From c447b58163b0efe2ccb091cd41cf278723d23de3 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Sat, 17 Oct 2026 00:30:49 +0800
Subject: [PATCH] =?UTF-8?q?=E9=83=A8=E7=BD=B2=E8=84=9A=E6=9C=AC=E5=A2=9E?=
 =?UTF-8?q?=E5=8A=A0=E7=BD=91=E7=BB=9C=E7=AB=AF=E5=8F=A3=E8=87=AA=E5=8A=A8?=
 =?UTF-8?q?=E6=94=BE=E8=A1=8C=E5=8A=9F=E8=83=BD(=E6=94=AF=E6=8C=81ufw/fire?=
 =?UTF-8?q?walld/iptables)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/install-systemd.sh | 47 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/deploy/install-systemd.sh b/deploy/install-systemd.sh
index 393fa682..663dd709 100644
--- a/deploy/install-systemd.sh
+++ b/deploy/install-systemd.sh
@@ -230,6 +230,53 @@ systemctl daemon-reload
 systemctl enable smail
 systemctl disable smail-admin >/dev/null 2>&1 || true
 
+open_firewall_ports() {
+  local ports="80 443 25 465 587 110 995 143 993"
+  echo "=== 正在检查并自动开放网络防火墙端口 ==="
+  local opened=false
+
+  # 1. 检查 ufw (Ubuntu / Debian 常用)
+  if command -v ufw >/dev/null 2>&1; then
+    if ufw status 2>/dev/null | grep -q "Status: active"; then
+      echo "检测到 ufw 防火墙处于开启状态，自动添加放行规则..."
+      for p in $ports; do
+        ufw allow "${p}/tcp" >/dev/null 2>&1 || true
+      done
+      opened=true
+      echo "ufw 端口放行完成 (80, 443, 25, 465, 587, 110, 995, 143, 993)。"
+    else
+      echo "检测到 ufw 未激活，跳过 ufw 规则添加。"
+    fi
+  fi
+
+  # 2. 检查 firewalld (CentOS / RHEL / Rocky / Fedora 常用)
+  if command -v firewall-cmd >/dev/null 2>&1; then
+    if systemctl is-active --quiet firewalld; then
+      echo "检测到 firewalld 处于运行状态，自动添加放行规则..."
+      for p in $ports; do
+        firewall-cmd --permanent --add-port="${p}/tcp" >/dev/null 2>&1 || true
+      done
+      firewall-cmd --reload >/dev/null 2>&1 || true
+      opened=true
+      echo "firewalld 端口放行并重载完成 (80, 443, 25, 465, 587, 110, 995, 143, 993)。"
+    else
+      echo "检测到 firewalld 未运行，跳过 firewalld 规则添加。"
+    fi
+  fi
+
+  # 3. 检查 iptables (若前两者未激活或不存在，但 iptables 命令存在)
+  if [ "$opened" = false ] && command -v iptables >/dev/null 2>&1; then
+    for p in $ports; do
+      if ! iptables -C INPUT -p tcp --dport "$p" -j ACCEPT >/dev/null 2>&1; then
+        iptables -I INPUT -p tcp --dport "$p" -j ACCEPT >/dev/null 2>&1 || true
+      fi
+    done
+    echo "iptables INPUT 规则已更新放行 (80, 443, 25, 465, 587, 110, 995, 143, 993)。"
+  fi
+}
+
+open_firewall_ports
+
 echo "=== 正在启动 Smail 系统服务 ==="
 systemctl restart smail