From 4f6150e93ae1e4974d2622906bdf9e6ee3ae1f97 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 21:52:54 +1100 Subject: [PATCH] Require TLS between smarthost and gateways over public IPs, merge mynetworks and milter map --- apps/base/mail/kustomization.yaml | 3 +- apps/base/mail/smarthost-networkpolicy.yaml | 8 ++++-- apps/base/mail/smarthost-statefulset.yaml | 8 ++++-- apps/base/mail/smarthost/gateways.cidr | 5 ++-- apps/base/mail/smarthost/main.cf | 17 ++++------- apps/base/mail/smarthost/milter.cidr | 4 --- apps/base/mail/smarthost/mynetworks.cidr | 31 +++++++++++++++++++++ apps/base/mail/smarthost/tls_policy | 2 ++ 8 files changed, 55 insertions(+), 23 deletions(-) delete mode 100644 apps/base/mail/smarthost/milter.cidr create mode 100644 apps/base/mail/smarthost/mynetworks.cidr create mode 100644 apps/base/mail/smarthost/tls_policy diff --git a/apps/base/mail/kustomization.yaml b/apps/base/mail/kustomization.yaml index 4c16052..603ae53 100644 --- a/apps/base/mail/kustomization.yaml +++ b/apps/base/mail/kustomization.yaml @@ -23,4 +23,5 @@ configMapGenerator: - smarthost/relay_domains - smarthost/transport - smarthost/gateways.cidr - - smarthost/milter.cidr + - smarthost/mynetworks.cidr + - smarthost/tls_policy diff --git a/apps/base/mail/smarthost-networkpolicy.yaml b/apps/base/mail/smarthost-networkpolicy.yaml index 3e055cb..05f4c67 100644 --- a/apps/base/mail/smarthost-networkpolicy.yaml +++ b/apps/base/mail/smarthost-networkpolicy.yaml @@ -1,5 +1,5 @@ --- -# Gateways, lab networks (incl. node IPs for kubelet probes) and opted-in pods in any namespace. +# Gateways (public IPs, see smarthost/gateways.cidr), lab networks (incl. node IPs for kubelet probes) and opted-in pods in any namespace. apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -14,7 +14,11 @@ spec: ingress: - from: - ipBlock: - cidr: 10.10.12.0/24 + cidr: 192.0.2.1/32 + - ipBlock: + cidr: 192.0.2.2/32 + - ipBlock: + cidr: 10.10.12.200/32 - ipBlock: cidr: 198.18.1.10/32 - ipBlock: diff --git a/apps/base/mail/smarthost-statefulset.yaml b/apps/base/mail/smarthost-statefulset.yaml index da5418a..9a401c5 100644 --- a/apps/base/mail/smarthost-statefulset.yaml +++ b/apps/base/mail/smarthost-statefulset.yaml @@ -92,8 +92,12 @@ spec: subPath: gateways.cidr readOnly: true - name: config - mountPath: /etc/postfix/milter.cidr - subPath: milter.cidr + mountPath: /etc/postfix/mynetworks.cidr + subPath: mynetworks.cidr + readOnly: true + - name: config + mountPath: /etc/postfix/tls_policy + subPath: tls_policy readOnly: true volumes: - name: config diff --git a/apps/base/mail/smarthost/gateways.cidr b/apps/base/mail/smarthost/gateways.cidr index 9e220d4..c3d1c3b 100644 --- a/apps/base/mail/smarthost/gateways.cidr +++ b/apps/base/mail/smarthost/gateways.cidr @@ -1,2 +1,3 @@ -# DMZ gateways (mta1/mta2) over WireGuard. -10.10.12.0/24 OK +# Gateway (mta1/mta2) public IPs; TEST-NET placeholders until the BinaryLane servers exist. +192.0.2.1/32 reject_plaintext_session, permit +192.0.2.2/32 reject_plaintext_session, permit diff --git a/apps/base/mail/smarthost/main.cf b/apps/base/mail/smarthost/main.cf index fdcbc80..dde1f78 100644 --- a/apps/base/mail/smarthost/main.cf +++ b/apps/base/mail/smarthost/main.cf @@ -9,21 +9,15 @@ inet_protocols = ipv4 maillog_file = /dev/stdout message_size_limit = 52428800 -# Relay-anywhere clients: pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs. -# Keep in sync with the NetworkPolicy; gateways must stay out of here. -pod_networks = 10.42.0.0/16 -mynetworks = $pod_networks - 10.10.12.200/32 198.18.1.10/32 - 198.18.2.160/27 198.18.2.192/27 198.18.21.160/27 198.18.21.192/27 - 198.18.13.0/24 198.18.14.0/24 198.18.15.0/24 198.18.16.0/24 198.18.17.0/24 198.18.18.0/24 - 198.18.19.0/24 198.18.20.0/24 198.18.21.0/24 198.18.22.0/24 198.18.23.0/24 - 198.18.25.0/24 198.18.26.0/24 198.18.27.0/24 198.18.28.0/24 198.18.29.0/24 - 198.18.64.0/24 198.18.65.0/24 198.18.66.0/24 198.18.67.0/24 198.18.68.0/24 198.18.69.0/24 +# Relay-anywhere clients, all routed through rspamd for DKIM signing; gateways must stay out. +mynetworks = cidr:/etc/postfix/mynetworks.cidr relay_domains = texthash:/etc/postfix/relay_domains transport_maps = texthash:/etc/postfix/transport relayhost = [mta1.edge.unkin.net]:25 smtp_fallback_relay = [mta2.edge.unkin.net]:25 +smtp_tls_policy_maps = texthash:/etc/postfix/tls_policy +smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt smtpd_client_restrictions = permit_mynetworks, check_client_access cidr:/etc/postfix/gateways.cidr, reject smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination smtpd_recipient_restrictions = permit_mynetworks, reject_unverified_recipient @@ -32,10 +26,9 @@ unverified_recipient_tempfail_action = defer_if_permit address_verify_negative_refresh_time = 5m address_verify_negative_expire_time = 1h -# Gateways skip rspamd via milter.cidr; everyone else admitted goes through it. milter_default_action = tempfail smtpd_milters = -smtpd_milter_maps = cidr:/etc/postfix/milter.cidr +smtpd_milter_maps = cidr:/etc/postfix/mynetworks.cidr smtpd_tls_security_level = may smtpd_tls_cert_file = /etc/postfix/tls/tls.crt diff --git a/apps/base/mail/smarthost/milter.cidr b/apps/base/mail/smarthost/milter.cidr deleted file mode 100644 index e66a085..0000000 --- a/apps/base/mail/smarthost/milter.cidr +++ /dev/null @@ -1,4 +0,0 @@ -# First match wins: gateways skip rspamd, every other admitted client goes through it. -10.10.12.200/32 inet:rspamd.mail.svc:11332 -10.10.12.0/24 DISABLE -0.0.0.0/0 inet:rspamd.mail.svc:11332 diff --git a/apps/base/mail/smarthost/mynetworks.cidr b/apps/base/mail/smarthost/mynetworks.cidr new file mode 100644 index 0000000..32779ce --- /dev/null +++ b/apps/base/mail/smarthost/mynetworks.cidr @@ -0,0 +1,31 @@ +# Pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs. +# Doubles as mynetworks and the milter map; keep in sync with the NetworkPolicy. +10.42.0.0/16 inet:rspamd.mail.svc:11332 +10.10.12.200/32 inet:rspamd.mail.svc:11332 +198.18.1.10/32 inet:rspamd.mail.svc:11332 +198.18.2.160/27 inet:rspamd.mail.svc:11332 +198.18.2.192/27 inet:rspamd.mail.svc:11332 +198.18.21.160/27 inet:rspamd.mail.svc:11332 +198.18.21.192/27 inet:rspamd.mail.svc:11332 +198.18.13.0/24 inet:rspamd.mail.svc:11332 +198.18.14.0/24 inet:rspamd.mail.svc:11332 +198.18.15.0/24 inet:rspamd.mail.svc:11332 +198.18.16.0/24 inet:rspamd.mail.svc:11332 +198.18.17.0/24 inet:rspamd.mail.svc:11332 +198.18.18.0/24 inet:rspamd.mail.svc:11332 +198.18.19.0/24 inet:rspamd.mail.svc:11332 +198.18.20.0/24 inet:rspamd.mail.svc:11332 +198.18.21.0/24 inet:rspamd.mail.svc:11332 +198.18.22.0/24 inet:rspamd.mail.svc:11332 +198.18.23.0/24 inet:rspamd.mail.svc:11332 +198.18.25.0/24 inet:rspamd.mail.svc:11332 +198.18.26.0/24 inet:rspamd.mail.svc:11332 +198.18.27.0/24 inet:rspamd.mail.svc:11332 +198.18.28.0/24 inet:rspamd.mail.svc:11332 +198.18.29.0/24 inet:rspamd.mail.svc:11332 +198.18.64.0/24 inet:rspamd.mail.svc:11332 +198.18.65.0/24 inet:rspamd.mail.svc:11332 +198.18.66.0/24 inet:rspamd.mail.svc:11332 +198.18.67.0/24 inet:rspamd.mail.svc:11332 +198.18.68.0/24 inet:rspamd.mail.svc:11332 +198.18.69.0/24 inet:rspamd.mail.svc:11332 diff --git a/apps/base/mail/smarthost/tls_policy b/apps/base/mail/smarthost/tls_policy new file mode 100644 index 0000000..dd1481a --- /dev/null +++ b/apps/base/mail/smarthost/tls_policy @@ -0,0 +1,2 @@ +[mta1.edge.unkin.net]:25 secure match=hostname +[mta2.edge.unkin.net]:25 secure match=hostname