Restrict smarthost ingress and shorten negative recipient cache

apps/base/mail/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - cnpg_backup.yaml
   - cnpg_cluster.yaml
   - namespace.yaml
+  - smarthost-networkpolicy.yaml
   - smarthost-pdb.yaml
   - smarthost-service.yaml
   - smarthost-statefulset.yaml

apps/base/mail/smarthost-networkpolicy.yaml

@@ -0,0 +1,76 @@
+---
+# Gateways, lab networks (incl. node IPs for kubelet probes) and opted-in pods in any namespace.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: smarthost
+  namespace: mail
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: smarthost
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - ipBlock:
+            cidr: 10.10.12.0/24
+        - ipBlock:
+            cidr: 198.18.1.10/32
+        - ipBlock:
+            cidr: 198.18.2.160/27
+        - ipBlock:
+            cidr: 198.18.2.192/27
+        - ipBlock:
+            cidr: 198.18.13.0/24
+        - ipBlock:
+            cidr: 198.18.14.0/24
+        - ipBlock:
+            cidr: 198.18.15.0/24
+        - ipBlock:
+            cidr: 198.18.16.0/24
+        - ipBlock:
+            cidr: 198.18.17.0/24
+        - ipBlock:
+            cidr: 198.18.18.0/24
+        - ipBlock:
+            cidr: 198.18.19.0/24
+        - ipBlock:
+            cidr: 198.18.20.0/24
+        - ipBlock:
+            cidr: 198.18.21.0/24
+        - ipBlock:
+            cidr: 198.18.22.0/24
+        - ipBlock:
+            cidr: 198.18.23.0/24
+        - ipBlock:
+            cidr: 198.18.25.0/24
+        - ipBlock:
+            cidr: 198.18.26.0/24
+        - ipBlock:
+            cidr: 198.18.27.0/24
+        - ipBlock:
+            cidr: 198.18.28.0/24
+        - ipBlock:
+            cidr: 198.18.29.0/24
+        - ipBlock:
+            cidr: 198.18.64.0/24
+        - ipBlock:
+            cidr: 198.18.65.0/24
+        - ipBlock:
+            cidr: 198.18.66.0/24
+        - ipBlock:
+            cidr: 198.18.67.0/24
+        - ipBlock:
+            cidr: 198.18.68.0/24
+        - ipBlock:
+            cidr: 198.18.69.0/24
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              mail.unkin.net/smarthost-client: "true"
+      ports:
+        - port: smtp
+          protocol: TCP
+        - port: submission
+          protocol: TCP

apps/base/mail/smarthost/main.cf

@@ -9,7 +9,7 @@ inet_protocols = ipv4
 maillog_file = /dev/stdout
 message_size_limit = 52428800
 
-# Pod CIDR (Stalwart) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
+# Pod CIDR (Stalwart; narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
 pod_networks = 10.42.0.0/16
 mynetworks = $pod_networks
   10.10.12.200/32 198.18.1.10/32
@@ -25,6 +25,9 @@ relayhost = [mx1.wg.unkin.net]:25
 smtp_fallback_relay = [mx2.wg.unkin.net]:25
 smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
 unverified_recipient_reject_code = 550
+unverified_recipient_tempfail_action = defer_if_permit
+address_verify_negative_refresh_time = 5m
+address_verify_negative_expire_time = 1h
 
 milter_default_action = tempfail
 rspamd_milter = inet:rspamd.mail.svc:11332