feat(postfix): deploy postfix MTA and rspamd spam filter

- postfix namespace with Deployment + HPA (2-6 replicas) - rspamd Deployment + HPA (2-6 replicas) with milter interface - postfix configured to relay inbound mail to stalwart via transport maps - rspamd milter on port 11332 for spam scanning and DKIM signing - DKIM keys stored in Vault at kubernetes/namespace/postfix/default/dkim-keys - TLS cert via cert-manager (vault-issuer) for mail.main.unkin.net - rspamd web UI exposed via Traefik Gateway at rspamd.k8s.syd1.au.unkin.net - postfix external LoadBalancer service for inbound MX on port 25 - artifactapi: add boky/postfix and rspamd/rspamd to dockerhub cache
2026-05-24 00:43:56 +10:00
parent cbc2c1cb9f
commit 1cf08dd5c1
20 changed files with 514 additions and 0 deletions
@@ -0,0 +1,90 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postfix
+  namespace: postfix
+spec:
+  selector:
+    matchLabels:
+      app: postfix
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: postfix
+    spec:
+      containers:
+        - name: postfix
+          image: boky/postfix:3.9.1
+          ports:
+            - containerPort: 25
+              name: smtp
+              protocol: TCP
+            - containerPort: 587
+              name: submission
+              protocol: TCP
+          env:
+            - name: SERVER_HOSTNAME
+              value: "mail.main.unkin.net"
+            - name: MYORIGIN
+              value: "main.unkin.net"
+            - name: MYNETWORKS
+              value: "127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
+            - name: ALLOWED_SENDER_DOMAINS
+              value: "main.unkin.net unkin.net"
+            - name: POSTFIX_myhostname
+              value: "mail.main.unkin.net"
+            - name: POSTFIX_mydestination
+              value: "localhost"
+            - name: POSTFIX_smtp_tls_security_level
+              value: "may"
+            - name: POSTFIX_smtpd_tls_security_level
+              value: "may"
+            - name: POSTFIX_smtpd_tls_cert_file
+              value: "/etc/postfix/tls/tls.crt"
+            - name: POSTFIX_smtpd_tls_key_file
+              value: "/etc/postfix/tls/tls.key"
+          livenessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          volumeMounts:
+            - name: postfix-config
+              mountPath: /etc/postfix/custom.d
+              readOnly: true
+            - name: postfix-transport
+              mountPath: /etc/postfix/transport
+              subPath: transport
+              readOnly: true
+            - name: postfix-tls
+              mountPath: /etc/postfix/tls
+              readOnly: true
+      volumes:
+        - name: postfix-config
+          configMap:
+            name: postfix-config
+        - name: postfix-transport
+          configMap:
+            name: postfix-transport
+        - name: postfix-tls
+          secret:
+            secretName: postfix-smtp-tls