Verify smarthost edge relays against the internal CA

2026-10-13 21:20:13 +11:00
parent 02ded6c26b
commit 98c639654a
2 changed files with 12 additions and 2 deletions
@@ -6,6 +6,7 @@ metadata:
  namespace: mail
  annotations:
    configmap.reloader.stakater.com/reload: "smarthost-config"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
 spec:
  serviceName: smarthost
  replicas: 2
@@ -71,6 +72,9 @@ spec:
            - name: tls
              mountPath: /etc/postfix/tls
              readOnly: true
+            - name: vault-ca-cert
+              mountPath: /etc/postfix/edge-ca
+              readOnly: true
            - name: config
              mountPath: /etc/postfix/main.cf
              subPath: main.cf
@@ -106,6 +110,12 @@ spec:
        - name: tls
          secret:
            secretName: wildcard-main-unkin-net-tls
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
  volumeClaimTemplates:
    - metadata:
        name: spool
@@ -1,2 +1,2 @@
-[mta1.edge.unkin.net]:25 secure match=hostname
-[mta2.edge.unkin.net]:25 secure match=hostname
+[mta1.edge.unkin.net]:25 secure match=hostname tafile=/etc/postfix/edge-ca/ca.crt
+[mta2.edge.unkin.net]:25 secure match=hostname tafile=/etc/postfix/edge-ca/ca.crt