Require TLS between smarthost and gateways over public IPs, merge mynetworks and milter map

apps/base/mail/kustomization.yaml

@@ -23,4 +23,5 @@ configMapGenerator:
       - smarthost/relay_domains
       - smarthost/transport
       - smarthost/gateways.cidr
-      - smarthost/milter.cidr
+      - smarthost/mynetworks.cidr
+      - smarthost/tls_policy

apps/base/mail/smarthost-networkpolicy.yaml

@@ -1,5 +1,5 @@
 ---
-# Gateways, lab networks (incl. node IPs for kubelet probes) and opted-in pods in any namespace.
+# Gateways (public IPs, see smarthost/gateways.cidr), lab networks (incl. node IPs for kubelet probes) and opted-in pods in any namespace.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -14,7 +14,11 @@ spec:
   ingress:
     - from:
         - ipBlock:
-            cidr: 10.10.12.0/24
+            cidr: 192.0.2.1/32
+        - ipBlock:
+            cidr: 192.0.2.2/32
+        - ipBlock:
+            cidr: 10.10.12.200/32
         - ipBlock:
             cidr: 198.18.1.10/32
         - ipBlock:

apps/base/mail/smarthost-statefulset.yaml

@@ -92,8 +92,12 @@ spec:
               subPath: gateways.cidr
               readOnly: true
             - name: config
-              mountPath: /etc/postfix/milter.cidr
-              subPath: milter.cidr
+              mountPath: /etc/postfix/mynetworks.cidr
+              subPath: mynetworks.cidr
+              readOnly: true
+            - name: config
+              mountPath: /etc/postfix/tls_policy
+              subPath: tls_policy
               readOnly: true
       volumes:
         - name: config

apps/base/mail/smarthost/gateways.cidr

@@ -1,2 +1,3 @@
-# DMZ gateways (mta1/mta2) over WireGuard.
-10.10.12.0/24 OK
+# Gateway (mta1/mta2) public IPs; TEST-NET placeholders until the BinaryLane servers exist.
+192.0.2.1/32 reject_plaintext_session, permit
+192.0.2.2/32 reject_plaintext_session, permit

apps/base/mail/smarthost/main.cf

@@ -9,21 +9,15 @@ inet_protocols = ipv4
 maillog_file = /dev/stdout
 message_size_limit = 52428800
 
-# Relay-anywhere clients: pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
-# Keep in sync with the NetworkPolicy; gateways must stay out of here.
-pod_networks = 10.42.0.0/16
-mynetworks = $pod_networks
-  10.10.12.200/32 198.18.1.10/32
-  198.18.2.160/27 198.18.2.192/27 198.18.21.160/27 198.18.21.192/27
-  198.18.13.0/24 198.18.14.0/24 198.18.15.0/24 198.18.16.0/24 198.18.17.0/24 198.18.18.0/24
-  198.18.19.0/24 198.18.20.0/24 198.18.21.0/24 198.18.22.0/24 198.18.23.0/24
-  198.18.25.0/24 198.18.26.0/24 198.18.27.0/24 198.18.28.0/24 198.18.29.0/24
-  198.18.64.0/24 198.18.65.0/24 198.18.66.0/24 198.18.67.0/24 198.18.68.0/24 198.18.69.0/24
+# Relay-anywhere clients, all routed through rspamd for DKIM signing; gateways must stay out.
+mynetworks = cidr:/etc/postfix/mynetworks.cidr
 
 relay_domains = texthash:/etc/postfix/relay_domains
 transport_maps = texthash:/etc/postfix/transport
 relayhost = [mta1.edge.unkin.net]:25
 smtp_fallback_relay = [mta2.edge.unkin.net]:25
+smtp_tls_policy_maps = texthash:/etc/postfix/tls_policy
+smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
 smtpd_client_restrictions = permit_mynetworks, check_client_access cidr:/etc/postfix/gateways.cidr, reject
 smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
 smtpd_recipient_restrictions = permit_mynetworks, reject_unverified_recipient
@@ -32,10 +26,9 @@ unverified_recipient_tempfail_action = defer_if_permit
 address_verify_negative_refresh_time = 5m
 address_verify_negative_expire_time = 1h
 
-# Gateways skip rspamd via milter.cidr; everyone else admitted goes through it.
 milter_default_action = tempfail
 smtpd_milters =
-smtpd_milter_maps = cidr:/etc/postfix/milter.cidr
+smtpd_milter_maps = cidr:/etc/postfix/mynetworks.cidr
 
 smtpd_tls_security_level = may
 smtpd_tls_cert_file = /etc/postfix/tls/tls.crt

apps/base/mail/smarthost/milter.cidr

@@ -1,4 +0,0 @@
-# First match wins: gateways skip rspamd, every other admitted client goes through it.
-10.10.12.200/32 inet:rspamd.mail.svc:11332
-10.10.12.0/24 DISABLE
-0.0.0.0/0 inet:rspamd.mail.svc:11332

apps/base/mail/smarthost/mynetworks.cidr

@@ -0,0 +1,31 @@
+# Pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
+# Doubles as mynetworks and the milter map; keep in sync with the NetworkPolicy.
+10.42.0.0/16 inet:rspamd.mail.svc:11332
+10.10.12.200/32 inet:rspamd.mail.svc:11332
+198.18.1.10/32 inet:rspamd.mail.svc:11332
+198.18.2.160/27 inet:rspamd.mail.svc:11332
+198.18.2.192/27 inet:rspamd.mail.svc:11332
+198.18.21.160/27 inet:rspamd.mail.svc:11332
+198.18.21.192/27 inet:rspamd.mail.svc:11332
+198.18.13.0/24 inet:rspamd.mail.svc:11332
+198.18.14.0/24 inet:rspamd.mail.svc:11332
+198.18.15.0/24 inet:rspamd.mail.svc:11332
+198.18.16.0/24 inet:rspamd.mail.svc:11332
+198.18.17.0/24 inet:rspamd.mail.svc:11332
+198.18.18.0/24 inet:rspamd.mail.svc:11332
+198.18.19.0/24 inet:rspamd.mail.svc:11332
+198.18.20.0/24 inet:rspamd.mail.svc:11332
+198.18.21.0/24 inet:rspamd.mail.svc:11332
+198.18.22.0/24 inet:rspamd.mail.svc:11332
+198.18.23.0/24 inet:rspamd.mail.svc:11332
+198.18.25.0/24 inet:rspamd.mail.svc:11332
+198.18.26.0/24 inet:rspamd.mail.svc:11332
+198.18.27.0/24 inet:rspamd.mail.svc:11332
+198.18.28.0/24 inet:rspamd.mail.svc:11332
+198.18.29.0/24 inet:rspamd.mail.svc:11332
+198.18.64.0/24 inet:rspamd.mail.svc:11332
+198.18.65.0/24 inet:rspamd.mail.svc:11332
+198.18.66.0/24 inet:rspamd.mail.svc:11332
+198.18.67.0/24 inet:rspamd.mail.svc:11332
+198.18.68.0/24 inet:rspamd.mail.svc:11332
+198.18.69.0/24 inet:rspamd.mail.svc:11332

apps/base/mail/smarthost/tls_policy

@@ -0,0 +1,2 @@
+[mta1.edge.unkin.net]:25 secure match=hostname
+[mta2.edge.unkin.net]:25 secure match=hostname