Serve all smarthost clients on port 25, rename gateways to mta1/mta2, grow spool to 50Gi

apps/base/mail/smarthost-networkpolicy.yaml

@@ -72,5 +72,3 @@ spec:
       ports:
         - port: smtp
           protocol: TCP
-        - port: submission
-          protocol: TCP

apps/base/mail/smarthost-service.yaml

@@ -12,9 +12,6 @@ spec:
     - name: smtp
       port: 25
       targetPort: smtp
-    - name: submission
-      port: 587
-      targetPort: submission
 ---
 # Gateways and lab networks; Local keeps client IPs for the postfix CIDR checks.
 apiVersion: v1
@@ -34,6 +31,3 @@ spec:
     - name: smtp
       port: 25
       targetPort: smtp
-    - name: submission
-      port: 587
-      targetPort: submission

apps/base/mail/smarthost-statefulset.yaml

@@ -35,9 +35,6 @@ spec:
             - containerPort: 25
               name: smtp
               protocol: TCP
-            - containerPort: 587
-              name: submission
-              protocol: TCP
           readinessProbe:
             tcpSocket:
               port: smtp
@@ -113,4 +110,4 @@ spec:
         storageClassName: cephrbd-fast-delete
         resources:
           requests:
-            storage: 5Gi
+            storage: 50Gi

apps/base/mail/smarthost/gateways.cidr

@@ -1,2 +1,2 @@
-# DMZ gateways (mx1/mx2) over WireGuard.
+# DMZ gateways (mta1/mta2) over WireGuard.
 10.10.12.0/24 OK

apps/base/mail/smarthost/main.cf

@@ -9,7 +9,8 @@ inet_protocols = ipv4
 maillog_file = /dev/stdout
 message_size_limit = 52428800
 
-# Pod CIDR (Stalwart; narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
+# Relay-anywhere clients: pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
+# Keep in sync with the NetworkPolicy; gateways must stay out of here.
 pod_networks = 10.42.0.0/16
 mynetworks = $pod_networks
   10.10.12.200/32 198.18.1.10/32
@@ -21,21 +22,20 @@ mynetworks = $pod_networks
 
 relay_domains = texthash:/etc/postfix/relay_domains
 transport_maps = texthash:/etc/postfix/transport
-relayhost = [mx1.wg.unkin.net]:25
-smtp_fallback_relay = [mx2.wg.unkin.net]:25
+relayhost = [mta1.wg.unkin.net]:25
+smtp_fallback_relay = [mta2.wg.unkin.net]:25
+smtpd_client_restrictions = permit_mynetworks, check_client_access cidr:/etc/postfix/gateways.cidr, reject
 smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
+smtpd_recipient_restrictions = permit_mynetworks, reject_unverified_recipient
 unverified_recipient_reject_code = 550
 unverified_recipient_tempfail_action = defer_if_permit
 address_verify_negative_refresh_time = 5m
 address_verify_negative_expire_time = 1h
 
+# Gateways skip rspamd via milter.cidr; everyone else admitted goes through it.
 milter_default_action = tempfail
-rspamd_milter = inet:rspamd.mail.svc:11332
-
-# Referenced from master.cf per listener.
-inbound_client_restrictions = permit_mynetworks, check_client_access cidr:/etc/postfix/gateways.cidr, reject
-inbound_recipient_restrictions = permit_mynetworks, reject_unverified_recipient
-submission_client_restrictions = permit_mynetworks, reject
+smtpd_milters =
+smtpd_milter_maps = cidr:/etc/postfix/milter.cidr
 
 smtpd_tls_security_level = may
 smtpd_tls_cert_file = /etc/postfix/tls/tls.crt

apps/base/mail/smarthost/master.cf

@@ -1,16 +1,5 @@
-# inbound-relay: gateways (no milter) and Stalwart's outbound relay (pod CIDR, rspamd milter).
+# Gateways (inbound to relay_domains, no milter) and mynetworks (relay anywhere via rspamd).
 25        inet  n       -       n       -       -       smtpd
-  -o syslog_name=postfix/inbound-relay
-  -o mynetworks=$pod_networks
-  -o smtpd_client_restrictions=$inbound_client_restrictions
-  -o smtpd_recipient_restrictions=$inbound_recipient_restrictions
-  -o smtpd_milters=
-  -o smtpd_milter_maps=cidr:/etc/postfix/milter.cidr
-# submission-internal: lab networks and pods, always through rspamd.
-587       inet  n       -       n       -       -       smtpd
-  -o syslog_name=postfix/submission-internal
-  -o smtpd_client_restrictions=$submission_client_restrictions
-  -o smtpd_milters=$rspamd_milter
 pickup    unix  n       -       n       60      1       pickup
 cleanup   unix  n       -       n       -       0       cleanup
 qmgr      unix  n       -       n       300     1       qmgr

apps/base/mail/smarthost/milter.cidr

@@ -1 +1,4 @@
-10.42.0.0/16 inet:rspamd.mail.svc:11332
+# First match wins: gateways skip rspamd, every other admitted client goes through it.
+10.10.12.200/32 inet:rspamd.mail.svc:11332
+10.10.12.0/24 DISABLE
+0.0.0.0/0 inet:rspamd.mail.svc:11332