernt." + } + } + finally { + Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null + } + } + } + + # Programmdateien. Wenn der Installer selbst aus dem Zielordner laeuft, kann er + # sich nicht zuverlaessig selbst loeschen. Dann bleiben Setup + Ordner bis nach Ende stehen. + $currentInstaller = [IO.Path]::GetFullPath($PSCommandPath) + $targetFull = [IO.Path]::GetFullPath($InstallPath) + + foreach ($item in Get-ChildItem -LiteralPath $2 -Force -ErrorAction SilentlyContinue) { + try { + if ($item.FullName -eq $2) { + continue + } + + Remove-Item -LiteralPath $item.FullName -Recurse -Force -ErrorAction Stop + } + catch { + Write-Warn "Konnte nicht entfernen: $($item.FullName)" + } + } + + Write-Ok "Lokale Programmdateien entfernt." + if ($currentInstaller.StartsWith($targetFull, [StringComparison]::OrdinalIgnoreCase)) { + Write-Warn "Der aktuell laufende Installer bleibt uebrig. Nach dem Beenden kann '$InstallPath' manuell geloescht werden." + } + + Write-Title "Deinstallation abgeschlossen" +} + +function Show-Status { + Write-Title "SMTPGraphRelay - Status anzeigen" + + $configPath = Join-Path $InstallPath$ConfigFileName + Write-Host "Installationspfad: $InstallPath" + + if (Test-Path -LiteralPath $configPath) { + Write-Ok "config.json vorhanden." + try { + $config = Get-RelayConfig -TargetPath $InstallPath + Write-Host " Sender: $($config.Graph.SenderMailbox) (ForceSender: $($config.Graph.ForceSender))" + Write-Host " SMTP: $($config.Smtp.ListenAddress):$($config.Smtp.Port)" + Write-Host " Client: $($config.Graph.ClientId)" + + if ($config.Smtp.PSObject.Properties.Name -contains "RequireAuth") { + $authText = if ([bool]$config.Smtp.RequireAuth) { "erforderlich" } else { "optional / aus" } + $authUsers = if ($config.Smtp.PSObject.Properties.Name -contains "AuthUsers") { @($config.Smtp.AuthUsers).Count } else { 0 } + Write-Host " AUTH: $authText ($authUsers Benutzer)" + } + + try { + $failedCount = @(Get-FailedQueueEntries -Config $2).Count + Write-Host " Failed: $failedCount Mail(s)" + } catch {} + } catch {} + } + else { + Write-Warn "Keine config.json vorhanden." + } + + $task = Get-ScheduledTask -TaskName $2 -ErrorAction SilentlyContinue + if ($task) { + Write-Host "Task State: $($task.State)" + } + else { + Write-Warn "Scheduled Task nicht vorhanden." + } +} + +function Show-Menu { + Clear-Host + Write-Title "SMTPGraphRelay - Bootstrap / Repair / Online Update" + Write-Host "Installationspfad: $InstallPath" -ForegroundColor DarkGray + + $installedVersion = Get-InstalledVersion -TargetPath $InstallPath + + if ($installedVersion -and $2.Version) { + Write-Host "Installiert: $($installedVersion.Version)" -ForegroundColor DarkGray + } + + Write-Host "Updatequelle: Gitea / main" -ForegroundColor DarkGray + Write-Host "" + Write-Host " [1] Neuinstallation aus Gitea" + Write-Host " [2] Installation aus Gitea reparieren" + Write-Host " [3] Nach Online-Updates suchen" + Write-Host " [4] Entra App & Berechtigungen pruefen" + Write-Host " [5] Zertifikat erneuern" + Write-Host " [6] Health Check ausfuehren" + Write-Host " [7] Deinstallieren" + Write-Host " [8] Status anzeigen" + Write-Host " [9] SMTP-AUTH verwalten" + Write-Host " [10] Failed Queue verwalten" + Write-Host " [11] Failure-Mode QA" + Write-Host " [0] Beenden" + Write-Host "" +} + +Assert-WindowsPowerShell51 + +while ($true) { + Show-Menu + $choice = Read-Host "Auswahl" + + try { + switch ($choice) { + "1" { Install-New } + "2" { Repair-Installation } + "3" { Update-Relay } + "4" { Verify-CloudPermissions } + "5" { Invoke-CertificateRenewal } + "6" { Invoke-HealthCheck } + "7" { Uninstall-Relay } + "8" { Show-Status } + "9" { Manage-SmtpAuth } + "10" { Manage-FailedQueue } + "11" { Invoke-FailureModeTests } + "0" { break } + default { Write-Warn "Ungueltige Auswahl." } + } + } + catch { + Write-Host "" + Write-Fail $_.Exception.Message + if ($_.ScriptStackTrace) { + Write-Host $_.ScriptStackTrace -ForegroundColor DarkYellow + } + } + + if ($choice -ne "0") { + Write-Host "" + Read-Host "Enter druecken, um zum Menue zurueckzukehren" + } + + if ($choice -eq "0") { + break + } +} + +