[modem7]

What

Makes the mail relay in build-templates.sh provider-neutral. It was Gmail only.

New shared.conf settings: MAIL_RELAY (gmail, custom, none), MAIL_RELAY_HOST, MAIL_RELAY_PORT, MAIL_RELAY_USER, MAIL_RELAY_PASSWORD, MAIL_ROOT_TO, MAIL_SENDER.

• gmail (default) keeps today's behaviour: [smtp.gmail.com]:587, STARTTLS, app password.
• custom: own host and port. 587 uses STARTTLS, 465 adds smtp_tls_wrappermode=yes, other ports use opportunistic TLS. A blank user means no login: no SASL files and no libsasl2-modules.
• none: no relay, mail stays local (Debian's "Local only" transports are left alone).
• MAIL_SENDER set rewrites every sender; blank keeps the current "no rewrite".
• GMAIL_USER and GMAIL_APP_PASSWORD still work as the old names, with one warning.
• The builder refuses placeholder values from shared.conf.example and validates host, port and relay choice.
• The relay is chosen when the payload is generated, so the generated postfix.sh has no branching on MAIL_RELAY.

README and --help updated.

Testing

bash -n and shellcheck are clean. Nothing was run as root and no real Postfix or mail was involved.

• Back-compat: old script (from HEAD) and new script were both run with --generate-only on the same fake Gmail config and the payloads compared. Every postconf argument and its order are identical; the only body differences are the variable rename (GMAIL_* to MAIL_*) and the aliases line reading $MAIL_ROOT_TO (same value). New names with MAIL_RELAY=gmail give a byte-identical postfix.sh.
• Generated payloads for custom 587, 465 and 25 (no login), with MAIL_SENDER, and none, were read, not executed.
• About 20 refusal cases (bad port, host, relay, placeholders, missing password) were checked.

Not tested: a real Gmail build and mail send, and any non-Gmail relay. Please rebuild a template and run verify-clone.sh before relying on it.

Known gap

verify-template.sh still expects the Gmail relay, so builds with custom or none show FAILs in its mail section. That is the next PR (verify reads its expectations from shared.conf).

Follow-up fix

An automated security review found that a custom relay with a login on a port other than 587 or 465 used opportunistic TLS (may), so the password could go in plain text if TLS failed. Fixed in 29c4e76: a login now always means encrypt. Checked: login on 2525 gives encrypt, no login on 25 stays may.