From 8105ba11f4e45b0aa0fd34659fafc45e94db4b01 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 21:46:32 +1100 Subject: [PATCH] Serve all smarthost clients on port 25, rename gateways to mta1/mta2, grow spool to 50Gi --- apps/base/mail/smarthost-networkpolicy.yaml | 2 -- apps/base/mail/smarthost-service.yaml | 6 ------ apps/base/mail/smarthost-statefulset.yaml | 5 +---- apps/base/mail/smarthost/gateways.cidr | 2 +- apps/base/mail/smarthost/main.cf | 18 +++++++++--------- apps/base/mail/smarthost/master.cf | 13 +------------ apps/base/mail/smarthost/milter.cidr | 5 ++++- 7 files changed, 16 insertions(+), 35 deletions(-) diff --git a/apps/base/mail/smarthost-networkpolicy.yaml b/apps/base/mail/smarthost-networkpolicy.yaml index 70cec03..3e055cb 100644 --- a/apps/base/mail/smarthost-networkpolicy.yaml +++ b/apps/base/mail/smarthost-networkpolicy.yaml @@ -72,5 +72,3 @@ spec: ports: - port: smtp protocol: TCP - - port: submission - protocol: TCP diff --git a/apps/base/mail/smarthost-service.yaml b/apps/base/mail/smarthost-service.yaml index 025947a..aabcec7 100644 --- a/apps/base/mail/smarthost-service.yaml +++ b/apps/base/mail/smarthost-service.yaml @@ -12,9 +12,6 @@ spec: - name: smtp port: 25 targetPort: smtp - - name: submission - port: 587 - targetPort: submission --- # Gateways and lab networks; Local keeps client IPs for the postfix CIDR checks. apiVersion: v1 @@ -34,6 +31,3 @@ spec: - name: smtp port: 25 targetPort: smtp - - name: submission - port: 587 - targetPort: submission diff --git a/apps/base/mail/smarthost-statefulset.yaml b/apps/base/mail/smarthost-statefulset.yaml index 224184e..da5418a 100644 --- a/apps/base/mail/smarthost-statefulset.yaml +++ b/apps/base/mail/smarthost-statefulset.yaml @@ -35,9 +35,6 @@ spec: - containerPort: 25 name: smtp protocol: TCP - - containerPort: 587 - name: submission - protocol: TCP readinessProbe: tcpSocket: port: smtp @@ -113,4 +110,4 @@ spec: storageClassName: cephrbd-fast-delete resources: requests: - storage: 5Gi + storage: 50Gi diff --git a/apps/base/mail/smarthost/gateways.cidr b/apps/base/mail/smarthost/gateways.cidr index de93a9b..9e220d4 100644 --- a/apps/base/mail/smarthost/gateways.cidr +++ b/apps/base/mail/smarthost/gateways.cidr @@ -1,2 +1,2 @@ -# DMZ gateways (mx1/mx2) over WireGuard. +# DMZ gateways (mta1/mta2) over WireGuard. 10.10.12.0/24 OK diff --git a/apps/base/mail/smarthost/main.cf b/apps/base/mail/smarthost/main.cf index a66aa35..0dd1e83 100644 --- a/apps/base/mail/smarthost/main.cf +++ b/apps/base/mail/smarthost/main.cf @@ -9,7 +9,8 @@ inet_protocols = ipv4 maillog_file = /dev/stdout message_size_limit = 52428800 -# Pod CIDR (Stalwart; narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs. +# Relay-anywhere clients: pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs. +# Keep in sync with the NetworkPolicy; gateways must stay out of here. pod_networks = 10.42.0.0/16 mynetworks = $pod_networks 10.10.12.200/32 198.18.1.10/32 @@ -21,21 +22,20 @@ mynetworks = $pod_networks relay_domains = texthash:/etc/postfix/relay_domains transport_maps = texthash:/etc/postfix/transport -relayhost = [mx1.wg.unkin.net]:25 -smtp_fallback_relay = [mx2.wg.unkin.net]:25 +relayhost = [mta1.wg.unkin.net]:25 +smtp_fallback_relay = [mta2.wg.unkin.net]:25 +smtpd_client_restrictions = permit_mynetworks, check_client_access cidr:/etc/postfix/gateways.cidr, reject smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination +smtpd_recipient_restrictions = permit_mynetworks, reject_unverified_recipient unverified_recipient_reject_code = 550 unverified_recipient_tempfail_action = defer_if_permit address_verify_negative_refresh_time = 5m address_verify_negative_expire_time = 1h +# Gateways skip rspamd via milter.cidr; everyone else admitted goes through it. milter_default_action = tempfail -rspamd_milter = inet:rspamd.mail.svc:11332 - -# Referenced from master.cf per listener. -inbound_client_restrictions = permit_mynetworks, check_client_access cidr:/etc/postfix/gateways.cidr, reject -inbound_recipient_restrictions = permit_mynetworks, reject_unverified_recipient -submission_client_restrictions = permit_mynetworks, reject +smtpd_milters = +smtpd_milter_maps = cidr:/etc/postfix/milter.cidr smtpd_tls_security_level = may smtpd_tls_cert_file = /etc/postfix/tls/tls.crt diff --git a/apps/base/mail/smarthost/master.cf b/apps/base/mail/smarthost/master.cf index ed18250..2f3bf5f 100644 --- a/apps/base/mail/smarthost/master.cf +++ b/apps/base/mail/smarthost/master.cf @@ -1,16 +1,5 @@ -# inbound-relay: gateways (no milter) and Stalwart's outbound relay (pod CIDR, rspamd milter). +# Gateways (inbound to relay_domains, no milter) and mynetworks (relay anywhere via rspamd). 25 inet n - n - - smtpd - -o syslog_name=postfix/inbound-relay - -o mynetworks=$pod_networks - -o smtpd_client_restrictions=$inbound_client_restrictions - -o smtpd_recipient_restrictions=$inbound_recipient_restrictions - -o smtpd_milters= - -o smtpd_milter_maps=cidr:/etc/postfix/milter.cidr -# submission-internal: lab networks and pods, always through rspamd. -587 inet n - n - - smtpd - -o syslog_name=postfix/submission-internal - -o smtpd_client_restrictions=$submission_client_restrictions - -o smtpd_milters=$rspamd_milter pickup unix n - n 60 1 pickup cleanup unix n - n - 0 cleanup qmgr unix n - n 300 1 qmgr diff --git a/apps/base/mail/smarthost/milter.cidr b/apps/base/mail/smarthost/milter.cidr index 3f75361..e66a085 100644 --- a/apps/base/mail/smarthost/milter.cidr +++ b/apps/base/mail/smarthost/milter.cidr @@ -1 +1,4 @@ -10.42.0.0/16 inet:rspamd.mail.svc:11332 +# First match wins: gateways skip rspamd, every other admitted client goes through it. +10.10.12.200/32 inet:rspamd.mail.svc:11332 +10.10.12.0/24 DISABLE +0.0.0.0/0 inet:rspamd.mail.svc:11332