Verify smarthost edge relays against the internal CA (#548)

The edge MTAs present certificates from the internal Vault PKI, so the smarthost cannot verify mta1/mta2.edge.unkin.net against the system CA bundle.

- pin both edge relay TLS policies to the internal CA via `tafile=`
- mount `vault-ca-cert` into the smarthost pods and reload on change

---------

Co-authored-by: BenVincent <benvin@main.unkin.net>
Reviewed-on: #548
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/mail/smarthost-statefulset.yaml

@@ -6,6 +6,7 @@ metadata:
   namespace: mail
   annotations:
     configmap.reloader.stakater.com/reload: "smarthost-config"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
 spec:
   serviceName: smarthost
   replicas: 2
@@ -71,6 +72,9 @@ spec:
             - name: tls
               mountPath: /etc/postfix/tls
               readOnly: true
+            - name: vault-ca-cert
+              mountPath: /etc/postfix/edge-ca
+              readOnly: true
             - name: config
               mountPath: /etc/postfix/main.cf
               subPath: main.cf
@@ -106,6 +110,12 @@ spec:
         - name: tls
           secret:
             secretName: wildcard-main-unkin-net-tls
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
   volumeClaimTemplates:
     - metadata:
         name: spool

apps/base/mail/smarthost/tls_policy

@@ -1,2 +1,2 @@
-[mta1.edge.unkin.net]:25 secure match=hostname
-[mta2.edge.unkin.net]:25 secure match=hostname
+[mta1.edge.unkin.net]:25 secure match=hostname tafile=/etc/postfix/edge-ca/ca.crt
+[mta2.edge.unkin.net]:25 secure match=hostname tafile=/etc/postfix/edge-ca/ca.crt