unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

Route gateway mail through the rspamd milter, accept XFORWARD from gateways
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details

Browse Source
This commit is contained in:
Unkin Agent
2026-10-12 22:05:50 +11:00
parent d19c7d7942
commit 926967b298
3 changed files with 34 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/mail/smarthost/main.cf
+3 -3
View File
@@ -9,7 +9,7 @@ inet_protocols = ipv4
maillog_file = /dev/stdout
message_size_limit = 52428800
# Relay-anywhere clients, all routed through rspamd for DKIM signing; gateways must stay out.
# Relay-anywhere clients; gateways must stay out.
mynetworks = cidr:/etc/postfix/mynetworks.cidr
relay_domains = texthash:/etc/postfix/relay_domains
@@ -31,8 +31,8 @@ address_verify_positive_refresh_time = 1h
address_verify_positive_expire_time = 1d
milter_default_action = tempfail
smtpd_milters =
smtpd_milter_maps = cidr:/etc/postfix/mynetworks.cidr
smtpd_milters = inet:rspamd.mail.svc:11332
smtpd_authorized_xforward_hosts = cidr:/etc/postfix/gateways.cidr
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
apps/base/mail/smarthost/master.cf
+1 -1
View File
@@ -1,4 +1,4 @@
# Gateways (inbound to relay_domains, no milter) and mynetworks (relay anywhere via rspamd).
# Gateways (inbound to relay_domains) and mynetworks (relay anywhere); all via the rspamd milter.
25 inet n - n - - smtpd
pickup unix n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
apps/base/mail/smarthost/mynetworks.cidr
+30 -30
View File
@@ -1,31 +1,31 @@
# Pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
# Doubles as mynetworks and the milter map; keep in sync with the NetworkPolicy.
10.42.0.0/16 inet:rspamd.mail.svc:11332
10.10.12.200/32 inet:rspamd.mail.svc:11332
198.18.1.10/32 inet:rspamd.mail.svc:11332
198.18.2.160/27 inet:rspamd.mail.svc:11332
198.18.2.192/27 inet:rspamd.mail.svc:11332
198.18.21.160/27 inet:rspamd.mail.svc:11332
198.18.21.192/27 inet:rspamd.mail.svc:11332
198.18.13.0/24 inet:rspamd.mail.svc:11332
198.18.14.0/24 inet:rspamd.mail.svc:11332
198.18.15.0/24 inet:rspamd.mail.svc:11332
198.18.16.0/24 inet:rspamd.mail.svc:11332
198.18.17.0/24 inet:rspamd.mail.svc:11332
198.18.18.0/24 inet:rspamd.mail.svc:11332
198.18.19.0/24 inet:rspamd.mail.svc:11332
198.18.20.0/24 inet:rspamd.mail.svc:11332
198.18.21.0/24 inet:rspamd.mail.svc:11332
198.18.22.0/24 inet:rspamd.mail.svc:11332
198.18.23.0/24 inet:rspamd.mail.svc:11332
198.18.25.0/24 inet:rspamd.mail.svc:11332
198.18.26.0/24 inet:rspamd.mail.svc:11332
198.18.27.0/24 inet:rspamd.mail.svc:11332
198.18.28.0/24 inet:rspamd.mail.svc:11332
198.18.29.0/24 inet:rspamd.mail.svc:11332
198.18.64.0/24 inet:rspamd.mail.svc:11332
198.18.65.0/24 inet:rspamd.mail.svc:11332
198.18.66.0/24 inet:rspamd.mail.svc:11332
198.18.67.0/24 inet:rspamd.mail.svc:11332
198.18.68.0/24 inet:rspamd.mail.svc:11332
198.18.69.0/24 inet:rspamd.mail.svc:11332
# Keep in sync with the NetworkPolicy.
10.42.0.0/16 OK
10.10.12.200/32 OK
198.18.1.10/32 OK
198.18.2.160/27 OK
198.18.2.192/27 OK
198.18.21.160/27 OK
198.18.21.192/27 OK
198.18.13.0/24 OK
198.18.14.0/24 OK
198.18.15.0/24 OK
198.18.16.0/24 OK
198.18.17.0/24 OK
198.18.18.0/24 OK
198.18.19.0/24 OK
198.18.20.0/24 OK
198.18.21.0/24 OK
198.18.22.0/24 OK
198.18.23.0/24 OK
198.18.25.0/24 OK
198.18.26.0/24 OK
198.18.27.0/24 OK
198.18.28.0/24 OK
198.18.29.0/24 OK
198.18.64.0/24 OK
198.18.65.0/24 OK
198.18.66.0/24 OK
198.18.67.0/24 OK
198.18.68.0/24 OK
198.18.69.0/24 OK