From 92f6c1472bb7922f7c55c0911cf63ee10237ca16 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 21:42:28 +1100 Subject: [PATCH] Restrict smarthost ingress and shorten negative recipient cache --- apps/base/mail/kustomization.yaml | 1 + apps/base/mail/smarthost-networkpolicy.yaml | 76 +++++++++++++++++++++ apps/base/mail/smarthost/main.cf | 5 +- 3 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 apps/base/mail/smarthost-networkpolicy.yaml diff --git a/apps/base/mail/kustomization.yaml b/apps/base/mail/kustomization.yaml index 6b7f837..4c16052 100644 --- a/apps/base/mail/kustomization.yaml +++ b/apps/base/mail/kustomization.yaml @@ -6,6 +6,7 @@ resources: - cnpg_backup.yaml - cnpg_cluster.yaml - namespace.yaml + - smarthost-networkpolicy.yaml - smarthost-pdb.yaml - smarthost-service.yaml - smarthost-statefulset.yaml diff --git a/apps/base/mail/smarthost-networkpolicy.yaml b/apps/base/mail/smarthost-networkpolicy.yaml new file mode 100644 index 0000000..70cec03 --- /dev/null +++ b/apps/base/mail/smarthost-networkpolicy.yaml @@ -0,0 +1,76 @@ +--- +# Gateways, lab networks (incl. node IPs for kubelet probes) and opted-in pods in any namespace. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: smarthost + namespace: mail +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: smarthost + policyTypes: + - Ingress + ingress: + - from: + - ipBlock: + cidr: 10.10.12.0/24 + - ipBlock: + cidr: 198.18.1.10/32 + - ipBlock: + cidr: 198.18.2.160/27 + - ipBlock: + cidr: 198.18.2.192/27 + - ipBlock: + cidr: 198.18.13.0/24 + - ipBlock: + cidr: 198.18.14.0/24 + - ipBlock: + cidr: 198.18.15.0/24 + - ipBlock: + cidr: 198.18.16.0/24 + - ipBlock: + cidr: 198.18.17.0/24 + - ipBlock: + cidr: 198.18.18.0/24 + - ipBlock: + cidr: 198.18.19.0/24 + - ipBlock: + cidr: 198.18.20.0/24 + - ipBlock: + cidr: 198.18.21.0/24 + - ipBlock: + cidr: 198.18.22.0/24 + - ipBlock: + cidr: 198.18.23.0/24 + - ipBlock: + cidr: 198.18.25.0/24 + - ipBlock: + cidr: 198.18.26.0/24 + - ipBlock: + cidr: 198.18.27.0/24 + - ipBlock: + cidr: 198.18.28.0/24 + - ipBlock: + cidr: 198.18.29.0/24 + - ipBlock: + cidr: 198.18.64.0/24 + - ipBlock: + cidr: 198.18.65.0/24 + - ipBlock: + cidr: 198.18.66.0/24 + - ipBlock: + cidr: 198.18.67.0/24 + - ipBlock: + cidr: 198.18.68.0/24 + - ipBlock: + cidr: 198.18.69.0/24 + - namespaceSelector: {} + podSelector: + matchLabels: + mail.unkin.net/smarthost-client: "true" + ports: + - port: smtp + protocol: TCP + - port: submission + protocol: TCP diff --git a/apps/base/mail/smarthost/main.cf b/apps/base/mail/smarthost/main.cf index 9945223..a66aa35 100644 --- a/apps/base/mail/smarthost/main.cf +++ b/apps/base/mail/smarthost/main.cf @@ -9,7 +9,7 @@ inet_protocols = ipv4 maillog_file = /dev/stdout message_size_limit = 52428800 -# Pod CIDR (Stalwart) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs. +# Pod CIDR (Stalwart; narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs. pod_networks = 10.42.0.0/16 mynetworks = $pod_networks 10.10.12.200/32 198.18.1.10/32 @@ -25,6 +25,9 @@ relayhost = [mx1.wg.unkin.net]:25 smtp_fallback_relay = [mx2.wg.unkin.net]:25 smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination unverified_recipient_reject_code = 550 +unverified_recipient_tempfail_action = defer_if_permit +address_verify_negative_refresh_time = 5m +address_verify_negative_expire_time = 1h milter_default_action = tempfail rspamd_milter = inet:rspamd.mail.svc:11332