Stalwart の MTA Hook で .forward のパイプ処理を置き換える

$ cat ~/.forward-hook
"| /home/<ユーザー>/script.sh"

外部 → Stalwart ──POST(JSON)──→ 受け口 (127.0.0.1:8090) ──→ script.sh
           │                          │
           └→ メールボックスに配送    └→ {"action":"accept"} を返す

#!/usr/bin/env python3
# Stalwart MTA Hook の受け口。特定の宛先のメールをプログラムに渡す。
import json, subprocess, threading
from email.utils import getaddresses
from http.server import BaseHTTPRequestHandler, HTTPServer

# 宛先 → 実行するコマンド(.forward-xxx の代わり)
TARGETS = {
    "user-hook@poppo-ya.com": ["/bin/bash", "/home/ubuntu/mailhook/script.sh"],
}

def recipients(req):
    # エンベロープはサブアドレス変換後(user@)なので、ヘッダの宛先も見る
    addrs = {t["address"].lower() for t in req.get("envelope", {}).get("to", [])}
    for name, value in req.get("message", {}).get("headers", []):
        if name.lower() in ("to", "cc", "delivered-to", "x-original-to"):
            for _, addr in getaddresses([value]):
                addrs.add(addr.lower())
    return addrs

def build_raw(msg):
    # ヘッダと本文から1通のメールを組み立て直す。改行は LF にそろえる
    lines = [f"{name}: {value.strip()}" for name, value in msg.get("headers", [])]
    raw = "\n".join(lines) + "\n\n" + msg.get("contents", "")
    return raw.replace("\r\n", "\n").encode()

def run(cmd, data):
    try:
        subprocess.run(cmd, input=data, timeout=300)
    except Exception as e:
        print(f"command failed: {cmd}: {e}", flush=True)

class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
        try:
            req = json.loads(body)
            for r in recipients(req):
                if r in TARGETS:
                    print(f"run {TARGETS[r]} for {r}", flush=True)
                    raw = build_raw(req.get("message", {}))
                    threading.Thread(target=run, args=(TARGETS[r], raw)).start()
        except Exception as e:
            print(f"hook error: {e}", flush=True)
        # 何があっても必ず accept を返す(メール自体は止めない)
        out = b'{"action":"accept"}'
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(out)))
        self.end_headers()
        self.wfile.write(out)

    def log_message(self, *args):
        pass

HTTPServer(("127.0.0.1", 8090), Handler).serve_forever()

{
  "envelope": { "to": [ { "address": "user@poppo-ya.com" } ] },
  "message": {
    "headers": [ ["To", "user-hook@poppo-ya.com"], ... ],
    "contents": "5LqI5a6a44Gu44OG44K544OI44Gn44GZCg==\r\n\r\n\r\n",
    "size": ...
  }
}

# /etc/systemd/system/mailhook.service
[Unit]
Description=Stalwart MTA hook receiver
After=network.target

[Service]
User=ubuntu
ExecStart=/usr/bin/python3 /home/ubuntu/mailhook/hook.py
Restart=always

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now mailhook

$ jq '.envelope.to' last-request.json
[ { "address": "user@poppo-ya.com" } ]

$ cat -A /tmp/org | head
Content-Transfer-Encoding: base64^M$
^M$
5LqI5a6a44Gu44OG44K544OI44Gn44GZCg==^M$

swaks --to user-hook@poppo-ya.com --server 127.0.0.1 \
  --ehlo test.example.com --from test@example.com \
  --header "Content-Type: text/plain; charset=UTF-8" \
  --header "Content-Transfer-Encoding: base64" \
  --body "$(echo '予定のテストです' | base64)"

# main.sieve
# user-hook 宛てはスクリプトで処理済みなので、受信箱には残さない
if address :is ["to", "cc"] "user-hook@poppo-ya.com" {
    discard;
    stop;
}

ss -tlnp | grep 4190   # Stalwart が待ち受けているか確認

sudo apt install sieve-connect
sieve-connect --server 127.0.0.1 --port 4190 --notlsverify \
  --user <ユーザー>@poppo-ya.com \
  --upload --localsieve main.sieve --remotesieve main
sieve-connect --server 127.0.0.1 --port 4190 --notlsverify \
  --user <ユーザー>@poppo-ya.com --activate --remotesieve main
sieve-connect --server 127.0.0.1 --port 4190 --notlsverify \
  --user <ユーザー>@poppo-ya.com --list