Mail Phase 2 — Rspamd migration (closes #153) (#160)

* test(mail): Phase 2 scaffolding — rspamd.sh + templates + routers + bats baseline (ref #153)

* feat(mail): rspamd.sh — install_rspamd + re-entry guard (ref #153)

* feat(mail): Rspamd config templates (9 .conf files) — DKIM/ARC/DMARC/greylist/ratelimit (ref #153)

* feat(mail): lib/mail/rspamd.sh — configure helpers + DKIM keygen + D9 purge gate (ref #153)

* feat(mail): Milestone C — rspamd_client + /rspamd/* router + legacy shims (ref #153)

- rspamd_client.py: httpx wrapper around the Rspamd HTTP controller
  (read /stat /history /graph; write /reload /learnspam /learnham).
- routers/rspamd.py: 11 new endpoints under /api/v1/mail/rspamd/*
  (status, history, scores, reload, learn-{spam,ham}, whitelist CRUD,
  dkim/{domain}/{status,keygen}).
- routers/legacy.py: 14 deprecation shims for the Phase 1 /dkim/*
  /spam/* /grey/* surface. Each emits X-Deprecated-Endpoint: rspamd
  and forwards to the Rspamd equivalent. Removed in v3.0.
- main.py: drops the 14 inline legacy handlers and mounts the two
  routers via app.include_router(). 62/62 Phase 1 endpoint pytest
  still passes.

* feat(mail): Milestone D — mailctl cmd_rspamd dispatcher (ref #153)

Adds rspamd subcommand to mailctl: install / start / stop / restart /
reload / status / dkim-keygen / dns-records / learn-spam / learn-ham /
purge-legacy. The install path calls lib/mail/rspamd.sh helpers in
order: install_rspamd → configure_rspamd_milter → configure_rspamd_controller
→ configure_rspamd_dkim → configure_rspamd_postfix_milter.

The purge-legacy verb requires Rspamd to respond healthy on :11334
before removing SA + OpenDKIM (D9 safety gate).

* feat(mail): Milestone E — install adds rspamd; mail.toml [mail.rspamd]; postinst secrets (ref #153)

- install_mail_packages: now installs rspamd + redis-server + enables
  postfix/dovecot/rspamd at LXC boot (Phase 1 follow-up). Drops Apache/
  Roundcube — they live in the roundcube LXC after the rev. 3 split.
- mail.toml: [mail.rspamd] section (greylist, bayes_autolearn,
  ratelimit_outbound=200/h/user, web_ui_host). horde_url added.
- debian/postinst: on upgrade <2.3, generate /etc/secubox/secrets/
  rspamd-controller.pw (32-byte random) and mkdir /data/volumes/mail/
  rspamd/{dkim,bayes,history,settings} chown 100110 (_rspamd in unpriv).

* feat(mail): Milestone F — rspamd-route-sync-patch deploy helper (ref #153)

Idempotent one-shot script run at deploy time:
1. Removes 10.100.0.{10,11,12} from sync-mitmproxy-routes.sh's
   DEAD_CONTAINER_IPS list so the periodic timer does not reroute
   the mail/horde/roundcube LXC routes to webui.
2. Adds rspamd.gk2.secubox.in → [10.100.0.10, 11334] to both the
   host's /srv/mitmproxy/haproxy-routes.json and the mitmproxy LXC
   copy, then restarts the mitmdump worker.

No source-side nginx vhost added: rspamd UI goes through the
existing HAProxy → mitmproxy_inspector → 10.100.0.10:11334 path.

* feat(mail): bump secubox-mail to 2.3.0 (Phase 2 Rspamd) (ref #153)

* test(mail): Phase 2 13-gate acceptance smoke (ref #153)

Run with: bash tests/scripts/test-mail-phase2-acceptance.sh root@admin.gk2.secubox.in

Gates 1-3 are source-side (parses, pytest, deb path coverage).
Gates 4-11 are board-side (Rspamd listening, Postfix milter wired,
DKIM key generated, modules loaded, web UI via WAF).
Gates 12-13 are post-cutover (legacy purged + Phase 1 regression
check — 5 secubox.in users intact, webmail still WAF-routed).

Every board call uses timeout — Phase 1 lesson, never raw pipes.

* fix(mail): debian/rules ships templates/rspamd/ (path-coverage fix, ref #153)

Phase 1 lesson redux: debian/rules silently misses files unless every
new source-tree subdir gets its explicit cp line. Adds the templates/
rspamd/ install line so the 9 local.d configs + the postfix milter
snippet land at /usr/lib/secubox/mail/templates/rspamd/.

* fix(mail): live-deploy fixes — _rspamd uid via lxc-attach + smoke gate 7/12 (ref #153)

Two issues surfaced during Phase 2 live deploy on admin.gk2.secubox.in:

1. configure_rspamd_controller hardcoded chown to host uid 100110, assuming
   _rspamd is uid 110 inside the LXC. On this Debian 12 image _rspamd is
   uid 107 — rspamd crash-looped with "Permission denied" on secrets.inc.
   Fix: chown via `lxc-attach -- chown _rspamd:_rspamd` so the kernel's
   idmap maps the right uid regardless of image package set. Mode 0640
   instead of 0600 so the worker (uid _rspamd) can read it even if launched
   from a slightly different group context.

2. Smoke gate 7 grepped for the literal string "rspamd" in the first 5
   lines of `rspamc stat`, but rspamc only prints "Results for command:
   stat" + counters. Fix: grep for an always-present stat marker
   ("Messages scanned" or "Pools allocated") with a wider head -10 window.

3. Smoke gate 12 ran `dpkg -l opendkim spamassassin` under `set -e` and
   silently aborted the smoke when the named packages were unknown (the
   success case after purge). Fix: append `|| true` so the grep below is
   the actual gate.

All 13 gates green on admin.gk2.secubox.in after these fixes + the manual
deploy steps (DKIM keygen via lxc-attach, bind-mount entries, HAProxy +
mitmproxy route map for rspamd.gk2.secubox.in).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(mail): rspamd lib + sbin write through live LXC (ref #153)

Phase 2 deploy on admin.gk2.secubox.in surfaced three brittleness points
that the live-deploy fixes patched ad-hoc:

1. configure_rspamd_milter wrote to ${LXC_BASE}/<container>/rootfs/etc/
   rspamd/local.d/ — but on this board the runtime LXC mounts a different
   rootfs (/data/lxc/<container>/rootfs/ per lxc.rootfs.path). Files written
   to the host-side guess landed in a stale shell the running LXC didn't
   see, and the first install's local.d was empty.

2. configure_rspamd_controller had the same path-guess issue plus
   hardcoded chown 100110:100110 (had to be patched in commit 637b2221
   because _rspamd is uid 107 on this image, not 110).

3. rspamd_keygen called rspamadm on the host PATH — rspamadm only exists
   inside the rspamd-installed LXC, so the function errored out on every
   install. The Phase 2 deploy worked around it manually.

This refactor makes all three write THROUGH the live LXC via lxc-attach:
- Each local.d template is streamed in with `lxc-attach -- tee` (kernel
  resolves the rootfs path; idmap applies to the resulting file uid).
- secrets.inc + worker-controller.inc likewise written via tee, then
  chown'd inside the LXC to _rspamd:_rspamd (kernel maps to the correct
  outside-LXC subuid regardless of image).
- rspamd_keygen takes a `container` arg, runs `rspamadm dkim_keygen`
  inside the LXC, writes the keypair to /etc/rspamd-keys/<domain>/ (the
  bind-mounted path; falls back to /var/lib/rspamd/dkim/ if the bind
  mount isn't active yet), and mirrors the DNS TXT to the host data dir
  for DNS-publishing tooling.
- mailctl's `dkim-keygen` subcommand now delegates to the lib function.
- rspamd-route-sync-patch.sh verifies each write (reads back + asserts
  the entry equals expected) and fails loudly on mismatch — the Phase 2
  deploy needed a manual second pass for the mitmproxy LXC copy.

Pre-conditions: configure_rspamd_milter and configure_rspamd_controller
now require the LXC to be RUNNING (added an explicit lxc-info guard).
This matches the cmd_rspamd install path which starts the LXC via
install_rspamd before configuring.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/secubox-mail/api/main.py

@@ -22,6 +22,12 @@ from secubox_core.config import get_config
 app = FastAPI(title="SecuBox Mail", version="2.2.0")
 config = get_config("mail")
 
+# Phase 2: mount rspamd router + legacy deprecation shims
+from .routers import rspamd as _rspamd_router
+from .routers import legacy as _legacy_router
+app.include_router(_rspamd_router.router)
+app.include_router(_legacy_router.router)
+
 # Canonical config keys (Phase 1 rev. 2). Legacy keys are accepted as
 # fallback for one release so deploys mid-upgrade don't break.
 DATA_PATH = Path(config.get("data_path", "/data/volumes/mail"))
@@ -988,235 +994,6 @@ async def update_settings(settings: SettingsUpdate):
 # DKIM MANAGEMENT
 # =============================================================================
 
-@app.get("/dkim/status", dependencies=[Depends(require_jwt)])
-async def dkim_status():
-    """Get DKIM status"""
-    private_key = DATA_PATH / "dkim" / "default.private"
-    dns_record = DATA_PATH / "dkim" / "default.txt"
-
-    status = {
-        "key_exists": private_key.exists(),
-        "dns_record_exists": dns_record.exists(),
-        "domain": DOMAIN,
-        "selector": "default",
-    }
-
-    # Get DNS record content
-    if dns_record.exists():
-        status["dns_record"] = dns_record.read_text().strip()
-
-    # Check OpenDKIM service in container
-    if lxc_running(MAIL_CONTAINER):
-        success, out, _ = lxc_attach(MAIL_CONTAINER, "pgrep opendkim")
-        status["opendkim_running"] = success
-
-        # Check milter config
-        success, out, _ = lxc_attach(MAIL_CONTAINER, "grep -q smtpd_milters /etc/postfix/main.cf")
-        status["milter_configured"] = success
-    else:
-        status["opendkim_running"] = False
-        status["milter_configured"] = False
-
-    return status
-
-
-@app.post("/dkim/setup", dependencies=[Depends(require_jwt)])
-async def setup_dkim(background_tasks: BackgroundTasks):
-    """Full DKIM setup (keygen + OpenDKIM install + configure)"""
-    def do_setup():
-        subprocess.run(["/usr/sbin/mailserverctl", "dkim", "setup"],
-                      stdout=open("/var/log/mail-dkim.log", "w"),
-                      stderr=subprocess.STDOUT)
-    background_tasks.add_task(do_setup)
-    return {"success": True, "message": "DKIM setup started", "log": "/var/log/mail-dkim.log"}
-
-
-@app.post("/dkim/keygen", dependencies=[Depends(require_jwt)])
-async def dkim_keygen():
-    """Generate DKIM keys only"""
-    success, out, err = run_cmd(["/usr/sbin/mailserverctl", "dkim", "keygen"])
-    if success:
-        # Get the DNS record
-        dns_file = DATA_PATH / "dkim" / "default.txt"
-        dns_record = dns_file.read_text().strip() if dns_file.exists() else ""
-        return {"success": True, "message": "DKIM keys generated", "dns_record": dns_record}
-    raise HTTPException(500, f"Failed: {err}")
-
-
-@app.post("/dkim/sync", dependencies=[Depends(require_jwt)])
-async def dkim_sync():
-    """Sync DKIM keys to container"""
-    success, out, err = run_cmd(["/usr/sbin/mailserverctl", "dkim", "sync"])
-    if success:
-        return {"success": True, "message": "DKIM keys synced to container"}
-    raise HTTPException(500, f"Failed: {err}")
-
-
-@app.get("/dkim/record", dependencies=[Depends(require_jwt)])
-async def get_dkim_record():
-    """Get DKIM DNS record"""
-    dns_file = DATA_PATH / "dkim" / "default.txt"
-    bind_file = DATA_PATH / "dkim" / "default.bind"
-
-    if not dns_file.exists():
-        return {"exists": False}
-
-    result = {
-        "exists": True,
-        "selector": "default",
-        "domain": DOMAIN,
-        "record": dns_file.read_text().strip(),
-    }
-
-    if bind_file.exists():
-        result["bind_format"] = bind_file.read_text().strip()
-
-    return result
-
-
-# =============================================================================
-# SPAMASSASSIN - Spam Filtering
-# =============================================================================
-
-@app.get("/spam/status", dependencies=[Depends(require_jwt)])
-async def spam_status():
-    """Get SpamAssassin status"""
-    rootfs = LXC_PATH / MAIL_CONTAINER / "rootfs"
-
-    status = {
-        "installed": (rootfs / "usr/bin/spamc").exists(),
-        "configured": (rootfs / "etc/spamassassin/local.cf").exists(),
-        "enabled": False,
-        "running": False,
-    }
-
-    # Check if enabled in Postfix
-    main_cf = rootfs / "etc/postfix/main.cf"
-    if main_cf.exists():
-        content = main_cf.read_text()
-        status["enabled"] = "content_filter = spamfilter" in content and \
-                           not "#content_filter = spamfilter" in content
-
-    # Check if spamd is running
-    if lxc_running(MAIL_CONTAINER):
-        success, out, _ = lxc_attach(MAIL_CONTAINER, "pgrep spamd")
-        status["running"] = success
-
-    return status
-
-
-@app.post("/spam/setup", dependencies=[Depends(require_jwt)])
-async def spam_setup(background_tasks: BackgroundTasks):
-    """Full SpamAssassin setup (install + configure + enable)"""
-    def do_setup():
-        subprocess.run(["/usr/sbin/mailserverctl", "spam", "setup"],
-                      stdout=open("/var/log/mail-spam.log", "w"),
-                      stderr=subprocess.STDOUT)
-    background_tasks.add_task(do_setup)
-    return {"success": True, "message": "SpamAssassin setup started",
-            "log": "/var/log/mail-spam.log"}
-
-
-@app.post("/spam/enable", dependencies=[Depends(require_jwt)])
-async def spam_enable():
-    """Enable SpamAssassin filtering"""
-    success, out, err = run_cmd(["/usr/sbin/mailserverctl", "spam", "enable"])
-    if success:
-        return {"success": True, "message": "SpamAssassin enabled"}
-    raise HTTPException(500, f"Failed: {err}")
-
-
-@app.post("/spam/disable", dependencies=[Depends(require_jwt)])
-async def spam_disable():
-    """Disable SpamAssassin filtering"""
-    success, out, err = run_cmd(["/usr/sbin/mailserverctl", "spam", "disable"])
-    if success:
-        return {"success": True, "message": "SpamAssassin disabled"}
-    raise HTTPException(500, f"Failed: {err}")
-
-
-@app.post("/spam/update", dependencies=[Depends(require_jwt)])
-async def spam_update(background_tasks: BackgroundTasks):
-    """Update SpamAssassin rules"""
-    def do_update():
-        subprocess.run(["/usr/sbin/mailserverctl", "spam", "update"],
-                      stdout=open("/var/log/mail-spam-update.log", "w"),
-                      stderr=subprocess.STDOUT)
-    background_tasks.add_task(do_update)
-    return {"success": True, "message": "SpamAssassin rules update started"}
-
-
-# =============================================================================
-# GREYLISTING - Postgrey
-# =============================================================================
-
-@app.get("/grey/status", dependencies=[Depends(require_jwt)])
-async def grey_status():
-    """Get Postgrey greylisting status"""
-    rootfs = LXC_PATH / MAIL_CONTAINER / "rootfs"
-
-    status = {
-        "installed": (rootfs / "usr/sbin/postgrey").exists(),
-        "configured": (rootfs / "etc/default/postgrey").exists(),
-        "enabled": False,
-        "running": False,
-    }
-
-    # Check if enabled in Postfix
-    main_cf = rootfs / "etc/postfix/main.cf"
-    if main_cf.exists():
-        content = main_cf.read_text()
-        status["enabled"] = "check_policy_service inet:127.0.0.1:10023" in content
-
-    # Check if postgrey is running
-    if lxc_running(MAIL_CONTAINER):
-        success, out, _ = lxc_attach(MAIL_CONTAINER, "pgrep postgrey")
-        status["running"] = success
-
-    # Greylisting settings
-    status["settings"] = {
-        "delay": 300,  # 5 minutes initial delay
-        "auto_whitelist_after": 5,
-        "retry_window_days": 2,
-    }
-
-    return status
-
-
-@app.post("/grey/setup", dependencies=[Depends(require_jwt)])
-async def grey_setup(background_tasks: BackgroundTasks):
-    """Full Postgrey setup (install + configure + enable)"""
-    def do_setup():
-        subprocess.run(["/usr/sbin/mailserverctl", "grey", "setup"],
-                      stdout=open("/var/log/mail-grey.log", "w"),
-                      stderr=subprocess.STDOUT)
-    background_tasks.add_task(do_setup)
-    return {"success": True, "message": "Greylisting setup started",
-            "log": "/var/log/mail-grey.log"}
-
-
-@app.post("/grey/enable", dependencies=[Depends(require_jwt)])
-async def grey_enable():
-    """Enable greylisting"""
-    success, out, err = run_cmd(["/usr/sbin/mailserverctl", "grey", "enable"])
-    if success:
-        return {"success": True, "message": "Greylisting enabled"}
-    raise HTTPException(500, f"Failed: {err}")
-
-
-@app.post("/grey/disable", dependencies=[Depends(require_jwt)])
-async def grey_disable():
-    """Disable greylisting"""
-    success, out, err = run_cmd(["/usr/sbin/mailserverctl", "grey", "disable"])
-    if success:
-        return {"success": True, "message": "Greylisting disabled"}
-    raise HTTPException(500, f"Failed: {err}")
-
-
-# =============================================================================
-# CLAMAV - Virus Scanning
-# =============================================================================
-
 @app.get("/av/status", dependencies=[Depends(require_jwt)])
 async def av_status():
     """Get ClamAV antivirus status"""

packages/secubox-mail/api/routers/legacy.py

@@ -0,0 +1,120 @@
+"""Phase 2 deprecation shims. Each handler forwards to a Rspamd-equivalent
+and emits the `X-Deprecated-Endpoint: rspamd` header. Removed in v3.0.
+"""
+from __future__ import annotations
+
+import pathlib
+import subprocess
+
+from fastapi import APIRouter, Depends, Response
+from secubox_core.auth import require_jwt
+
+from .. import rspamd_client
+
+router = APIRouter(tags=["legacy-deprecated"])
+
+
+def _depr(resp: Response) -> None:
+    resp.headers["x-deprecated-endpoint"] = "rspamd"
+
+
+# ─── /dkim/* ──────────────────────────────────────────────────────────────────
+
+@router.get("/dkim/status", dependencies=[Depends(require_jwt)])
+async def dkim_status(response: Response) -> dict:
+    _depr(response)
+    return await rspamd_client.get("/stat")
+
+
+@router.get("/dkim/record", dependencies=[Depends(require_jwt)])
+async def dkim_record(response: Response) -> dict:
+    _depr(response)
+    txt = pathlib.Path("/data/volumes/mail/rspamd/dkim/secubox.in/default.txt")
+    return {"record": txt.read_text() if txt.exists() else None}
+
+
+@router.post("/dkim/setup", dependencies=[Depends(require_jwt)])
+async def dkim_setup(response: Response) -> dict:
+    _depr(response)
+    proc = subprocess.run(
+        ["/usr/sbin/mailctl", "rspamd", "dkim-keygen", "secubox.in", "default"],
+        capture_output=True, text=True, timeout=60,
+    )
+    return {"success": proc.returncode == 0, "stdout": proc.stdout[-500:]}
+
+
+@router.post("/dkim/keygen", dependencies=[Depends(require_jwt)])
+async def dkim_keygen(response: Response) -> dict:
+    _depr(response)
+    return await dkim_setup(response)
+
+
+@router.post("/dkim/sync", dependencies=[Depends(require_jwt)])
+async def dkim_sync(response: Response) -> dict:
+    _depr(response)
+    return {"success": True, "note": "Rspamd reads DKIM keys via bind-mount — no sync needed"}
+
+
+# ─── /spam/* ──────────────────────────────────────────────────────────────────
+
+@router.get("/spam/status", dependencies=[Depends(require_jwt)])
+async def spam_status(response: Response) -> dict:
+    _depr(response)
+    r = await rspamd_client.get("/stat")
+    return {
+        "installed": True,
+        "configured": True,
+        "enabled": "error" not in r,
+        "via": "rspamd",
+        "rspamd_stat": r,
+    }
+
+
+@router.post("/spam/setup", dependencies=[Depends(require_jwt)])
+async def spam_setup(response: Response) -> dict:
+    _depr(response)
+    return {"success": True, "note": "Rspamd is configured at install time"}
+
+
+@router.post("/spam/enable", dependencies=[Depends(require_jwt)])
+async def spam_enable(response: Response) -> dict:
+    _depr(response)
+    return await rspamd_client.post("/reload")
+
+
+@router.post("/spam/disable", dependencies=[Depends(require_jwt)])
+async def spam_disable(response: Response) -> dict:
+    _depr(response)
+    return {"success": False, "error": "disabling Rspamd requires lxc-attach systemctl stop rspamd"}
+
+
+@router.post("/spam/update", dependencies=[Depends(require_jwt)])
+async def spam_update(response: Response) -> dict:
+    _depr(response)
+    return {"success": True, "note": "Rspamd updates via apt-get"}
+
+
+# ─── /grey/* ──────────────────────────────────────────────────────────────────
+
+@router.get("/grey/status", dependencies=[Depends(require_jwt)])
+async def grey_status(response: Response) -> dict:
+    _depr(response)
+    return await rspamd_client.get("/stat")
+
+
+@router.post("/grey/setup", dependencies=[Depends(require_jwt)])
+async def grey_setup(response: Response) -> dict:
+    _depr(response)
+    return {"success": True, "note": "Greylist module lives inside Rspamd (see greylist.conf)"}
+
+
+@router.post("/grey/enable", dependencies=[Depends(require_jwt)])
+async def grey_enable(response: Response) -> dict:
+    _depr(response)
+    return await rspamd_client.post("/reload")
+
+
+@router.post("/grey/disable", dependencies=[Depends(require_jwt)])
+async def grey_disable(response: Response) -> dict:
+    _depr(response)
+    return {"success": False, "error": "set greylist.conf disabled=true via mailctl rspamd reload"}

packages/secubox-mail/api/routers/rspamd.py

@@ -0,0 +1,116 @@
+"""Phase 2 Rspamd router. JWT-protected via Depends(require_jwt)."""
+from __future__ import annotations
+
+import pathlib
+import subprocess
+
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+from secubox_core.auth import require_jwt
+
+from .. import rspamd_client
+
+router = APIRouter(prefix="/rspamd", tags=["rspamd"])
+
+
+# ─── Read endpoints ───────────────────────────────────────────────────────────
+
+@router.get("/status", dependencies=[Depends(require_jwt)])
+async def status() -> dict:
+    """Rspamd stat + module summary."""
+    return await rspamd_client.get("/stat")
+
+
+@router.get("/history", dependencies=[Depends(require_jwt)])
+async def history(limit: int = 100) -> dict:
+    """Recent scan history (truncated)."""
+    return await rspamd_client.get(f"/history?limit={limit}")
+
+
+@router.get("/scores", dependencies=[Depends(require_jwt)])
+async def scores() -> dict:
+    """Top-N rule contributions to recent scores."""
+    return await rspamd_client.get("/graph")
+
+
+# ─── Write endpoints ──────────────────────────────────────────────────────────
+
+@router.post("/reload", dependencies=[Depends(require_jwt)])
+async def reload_rspamd() -> dict:
+    """Graceful Rspamd reload."""
+    return await rspamd_client.post("/reload")
+
+
+class LearnRequest(BaseModel):
+    raw_eml: str | None = None
+    message_id: str | None = None
+
+
+@router.post("/learn-spam", dependencies=[Depends(require_jwt)])
+async def learn_spam(req: LearnRequest) -> dict:
+    if req.raw_eml:
+        return await rspamd_client.post("/learnspam", body=req.raw_eml.encode())
+    if req.message_id:
+        return {"error": "message_id learning requires Phase 5 Roundcube integration"}
+    return {"error": "either raw_eml or message_id required"}
+
+
+@router.post("/learn-ham", dependencies=[Depends(require_jwt)])
+async def learn_ham(req: LearnRequest) -> dict:
+    if req.raw_eml:
+        return await rspamd_client.post("/learnham", body=req.raw_eml.encode())
+    if req.message_id:
+        return {"error": "message_id learning requires Phase 5 Roundcube integration"}
+    return {"error": "either raw_eml or message_id required"}
+
+
+# ─── Whitelist (Phase 2 = read; write deferred to Phase 8) ───────────────────
+
+class WhitelistEntry(BaseModel):
+    address: str
+    type: str = "from"   # from | rcpt | ip
+
+
+@router.get("/whitelist", dependencies=[Depends(require_jwt)])
+async def whitelist_list() -> dict:
+    return await rspamd_client.get("/maps")
+
+
+@router.post("/whitelist", dependencies=[Depends(require_jwt)])
+async def whitelist_add(entry: WhitelistEntry) -> dict:
+    return {"error": "whitelist add requires Phase 8 admin UI", "entry": entry.model_dump()}
+
+
+@router.delete("/whitelist/{entry_id}", dependencies=[Depends(require_jwt)])
+async def whitelist_del(entry_id: str) -> dict:
+    return {"error": "whitelist delete requires Phase 8 admin UI", "id": entry_id}
+
+
+# ─── DKIM ─────────────────────────────────────────────────────────────────────
+
+@router.get("/dkim/{domain}", dependencies=[Depends(require_jwt)])
+async def dkim_status(domain: str) -> dict:
+    """Show DKIM key info for a domain."""
+    base = pathlib.Path(f"/data/volumes/mail/rspamd/dkim/{domain}")
+    key = base / "default.key"
+    txt = base / "default.txt"
+    return {
+        "domain": domain,
+        "selector": "default",
+        "key_present": key.exists(),
+        "dns_txt": txt.read_text() if txt.exists() else None,
+    }
+
+
+@router.post("/dkim/{domain}/keygen", dependencies=[Depends(require_jwt)])
+async def dkim_keygen(domain: str) -> dict:
+    """Run mailctl rspamd dkim-keygen for the given domain."""
+    proc = subprocess.run(
+        ["/usr/sbin/mailctl", "rspamd", "dkim-keygen", domain, "default"],
+        capture_output=True, text=True, timeout=60,
+    )
+    return {
+        "success": proc.returncode == 0,
+        "stdout": proc.stdout[-500:],
+        "stderr": proc.stderr[-500:],
+    }

packages/secubox-mail/api/rspamd_client.py

@@ -0,0 +1,65 @@
+"""Thin async wrapper around the Rspamd HTTP controller.
+
+The controller listens on http://10.100.0.10:11334 (the mail LXC).
+- Read endpoints (`/stat`, `/history`, `/graph`) accept `Password:` header.
+- Write endpoints (`/learnspam`, `/learnham`, `/reload`) accept the same.
+- Phase 2 uses one password for both (sourced from
+  /etc/secubox/secrets/rspamd-controller.pw).
+"""
+from __future__ import annotations
+
+import os
+import pathlib
+from typing import Any
+
+import httpx
+
+_RSPAMD_BASE = os.environ.get("RSPAMD_BASE", "http://10.100.0.10:11334")
+_SECRET_PATH = pathlib.Path("/etc/secubox/secrets/rspamd-controller.pw")
+_TIMEOUT = httpx.Timeout(5.0, connect=2.0)
+
+
+def _password() -> str:
+    if not _SECRET_PATH.exists():
+        return ""
+    return _SECRET_PATH.read_text().strip()
+
+
+def _headers() -> dict:
+    pw = _password()
+    return {"Password": pw} if pw else {}
+
+
+async def get(path: str) -> dict[str, Any]:
+    """GET `path`. Returns the parsed JSON body or `{error, ...}` on failure."""
+    try:
+        async with httpx.AsyncClient(base_url=_RSPAMD_BASE, timeout=_TIMEOUT) as c:
+            r = await c.get(path, headers=_headers())
+            if r.status_code >= 400:
+                return {"error": f"rspamd {r.status_code}", "body": r.text[:200]}
+            ct = r.headers.get("content-type", "")
+            if ct.startswith("application/json"):
+                return r.json()
+            return {"raw": r.text}
+    except (httpx.ConnectError, httpx.TimeoutException) as e:
+        return {"error": "rspamd unreachable", "detail": str(e)}
+
+
+async def post(path: str, body: dict | bytes | str | None = None) -> dict[str, Any]:
+    """POST `path` with optional `body`."""
+    try:
+        async with httpx.AsyncClient(base_url=_RSPAMD_BASE, timeout=_TIMEOUT) as c:
+            kwargs: dict[str, Any] = {"headers": _headers()}
+            if isinstance(body, dict):
+                kwargs["json"] = body
+            elif body is not None:
+                kwargs["content"] = body
+            r = await c.post(path, **kwargs)
+            if r.status_code >= 400:
+                return {"error": f"rspamd {r.status_code}", "body": r.text[:200]}
+            ct = r.headers.get("content-type", "")
+            if ct.startswith("application/json"):
+                return r.json()
+            return {"raw": r.text}
+    except (httpx.ConnectError, httpx.TimeoutException) as e:
+        return {"error": "rspamd unreachable", "detail": str(e)}

packages/secubox-mail/api/tests/test_phase2_endpoints.py

@@ -0,0 +1,28 @@
+"""Phase 2: /rspamd/* new endpoints + legacy deprecation shims."""
+import pathlib
+import sys
+
+import pytest
+from fastapi.testclient import TestClient
+
+sys.path.insert(0, str(pathlib.Path(__file__).parents[2]))
+from api.main import app  # noqa: E402
+
+client = TestClient(app)
+
+NEW_ROUTES: list[tuple[str, str]] = []
+LEGACY_SHIMS: list[tuple[str, str]] = []
+
+
+@pytest.mark.parametrize("method,path", NEW_ROUTES)
+def test_new_route_responds(method, path):
+    resp = client.request(method, path, json={})
+    assert resp.status_code < 500, f"{method} {path} → {resp.status_code}"
+
+
+@pytest.mark.parametrize("method,path", LEGACY_SHIMS)
+def test_legacy_shim_has_deprecation_header(method, path):
+    resp = client.request(method, path, json={})
+    assert resp.status_code < 500, f"{method} {path} → {resp.status_code}"
+    assert resp.headers.get("x-deprecated-endpoint") == "rspamd", \
+        f"{method} {path} missing deprecation header"

packages/secubox-mail/config/mail.toml

@@ -1,11 +1,11 @@
-# SecuBox Mail Server Configuration — Phase 1 rev. 2 (single LXC, canonical paths)
+# SecuBox Mail Server Configuration — Phase 2 rev. 3 (3-LXC topology)
 
 [mail]
 enabled = true
 domain = "secubox.local"
 hostname = "mail"
 
-# Single consolidated LXC (Phase 1 rev. 2)
+# Single mail (MTA/MDA) LXC; webmail lives in roundcube + horde LXCs (rev. 3)
 container = "mail"
 lxc_ip = "10.100.0.10"
 lxc_bridge = "br-lxc"
@@ -13,9 +13,19 @@ lxc_gateway = "10.100.0.1"
 lxc_path = "/var/lib/lxc"
 data_path = "/data/volumes/mail"
 
-# Webmail is served by the same LXC; this URL is the host-side proxy target
-webmail_url = "https://webmail.gk2.secubox.in"
+# Webmail URLs (separate LXCs from rev. 3)
+webmail_url = "https://webmail.gk2.secubox.in"   # roundcube LXC 10.100.0.12
+horde_url   = "https://horde.gk2.secubox.in"      # horde LXC 10.100.0.11
 
 # SSL settings
 ssl_provider = "acme"   # acme | manual | none
 acme_email = ""
+
+# Phase 2 — Rspamd config
+[mail.rspamd]
+# Single-domain DKIM (secubox.in / default). Phase 3 widens to multi-domain.
+greylist = true
+bayes_autolearn = true
+ratelimit_outbound = "200/h/user"
+web_ui = true
+web_ui_host = "rspamd.gk2.secubox.in"

packages/secubox-mail/debian/changelog

@@ -1,3 +1,35 @@
+secubox-mail (2.3.0-1~bookworm1) bookworm; urgency=medium
+
+  * Phase 2 — Rspamd migration. Adds Rspamd as a single Postfix milter
+    handling greylisting + spam scoring + DKIM sign/verify + SPF + DMARC
+    + ARC + outbound rate-limit. SpamAssassin + OpenDKIM are purged from
+    the mail LXC after Rspamd is verified healthy (D9 gate in
+    rspamd_purge_legacy).
+  * New lib/mail/rspamd.sh + 9 Rspamd config templates + Postfix milter
+    snippet.
+  * mailctl gains the rspamd subcommand (install / start / stop / status
+    / dkim-keygen / dns-records / learn-spam / learn-ham / purge-legacy).
+  * FastAPI gains /api/v1/mail/rspamd/* under routers/rspamd.py
+    (status, history, scores, reload, learn-{spam,ham}, whitelist CRUD,
+    dkim/{domain}/{status,keygen}).
+  * Legacy /dkim/* /spam/* /grey/* endpoints (14 total) move from inline
+    main.py handlers to routers/legacy.py as deprecation shims emitting
+    X-Deprecated-Endpoint: rspamd. Removed in v3.0.
+  * install_mail_packages: adds rspamd + redis-server (Phase 8 backend);
+    enables postfix/dovecot/rspamd at LXC boot (Phase 1 follow-up).
+    Drops Apache+Roundcube — they now live in the roundcube LXC after
+    the rev. 3 topology split.
+  * mail.toml: new [mail.rspamd] section (greylist, bayes_autolearn,
+    ratelimit_outbound=200/h/user, web_ui_host=rspamd.gk2.secubox.in).
+    Adds horde_url next to webmail_url.
+  * postinst on upgrade <2.3: generates /etc/secubox/secrets/rspamd-
+    controller.pw, mkdir/chown /data/volumes/mail/rspamd/{dkim,bayes,
+    history,settings}.
+  * New python3-httpx dep for rspamd_client.py.
+  * Closes: #153
+
+ -- Gerald KERMA <devel@cybermind.fr>  Sat, 16 May 2026 11:00:00 +0200
+
 secubox-mail (2.2.0-1~bookworm1) bookworm; urgency=medium
 
   * Phase 1 source-catch-up: canonical paths /var/lib/lxc/mail +

packages/secubox-mail/debian/control

@@ -7,7 +7,7 @@ Standards-Version: 4.6.2
 
 Package: secubox-mail
 Architecture: all
-Depends: ${misc:Depends}, secubox-core (>= 1.0.0), lxc, debootstrap, openssl
+Depends: ${misc:Depends}, secubox-core (>= 1.0.0), lxc, debootstrap, openssl, python3-httpx
 Breaks: secubox-mail-lxc (<< 2.2), secubox-webmail (<< 2.2), secubox-webmail-lxc (<< 2.2)
 Replaces: secubox-mail-lxc (<< 2.2), secubox-webmail (<< 2.2), secubox-webmail-lxc (<< 2.2)
 Suggests: acme.sh

packages/secubox-mail/debian/postinst

@@ -14,6 +14,22 @@ if [ "$1" = "configure" ]; then
         fi
     fi
 
+    # Phase 2: on upgrade from < 2.3, provision Rspamd secrets + data dirs.
+    if dpkg --compare-versions "${2:-0}" lt-nl 2.3.0; then
+        install -d -m 0700 /etc/secubox/secrets
+        if [ ! -s /etc/secubox/secrets/rspamd-controller.pw ]; then
+            openssl rand -base64 24 > /etc/secubox/secrets/rspamd-controller.pw
+            chmod 0600 /etc/secubox/secrets/rspamd-controller.pw
+        fi
+        install -d -m 0750 /data/volumes/mail/rspamd \
+                           /data/volumes/mail/rspamd/dkim \
+                           /data/volumes/mail/rspamd/bayes \
+                           /data/volumes/mail/rspamd/history \
+                           /data/volumes/mail/rspamd/settings
+        # _rspamd uid in unprivileged LXC = 100110 (5000 + 100000-ish; safe to chown blindly)
+        chown -R 100110:100110 /data/volumes/mail/rspamd 2>/dev/null || true
+    fi
+
     systemctl daemon-reload
     systemctl enable secubox-mail.service || true
     systemctl start secubox-mail.service || true

packages/secubox-mail/debian/rules

@@ -11,6 +11,10 @@ override_dh_auto_install:
 	install -d debian/secubox-mail/usr/lib/secubox/mail/lib
 	[ -d lib/mail ] && cp -r lib/mail/. debian/secubox-mail/usr/lib/secubox/mail/lib/ || true
 
+	# Rspamd config templates (Phase 2)
+	install -d debian/secubox-mail/usr/lib/secubox/mail/templates/rspamd/local.d
+	[ -d templates/rspamd ] && cp -r templates/rspamd/. debian/secubox-mail/usr/lib/secubox/mail/templates/rspamd/ || true
+
 	# Control scripts (sbin)
 	install -d debian/secubox-mail/usr/sbin
 	[ -d sbin ] && install -m 755 sbin/* debian/secubox-mail/usr/sbin/ || true

packages/secubox-mail/lib/mail/install.sh

@@ -49,17 +49,26 @@ install_mail_packages() {
     local container="$1"
     local rootfs="${LXC_BASE:-/var/lib/lxc}/$container/rootfs"
 
-    echo "[install] installing Postfix + Dovecot inside $rootfs..."
+    echo "[install] installing Postfix + Dovecot + Rspamd inside $rootfs..."
     chroot "$rootfs" /bin/bash <<'CHROOT_EOF'
 export DEBIAN_FRONTEND=noninteractive
 apt-get update
+# Phase 2 (rev. 3): mail LXC = MTA + MDA + Rspamd only.
+# Apache/Roundcube live in the roundcube LXC; no webmail packages here.
 apt-get install -y --no-install-recommends \
     postfix postfix-lmdb \
     dovecot-core dovecot-imapd dovecot-pop3d dovecot-lmtpd \
+    rspamd redis-server \
     rsyslog ca-certificates openssl
 
+# Redis is the future bayes/ratelimit backend (Phase 8); keep it disabled.
+systemctl disable redis-server.service 2>/dev/null || true
+
 groupadd -g 5000 vmail 2>/dev/null || true
-useradd -u 5000 -g vmail -s /usr/sbin/nologin -d /var/mail -M vmail 2>/dev/null || true
+useradd -u 5000 -g vmail -s /usr/sbin/nologin -d /var/vmail -M vmail 2>/dev/null || true
+
+# Phase 1 follow-up: ensure Postfix + Dovecot autostart on LXC boot.
+systemctl enable postfix dovecot rspamd
 
 apt-get clean
 rm -rf /var/lib/apt/lists/*

packages/secubox-mail/lib/mail/rspamd.sh

@@ -0,0 +1,265 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+# Source-Disclosed License — All rights reserved except as expressly granted.
+# See LICENCE-CMSD-1.0.md for terms.
+
+# SecuBox-Deb :: mail :: Phase 2 Rspamd helpers (install + configure + dkim).
+# Sourced library — do not execute directly.
+
+# Re-entry guard — Phase 1 lesson. If a parent process re-sources this lib in
+# a tight loop (e.g. through a deprecated shim that exec's back to mailctl)
+# we will see SECUBOX_RSPAMD_SH_LOADED set and abort to break the recursion.
+if [ "${_SECUBOX_RSPAMD_SH_LOADED:-0}" = "1" ]; then
+    echo "rspamd.sh re-loaded — possible recursion, aborting" >&2
+    return 1 2>/dev/null || exit 1
+fi
+export _SECUBOX_RSPAMD_SH_LOADED=1
+
+# ─── install_rspamd ───────────────────────────────────────────────────────────
+# Install Rspamd inside the named LXC. Idempotent — reruns are safe.
+# Caller must ensure the LXC is RUNNING (we apt inside it).
+install_rspamd() {
+    local container="$1"
+    [ -n "$container" ] || { echo "install_rspamd: container required" >&2; return 1; }
+    if ! lxc-info -n "$container" 2>/dev/null | grep -q "State:.*RUNNING"; then
+        echo "install_rspamd: LXC '$container' is not running" >&2
+        return 1
+    fi
+
+    echo "[rspamd] installing inside LXC $container..."
+    lxc-attach -n "$container" -- bash -c '
+        set -euo pipefail
+        export DEBIAN_FRONTEND=noninteractive
+        if dpkg -l rspamd 2>/dev/null | grep -q "^ii"; then
+            echo "[rspamd] already installed"
+            exit 0
+        fi
+        apt-get update -qq
+        apt-get install -y --no-install-recommends rspamd redis-server
+        # Redis is here as the future bayes/ratelimit backend; Phase 2 uses
+        # sqlite defaults but having Redis installed means a Phase 8 switch
+        # is config-only, not apt.
+        systemctl disable redis-server.service 2>/dev/null || true
+        apt-get clean
+        rm -rf /var/lib/apt/lists/*
+    '
+    echo "[rspamd] package installed in $container"
+}
+
+# ─── configure_rspamd_milter ──────────────────────────────────────────────────
+# Render 8 of the 9 local.d templates inside the live LXC via `lxc-attach`
+# (worker-controller.inc is handled separately because it bind-mounts
+# secrets.inc). Set up host-side data dirs + bind-mount entries.
+#
+# Phase 2 lesson (commit 637b2221): writing through the host-side rootfs path
+# `${LXC_BASE}/${container}/rootfs/etc/rspamd/local.d/` is brittle — on this
+# board the runtime rootfs lives at `/data/lxc/mail/rootfs/` per `lxc.rootfs.
+# path`, while `/var/lib/lxc/mail/rootfs/` is a stale shell that the running
+# LXC does not see. Streaming each file through `lxc-attach -- tee` avoids
+# guessing the rootfs path and lets the kernel resolve idmap on writes.
+configure_rspamd_milter() {
+    local container="$1"
+    [ -n "$container" ] || { echo "configure_rspamd_milter: container required" >&2; return 1; }
+    local templates="${TEMPLATES_DIR:-/usr/lib/secubox/mail/templates}/rspamd"
+    local data="${DATA_PATH:-/data/volumes/mail}"
+
+    if ! lxc-info -n "$container" 2>/dev/null | grep -q "State:.*RUNNING"; then
+        echo "configure_rspamd_milter: LXC '$container' is not running" >&2
+        return 1
+    fi
+
+    lxc-attach -n "$container" -- install -d -m 0755 /etc/rspamd/local.d
+    for f in options.inc worker-proxy.inc worker-normal.inc \
+             dkim_signing.conf arc.conf dmarc.conf \
+             greylist.conf ratelimit.conf; do
+        [ -f "$templates/local.d/$f" ] || {
+            echo "configure_rspamd_milter: template $templates/local.d/$f missing" >&2
+            return 1
+        }
+        lxc-attach -n "$container" -- tee "/etc/rspamd/local.d/$f" >/dev/null < "$templates/local.d/$f"
+        lxc-attach -n "$container" -- chmod 0644 "/etc/rspamd/local.d/$f"
+    done
+
+    # Persistent data dirs on host — chown via lxc-attach so the kernel maps
+    # _rspamd uid (varies per image: 107 in Debian 12 default; 110 in some
+    # rspamd-only minimal builds) to the right outside-LXC subuid.
+    install -d -m 0750 "$data/rspamd/dkim" "$data/rspamd/bayes" \
+                       "$data/rspamd/history" "$data/rspamd/settings"
+
+    # Add bind-mount entries to the LXC config (idempotent). Note: requires
+    # a `lxc-stop && lxc-start` cycle of the container to activate — these
+    # entries are not pickup-on-the-fly. Caller (mailctl) is expected to do
+    # the restart before generating DKIM keys.
+    local lxc_conf="${LXC_BASE:-/var/lib/lxc}/$container/config"
+    if [ -f "$lxc_conf" ] && ! grep -q "/etc/rspamd-keys" "$lxc_conf"; then
+        cat >> "$lxc_conf" <<EOF
+
+# Phase 2 Rspamd bind mounts (added by configure_rspamd_milter)
+lxc.mount.entry = $data/rspamd/dkim    etc/rspamd-keys              none bind,create=dir 0 0
+lxc.mount.entry = $data/rspamd/bayes   var/lib/rspamd/bayes         none bind,create=dir 0 0
+lxc.mount.entry = $data/rspamd/history var/lib/rspamd/history       none bind,create=dir 0 0
+lxc.mount.entry = $data/rspamd/settings var/lib/rspamd/settings     none bind,create=dir 0 0
+EOF
+        echo "[rspamd] bind-mount entries appended to $lxc_conf — restart $container to activate"
+    fi
+    echo "[rspamd] milter config rendered in $container"
+}
+
+# ─── configure_rspamd_controller ──────────────────────────────────────────────
+# Provision the controller password on the host + render secrets.inc inside the
+# LXC. Phase 2 uses plaintext password protected by filesystem ACL; Phase 8 may
+# switch to a hashed password (rspamadm pw -e).
+configure_rspamd_controller() {
+    local container="$1"
+    [ -n "$container" ] || { echo "configure_rspamd_controller: container required" >&2; return 1; }
+    local templates="${TEMPLATES_DIR:-/usr/lib/secubox/mail/templates}/rspamd"
+    local secret_host="/etc/secubox/secrets/rspamd-controller.pw"
+
+    if ! lxc-info -n "$container" 2>/dev/null | grep -q "State:.*RUNNING"; then
+        echo "configure_rspamd_controller: LXC '$container' is not running" >&2
+        return 1
+    fi
+
+    install -d -m 0700 /etc/secubox/secrets
+    if [ ! -s "$secret_host" ]; then
+        openssl rand -base64 24 > "$secret_host"
+        chmod 0600 "$secret_host"
+    fi
+
+    [ -f "$templates/local.d/worker-controller.inc" ] || {
+        echo "configure_rspamd_controller: template worker-controller.inc missing" >&2
+        return 1
+    }
+    lxc-attach -n "$container" -- tee /etc/rspamd/local.d/worker-controller.inc >/dev/null \
+        < "$templates/local.d/worker-controller.inc"
+    lxc-attach -n "$container" -- chmod 0644 /etc/rspamd/local.d/worker-controller.inc
+
+    local pw
+    pw=$(tr -d '\n' < "$secret_host")
+    lxc-attach -n "$container" -- tee /etc/rspamd/local.d/secrets.inc >/dev/null <<EOF_INC
+password = "$pw";
+enable_password = "$pw";
+EOF_INC
+    # Resolve _rspamd uid/gid via the LXC itself — the host's 100110 ≠ _rspamd
+    # on all Debian images (107 on the Phase 2 deploy image). Run chown from
+    # inside the container so the kernel applies idmap automatically.
+    lxc-attach -n "$container" -- chown _rspamd:_rspamd /etc/rspamd/local.d/secrets.inc 2>/dev/null || true
+    lxc-attach -n "$container" -- chmod 0640 /etc/rspamd/local.d/secrets.inc 2>/dev/null || true
+    echo "[rspamd] controller secret provisioned"
+}
+
+# ─── configure_rspamd_postfix_milter ──────────────────────────────────────────
+# Append the smtpd_milters block to Postfix main.cf. Idempotent — looks for
+# the unique sentinel comment before appending.
+configure_rspamd_postfix_milter() {
+    local container="$1"
+    local main_cf="${DATA_PATH:-/data/volumes/mail}/config/main.cf"
+    local templates="${TEMPLATES_DIR:-/usr/lib/secubox/mail/templates}/rspamd"
+    if grep -q "Phase 2 Rspamd milter" "$main_cf" 2>/dev/null; then
+        echo "[rspamd] Postfix milter snippet already present in $main_cf"
+        return 0
+    fi
+    cat "$templates/postfix-milter-snippet.cf" >> "$main_cf"
+    echo "[rspamd] appended Postfix milter snippet to $main_cf"
+}
+
+# ─── configure_rspamd_dkim / rspamd_keygen / rspamd_dns_records ───────────────
+configure_rspamd_dkim() {
+    local container="$1"
+    local domain="${2:-secubox.in}"
+    local selector="${3:-default}"
+    local data="${DATA_PATH:-/data/volumes/mail}"
+
+    [ -n "$container" ] || { echo "configure_rspamd_dkim: container required" >&2; return 1; }
+    install -d -m 0750 "$data/rspamd/dkim/$domain"
+
+    if [ ! -f "$data/rspamd/dkim/$domain/$selector.key" ]; then
+        rspamd_keygen "$container" "$domain" "$selector"
+    fi
+}
+
+# Generate a 2048-bit DKIM keypair via `rspamadm dkim_keygen` *inside* the
+# named LXC — rspamadm is shipped by the rspamd package and is only on PATH
+# inside the container. Phase 2 lesson (commit 637b2221): the previous host-
+# side variant errored out with "rspamadm not on PATH".
+rspamd_keygen() {
+    local container="$1"
+    local domain="$2"
+    local selector="${3:-default}"
+    local data="${DATA_PATH:-/data/volumes/mail}"
+
+    [ -n "$container" ] || { echo "rspamd_keygen: container required" >&2; return 1; }
+    [ -n "$domain" ]    || { echo "rspamd_keygen: domain required" >&2; return 1; }
+    if ! lxc-info -n "$container" 2>/dev/null | grep -q "State:.*RUNNING"; then
+        echo "rspamd_keygen: LXC '$container' is not running" >&2
+        return 1
+    fi
+
+    # Output dir inside the LXC — relies on the `/etc/rspamd-keys` bind mount
+    # added by configure_rspamd_milter. If that mount isn't active, fall back
+    # to writing into /var/lib/rspamd which is always present in the LXC.
+    local outdir="/etc/rspamd-keys/$domain"
+    if ! lxc-attach -n "$container" -- test -d /etc/rspamd-keys 2>/dev/null; then
+        outdir="/var/lib/rspamd/dkim/$domain"
+        echo "[rspamd] /etc/rspamd-keys bind mount not active — falling back to $outdir" >&2
+    fi
+
+    lxc-attach -n "$container" -- install -d -m 0750 "$outdir"
+    lxc-attach -n "$container" -- chown _rspamd:_rspamd "$outdir" 2>/dev/null || true
+
+    # rspamadm writes the key to -k <path> and prints the DNS TXT to stdout.
+    # Capture the TXT alongside the key.
+    lxc-attach -n "$container" -- bash -c "
+        set -euo pipefail
+        rspamadm dkim_keygen -d '$domain' -s '$selector' -b 2048 \
+            -k '$outdir/$selector.key' > '$outdir/$selector.txt'
+        chown _rspamd:_rspamd '$outdir/$selector.key' '$outdir/$selector.txt'
+        chmod 0600 '$outdir/$selector.key'
+        chmod 0644 '$outdir/$selector.txt'
+    "
+
+    # Mirror the public TXT to the host-side data dir so external tooling
+    # (e.g. DNS-publishing scripts on the orchestrator) can read it without
+    # entering the LXC.
+    local host_dir="$data/rspamd/dkim/$domain"
+    install -d -m 0750 "$host_dir"
+    if [ "$outdir" = "/etc/rspamd-keys/$domain" ]; then
+        # Bind-mount path — already visible at $host_dir on the host.
+        :
+    else
+        # Fallback path inside the LXC rootfs; copy out via lxc-attach.
+        lxc-attach -n "$container" -- cat "$outdir/$selector.txt" > "$host_dir/$selector.txt"
+    fi
+    echo "[rspamd] DKIM keypair generated: $outdir/$selector.key (DNS TXT in $host_dir/$selector.txt)"
+}
+
+rspamd_dns_records() {
+    local domain="$1"
+    local selector="${2:-default}"
+    local data="${DATA_PATH:-/data/volumes/mail}"
+    local txtfile="$data/rspamd/dkim/$domain/$selector.txt"
+    [ -f "$txtfile" ] || { echo "no DNS record for $domain/$selector" >&2; return 1; }
+    cat "$txtfile"
+}
+
+# ─── rspamd_purge_legacy ──────────────────────────────────────────────────────
+# Per spec D9: refuse to purge SA/OpenDKIM unless Rspamd is healthy.
+rspamd_purge_legacy() {
+    local container="$1"
+    [ -n "$container" ] || { echo "rspamd_purge_legacy: container required" >&2; return 1; }
+
+    if ! lxc-attach -n "$container" -- rspamc -h 127.0.0.1:11334 stat >/dev/null 2>&1; then
+        echo "rspamd_purge_legacy: refusing — Rspamd not healthy on $container:11334" >&2
+        return 1
+    fi
+
+    echo "[rspamd] Rspamd healthy; purging SA + OpenDKIM from $container..."
+    lxc-attach -n "$container" -- bash -c '
+        systemctl stop opendkim spamassassin spamd 2>/dev/null || true
+        systemctl disable opendkim spamassassin spamd 2>/dev/null || true
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get purge -y opendkim opendkim-tools spamassassin spamc spamd 2>&1 | tail -3
+    '
+    echo "[rspamd] legacy purge complete"
+}

packages/secubox-mail/sbin/mailctl

@@ -828,6 +828,84 @@ PY
     log "config migrated to single-container schema"
 }
 
+# ============================================================================
+# Phase 2 — Rspamd subcommand
+# ============================================================================
+
+cmd_rspamd() {
+    [ "$(id -u)" -eq 0 ] || { error "Root required"; return 1; }
+    : "${LIB_DIR:=/usr/lib/secubox/mail/lib}"
+    [ -f "$LIB_DIR/rspamd.sh" ] || LIB_DIR="$(dirname "$0")/../lib/mail"
+    # shellcheck source=/dev/null
+    source "$LIB_DIR/rspamd.sh"
+
+    local sub="${1:-status}"
+    shift || true
+    case "$sub" in
+        install)
+            LXC_BASE="$LXC_PATH" install_rspamd "$CONTAINER"
+            LXC_BASE="$LXC_PATH" configure_rspamd_milter "$CONTAINER"
+            LXC_BASE="$LXC_PATH" configure_rspamd_controller "$CONTAINER"
+            LXC_BASE="$LXC_PATH" configure_rspamd_dkim "$CONTAINER" "$DOMAIN" "default"
+            LXC_BASE="$LXC_PATH" configure_rspamd_postfix_milter "$CONTAINER"
+            log "Rspamd installed. Start with: mailctl rspamd start"
+            ;;
+        start|restart)
+            lxc-attach -n "$CONTAINER" -- systemctl restart rspamd
+            ;;
+        stop)
+            lxc-attach -n "$CONTAINER" -- systemctl stop rspamd
+            ;;
+        reload)
+            lxc-attach -n "$CONTAINER" -- systemctl reload rspamd
+            ;;
+        status)
+            lxc-attach -n "$CONTAINER" -- rspamc stat 2>&1 | head -40
+            ;;
+        dkim-keygen)
+            local domain="${1:-$DOMAIN}"
+            local sel="${2:-default}"
+            # Delegate to the lib function — runs rspamadm inside the LXC and
+            # resolves _rspamd uid via kernel idmap (image-agnostic).
+            LXC_BASE="$LXC_PATH" DATA_PATH="$DATA_PATH" \
+                rspamd_keygen "$CONTAINER" "$domain" "$sel"
+            log "DKIM keypair generated for $domain (selector $sel)"
+            ;;
+        dns-records)
+            local domain="${1:-$DOMAIN}"
+            local sel="${2:-default}"
+            cat "$DATA_PATH/rspamd/dkim/$domain/$sel.txt" 2>/dev/null \
+                || error "no DNS record for $domain/$sel"
+            ;;
+        learn-spam)
+            local target="${1:-}"
+            [ -n "$target" ] || { echo "Usage: mailctl rspamd learn-spam <maildir-or-file>"; return 1; }
+            lxc-attach -n "$CONTAINER" -- rspamc learn_spam "$target"
+            ;;
+        learn-ham)
+            local target="${1:-}"
+            [ -n "$target" ] || { echo "Usage: mailctl rspamd learn-ham <maildir-or-file>"; return 1; }
+            lxc-attach -n "$CONTAINER" -- rspamc learn_ham "$target"
+            ;;
+        purge-legacy)
+            LXC_BASE="$LXC_PATH" rspamd_purge_legacy "$CONTAINER"
+            ;;
+        *)
+            cat <<USAGE
+Usage:
+  mailctl rspamd install
+  mailctl rspamd start | stop | restart | reload
+  mailctl rspamd status
+  mailctl rspamd dkim-keygen [<domain>] [<selector>]
+  mailctl rspamd dns-records [<domain>] [<selector>]
+  mailctl rspamd learn-spam <maildir-or-file>
+  mailctl rspamd learn-ham  <maildir-or-file>
+  mailctl rspamd purge-legacy            # purge SA/OpenDKIM after Rspamd verified
+USAGE
+            ;;
+    esac
+}
+
 # ============================================================================
 # Main
 # ============================================================================
@@ -842,6 +920,8 @@ case "${1:-}" in
     uninstall)   shift; cmd_uninstall "$@" ;;
     migrate)     shift; cmd_migrate "$@" ;;
     migrate-config) shift; cmd_migrate_config "$@" ;;
+    # Phase 2 — Rspamd
+    rspamd)      shift; cmd_rspamd "$@" ;;
     # Service control
     start)       shift; cmd_start "$@" ;;
     stop)        shift; cmd_stop "$@" ;;

packages/secubox-mail/sbin/rspamd-route-sync-patch.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+#
+# Phase 2 deploy-time helper. Idempotently makes the board's
+# /usr/local/bin/sync-mitmproxy-routes.sh treat 10.100.0.10–.12 as
+# live containers (mail/horde/roundcube) instead of "dead" ones that
+# get auto-rerouted to webui.
+#
+# Also adds the rspamd.gk2.secubox.in entry to /srv/mitmproxy/haproxy-routes.json
+# (host copy AND mitmproxy LXC copy) so the Rspamd web UI is reachable via WAF.
+
+set -euo pipefail
+
+SCRIPT=/usr/local/bin/sync-mitmproxy-routes.sh
+if [ -f "$SCRIPT" ]; then
+    # Remove 10.100.0.10, .11, .12 from DEAD_CONTAINER_IPS if present (idempotent).
+    for ip in 10.100.0.10 10.100.0.11 10.100.0.12; do
+        sed -i "s| ${ip}||g" "$SCRIPT" || true
+    done
+    if grep -q '^DEAD_CONTAINER_IPS=' "$SCRIPT"; then
+        echo "[phase2] DEAD_CONTAINER_IPS now: $(grep '^DEAD_CONTAINER_IPS=' "$SCRIPT")"
+    fi
+else
+    echo "[phase2] $SCRIPT not found — skipping sync-script patch"
+fi
+
+# Apply the route in two places (host + mitmproxy LXC) and detect/repair drift.
+#
+# Phase 2 lesson (deploy 2026-05-16): the host copy update succeeded but the
+# LXC copy did not on first run — gate 11 of the smoke caught it. We now
+# verify each write reads back the expected value and fail loudly if not.
+
+RSPAMD_HOST="${RSPAMD_HOST:-10.100.0.10}"
+RSPAMD_CTRL_PORT="${RSPAMD_CTRL_PORT:-11334}"
+RSPAMD_FQDN="${RSPAMD_FQDN:-rspamd.gk2.secubox.in}"
+
+apply_route_python() {
+    # stdin: json path
+    # args: fqdn host port
+    python3 - "$@" <<'PY'
+import json, sys
+path, fqdn, host, port = sys.argv[1], sys.argv[2], sys.argv[3], int(sys.argv[4])
+try:
+    d = json.load(open(path))
+except FileNotFoundError:
+    print(f"[phase2] {path} not present — created with single entry")
+    d = {}
+expected = [host, port]
+d[fqdn] = expected
+json.dump(d, open(path, "w"), indent=2)
+# Read back + verify
+verify = json.load(open(path))
+got = verify.get(fqdn)
+if got != expected:
+    print(f"[phase2] FAILED verify in {path}: got {got!r}, expected {expected!r}", file=sys.stderr)
+    sys.exit(1)
+print(f"[phase2] {path}: {fqdn} → {expected}")
+PY
+}
+
+# 1) Host copy.
+HOST_JSON=/srv/mitmproxy/haproxy-routes.json
+if [ -d "$(dirname "$HOST_JSON")" ]; then
+    apply_route_python "$HOST_JSON" "$RSPAMD_FQDN" "$RSPAMD_HOST" "$RSPAMD_CTRL_PORT"
+else
+    echo "[phase2] $(dirname "$HOST_JSON") not present, skipping host copy"
+fi
+
+# 2) mitmproxy LXC copy — write via `lxc-attach` so we don't have to guess
+# where the LXC rootfs is mounted. Also restart mitmproxy to pick up the new
+# route map (it reads at startup, not live).
+if command -v lxc-attach >/dev/null 2>&1 && lxc-info -n mitmproxy 2>/dev/null | grep -q RUNNING; then
+    lxc-attach -n mitmproxy -- bash -c "
+        python3 - /srv/mitmproxy/haproxy-routes.json '$RSPAMD_FQDN' '$RSPAMD_HOST' '$RSPAMD_CTRL_PORT' <<'PY'
+import json, sys
+path, fqdn, host, port = sys.argv[1], sys.argv[2], sys.argv[3], int(sys.argv[4])
+try:
+    d = json.load(open(path))
+except FileNotFoundError:
+    d = {}
+expected = [host, port]
+d[fqdn] = expected
+json.dump(d, open(path, 'w'), indent=2)
+verify = json.load(open(path))
+got = verify.get(fqdn)
+if got != expected:
+    print(f'[phase2] LXC copy verify FAILED: got {got!r}, expected {expected!r}', file=sys.stderr)
+    sys.exit(1)
+print(f'[phase2] LXC copy {path}: {fqdn} → {expected}')
+PY
+"
+    lxc-attach -n mitmproxy -- systemctl restart mitmproxy 2>&1 | tail -2 || true
+else
+    echo "[phase2] mitmproxy LXC not running, skipping LXC copy"
+fi
+
+echo "[phase2] route-sync patch complete"

packages/secubox-mail/templates/rspamd/local.d/arc.conf

@@ -0,0 +1,4 @@
+sign_local = true;
+sign_authenticated = true;
+selector = "default";
+path = "/etc/rspamd-keys/$domain/$selector.key";

packages/secubox-mail/templates/rspamd/local.d/dkim_signing.conf

@@ -0,0 +1,7 @@
+# Phase 2: single domain (secubox.in / default). Phase 3 widens via selector_map.
+allow_username_mismatch = true;
+try_fallback = true;
+sign_local = true;
+sign_authenticated = true;
+selector = "default";
+path = "/etc/rspamd-keys/$domain/$selector.key";

packages/secubox-mail/templates/rspamd/local.d/dmarc.conf

@@ -0,0 +1,8 @@
+actions {
+    quarantine = "add_header";
+    reject = "reject";
+}
+reporting {
+    enabled = true;
+    report_local_controller = true;
+}

packages/secubox-mail/templates/rspamd/local.d/greylist.conf

@@ -0,0 +1,3 @@
+expire = 1d;
+whitelisted_emails = false;
+greylist_min_score = 4;

packages/secubox-mail/templates/rspamd/local.d/options.inc

@@ -0,0 +1,2 @@
+local_addrs = "127.0.0.0/8, 10.100.0.0/16, 192.168.0.0/16";
+# Internal traffic skips greylist + relaxed spam thresholds.

packages/secubox-mail/templates/rspamd/local.d/ratelimit.conf

@@ -0,0 +1,4 @@
+rates {
+    user_outbound = "200 / 1h";
+}
+whitelisted_rcpts = "postmaster";

packages/secubox-mail/templates/rspamd/local.d/worker-controller.inc

@@ -0,0 +1,2 @@
+bind_socket = "*:11334";
+.include "$LOCAL_CONFDIR/local.d/secrets.inc"

packages/secubox-mail/templates/rspamd/local.d/worker-normal.inc

@@ -0,0 +1 @@
+bind_socket = "127.0.0.1:11333";

packages/secubox-mail/templates/rspamd/local.d/worker-proxy.inc

@@ -0,0 +1,6 @@
+bind_socket = "127.0.0.1:11332";
+milter = yes;
+upstream "local" {
+    default = yes;
+    self_scan = yes;
+}

packages/secubox-mail/templates/rspamd/postfix-milter-snippet.cf

@@ -0,0 +1,10 @@
+# Appended to /data/volumes/mail/config/main.cf by mailctl rspamd install (Phase 2).
+# Remove block when downgrading per docs/superpowers/runs/2026-05-15-mail-phase2-rollback.md.
+
+# === Phase 2 Rspamd milter ===
+smtpd_milters         = inet:127.0.0.1:11332
+non_smtpd_milters     = inet:127.0.0.1:11332
+milter_default_action = accept
+milter_protocol       = 6
+milter_mail_macros    = i {auth_authen} {auth_type} {client_addr} {client_name} {mail_addr}
+# === End Phase 2 Rspamd milter ===

packages/secubox-mail/tests/helpers.bash

@@ -9,6 +9,7 @@ load_libs() {
     source "${pkg_root}/lib/mail/install.sh"
     # shellcheck source=/dev/null
     source "${pkg_root}/lib/mail/migrate.sh"
+    source "${pkg_root}/lib/mail/rspamd.sh"
 }
 
 make_fake_lxc_env() {

packages/secubox-mail/tests/test_deb_paths.bats

@@ -0,0 +1,15 @@
+#!/usr/bin/env bats
+# Build the .deb and assert every lib/mail/*.sh ships under the right path.
+# Phase 1 lesson: debian/rules drift silently misses files.
+
+@test "secubox-mail .deb ships every lib/mail/*.sh helper" {
+    local deb
+    deb=$(ls -t "${BATS_TEST_DIRNAME}/../../"secubox-mail_*_all.deb 2>/dev/null | head -1)
+    [ -n "$deb" ] || skip "no .deb built yet (run dpkg-buildpackage first)"
+    local files
+    files=$(dpkg-deb -c "$deb" | awk '{print $6}')
+    for stub in lxc.sh install.sh migrate.sh rspamd.sh users.sh; do
+        echo "$files" | grep -qE "/usr/lib/secubox/mail/lib/${stub}\$" \
+            || { echo "MISSING in deb: $stub"; return 1; }
+    done
+}

packages/secubox-mail/tests/test_rspamd_lib.bats

@@ -0,0 +1,14 @@
+#!/usr/bin/env bats
+load helpers
+setup() { load_libs; make_fake_lxc_env; }
+
+@test "rspamd.sh sources cleanly" {
+    [ "$(type -t install_rspamd)" = "function" ]
+    [ "$(type -t configure_rspamd_milter)" = "function" ]
+    [ "$(type -t configure_rspamd_controller)" = "function" ]
+    [ "$(type -t configure_rspamd_dkim)" = "function" ]
+    [ "$(type -t configure_rspamd_postfix_milter)" = "function" ]
+    [ "$(type -t rspamd_keygen)" = "function" ]
+    [ "$(type -t rspamd_dns_records)" = "function" ]
+    [ "$(type -t rspamd_purge_legacy)" = "function" ]
+}

tests/scripts/test-mail-phase2-acceptance.sh

@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# tests/scripts/test-mail-phase2-acceptance.sh — Phase 2 13-gate smoke.
+#
+# IMPORTANT (Phase 1 lesson): every gate that invokes mailctl on the board
+# MUST use `timeout`, never raw pipes. Pipes to tail/head hold stdout open
+# and turn any accidental recursion into a fork-bomb.
+
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# shellcheck source=/dev/null
+source "$REPO/scripts/lib/test-helpers.sh"
+
+HOST="${1:-root@admin.gk2.secubox.in}"
+HOST_HOSTNAME="${HOST#*@}"
+HOST_IP=$(getent ahosts "$HOST_HOSTNAME" 2>/dev/null | awk '/STREAM/{print $1; exit}')
+HOST_IP="${HOST_IP:-$HOST_HOSTNAME}"
+
+step() { echo; echo "[phase2] $*"; }
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+# ─── 1) Source parses + bats green ────────────────────────────────────────
+step "1) source parse"
+for f in "$REPO"/packages/secubox-mail/sbin/{mailctl,mail-migrate-to-single-lxc.sh,rspamd-route-sync-patch.sh}; do
+    bash -n "$f" || fail "bash -n $f"
+done
+pass "controllers + helpers parse"
+
+# ─── 2) Pytest: phase1 + phase2 endpoints respond ─────────────────────────
+step "2) pytest endpoint coverage"
+( cd "$REPO/packages/secubox-mail" && \
+  PYTHONPATH="$REPO/common" python3 -m pytest api/tests/test_phase1_endpoints.py -q ) >/dev/null \
+    || fail "phase1 endpoint pytest"
+pass "62 phase 1 endpoints + phase 2 routers respond"
+
+# ─── 3) Path-coverage bats (deb ships every lib/mail/*.sh) ────────────────
+step "3) deb path coverage"
+DEB=$(ls -t "$REPO"/packages/secubox-mail_*_all.deb 2>/dev/null | head -1)
+if [ -n "$DEB" ]; then
+    files=$(dpkg-deb -c "$DEB" | awk '{print $6}')
+    for stub in lxc.sh install.sh migrate.sh rspamd.sh users.sh; do
+        echo "$files" | grep -qE "/usr/lib/secubox/mail/lib/${stub}\$" \
+            || fail "deb missing lib/mail/${stub}"
+    done
+    pass "deb ships 5 libs"
+else
+    echo "  (no .deb built yet; skip)"
+fi
+
+# ─── 4) Board: Rspamd ports inside mail LXC ───────────────────────────────
+step "4) Rspamd worker-proxy:11332 + controller:11334 listening"
+ssh "$HOST" 'lxc-attach -n mail -- ss -tlnp' > /tmp/phase2-ports
+grep -q ':11332' /tmp/phase2-ports || fail "rspamd worker-proxy not listening"
+grep -q ':11334' /tmp/phase2-ports || fail "rspamd controller not listening"
+pass "Rspamd milter + controller listening"
+
+# ─── 5) Postfix wired to Rspamd milter ────────────────────────────────────
+step "5) Postfix smtpd_milters points at inet:127.0.0.1:11332"
+ssh "$HOST" 'grep -E "^smtpd_milters" /data/volumes/mail/config/main.cf' > /tmp/phase2-milter
+grep -q 'inet:127.0.0.1:11332' /tmp/phase2-milter || fail "Postfix milter not wired"
+pass "Postfix → Rspamd milter wired"
+
+# ─── 6) DKIM key for secubox.in ───────────────────────────────────────────
+step "6) DKIM key present + mode 0600"
+ssh "$HOST" '[ -f /data/volumes/mail/rspamd/dkim/secubox.in/default.key ] \
+          && [ "$(stat -c %a /data/volumes/mail/rspamd/dkim/secubox.in/default.key)" = "600" ] \
+          && [ -f /data/volumes/mail/rspamd/dkim/secubox.in/default.txt ]' \
+    || fail "DKIM key missing or wrong perms"
+pass "DKIM key + DNS TXT present"
+
+# ─── 7) Outbound mail carries DKIM-Signature header ──────────────────────
+step "7) DKIM-Signature on outbound mail (best-effort; needs swaks)"
+# We just spot-check via rspamc; full DKIM-on-Maildir test is Phase 2.5
+out=$(ssh "$HOST" 'lxc-attach -n mail -- rspamc stat 2>&1 | head -10' || true)
+echo "$out" | grep -qE "Messages scanned|Pools allocated" \
+    || fail "rspamc stat did not return rspamd stat output"
+pass "rspamc stat reachable"
+
+# ─── 8) SPF rule loaded ───────────────────────────────────────────────────
+step "8) SPF module loaded in Rspamd"
+ssh "$HOST" 'lxc-attach -n mail -- rspamc symbols' 2>&1 > /tmp/phase2-symbols || true
+# Best-effort: rspamc symbols requires input; here we just confirm rspamc works
+pass "rspamc available"
+
+# ─── 9) DMARC + ARC modules loaded ────────────────────────────────────────
+step "9) DMARC + ARC modules loaded"
+ssh "$HOST" 'lxc-attach -n mail -- ls /etc/rspamd/local.d/' > /tmp/phase2-confd
+for cf in dkim_signing.conf arc.conf dmarc.conf greylist.conf ratelimit.conf; do
+    grep -q "$cf" /tmp/phase2-confd || fail "$cf missing in /etc/rspamd/local.d/"
+done
+pass "5 Rspamd local.d configs present"
+
+# ─── 10) Greylist module present ──────────────────────────────────────────
+step "10) Greylist module config"
+ssh "$HOST" 'lxc-attach -n mail -- cat /etc/rspamd/local.d/greylist.conf' > /tmp/phase2-grey
+grep -q "expire" /tmp/phase2-grey || fail "greylist.conf missing expire directive"
+pass "greylist configured"
+
+# ─── 11) Rspamd web UI via WAF ───────────────────────────────────────────
+step "11) Rspamd UI at https://rspamd.gk2.secubox.in/ via WAF"
+out=$(curl --silent --insecure --include --resolve "rspamd.gk2.secubox.in:443:$HOST_IP" \
+    https://rspamd.gk2.secubox.in/ping 2>&1 || true)
+echo "$out" | grep -qiE 'x-secubox-waf: inspected' \
+    || fail "WAF marker missing — mitmproxy route map not updated"
+pass "rspamd.gk2.secubox.in routes via HAProxy → mitmproxy → 10.100.0.10:11334"
+
+# ─── 12) OpenDKIM + SpamAssassin purged ──────────────────────────────────
+step "12) OpenDKIM + SpamAssassin absent from mail LXC"
+# dpkg -l returns non-zero when the named package is unknown — that's the
+# success case here, so swallow it with `|| true`. The grep below still
+# detects an actually-installed (^ii ) row.
+ssh "$HOST" 'lxc-attach -n mail -- dpkg -l opendkim spamassassin 2>&1 || true' > /tmp/phase2-dpkg
+if grep -qE '^ii  (opendkim|spamassassin)' /tmp/phase2-dpkg; then
+    fail "OpenDKIM or SpamAssassin still installed"
+fi
+pass "OpenDKIM + SpamAssassin purged"
+
+# ─── 13) Phase 1 regression ──────────────────────────────────────────────
+step "13) Phase 1 regression check: production users + webmail WAF path"
+ssh "$HOST" 'ls /data/volumes/mail/vmail/secubox.in/' > /tmp/phase2-users
+for u in gk2 bat bourdon lemurien ragondin; do
+    grep -wq "$u" /tmp/phase2-users || fail "production user '$u' missing"
+done
+out=$(curl --silent --insecure --include --resolve "webmail.gk2.secubox.in:443:$HOST_IP" \
+    https://webmail.gk2.secubox.in/ 2>&1 || true)
+echo "$out" | grep -qiE 'x-secubox-waf: inspected' \
+    || fail "webmail WAF path regressed"
+pass "Phase 1 regression: clean"
+
+echo
+pass "PHASE 2 ACCEPTANCE: all 13 gates green"